npm - @tangle-network/sandbox-cli - Versions diffs - 0.22.136 → 0.22.137 - Mend

@tangle-network/sandbox-cli 0.22.136 → 0.22.137

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/index.mjs +17 -17
package/package.json +6 -6

package/dist/index.mjs CHANGED Viewed

@@ -1,4 +1,4 @@
-import{a as e,c as t,d as n,f as r,i,l as a,n as o,o as s,p as c,r as l,s as u,t as d,u as f}from"./output-BqCeTtw4.mjs";import{i as p,n as m,r as h,t as g}from"./credential-store-Bpw_4ZTQ.mjs";import{createRequire as _,findPackageJSON as v}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as y,AuthError as b,InteractiveSessionNotRunningError as x,NetworkError as S,NotFoundError as C,PublicTemplatePublishError as w,QuotaError as T,SANDBOX_RUNTIMES as ee,Sandbox as E,SandboxError as D,ServerError as O,StateError as k,TimeoutError as A,ValidationError as te,createAgentRunOutcomeTracker as ne,createConfidentialSandbox as re,generateAttestationNonce as ie,parseBackendType as ae,parseSSEStream as oe,validateBatchRunRequest as se}from"@tangle-network/sandbox";import j from"chalk";import*as ce from"node:path";import{basename as le,dirname as ue,extname as de,isAbsolute as fe,join as M,posix as pe,relative as me,resolve as he,sep as ge}from"node:path";import{Command as N,Option as _e}from"commander";import{createHash as ve,randomBytes as ye,randomUUID as be}from"node:crypto";import{ProxySecretsSchema as xe,REASONING_EFFORTS as Se,agentCandidateArtifactRefSchema as Ce,agentCandidateWorkspaceSnapshotEvidenceSchema as we,agentInteractiveSessionRunRef as Te,agentProfileSchema as Ee,canonicalAgentProfileDigest as De,canonicalCandidateDigest as P,modelProvider as Oe,parseSeatSpec as ke,validateAgentProfileSecurity as Ae}from"@tangle-network/agent-interface";import{z as F}from"zod";import{execCli as je,shellQuote as Me}from"@tangle-network/sdk-cli-runner";import*as Ne from"node:fs";import{chmodSync as Pe,constants as Fe,existsSync as Ie,mkdirSync as Le,readFileSync as Re,realpathSync as ze,renameSync as Be,writeFileSync as Ve}from"node:fs";import*as He from"node:os";import{homedir as I,tmpdir as Ue}from"node:os";import{execFile as We,execFileSync as Ge,spawn as Ke}from"node:child_process";import{HubClient as qe,graphMcpPolicySchema as Je,graphMcpPolicySchema as Ye,graphProfileSecurity as Xe,resolveConnectionReferenceFrom as Ze,resolveConnectionReferenceFrom as Qe}from"@tangle-network/hub-sdk";import{createInterface as $e}from"node:readline";import{Writable as et}from"node:stream";import{buffer as tt}from"node:stream/consumers";import{setTimeout as nt}from"node:timers/promises";import{CONTENT_COMPLETION_KEY as rt,CONTENT_PROMPT_KEY as it,CONTENT_TOOL_ARGS_KEY as at,CONTENT_TOOL_NAME_KEY as ot,CONTENT_TOOL_RESULT_KEY as st,TANGLE_SUBJECT_KEY as ct,asContentField as lt,asContentString as ut}from"@tangle-network/agent-core/telemetry";import{lstat as dt,mkdir as ft,mkdtemp as pt,open as mt,readFile as L,realpath as R,rm as ht,writeFile as z}from"node:fs/promises";import{promisify as gt,stripVTControlCharacters as _t}from"node:util";import{gunzipSync as vt}from"node:zlib";import{fileURLToPath as yt,pathToFileURL as bt}from"node:url";import{ensureAgentPreview as xt,publishAgentPreview as St,resolveSelfSandbox as Ct}from"@tangle-network/sandbox/preview";import{createIntelligenceClient as wt}from"@tangle-network/sandbox/intelligence";var B=class extends Error{constructor(e,t,n,r){super(t),this.code=e,this.cause=n,this.fix=r,this.name=`ActionableCliError`}};const Tt=new Set([`AUTH_EXPIRED`,`SANDBOX_CREDENTIAL_REFUSED`,`AUTH_WRONG_AUDIENCE`,`SEAT_NONE_DETECTED`,`SEAT_NOT_LOGGED_IN`,`SEAT_NOT_ENROLLED`,`HUB_NOT_CONNECTED`,`HUB_RECONNECT`,`HUB_APP_NOT_INSTALLED`,`HUB_APPROVAL_REQUIRED`]),Et=new Set([`GRAPH_INVALID`,`STEP_REF`,`PROFILE_INVALID`,`UNKNOWN_HARNESS`,`HUB_TOOL_UNKNOWN`,`TRIGGER_INVALID`,`WORKFLOW_INPUT_FILE_INVALID`,`VALIDATION_ERROR`]),Dt=new Set([`UNKNOWN_COMMAND`,`GRAPH_PARAM_MISSING`,`GRAPH_PARAM_UNKNOWN`,`SEAT_SYNTAX`,`HUB_PROVIDER_UNKNOWN`,`USAGE_INVALID`]),Ot=new Set([`SUBSCRIPTION_REQUIRED`,`MODEL_NOT_FOUND`,`MODEL_PROVIDER_MISMATCH`,`MCP_BLOCKED`,`CLOUD_SEAT_UNSUPPORTED`,`SCHEDULE_AUTHORITY`]);function kt(e){return typeof e==`object`&&e?e:{}}function V(e){return typeof e==`string`&&e.length>0?e:void 0}function At(e){let t=V(e);return t&&/^[a-z0-9][a-z0-9_-]*$/i.test(t)?t:void 0}function jt(e){let t,n=e;for(let e=0;n instanceof Error&&e<5;e++,n=n.cause){let e=n.message||(n instanceof AggregateError?n.errors.map(e=>e instanceof Error?e.message:String(e)).join(`; `):``),r=V(kt(n).code);(e||r)&&(t=r?`${r}${e?`: ${e}`:``}`:e)}return t}function Mt(e){return e.code===`credential-refused`&&e.owner===`caller`&&e.providerCode===`subscription_required`?kt(e.remediation):{}}function Nt(e){let t=kt(e),n=Array.isArray(t.runtimeFailures)?t.runtimeFailures.map(kt):[],r=n.find(e=>V(Mt(kt(e.failure)).fix))??n[0],i=kt(r?.failure??t.runtimeFailure),a=Mt(i),o=kt(t.details),s=At(t.provider??o.provider??o.providerId),c=kt(t.fix??o.fix),l=V(t.code)??`CLI_ERROR`,u=V(t.message)??String(e),d=V(i.cause)??V(t.cause)??V(o.reason)??u,f=`tangle --help`,p=typeof o.providerRetryable==`boolean`?o.providerRetryable:typeof t.retryable==`boolean`?t.retryable:null;if(e instanceof b||l===`HUB_UNAUTHENTICATED`||t.status===401)l=`AUTH_EXPIRED`,u=`Authentication failed`,f=`tangle auth login`;else if(t.status===403&&u.startsWith(`Sandbox runtime creden`))l=`SANDBOX_CREDENTIAL_REFUSED`,u=`This sandbox's own TANGLE_API_KEY may call Hub endpoints only`,f=`export TANGLE_API_KEY=<owner or workspace sk-tan- key> (or pass --api-key), or run outside the sandbox`;else if([`HUB_CONNECTION_MISSING`,`HUB_CONNECTION_REVOKED`,`HUB_CONNECTION_UNHEALTHY`,`HUB_RECONNECT_REQUIRED`,`CONNECTION_REQUIRED`].includes(l))l=[`HUB_CONNECTION_MISSING`,`CONNECTION_REQUIRED`].includes(l)?`HUB_NOT_CONNECTED`:`HUB_RECONNECT`,f=s?`tangle hub connect ${s}`:`tangle hub connections --json`;else if(l===`HUB_APPROVAL_REQUIRED`){let e=At(kt(o.approval).id);f=e?`tangle hub approvals approve ${e}`:`tangle hub approvals list --json`}else l===`HUB_PROVIDER_REJECTED`?(f=`tangle hub status --json`,o.providerRetryable===!1&&(d+=`. Change the request before retrying`)):l===`provider_quota_exhausted`||l===`SEAT_LIMIT`?(l=`SEAT_LIMIT`,f=`tangle auth status`,p=!0):e instanceof T?f=`tangle usage --json`:e instanceof S?(l=`NETWORK_UNAVAILABLE`,u=`Network error: ${u}`,d=jt(e.cause)??`No response arrived`,f=`tangle auth status --json`):e instanceof A?(l=`TIMEOUT`,f=`tangle sandbox list --json`):e instanceof te?(l=`VALIDATION_ERROR`,u=`Invalid input`):e instanceof C||e instanceof k?f=`tangle sandbox list --json`:l===`commander.unknownCommand`?(l=`UNKNOWN_COMMAND`,f=u.includes(`'graph'`)?`npm install -g @tangle-network/sandbox-cli@latest`:`tangle --help`):l.startsWith(`commander.`)?l=`USAGE_INVALID`:(l===`ENOENT`||l===`EACCES`)&&(l=`INPUT_UNAVAILABLE`);e instanceof B&&(f=e.fix,p=!1),V(a.fix)&&(l=a.cause===`not_authenticated`?`SEAT_NOT_LOGGED_IN`:`SUBSCRIPTION_REQUIRED`),e instanceof w&&f===`tangle --help`&&(f=`tangle template publish --help`),f=V(a.fix)??V(c.command)??(l===`HUB_NOT_CONNECTED`?void 0:V(t.fixCommand))??f,Tt.has(l)&&f===`tangle --help`&&(f=`tangle auth login`);let m=kt(t.subject??o.subject??{node:r?.node??t.node,seat:t.seat??a.harness}),h=e instanceof S||e instanceof Error&&`batchCustody`in e?t.batchCustody:void 0;h&&(d=`Batch acceptance: ${h.acceptance}; retirement receipt ${h.cleanup?.mode===`release`&&h.cleanup.isComplete?`proved`:`unproved`}.`,p=!1,f=`tangle batch run --help`);let g=V(t.resumeAt??o.resumeAt??o.resetAt);return{code:l,...h?{batchCustody:h}:{},catalogCode:V(t.catalogCode),message:V(t.nextStep)&&V(t.message),nextStep:V(t.nextStep),subject:{...V(m.node)?{node:String(m.node)}:{},...V(m.seat)?{seat:String(m.seat)}:{}},what:u,cause:d,fix:{command:f,...Array.isArray(c.alternatives)&&c.alternatives.every(e=>typeof e==`string`)?{alternatives:c.alternatives}:{},...c.edit===void 0?{}:{edit:c.edit},...V(c.url)?{url:String(c.url)}:{}},retryable:p,...g&&Number.isFinite(Date.parse(g))?{resumeAt:g}:{},...V(t.runId)?{runId:String(t.runId)}:{},...V(t.requestId)?{requestId:String(t.requestId)}:{},...typeof t.status==`number`?{status:t.status}:{},...V(i.code)&&V(i.owner)?{runtimeFailure:{code:String(i.code),owner:String(i.owner),cause:typeof i.cause==`string`?i.cause:d,...V(i.providerCode)?{providerCode:String(i.providerCode)}:{},...typeof i.providerStatus==`number`?{providerStatus:i.providerStatus}:{},...typeof i.retryAfterMs==`number`?{retryAfterMs:i.retryAfterMs}:{},...Object.keys(a).length?{remediation:a}:{}}}:{},...e instanceof w&&e.job?{job:e.job}:{}}}function Pt(e){let t=[e.subject.node&&`node ${e.subject.node}`,e.subject.seat].filter(Boolean).join(` · `);return`✗ ${`${t?`${t}: `:``}${e.what}${e.status?` (HTTP ${e.status})`:``}`}${e.cause===e.what?``:` — ${e.cause}`}${e.nextStep?`\n  → next: ${e.nextStep}`:``}\n  → run: ${e.fix.command}`+(e.runtimeFailure?`\n  runtime: ${e.runtimeFailure.code} · ${e.runtimeFailure.owner}${e.runtimeFailure.providerCode?` · ${e.runtimeFailure.providerCode}`:``}${e.runtimeFailure.providerStatus===void 0?``:` · HTTP ${e.runtimeFailure.providerStatus}`}${e.runtimeFailure.retryAfterMs===void 0?``:` · retry-after ${e.runtimeFailure.retryAfterMs} ms`}`:``)+(e.fix.alternatives?.map(e=>`\n  or: ${e}`).join(``)??``)+(e.resumeAt?`\n  resumes ${e.resumeAt}${e.subject.seat?` on ${e.subject.seat}`:``}`:``)}function Ft(e){return Pt(Nt(e))}function H(t,r=!1){n();let i=Nt(t);r?e({ok:!1,error:i}):console.error(j.red(Pt(i)));let a=1;Tt.has(i.code)?a=77:Et.has(i.code)?a=65:Dt.has(i.code)?a=64:Ot.has(i.code)?a=78:[`SEAT_LIMIT`,`RATE_LIMITED`].includes(i.code)?a=75:[`HARNESS_NOT_INSTALLED`,`MCP_UNREACHABLE`,`NETWORK_UNAVAILABLE`].includes(i.code)?a=69:i.code===`RUN_STOPPED`&&(a=130),process.exit(a)}const It={OPENCODE:`opencode`,CLAUDE_CODE:`claude-code`,KIMI_CODE:`kimi-code`,CODEX:`codex`,AMP:`amp`,FACTORY_DROIDS:`factory-droids`,PI:`pi`,PRIME:`prime`,HERMES:`hermes`,OPENCLAW:`openclaw`,NANOCLAW:`nanoclaw`,NANOCODE:`nanocode`,EXO:`exo`,ACP:`acp`,CURSOR:`cursor`,GROK:`grok`,CLI_BASE:`cli-base`},Lt=Object.values(It);F.enum(Lt);const Rt=new Set([It.OPENCODE,It.CLAUDE_CODE,It.KIMI_CODE,It.CODEX,It.PI,It.HERMES]);F.string().regex(/^[A-Za-z0-9_.:@-]{1,256}$/);const zt=new Set(Lt);function Bt(e){return zt.has(e)}function Vt(e){if(e.startsWith(`github:`)){let[t,n]=e.slice(7).split(`@`,2),r=t.split(`/`).filter(Boolean);if(r.length<3)throw Error(`invalid github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let i=`${r[0]}/${r[1]}`,a=r.slice(2).join(`/`);return{kind:`github`,repository:i,path:a,...n?{ref:n}:{},name:le(a)}}let t;try{t=Re(e,`utf8`)}catch{throw Error(`cannot read skill/tool "${e}": not a readable file and not a github: ref`)}return{kind:`inline`,name:le(e),content:t}}function Ht(e){let t=(e.skills??[]).map(Vt),n=(e.tools??[]).map(Vt),r=t.length>0||n.length>0;if(!(!e.model&&!e.systemPrompt&&!r))return{...e.model?{model:{default:e.model}}:{},...e.systemPrompt?{prompt:{systemPrompt:e.systemPrompt}}:{},...r?{resources:{...t.length>0?{skills:t}:{},...n.length>0?{tools:n}:{}}}:{}}}async function Ut(e){let t;if(e.startsWith(`github:`)){let[n,r]=e.slice(7).split(`@`,2),i=n.split(`/`).filter(Boolean);if(i.length<3)throw Error(`invalid --profile github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let a=r??`main`;t=await Gt(`https://raw.githubusercontent.com/${i[0]}/${i[1]}/${a}/${i.slice(2).join(`/`)}`)}else t=/^https?:\/\//.test(e)?await Gt(e):Re(e,`utf8`);let n;try{n=JSON.parse(t)}catch{throw new B(`PROFILE_INVALID`,`Profile '${e}' is invalid`,`Expected a JSON AgentProfile`,`tangle agent profile create --name my-agent --json`)}return Wt(n,e)}function Wt(e,t){let n=Ee.safeParse(e);if(!n.success)throw new B(`PROFILE_INVALID`,`Profile '${t}' is invalid`,n.error.issues.map(e=>`${e.path.join(`.`)||`(root)`}: ${e.message}`).join(`; `),`tangle agent profile create --name my-agent --json`);return e}async function Gt(e){let t=await fetch(e);if(!t.ok)throw Error(`failed to fetch ${e} (${t.status})`);return t.text()}async function Kt(e){let t=e.profileSource?await Ut(e.profileSource):void 0,n=Ht(e);return t?n?{...t,...n,...n.resources?{resources:{...t.resources,...n.resources}}:{}}:t:n}const qt=ce.join(He.homedir(),`.tangle`),Jt=ce.join(qt,`config.json`),Yt=`https://id.tangle.tools`,Xt=`https://solve.tangle.tools/api/solve`,Zt=`default`;function Qt(){return{tangleBaseUrl:process.env.TANGLE_BASE_URL,sandboxBaseUrl:process.env.SANDBOX_BASE_URL,hubUrl:process.env.TANGLE_HUB_URL}}function $t(e,t){let n=on(t??(e===`solve`?`solve`:void 0));if(e===`solve`){if(n!==`solve`)throw Error(`The solve app cannot use profile '${n}'. Use the reserved 'solve' profile.`);return n}if(e===`sandbox`&&!t&&n===`solve`)return Zt;if(new Set([`solve`]).has(n))throw Error(`The ${e} app cannot use the reserved '${n}' profile. Use the '${e}' profile or choose a custom profile.`);return n}function en(){Ne.existsSync(qt)||Ne.mkdirSync(qt,{mode:448,recursive:!0})}function tn(e,t){en();let n=`${e}.${process.pid}.tmp`;Ne.writeFileSync(n,t,{mode:384}),Ne.renameSync(n,e)}function nn(e){return e.startsWith(`sk_`)||e.startsWith(`sk-tan-`)}function rn(){try{if(Ne.existsSync(Jt))return JSON.parse(Ne.readFileSync(Jt,`utf-8`))}catch{}return{}}function an(e){let t=Nn(rn(),e);tn(Jt,`${JSON.stringify(t,null,2)}\n`)}function on(e){return Pn(e||process.env.TANGLE_PROFILE||process.env.SANDBOX_PROFILE||rn().activeProfile||Zt)}function sn(e){an({activeProfile:Pn(e)})}function cn(){return{token:process.env.TANGLE_LINE_TOKEN,baseUrl:process.env.TANGLE_HUB_URL}}function ln(){return process.env.TANGLE_SANDBOX||rn().currentSandbox||void 0}function un(e){an({currentSandbox:e})}function dn(){let e=rn();delete e.currentSandbox,tn(Jt,`${JSON.stringify(e,null,2)}\n`)}function fn(){let e=rn().deviceId;if(e&&/^[A-Za-z0-9_.-]{1,64}$/.test(e))return e;let t=He.hostname().replace(/[^A-Za-z0-9_.-]/g,`-`).replace(/^-+|-+$/g,``).slice(0,32),n=ye(4).toString(`hex`),r=`${t?`${t}-`:`device-`}${n}`;return an({deviceId:r}),r}function pn(e){let t=e||ln();if(!t)throw Error("No sandbox specified. Pass it positionally, set a default with `tangle use <id>`, pass `--box <id>`, or set TANGLE_SANDBOX.");return t}function mn(){let e=rn(),t=on(),n=new Set([Zt,...Object.keys(e.profiles??{})]);return e.activeProfile&&n.add(Pn(e.activeProfile)),[...n].map(e=>{let n=h(e).source;return{name:e,active:e===t,hasApiKey:n!==`none`,baseUrl:Cn(void 0,e),apiKeySource:n}}).sort((e,t)=>e.name.localeCompare(t.name))}function hn(e){let t=on(e);return{name:t,active:t===on(),baseUrl:Cn(void 0,t),credentialSource:h(t).source}}function gn(e,t){let n=Pn(e),r=rn(),i=Mn(n,r),a={},o=t.baseUrl??i.baseUrl;o&&(a.baseUrl=o);let s=t.activeTeamId??i.activeTeamId;s&&(a.activeTeamId=s);let c=t.activeTeamName??i.activeTeamName;c&&(a.activeTeamName=c);let l={...r.profiles??{}};a.baseUrl||a.activeTeamId||a.activeTeamName?l[n]=a:delete l[n];let u;return t.apiKey&&(u=p(n,t.apiKey)),an({profiles:Object.keys(l).length>0?l:{}}),u}function _n(e){let t=on(e),n={...rn().profiles??{}},r=n[t];if(r){let e={...r};e.baseUrl||e.activeTeamId||e.activeTeamName?n[t]=e:delete n[t]}an({profiles:n}),m(t)}function vn(){let e=process.env.TANGLE_API_KEY_FILE;if(e){let t=Ne.readFileSync(e,`utf8`).trim();if(!t.startsWith(`sk-tan-`))throw Error(`Invalid sandbox credential file`);return t}return process.env.TANGLE_API_KEY}function yn(e,t){let n=$t(`sandbox`,t);return e||vn()||h(n).value}function bn(e,t){return e||(process.env.TANGLE_SOLVE_API_KEY?process.env.TANGLE_SOLVE_API_KEY:h($t(`solve`,t)).value)}function xn(e,t){let n=$t(`sandbox`,t);return e?`flag`:process.env.TANGLE_API_KEY_FILE||process.env.TANGLE_API_KEY?`env`:h(n).source}function Sn(e,t){return e?`flag`:process.env.TANGLE_SOLVE_API_KEY?`env`:h($t(`solve`,t)).source}function Cn(e,t){if(e)return e;let n=process.env.TANGLE_BASE_URL||process.env.SANDBOX_BASE_URL;if(n)return n;let r=on(t),i=rn(),a=Mn(r,i);return a.baseUrl?a.baseUrl:(r===Zt||r===`sandbox`)&&i.baseUrl?i.baseUrl:`https://sandbox.tangle.tools`}function wn(e){if(e)return e.replace(/\/v1\/hub\/?$/,``)}function Tn(e){return e?.trim().replace(/\/+$/,``)||void 0}function En(e){return Tn(e?.flag)??Tn(wn(Tn(process.env.TANGLE_HUB_URL)))??Tn(process.env.TANGLE_PLATFORM_URL)??Tn(e?.cachedPlatformUrl?.())??Yt}function Dn(e){let t=Tn(e)??Tn(process.env.TANGLE_SOLVE_API_URL);if(t&&t!==Xt)throw Error(`Solve credentials may only be sent to ${Xt}`);return Xt}function On(e){let t=Tn(e);if(t&&t!==Yt)throw Error(`Solve credentials may only be sent to ${Yt}`);return Yt}function U(e){let t=$t(`sandbox`,e.profile),n=yn(e.apiKey,t);if(!n)throw Error(`No API key found for profile '${t}'. Set TANGLE_API_KEY or run: tangle auth login${t===Zt?``:` --profile ${t}`}`);return{apiKey:n,baseUrl:Cn(e.baseUrl,t),timeout:e.timeout??3e4,profile:t,...kn(t)}}function kn(e){let t=rn(),n=Mn(on(e),t);return{activeTeamId:n.activeTeamId,activeTeamName:n.activeTeamName}}function An(e,t){gn(on(t),{activeTeamId:e.id,activeTeamName:e.name})}function jn(e){let t=on(e),n=rn(),r={...n.profiles??{}},i={baseUrl:Mn(t,n).baseUrl};i.baseUrl?r[t]=i:delete r[t],an({profiles:r})}function Mn(e,t=rn()){let n=Pn(e);return{...n===Zt?{baseUrl:t.baseUrl,activeTeamId:t.profiles?.[Zt]?.activeTeamId,activeTeamName:t.profiles?.[Zt]?.activeTeamName}:{},...t.profiles?.[n]??{}}}function Nn(e,t){let n=t.profiles===void 0?{...e.profiles??{}}:Object.fromEntries(Object.entries(t.profiles).filter(([,e])=>!!(e.apiKey||e.baseUrl||e.activeTeamId||e.activeTeamName)));return{...e,...t,profiles:Object.keys(n).length>0?n:void 0}}function Pn(e){let t=e.trim().toLowerCase();if(!t)throw Error(`Profile name cannot be empty`);if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw Error(`Profile names may only contain lowercase letters, numbers, dots, underscores, and hyphens`);return t}let Fn=null,In=null;function W(e){if(!e&&Fn)return Fn;let t=e??U({});return(!Fn||!In||In.apiKey!==t.apiKey||In.baseUrl!==t.baseUrl||In.timeout!==t.timeout)&&(Fn=new E({apiKey:t.apiKey,baseUrl:t.baseUrl,timeoutMs:t.timeout}),In=t),Fn}function Ln(){Fn=null,In=null}function G(e){let t=U({apiKey:e.apiKey,baseUrl:e.baseUrl});return{context:t,client:W(t)}}async function Rn(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);if(n.startsWith(`hubconn_`))return n;let{connections:r}=await e.connections.list();return Ze(r,n)}function zn(e,t){return[...t,e]}async function Bn(e,t){let n=e.map(e=>{let t=e.trim(),n=t.indexOf(`:`);return n===-1?{raw:e,ref:null,tail:null}:{raw:e,ref:t.slice(0,n).trim(),tail:t.slice(n+1)}});if(!n.some(e=>e.ref!==null&&e.ref!==`*`&&!e.ref.startsWith(`hubconn_`)))return[...e];let{connections:r}=await(await t()).connections.list();return n.map(e=>e.ref===null||e.ref===`*`||e.ref.startsWith(`hubconn_`)?e.raw:`${Qe(r,e.ref)}:${e.tail}`)}function Vn(e){let t=new Map,n=[];for(let r of e){let e=r.trim(),i=e.indexOf(`:`);if(i===-1)throw Error(`Invalid --connection "${r}": expected <connectionId>:<capability>[,<capability>]. List connection ids with \`tangle hub connections\` and capability paths with \`tangle hub tools search <keyword>\`.`);let a=e.slice(0,i).trim();if(a.length===0)throw Error(`Invalid --connection "${r}": connection id is empty. Use <connectionId>:<capability> — list ids with \`tangle hub connections\`.`);let o=e.slice(i+1).split(`,`).map(e=>e.trim()).filter(e=>e.length>0);if(o.length===0)throw Error(`Invalid --connection "${r}": grant at least one capability, e.g. ${a}:gmail.messages.list. Discover paths with \`tangle hub tools search <keyword>\`.`);if(o.includes(`*`)&&o.length>1)throw Error(`Invalid --connection "${r}": "*" grants all capabilities and can't be combined with specific paths. Use <connectionId>:* alone, or list explicit paths.`);if(a===`*`&&!(o.length===1&&o[0]===`*`))throw Error(`Invalid --connection "${r}": a "*" connection is only valid as "*:*" (all connections, all capabilities). Name a connection id for specific paths.`);let s=t.get(a);s===void 0&&(s=new Set,t.set(a,s),n.push(a));for(let e of o)s.add(e)}return n.map(e=>{let n=t.get(e),r=n?[...n]:[];if(r.includes(`*`)&&r.length>1)throw Error(`Invalid --connection for "${e}": "*" can't be combined with specific capability paths across repeated --connection flags.`);return{connectionId:e,capabilities:r}})}function Hn(e,t){return ve(`sha256`).update(`${e}\0${t}`).digest(`hex`).slice(0,32)}function Un(e){return`${e}:hub`}function Wn(e){let{value:t}=h(Un(e));if(!t)return null;try{let e=JSON.parse(t);if(typeof e.key==`string`&&typeof e.expiresAt==`string`&&typeof e.platformUrl==`string`&&typeof e.sessionFingerprint==`string`)return{key:e.key,expiresAt:e.expiresAt,platformUrl:e.platformUrl,sessionFingerprint:e.sessionFingerprint}}catch{}return null}function Gn(e,t){try{p(Un(e),JSON.stringify(t))}catch{}}async function Kn(e,t,n,r){let i=`${e.replace(/\/+$/,``)}/auth/cli/hub-key`,a;try{a=await fetch(i,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${t}`},body:JSON.stringify({device_id:n}),signal:r})}catch(e){throw Error(`Could not reach ${i} to mint a platform key: ${e instanceof Error?e.message:String(e)}`)}let o=await a.text(),s;try{s=JSON.parse(o)}catch{s=null}if(!a.ok||!s?.success){let e=typeof s?.error?.message==`string`?s.error.message:`HTTP ${a.status}`;throw Error(`Platform key minting failed: ${e}. Your sandbox session may have expired — run \`tangle auth login\`.`)}let c=s.data;if(typeof c?.api_key!=`string`||typeof c?.expires_at!=`string`||typeof c?.platform_url!=`string`)throw Error(`Platform key minting returned an unexpected response shape.`);return{key:c.api_key,expiresAt:c.expires_at,platformUrl:c.platform_url}}var qn=class{cache;fingerprint;constructor(e,t,n,r,i){this.profile=e,this.sandboxBaseUrl=t,this.sessionToken=n,this.deviceId=r,this.signal=i,this.fingerprint=Hn(t,n);let a=Wn(e);this.cache=a&&a.sessionFingerprint===this.fingerprint?a:null}isFresh(e){return e!==null&&Date.parse(e.expiresAt)-Date.now()>6e4}async ensure(e=!1){if(this.signal?.throwIfAborted(),!e&&this.isFresh(this.cache))return this.cache;let t={...await Kn(this.sandboxBaseUrl,this.sessionToken,this.deviceId,this.signal),sessionFingerprint:this.fingerprint};return this.cache=t,Gn(this.profile,t),t}};function Jn(e){if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function Yn(e,t){return En({flag:e.baseUrl,...e.useCachedPlatformUrl?{cachedPlatformUrl:()=>Wn(t)?.platformUrl}:{}})}function Xn(e,t){let n=$t(`sandbox`,e.profile),r=yn(e.apiKey,n),i=xn(e.apiKey,n),a=e.allowHubCapabilityToken&&process.env.TANGLE_HUB_CAPABILITY_TOKEN?.trim()||void 0;if(a&&i===`env`)throw Error(`Set exactly one of TANGLE_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN, not both`);let o=i===`flag`&&r?r:a??r;if(!o)throw Error(`No API key found for profile '${n}'. Set TANGLE_API_KEY or run: tangle auth login${n===`default`?``:` --profile ${n}`}`);return(i===`flag`||i===`env`)&&r||a||o.startsWith(`sk-tan-`)||t?{kind:`static`,apiKey:o,baseUrl:Yn(e,n)}:{kind:`managed`,profile:n,sandboxBaseUrl:Cn(e.sandboxBaseUrl,n),sessionToken:o,deviceId:fn(),baseUrlOverride:e.baseUrl}}async function Zn(e={}){let t=Xn(e,e.hubKey===!1||Jn(process.env.TANGLE_SKIP_HUB_KEY));if(t.kind===`static`)return{token:t.apiKey,baseUrl:t.baseUrl,minted:!1};let n=new qn(t.profile,t.sandboxBaseUrl,t.sessionToken,t.deviceId,e.signal),r=await n.ensure();return{token:r.key,baseUrl:t.baseUrlOverride??r.platformUrl,refresh:async()=>(await n.ensure(!0)).key,minted:!0}}async function Qn(e,t,n={}){let r=e=>{let r=new Headers(n.headers);return r.set(`Authorization`,`Bearer ${e}`),fetch(t,{...n,headers:r})},i=await r(e.token);return i.status!==401||!e.refresh?i:r(await e.refresh())}async function $n(e={}){let t;try{t=await Zn(e)}catch(e){return{reachable:!1,reason:e instanceof Error?e.message:String(e),refused:!0}}try{let e=await Qn(t,`${t.baseUrl.replace(/\/+$/,``)}/v1/plans/current`);if(e.ok)return{reachable:!0,baseUrl:t.baseUrl};let n=e.status===401||e.status===403;return{reachable:!1,baseUrl:t.baseUrl,reason:n?`the platform refused this credential (HTTP ${e.status})`:`the platform answered HTTP ${e.status}`,refused:n}}catch(e){return{reachable:!1,baseUrl:t.baseUrl,reason:`could not reach ${t.baseUrl}: ${e instanceof Error?e.message:String(e)}`,refused:!1}}}async function er(e){let t=e.signal,n=t?(e,n)=>{let r=n?.signal??(e instanceof Request?e.signal:void 0);return fetch(e,{...n,signal:r?AbortSignal.any([r,t]):t})}:fetch.bind(globalThis),r=Xn(e,e.hubKey===!1||Jn(process.env.TANGLE_SKIP_HUB_KEY));if(r.kind===`static`){let t=!e.apiKey&&process.env.TANGLE_API_KEY_FILE&&!process.env.TANGLE_HUB_CAPABILITY_TOKEN;return new qe({baseUrl:r.baseUrl,fetch:n,authHeaders:()=>({Authorization:`Bearer ${t?vn():r.apiKey}`})})}let i=new qn(r.profile,r.sandboxBaseUrl,r.sessionToken,r.deviceId,e.signal),a=await i.ensure();return new qe({baseUrl:r.baseUrlOverride??a.platformUrl,authHeaders:async()=>({Authorization:`Bearer ${(await i.ensure()).key}`}),fetch:async(e,t)=>{let r=await n(e,t);if(r.status!==401)return r;let a=await i.ensure(!0),o=new Headers(t?.headers);return o.set(`Authorization`,`Bearer ${a.key}`),n(e,{...t,headers:o})}})}function tr(e={}){return er(e)}function K(e={}){return er({...e,useCachedPlatformUrl:!0,allowHubCapabilityToken:!0})}function nr(e,t){return`Sandbox name is ambiguous: ${e}. Use a sandbox id instead.\n${t.map(e=>`- ${e.id} (status: ${e.status}, created: ${e.createdAt.toISOString()})`).join(`
+import{a as e,c as t,d as n,f as r,i,l as a,n as o,o as s,p as c,r as l,s as u,t as d,u as f}from"./output-BqCeTtw4.mjs";import{i as p,n as m,r as h,t as g}from"./credential-store-Bpw_4ZTQ.mjs";import{createRequire as _,findPackageJSON as v}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as y,AuthError as b,InteractiveSessionNotRunningError as x,NetworkError as S,NotFoundError as C,PublicTemplatePublishError as w,QuotaError as T,SANDBOX_RUNTIMES as ee,Sandbox as E,SandboxError as D,ServerError as O,StateError as k,TimeoutError as A,ValidationError as te,createAgentRunOutcomeTracker as ne,createConfidentialSandbox as re,generateAttestationNonce as ie,parseBackendType as ae,parseSSEStream as oe,validateBatchRunRequest as se}from"@tangle-network/sandbox";import j from"chalk";import*as ce from"node:path";import{basename as le,dirname as ue,extname as de,isAbsolute as fe,join as M,posix as pe,relative as me,resolve as he,sep as ge}from"node:path";import{Command as N,Option as _e}from"commander";import{createHash as ve,randomBytes as ye,randomUUID as be}from"node:crypto";import{setTimeout as xe}from"node:timers/promises";import{ProxySecretsSchema as Se,REASONING_EFFORTS as Ce,agentCandidateArtifactRefSchema as we,agentCandidateWorkspaceSnapshotEvidenceSchema as Te,agentInteractiveSessionRunRef as Ee,agentProfileSchema as De,canonicalAgentProfileDigest as Oe,canonicalCandidateDigest as P,modelProvider as ke,parseSeatSpec as Ae,validateAgentProfileSecurity as je}from"@tangle-network/agent-interface";import{z as F}from"zod";import{execCli as Me,shellQuote as Ne}from"@tangle-network/sdk-cli-runner";import*as Pe from"node:fs";import{chmodSync as Fe,constants as Ie,existsSync as Le,mkdirSync as Re,readFileSync as ze,realpathSync as Be,renameSync as Ve,writeFileSync as He}from"node:fs";import*as Ue from"node:os";import{homedir as I,tmpdir as We}from"node:os";import{execFile as Ge,execFileSync as Ke,spawn as qe}from"node:child_process";import{HubClient as Je,graphMcpPolicySchema as Ye,graphMcpPolicySchema as Xe,graphProfileSecurity as Ze,resolveConnectionReferenceFrom as Qe,resolveConnectionReferenceFrom as $e}from"@tangle-network/hub-sdk";import{createInterface as et}from"node:readline";import{Writable as tt}from"node:stream";import{buffer as nt}from"node:stream/consumers";import{CONTENT_COMPLETION_KEY as rt,CONTENT_PROMPT_KEY as it,CONTENT_TOOL_ARGS_KEY as at,CONTENT_TOOL_NAME_KEY as ot,CONTENT_TOOL_RESULT_KEY as st,TANGLE_SUBJECT_KEY as ct,asContentField as lt,asContentString as ut}from"@tangle-network/agent-core/telemetry";import{lstat as dt,mkdir as ft,mkdtemp as pt,open as mt,readFile as L,realpath as R,rm as ht,writeFile as z}from"node:fs/promises";import{promisify as gt,stripVTControlCharacters as _t}from"node:util";import{gunzipSync as vt}from"node:zlib";import{fileURLToPath as yt,pathToFileURL as bt}from"node:url";import{ensureAgentPreview as xt,publishAgentPreview as St,resolveSelfSandbox as Ct}from"@tangle-network/sandbox/preview";import{createIntelligenceClient as wt}from"@tangle-network/sandbox/intelligence";var B=class extends Error{constructor(e,t,n,r){super(t),this.code=e,this.cause=n,this.fix=r,this.name=`ActionableCliError`}};const Tt=new Set([`AUTH_EXPIRED`,`SANDBOX_CREDENTIAL_REFUSED`,`AUTH_WRONG_AUDIENCE`,`SEAT_NONE_DETECTED`,`SEAT_NOT_LOGGED_IN`,`SEAT_NOT_ENROLLED`,`HUB_NOT_CONNECTED`,`HUB_RECONNECT`,`HUB_APP_NOT_INSTALLED`,`HUB_APPROVAL_REQUIRED`]),Et=new Set([`GRAPH_INVALID`,`STEP_REF`,`PROFILE_INVALID`,`UNKNOWN_HARNESS`,`HUB_TOOL_UNKNOWN`,`TRIGGER_INVALID`,`WORKFLOW_INPUT_FILE_INVALID`,`VALIDATION_ERROR`]),Dt=new Set([`UNKNOWN_COMMAND`,`GRAPH_PARAM_MISSING`,`GRAPH_PARAM_UNKNOWN`,`SEAT_SYNTAX`,`HUB_PROVIDER_UNKNOWN`,`USAGE_INVALID`]),Ot=new Set([`SUBSCRIPTION_REQUIRED`,`MODEL_NOT_FOUND`,`MODEL_PROVIDER_MISMATCH`,`MCP_BLOCKED`,`CLOUD_SEAT_UNSUPPORTED`,`SCHEDULE_AUTHORITY`]);function kt(e){return typeof e==`object`&&e?e:{}}function V(e){return typeof e==`string`&&e.length>0?e:void 0}function At(e){let t=V(e);return t&&/^[a-z0-9][a-z0-9_-]*$/i.test(t)?t:void 0}function jt(e){let t,n=e;for(let e=0;n instanceof Error&&e<5;e++,n=n.cause){let e=n.message||(n instanceof AggregateError?n.errors.map(e=>e instanceof Error?e.message:String(e)).join(`; `):``),r=V(kt(n).code);(e||r)&&(t=r?`${r}${e?`: ${e}`:``}`:e)}return t}function Mt(e){return e.code===`credential-refused`&&e.owner===`caller`&&e.providerCode===`subscription_required`?kt(e.remediation):{}}function Nt(e){let t=kt(e),n=Array.isArray(t.runtimeFailures)?t.runtimeFailures.map(kt):[],r=n.find(e=>V(Mt(kt(e.failure)).fix))??n[0],i=kt(r?.failure??t.runtimeFailure),a=Mt(i),o=kt(t.details),s=At(t.provider??o.provider??o.providerId),c=kt(t.fix??o.fix),l=V(t.code)??`CLI_ERROR`,u=V(t.message)??String(e),d=V(i.cause)??V(t.cause)??V(o.reason)??u,f=`tangle --help`,p=typeof o.providerRetryable==`boolean`?o.providerRetryable:typeof t.retryable==`boolean`?t.retryable:null;if(e instanceof b||l===`HUB_UNAUTHENTICATED`||t.status===401)l=`AUTH_EXPIRED`,u=`Authentication failed`,f=`tangle auth login`;else if(t.status===403&&u.startsWith(`Sandbox runtime creden`))l=`SANDBOX_CREDENTIAL_REFUSED`,u=`This sandbox's own TANGLE_API_KEY may call Hub endpoints only`,f=`export TANGLE_API_KEY=<owner or workspace sk-tan- key> (or pass --api-key), or run outside the sandbox`;else if([`HUB_CONNECTION_MISSING`,`HUB_CONNECTION_REVOKED`,`HUB_CONNECTION_UNHEALTHY`,`HUB_RECONNECT_REQUIRED`,`CONNECTION_REQUIRED`].includes(l))l=[`HUB_CONNECTION_MISSING`,`CONNECTION_REQUIRED`].includes(l)?`HUB_NOT_CONNECTED`:`HUB_RECONNECT`,f=s?`tangle hub connect ${s}`:`tangle hub connections --json`;else if(l===`HUB_APPROVAL_REQUIRED`){let e=At(kt(o.approval).id);f=e?`tangle hub approvals approve ${e}`:`tangle hub approvals list --json`}else l===`HUB_PROVIDER_REJECTED`?(f=`tangle hub status --json`,o.providerRetryable===!1&&(d+=`. Change the request before retrying`)):l===`provider_quota_exhausted`||l===`SEAT_LIMIT`?(l=`SEAT_LIMIT`,f=`tangle auth status`,p=!0):e instanceof T?f=`tangle usage --json`:e instanceof S?(l=`NETWORK_UNAVAILABLE`,u=`Network error: ${u}`,d=jt(e.cause)??`No response arrived`,f=`tangle auth status --json`):e instanceof A?(l=`TIMEOUT`,f=`tangle sandbox list --json`):e instanceof te?(l=`VALIDATION_ERROR`,u=`Invalid input`):e instanceof C||e instanceof k?f=`tangle sandbox list --json`:l===`commander.unknownCommand`?(l=`UNKNOWN_COMMAND`,f=u.includes(`'graph'`)?`npm install -g @tangle-network/sandbox-cli@latest`:`tangle --help`):l.startsWith(`commander.`)?l=`USAGE_INVALID`:(l===`ENOENT`||l===`EACCES`)&&(l=`INPUT_UNAVAILABLE`);e instanceof B&&(f=e.fix,p=!1),V(a.fix)&&(l=a.cause===`not_authenticated`?`SEAT_NOT_LOGGED_IN`:`SUBSCRIPTION_REQUIRED`),e instanceof w&&f===`tangle --help`&&(f=`tangle template publish --help`),f=V(a.fix)??V(c.command)??(l===`HUB_NOT_CONNECTED`?void 0:V(t.fixCommand))??f,Tt.has(l)&&f===`tangle --help`&&(f=`tangle auth login`);let m=kt(t.subject??o.subject??{node:r?.node??t.node,seat:t.seat??a.harness}),h=e instanceof S||e instanceof Error&&`batchCustody`in e?t.batchCustody:void 0;h&&(d=`Batch acceptance: ${h.acceptance}; retirement receipt ${h.cleanup?.mode===`release`&&h.cleanup.isComplete?`proved`:`unproved`}.`,p=!1,f=`tangle batch run --help`);let g=V(t.resumeAt??o.resumeAt??o.resetAt);return{code:l,...h?{batchCustody:h}:{},catalogCode:V(t.catalogCode),message:V(t.nextStep)&&V(t.message),nextStep:V(t.nextStep),subject:{...V(m.node)?{node:String(m.node)}:{},...V(m.seat)?{seat:String(m.seat)}:{}},what:u,cause:d,fix:{command:f,...Array.isArray(c.alternatives)&&c.alternatives.every(e=>typeof e==`string`)?{alternatives:c.alternatives}:{},...c.edit===void 0?{}:{edit:c.edit},...V(c.url)?{url:String(c.url)}:{}},retryable:p,...g&&Number.isFinite(Date.parse(g))?{resumeAt:g}:{},...V(t.runId)?{runId:String(t.runId)}:{},...V(t.requestId)?{requestId:String(t.requestId)}:{},...typeof t.status==`number`?{status:t.status}:{},...V(i.code)&&V(i.owner)?{runtimeFailure:{code:String(i.code),owner:String(i.owner),cause:typeof i.cause==`string`?i.cause:d,...V(i.providerCode)?{providerCode:String(i.providerCode)}:{},...typeof i.providerStatus==`number`?{providerStatus:i.providerStatus}:{},...typeof i.retryAfterMs==`number`?{retryAfterMs:i.retryAfterMs}:{},...Object.keys(a).length?{remediation:a}:{}}}:{},...e instanceof w&&e.job?{job:e.job}:{}}}function Pt(e){let t=[e.subject.node&&`node ${e.subject.node}`,e.subject.seat].filter(Boolean).join(` · `);return`✗ ${`${t?`${t}: `:``}${e.what}${e.status?` (HTTP ${e.status})`:``}`}${e.cause===e.what?``:` — ${e.cause}`}${e.nextStep?`\n  → next: ${e.nextStep}`:``}\n  → run: ${e.fix.command}`+(e.runtimeFailure?`\n  runtime: ${e.runtimeFailure.code} · ${e.runtimeFailure.owner}${e.runtimeFailure.providerCode?` · ${e.runtimeFailure.providerCode}`:``}${e.runtimeFailure.providerStatus===void 0?``:` · HTTP ${e.runtimeFailure.providerStatus}`}${e.runtimeFailure.retryAfterMs===void 0?``:` · retry-after ${e.runtimeFailure.retryAfterMs} ms`}`:``)+(e.fix.alternatives?.map(e=>`\n  or: ${e}`).join(``)??``)+(e.resumeAt?`\n  resumes ${e.resumeAt}${e.subject.seat?` on ${e.subject.seat}`:``}`:``)}function Ft(e){return Pt(Nt(e))}function H(t,r=!1){n();let i=Nt(t);r?e({ok:!1,error:i}):console.error(j.red(Pt(i)));let a=1;Tt.has(i.code)?a=77:Et.has(i.code)?a=65:Dt.has(i.code)?a=64:Ot.has(i.code)?a=78:[`SEAT_LIMIT`,`RATE_LIMITED`].includes(i.code)?a=75:[`HARNESS_NOT_INSTALLED`,`MCP_UNREACHABLE`,`NETWORK_UNAVAILABLE`].includes(i.code)?a=69:i.code===`RUN_STOPPED`&&(a=130),process.exit(a)}const It={OPENCODE:`opencode`,CLAUDE_CODE:`claude-code`,KIMI_CODE:`kimi-code`,CODEX:`codex`,AMP:`amp`,FACTORY_DROIDS:`factory-droids`,PI:`pi`,PRIME:`prime`,HERMES:`hermes`,OPENCLAW:`openclaw`,NANOCLAW:`nanoclaw`,NANOCODE:`nanocode`,EXO:`exo`,ACP:`acp`,CURSOR:`cursor`,GROK:`grok`,CLI_BASE:`cli-base`},Lt=Object.values(It);F.enum(Lt);const Rt=new Set([It.OPENCODE,It.CLAUDE_CODE,It.KIMI_CODE,It.CODEX,It.PI,It.HERMES]);F.string().regex(/^[A-Za-z0-9_.:@-]{1,256}$/);const zt=new Set(Lt);function Bt(e){return zt.has(e)}function Vt(e){if(e.startsWith(`github:`)){let[t,n]=e.slice(7).split(`@`,2),r=t.split(`/`).filter(Boolean);if(r.length<3)throw Error(`invalid github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let i=`${r[0]}/${r[1]}`,a=r.slice(2).join(`/`);return{kind:`github`,repository:i,path:a,...n?{ref:n}:{},name:le(a)}}let t;try{t=ze(e,`utf8`)}catch{throw Error(`cannot read skill/tool "${e}": not a readable file and not a github: ref`)}return{kind:`inline`,name:le(e),content:t}}function Ht(e){let t=(e.skills??[]).map(Vt),n=(e.tools??[]).map(Vt),r=t.length>0||n.length>0;if(!(!e.model&&!e.systemPrompt&&!r))return{...e.model?{model:{default:e.model}}:{},...e.systemPrompt?{prompt:{systemPrompt:e.systemPrompt}}:{},...r?{resources:{...t.length>0?{skills:t}:{},...n.length>0?{tools:n}:{}}}:{}}}async function Ut(e){let t;if(e.startsWith(`github:`)){let[n,r]=e.slice(7).split(`@`,2),i=n.split(`/`).filter(Boolean);if(i.length<3)throw Error(`invalid --profile github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let a=r??`main`;t=await Gt(`https://raw.githubusercontent.com/${i[0]}/${i[1]}/${a}/${i.slice(2).join(`/`)}`)}else t=/^https?:\/\//.test(e)?await Gt(e):ze(e,`utf8`);let n;try{n=JSON.parse(t)}catch{throw new B(`PROFILE_INVALID`,`Profile '${e}' is invalid`,`Expected a JSON AgentProfile`,`tangle agent profile create --name my-agent --json`)}return Wt(n,e)}function Wt(e,t){let n=De.safeParse(e);if(!n.success)throw new B(`PROFILE_INVALID`,`Profile '${t}' is invalid`,n.error.issues.map(e=>`${e.path.join(`.`)||`(root)`}: ${e.message}`).join(`; `),`tangle agent profile create --name my-agent --json`);return e}async function Gt(e){let t=await fetch(e);if(!t.ok)throw Error(`failed to fetch ${e} (${t.status})`);return t.text()}async function Kt(e){let t=e.profileSource?await Ut(e.profileSource):void 0,n=Ht(e);return t?n?{...t,...n,...n.resources?{resources:{...t.resources,...n.resources}}:{}}:t:n}const qt=ce.join(Ue.homedir(),`.tangle`),Jt=ce.join(qt,`config.json`),Yt=`https://id.tangle.tools`,Xt=`https://solve.tangle.tools/api/solve`,Zt=`default`;function Qt(){return{tangleBaseUrl:process.env.TANGLE_BASE_URL,sandboxBaseUrl:process.env.SANDBOX_BASE_URL,hubUrl:process.env.TANGLE_HUB_URL}}function $t(e,t){let n=on(t??(e===`solve`?`solve`:void 0));if(e===`solve`){if(n!==`solve`)throw Error(`The solve app cannot use profile '${n}'. Use the reserved 'solve' profile.`);return n}if(e===`sandbox`&&!t&&n===`solve`)return Zt;if(new Set([`solve`]).has(n))throw Error(`The ${e} app cannot use the reserved '${n}' profile. Use the '${e}' profile or choose a custom profile.`);return n}function en(){Pe.existsSync(qt)||Pe.mkdirSync(qt,{mode:448,recursive:!0})}function tn(e,t){en();let n=`${e}.${process.pid}.tmp`;Pe.writeFileSync(n,t,{mode:384}),Pe.renameSync(n,e)}function nn(e){return e.startsWith(`sk_`)||e.startsWith(`sk-tan-`)}function rn(){try{if(Pe.existsSync(Jt))return JSON.parse(Pe.readFileSync(Jt,`utf-8`))}catch{}return{}}function an(e){let t=Nn(rn(),e);tn(Jt,`${JSON.stringify(t,null,2)}\n`)}function on(e){return Pn(e||process.env.TANGLE_PROFILE||process.env.SANDBOX_PROFILE||rn().activeProfile||Zt)}function sn(e){an({activeProfile:Pn(e)})}function cn(){return{token:process.env.TANGLE_LINE_TOKEN,baseUrl:process.env.TANGLE_HUB_URL}}function ln(){return process.env.TANGLE_SANDBOX||rn().currentSandbox||void 0}function un(e){an({currentSandbox:e})}function dn(){let e=rn();delete e.currentSandbox,tn(Jt,`${JSON.stringify(e,null,2)}\n`)}function fn(){let e=rn().deviceId;if(e&&/^[A-Za-z0-9_.-]{1,64}$/.test(e))return e;let t=Ue.hostname().replace(/[^A-Za-z0-9_.-]/g,`-`).replace(/^-+|-+$/g,``).slice(0,32),n=ye(4).toString(`hex`),r=`${t?`${t}-`:`device-`}${n}`;return an({deviceId:r}),r}function pn(e){let t=e||ln();if(!t)throw Error("No sandbox specified. Pass it positionally, set a default with `tangle use <id>`, pass `--box <id>`, or set TANGLE_SANDBOX.");return t}function mn(){let e=rn(),t=on(),n=new Set([Zt,...Object.keys(e.profiles??{})]);return e.activeProfile&&n.add(Pn(e.activeProfile)),[...n].map(e=>{let n=h(e).source;return{name:e,active:e===t,hasApiKey:n!==`none`,baseUrl:Cn(void 0,e),apiKeySource:n}}).sort((e,t)=>e.name.localeCompare(t.name))}function hn(e){let t=on(e);return{name:t,active:t===on(),baseUrl:Cn(void 0,t),credentialSource:h(t).source}}function gn(e,t){let n=Pn(e),r=rn(),i=Mn(n,r),a={},o=t.baseUrl??i.baseUrl;o&&(a.baseUrl=o);let s=t.activeTeamId??i.activeTeamId;s&&(a.activeTeamId=s);let c=t.activeTeamName??i.activeTeamName;c&&(a.activeTeamName=c);let l={...r.profiles??{}};a.baseUrl||a.activeTeamId||a.activeTeamName?l[n]=a:delete l[n];let u;return t.apiKey&&(u=p(n,t.apiKey)),an({profiles:Object.keys(l).length>0?l:{}}),u}function _n(e){let t=on(e),n={...rn().profiles??{}},r=n[t];if(r){let e={...r};e.baseUrl||e.activeTeamId||e.activeTeamName?n[t]=e:delete n[t]}an({profiles:n}),m(t)}function vn(){let e=process.env.TANGLE_API_KEY_FILE;if(e){let t=Pe.readFileSync(e,`utf8`).trim();if(!t.startsWith(`sk-tan-`))throw Error(`Invalid sandbox credential file`);return t}return process.env.TANGLE_API_KEY}function yn(e,t){let n=$t(`sandbox`,t);return e||vn()||h(n).value}function bn(e,t){return e||(process.env.TANGLE_SOLVE_API_KEY?process.env.TANGLE_SOLVE_API_KEY:h($t(`solve`,t)).value)}function xn(e,t){let n=$t(`sandbox`,t);return e?`flag`:process.env.TANGLE_API_KEY_FILE||process.env.TANGLE_API_KEY?`env`:h(n).source}function Sn(e,t){return e?`flag`:process.env.TANGLE_SOLVE_API_KEY?`env`:h($t(`solve`,t)).source}function Cn(e,t){if(e)return e;let n=process.env.TANGLE_BASE_URL||process.env.SANDBOX_BASE_URL;if(n)return n;let r=on(t),i=rn(),a=Mn(r,i);return a.baseUrl?a.baseUrl:(r===Zt||r===`sandbox`)&&i.baseUrl?i.baseUrl:`https://sandbox.tangle.tools`}function wn(e){if(e)return e.replace(/\/v1\/hub\/?$/,``)}function Tn(e){return e?.trim().replace(/\/+$/,``)||void 0}function En(e){return Tn(e?.flag)??Tn(wn(Tn(process.env.TANGLE_HUB_URL)))??Tn(process.env.TANGLE_PLATFORM_URL)??Tn(e?.cachedPlatformUrl?.())??Yt}function Dn(e){let t=Tn(e)??Tn(process.env.TANGLE_SOLVE_API_URL);if(t&&t!==Xt)throw Error(`Solve credentials may only be sent to ${Xt}`);return Xt}function On(e){let t=Tn(e);if(t&&t!==Yt)throw Error(`Solve credentials may only be sent to ${Yt}`);return Yt}function U(e){let t=$t(`sandbox`,e.profile),n=yn(e.apiKey,t);if(!n)throw Error(`No API key found for profile '${t}'. Set TANGLE_API_KEY or run: tangle auth login${t===Zt?``:` --profile ${t}`}`);return{apiKey:n,baseUrl:Cn(e.baseUrl,t),timeout:e.timeout??3e4,profile:t,...kn(t)}}function kn(e){let t=rn(),n=Mn(on(e),t);return{activeTeamId:n.activeTeamId,activeTeamName:n.activeTeamName}}function An(e,t){gn(on(t),{activeTeamId:e.id,activeTeamName:e.name})}function jn(e){let t=on(e),n=rn(),r={...n.profiles??{}},i={baseUrl:Mn(t,n).baseUrl};i.baseUrl?r[t]=i:delete r[t],an({profiles:r})}function Mn(e,t=rn()){let n=Pn(e);return{...n===Zt?{baseUrl:t.baseUrl,activeTeamId:t.profiles?.[Zt]?.activeTeamId,activeTeamName:t.profiles?.[Zt]?.activeTeamName}:{},...t.profiles?.[n]??{}}}function Nn(e,t){let n=t.profiles===void 0?{...e.profiles??{}}:Object.fromEntries(Object.entries(t.profiles).filter(([,e])=>!!(e.apiKey||e.baseUrl||e.activeTeamId||e.activeTeamName)));return{...e,...t,profiles:Object.keys(n).length>0?n:void 0}}function Pn(e){let t=e.trim().toLowerCase();if(!t)throw Error(`Profile name cannot be empty`);if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw Error(`Profile names may only contain lowercase letters, numbers, dots, underscores, and hyphens`);return t}let Fn=null,In=null;function W(e){if(!e&&Fn)return Fn;let t=e??U({});return(!Fn||!In||In.apiKey!==t.apiKey||In.baseUrl!==t.baseUrl||In.timeout!==t.timeout)&&(Fn=new E({apiKey:t.apiKey,baseUrl:t.baseUrl,timeoutMs:t.timeout}),In=t),Fn}function Ln(){Fn=null,In=null}function G(e){let t=U({apiKey:e.apiKey,baseUrl:e.baseUrl});return{context:t,client:W(t)}}async function Rn(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);if(n.startsWith(`hubconn_`))return n;let{connections:r}=await e.connections.list();return Qe(r,n)}function zn(e,t){return[...t,e]}async function Bn(e,t){let n=e.map(e=>{let t=e.trim(),n=t.indexOf(`:`);return n===-1?{raw:e,ref:null,tail:null}:{raw:e,ref:t.slice(0,n).trim(),tail:t.slice(n+1)}});if(!n.some(e=>e.ref!==null&&e.ref!==`*`&&!e.ref.startsWith(`hubconn_`)))return[...e];let{connections:r}=await(await t()).connections.list();return n.map(e=>e.ref===null||e.ref===`*`||e.ref.startsWith(`hubconn_`)?e.raw:`${$e(r,e.ref)}:${e.tail}`)}function Vn(e){let t=new Map,n=[];for(let r of e){let e=r.trim(),i=e.indexOf(`:`);if(i===-1)throw Error(`Invalid --connection "${r}": expected <connectionId>:<capability>[,<capability>]. List connection ids with \`tangle hub connections\` and capability paths with \`tangle hub tools search <keyword>\`.`);let a=e.slice(0,i).trim();if(a.length===0)throw Error(`Invalid --connection "${r}": connection id is empty. Use <connectionId>:<capability> — list ids with \`tangle hub connections\`.`);let o=e.slice(i+1).split(`,`).map(e=>e.trim()).filter(e=>e.length>0);if(o.length===0)throw Error(`Invalid --connection "${r}": grant at least one capability, e.g. ${a}:gmail.messages.list. Discover paths with \`tangle hub tools search <keyword>\`.`);if(o.includes(`*`)&&o.length>1)throw Error(`Invalid --connection "${r}": "*" grants all capabilities and can't be combined with specific paths. Use <connectionId>:* alone, or list explicit paths.`);if(a===`*`&&!(o.length===1&&o[0]===`*`))throw Error(`Invalid --connection "${r}": a "*" connection is only valid as "*:*" (all connections, all capabilities). Name a connection id for specific paths.`);let s=t.get(a);s===void 0&&(s=new Set,t.set(a,s),n.push(a));for(let e of o)s.add(e)}return n.map(e=>{let n=t.get(e),r=n?[...n]:[];if(r.includes(`*`)&&r.length>1)throw Error(`Invalid --connection for "${e}": "*" can't be combined with specific capability paths across repeated --connection flags.`);return{connectionId:e,capabilities:r}})}function Hn(e,t){return ve(`sha256`).update(`${e}\0${t}`).digest(`hex`).slice(0,32)}function Un(e){return`${e}:hub`}function Wn(e){let{value:t}=h(Un(e));if(!t)return null;try{let e=JSON.parse(t);if(typeof e.key==`string`&&typeof e.expiresAt==`string`&&typeof e.platformUrl==`string`&&typeof e.sessionFingerprint==`string`)return{key:e.key,expiresAt:e.expiresAt,platformUrl:e.platformUrl,sessionFingerprint:e.sessionFingerprint}}catch{}return null}function Gn(e,t){try{p(Un(e),JSON.stringify(t))}catch{}}async function Kn(e,t,n,r){let i=`${e.replace(/\/+$/,``)}/auth/cli/hub-key`,a;try{a=await fetch(i,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${t}`},body:JSON.stringify({device_id:n}),signal:r})}catch(e){throw Error(`Could not reach ${i} to mint a platform key: ${e instanceof Error?e.message:String(e)}`)}let o=await a.text(),s;try{s=JSON.parse(o)}catch{s=null}if(!a.ok||!s?.success){let e=typeof s?.error?.message==`string`?s.error.message:`HTTP ${a.status}`;throw Error(`Platform key minting failed: ${e}. Your sandbox session may have expired — run \`tangle auth login\`.`)}let c=s.data;if(typeof c?.api_key!=`string`||typeof c?.expires_at!=`string`||typeof c?.platform_url!=`string`)throw Error(`Platform key minting returned an unexpected response shape.`);return{key:c.api_key,expiresAt:c.expires_at,platformUrl:c.platform_url}}var qn=class{cache;fingerprint;constructor(e,t,n,r,i){this.profile=e,this.sandboxBaseUrl=t,this.sessionToken=n,this.deviceId=r,this.signal=i,this.fingerprint=Hn(t,n);let a=Wn(e);this.cache=a&&a.sessionFingerprint===this.fingerprint?a:null}isFresh(e){return e!==null&&Date.parse(e.expiresAt)-Date.now()>6e4}async ensure(e=!1){if(this.signal?.throwIfAborted(),!e&&this.isFresh(this.cache))return this.cache;let t={...await Kn(this.sandboxBaseUrl,this.sessionToken,this.deviceId,this.signal),sessionFingerprint:this.fingerprint};return this.cache=t,Gn(this.profile,t),t}};function Jn(e){if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function Yn(e,t){return En({flag:e.baseUrl,...e.useCachedPlatformUrl?{cachedPlatformUrl:()=>Wn(t)?.platformUrl}:{}})}function Xn(e,t){let n=$t(`sandbox`,e.profile),r=yn(e.apiKey,n),i=xn(e.apiKey,n),a=e.allowHubCapabilityToken&&process.env.TANGLE_HUB_CAPABILITY_TOKEN?.trim()||void 0;if(a&&i===`env`)throw Error(`Set exactly one of TANGLE_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN, not both`);let o=i===`flag`&&r?r:a??r;if(!o)throw Error(`No API key found for profile '${n}'. Set TANGLE_API_KEY or run: tangle auth login${n===`default`?``:` --profile ${n}`}`);return(i===`flag`||i===`env`)&&r||a||o.startsWith(`sk-tan-`)||t?{kind:`static`,apiKey:o,baseUrl:Yn(e,n)}:{kind:`managed`,profile:n,sandboxBaseUrl:Cn(e.sandboxBaseUrl,n),sessionToken:o,deviceId:fn(),baseUrlOverride:e.baseUrl}}async function Zn(e={}){let t=Xn(e,e.hubKey===!1||Jn(process.env.TANGLE_SKIP_HUB_KEY));if(t.kind===`static`)return{token:t.apiKey,baseUrl:t.baseUrl,minted:!1};let n=new qn(t.profile,t.sandboxBaseUrl,t.sessionToken,t.deviceId,e.signal),r=await n.ensure();return{token:r.key,baseUrl:t.baseUrlOverride??r.platformUrl,refresh:async()=>(await n.ensure(!0)).key,minted:!0}}async function Qn(e,t,n={}){let r=e=>{let r=new Headers(n.headers);return r.set(`Authorization`,`Bearer ${e}`),fetch(t,{...n,headers:r})},i=await r(e.token);return i.status!==401||!e.refresh?i:r(await e.refresh())}async function $n(e={}){let t;try{t=await Zn(e)}catch(e){return{reachable:!1,reason:e instanceof Error?e.message:String(e),refused:!0}}try{let e=await Qn(t,`${t.baseUrl.replace(/\/+$/,``)}/v1/plans/current`);if(e.ok)return{reachable:!0,baseUrl:t.baseUrl};let n=e.status===401||e.status===403;return{reachable:!1,baseUrl:t.baseUrl,reason:n?`the platform refused this credential (HTTP ${e.status})`:`the platform answered HTTP ${e.status}`,refused:n}}catch(e){return{reachable:!1,baseUrl:t.baseUrl,reason:`could not reach ${t.baseUrl}: ${e instanceof Error?e.message:String(e)}`,refused:!1}}}async function er(e){let t=e.signal,n=t?(e,n)=>{let r=n?.signal??(e instanceof Request?e.signal:void 0);return fetch(e,{...n,signal:r?AbortSignal.any([r,t]):t})}:fetch.bind(globalThis),r=Xn(e,e.hubKey===!1||Jn(process.env.TANGLE_SKIP_HUB_KEY));if(r.kind===`static`){let t=!e.apiKey&&process.env.TANGLE_API_KEY_FILE&&!process.env.TANGLE_HUB_CAPABILITY_TOKEN;return new Je({baseUrl:r.baseUrl,fetch:n,authHeaders:()=>({Authorization:`Bearer ${t?vn():r.apiKey}`})})}let i=new qn(r.profile,r.sandboxBaseUrl,r.sessionToken,r.deviceId,e.signal),a=await i.ensure();return new Je({baseUrl:r.baseUrlOverride??a.platformUrl,authHeaders:async()=>({Authorization:`Bearer ${(await i.ensure()).key}`}),fetch:async(e,t)=>{let r=await n(e,t);if(r.status!==401)return r;let a=await i.ensure(!0),o=new Headers(t?.headers);return o.set(`Authorization`,`Bearer ${a.key}`),n(e,{...t,headers:o})}})}function tr(e={}){return er(e)}function K(e={}){return er({...e,useCachedPlatformUrl:!0,allowHubCapabilityToken:!0})}function nr(e,t){return`Sandbox name is ambiguous: ${e}. Use a sandbox id instead.\n${t.map(e=>`- ${e.id} (status: ${e.status}, created: ${e.createdAt.toISOString()})`).join(`
 `)}`}function rr(e){return e.activeTeamId?`team:${e.activeTeamId}`:void 0}async function q(e,t,n,r={}){if(!r.nameOnly){let t=await e.get(n);if(t)return t;if(ar(n))throw Error(`Sandbox not found: ${n}`)}let i=(await e.list({scope:rr(t)})).filter(e=>e.name?.toLowerCase()===n.toLowerCase());if(i.length===0)throw Error(`Sandbox not found: ${n}`);if(i.length>1)throw Error(nr(n,i));return i[0]}const ir=/^sandbox-(?:(?:(?:[a-z][a-z0-9-]*)-)?(?:[a-v0-9]{12}|[a-f0-9]{8}-[a-f0-9]{3})|l[0-9a-z]{1,8}-[0-9a-f]{8})(?:-branch-[a-z0-9]+-[0-9]+)*$/;function ar(e){return ir.test(e)}async function or(e,t,n,r={}){let i=n;try{i=(await q(e,t,n,{nameOnly:r.name})).id}catch(e){if(!(e instanceof Error&&e.message===`Sandbox not found: ${n}`)||r.name||!r.retryCleanup&&!ar(n))throw e}let a=await e.delete(i,{until:r.until}).catch(e=>{throw e instanceof D&&e.method&&e.endpoint&&(e.message=`${e.method} ${e.endpoint}: ${e.message}`),e});if(r.until===`removed`&&a.removal!==`complete`)throw Error(`Sandbox removal is unconfirmed for ${i}: ${a.removal??`unknown`}`);return a.outcome}async function J(e,t){if(e.status!==`stopped`)return e;let n=t?.resumeTimeoutMs??12e4;l(`Sandbox ${e.id} is stopped. Resuming...`);try{await e.resume({timeoutMs:n}),await e.waitFor(`running`,{timeoutMs:n})}catch(t){let r=t instanceof Error?t.message:String(t);throw Error(`Failed to resume sandbox ${e.id}: ${r}. Run \`tangle sandbox resume ${e.id} --timeout ${n}\` and retry.`)}return e}const sr=[`anthropic`,`openai`,`vercel-ai`,`mastra`,`mcp-local`,`claude-desktop`,`cursor`,`zed`];function cr(e,t,n){switch(e){case`anthropic`:return`// pnpm add @anthropic-ai/sdk @tangle-network/sandbox
 import Anthropic from "@anthropic-ai/sdk";
 import { Sandbox } from "@tangle-network/sandbox";
@@ -119,9 +119,9 @@ await connect(new StdioServerTransport());`;case`claude-desktop`:return`// Add t
       }
     }
   }
-}`}}function lr(e){return{anthropic:`Anthropic Messages API (Claude)`,openai:`OpenAI Chat Completions (function calling)`,"vercel-ai":`Vercel AI SDK (generateText / streamText)`,mastra:`Mastra agent framework`,"mcp-local":`Local MCP server bridge (stdio)`,"claude-desktop":`Claude Desktop config (uses local MCP)`,cursor:`Cursor config (uses local MCP)`,zed:`Zed config (uses local MCP)`}[e]}function ur(){return new N(`connect`).description(`Print a copy-paste SDK integration snippet for one of: ${sr.join(`, `)} (to stream a local agent's telemetry to Intelligence, see 'tangle connect')`).argument(`<framework>`,sr.join(` | `)).option(`-i, --sandbox <id>`,`Sandbox ID to embed in the snippet`,`<SANDBOX_ID>`).option(`-s, --session <id>`,`Session ID to embed in the snippet`,`default`).action((e,t)=>{sr.includes(e)||(console.error(j.red(`unknown framework: ${e}`),`\nsupported: ${sr.join(`, `)}`),process.exit(2));let n=e;process.stdout.write(j.cyan(`# ${lr(n)}\n\n`)),process.stdout.write(`${cr(n,t.sandbox,t.session)}\n`)})}async function dr(e,t=!1,n){n?.throwIfAborted();let r=t?new et({write(e,t,n){n()}}):process.stderr,i=$e({input:process.stdin,signal:n,output:r,...t?{terminal:!0}:{}});n&&i.once(`SIGINT`,()=>{process.emit(`SIGINT`),i.close()}),t&&process.stderr.write(e);try{return await new Promise(n=>{i.once(`close`,()=>n(void 0)),i.question(t?``:e,e=>{n(e.trim()),i.close()})})}finally{i.close(),t&&process.stderr.write(`
+}`}}function lr(e){return{anthropic:`Anthropic Messages API (Claude)`,openai:`OpenAI Chat Completions (function calling)`,"vercel-ai":`Vercel AI SDK (generateText / streamText)`,mastra:`Mastra agent framework`,"mcp-local":`Local MCP server bridge (stdio)`,"claude-desktop":`Claude Desktop config (uses local MCP)`,cursor:`Cursor config (uses local MCP)`,zed:`Zed config (uses local MCP)`}[e]}function ur(){return new N(`connect`).description(`Print a copy-paste SDK integration snippet for one of: ${sr.join(`, `)} (to stream a local agent's telemetry to Intelligence, see 'tangle connect')`).argument(`<framework>`,sr.join(` | `)).option(`-i, --sandbox <id>`,`Sandbox ID to embed in the snippet`,`<SANDBOX_ID>`).option(`-s, --session <id>`,`Session ID to embed in the snippet`,`default`).action((e,t)=>{sr.includes(e)||(console.error(j.red(`unknown framework: ${e}`),`\nsupported: ${sr.join(`, `)}`),process.exit(2));let n=e;process.stdout.write(j.cyan(`# ${lr(n)}\n\n`)),process.stdout.write(`${cr(n,t.sandbox,t.session)}\n`)})}async function dr(e,t=!1,n){n?.throwIfAborted();let r=t?new tt({write(e,t,n){n()}}):process.stderr,i=et({input:process.stdin,signal:n,output:r,...t?{terminal:!0}:{}});n&&i.once(`SIGINT`,()=>{process.emit(`SIGINT`),i.close()}),t&&process.stderr.write(e);try{return await new Promise(n=>{i.once(`close`,()=>n(void 0)),i.question(t?``:e,e=>{n(e.trim()),i.close()})})}finally{i.close(),t&&process.stderr.write(`
 `)}}async function fr(e){let t=await dr(e,!0);if(t===void 0)throw Error(`No answer on stdin.`);return t}async function pr(e,t){let n=await dr(e);if(n===void 0)throw process.stderr.write(`
-`),Error(t?`No answer on stdin. Pass ${t} to skip the confirmation.`:`No answer on stdin.`);return[`y`,`yes`].includes(n.toLowerCase())}async function mr(e,t,n){let r=await dr(`${e}${t?` [${t}]`:``}: `,!1,n);if(r===void 0)throw Error(`No answer on stdin.`);return r||t||``}async function hr(e,t=`secret`){if(process.stdin.isTTY)throw Error(e?`${e} reads ${t} from stdin, but stdin is a terminal; pipe it in`:`Cannot read ${t} from stdin when stdin is a TTY`);return(await tt(process.stdin)).toString(`utf8`).replace(/\r?\n$/,``)}function gr(){let t=new N(`profile`).description(`Create, inspect, and validate portable agent profiles`);return t.command(`create [output]`).description(`Create a profile — interactively (a wizard), or fully via flags`).option(`--name <name>`,`Profile name (when set, skips the wizard)`).option(`--description <text>`,`Profile description`).option(`--model <model>`,`Model (provider/model)`).option(`--system-prompt <text>`,`System prompt`).option(`--skills <ref...>`,`Skill refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--tools <ref...>`,`Tool refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--harness <name>`,`Harness hint shown in the run command`).action(async(t,n)=>{let r=n.name,i=n.description,a=n.harness,o=n.model,s=n.systemPrompt,c=n.skills??[],u=n.tools??[];if(!r&&process.stdin.isTTY&&(r=await mr(`Profile name`,`my-agent`),i=await mr(`Description (optional)`)||void 0,a=await mr(`Harness`,`claude-code`)||void 0,o=await mr(`Model (optional, provider/model)`)||void 0,s=await mr(`System prompt (optional)`)||void 0,c=await _r(`Skill ref (local path or github:..., blank to finish)`),u=await _r(`Tool ref (blank to finish)`)),!r)throw Error(process.stdin.isTTY?`Profile name is required.`:"`agent profile create` needs at least --name in a non-interactive shell (no TTY to prompt). Pass --name <name> (and optionally --model/--skills/--tools/--system-prompt).");let d=Ht({model:o,systemPrompt:s,skills:c,tools:u}),f=Wt({...r?{name:r}:{},...i?{description:i}:{},...d??{},...a?{harness:a}:{}},`new profile`);if(n.json){e(f);return}let p=t??`agent-profile.json`;Ve(p,`${JSON.stringify(f,null,2)}\n`),l(`Wrote ${p}`),l(`Run it: tangle agent prompt <box> --profile ${p}${a?` --harness ${a}`:``}`)}),t.command(`show <source>`).description(`Load and print a profile (local path, https URL, or github:owner/repo/path[@ref])`).action(async t=>{try{e(await Ut(t))}catch(e){H(e,!0)}}),t.command(`validate <source>`).description(`Validate a profile against the canonical AgentProfile schema`).action(async(t,n)=>{let r=await Ut(t),i=typeof r.name==`string`?r.name:`(unnamed)`;n.json?e({ok:!0,name:i}):l(`Profile valid: "${i}"`)}),t}async function _r(e){let t=[];for(;;){let n=await mr(e);if(!n)break;t.push(n)}return t}function vr(e){return(process.env.TANGLE_SANDBOX_WEB_URL?.trim()||e).replace(/\/+$/,``)}function yr(e,t){if(process.exitCode=1,e.status===`blocked_on_approval`){console.error(j.yellow(`⚠ Blocked on a hub approval.`));let t=e.approval?.approvalId;console.error(t?`Approve it:  tangle hub approvals approve ${t}`:"Approve the pending request (`tangle hub approvals`), then re-run.");return}if(e.status===`awaiting_question`){console.error(j.yellow(`⚠ Agent is awaiting an answer to a question.`)),console.error(`Re-run with --interactive to answer it, or answer programmatically via box.session(<id>).answer(<questionId>, { ... }).`);return}if(e.status===`awaiting_interaction`){console.error(j.yellow(`⚠ Agent is awaiting a response.`)),console.error(`Open an interactive session, or answer the canonical interaction through the Sandbox SDK.`);return}if(e.status===`awaiting_plan_decision`){console.error(j.yellow(`⚠ Agent is awaiting a plan decision.`)),console.error(`Approve or reject the pending plan before continuing.`);return}console.error(j.red(`✗ ${e.error&&e.error.length>0?e.error:t}`))}async function br(e,t,n,r){if(n.errorCode===`TIMEOUT`)return{partial:(await e.session(t).messages().catch(()=>[])).filter(e=>e.role===`assistant`&&e.id===n.executionId).flatMap(e=>e.parts).flatMap(e=>{if(e.type===`text`&&typeof e.text==`string`)return[e.text];let t=e.state;return e.type===`tool`?[`[tool ${String(e.tool)}: ${t?.status??`unknown`}]`]:[]}),next:`tangle agent prompt ${Me(e.id)} 'continue' --session ${Me(t)} --timeout ${r*2}`}}function xr(e){let t=e.part;if(t?.type===`text`)return t.text??t.content??void 0}function Sr(e){return e.finalText??e.response??e.output??e.content??e.text??void 0}function Cr(e){if(!e.result.success){yr(e.result,`Agent run failed`);return}let t=Date.now()-e.startedAt,n=e.tokenUsage,r=[`${t}ms`,n?.inputTokens===void 0?void 0:`${n.inputTokens} in`,n?.outputTokens===void 0?void 0:`${n.outputTokens} out`].filter(e=>!!e);console.log(j.green(`✓ Done`),j.dim(`(${r.join(`, `)})`))}async function wr(e,t,n=!0){let r=``,i,a=ne(),o=e=>{if(e.startsWith(r)){let t=e.slice(r.length);t&&n&&process.stdout.write(t)}else n&&process.stdout.write(e);r=e};try{for await(let t of e)switch(a.observe(t),t.type){case`token`:{let e=t.data?.value;typeof e==`string`&&(n&&process.stdout.write(e),r+=e);break}case`message.part.updated`:{let e=xr(t.data);typeof e==`string`&&e.length>0&&o(e);break}case`raw`:break;case`result`:i=t.data;break}}catch(e){a.observe({type:`error`,data:{message:e instanceof Error?e.message:String(e)}})}if(r.length===0&&i){let e=Sr(i);typeof e==`string`&&e.length>0&&(n&&process.stdout.write(e),r=e)}return{outcome:{result:a.finish(),startedAt:t,tokenUsage:i?.tokenUsage},resultData:i,printed:r.length,...r.length>0?{response:r}:{}}}function Tr(e){let t=Vn(e??[]);if(t.length!==0)return{profile:{connections:t}}}function Er(e,t,n){if(!Bt(e)||Rt.has(e))return;let r=`Harness "${e}" takes no opening prompt, so it has no interactive session; run the task headless.`;throw new B(`USAGE_INVALID`,r,r,`tangle agent prompt ${Me(t)} ${Me(n)} --harness ${e}`)}function Dr(e,t,n,r,i,a){let o={...r??{},harness:n,...i?{model:{...r?.model??{},default:i}}:{}},s={profile:o,requestedProfileDigest:De(o),initialPrompt:a};return{...s,run:Te({provider:`tangle-sandbox`,environmentId:e,sessionId:t,executionId:`interactive-execution-${t}`},s)}}async function Or(e){let t=Vn(e.connection??[]);if(t.length===0)throw Error(`--allow-writes needs at least one --connection to grant writes for.`);if(t.some(e=>e.connectionId===`*`))throw Error("--allow-writes needs explicit --connection ids; the `*:*` wildcard can't be bulk-granted. Grant per connection, e.g. --connection conn_x:* --allow-writes.");let n=await K({hubKey:e.hubKey});for(let r of t){let t=await n.permissions.allowWrites(r.connectionId);e.json||l(`Allowed ${t.writeActions} write action${t.writeActions===1?``:`s`} for connection ${r.connectionId} (${t.granted} newly granted).`)}e.json||l(`Revert anytime: ${t.map(e=>`tangle hub permissions revert-writes --connection ${e.connectionId}`).join(`  ·  `)}`)}async function kr(e){!e.connection||e.connection.length===0||(e.connection=await Bn(e.connection,()=>K({hubKey:e.hubKey})))}const Ar=15e3;async function jr(e){let t=process.stdin,n=process.stdout,r=null,i=!1,a=!1,o=!1,s=!1,c,u=0,d,f,p=new Promise(e=>{f=e}),m=()=>{try{t.setRawMode(!1)}catch{}t.pause()},h=()=>{i||(i=!0,clearTimeout(d),m(),t.off(`data`,w),process.off(`SIGWINCH`,_),process.off(`SIGINT`,g),process.off(`SIGTERM`,g),process.off(`exit`,m),f())},g=e=>{s=!0,Promise.resolve(r?.close()).finally(()=>{h(),process.exit(e===`SIGTERM`?143:130)})},_=()=>{r?.isOpen&&!o&&r.resize(n.columns||80,n.rows||24)},v=[],y=e=>{if(e.length!==0){try{if(!o&&r?.isOpen)return r.write(e)}catch{}v.push(e),C()}},b=()=>{clearTimeout(d);let e=r?.authorityLifetimeMs;e!==void 0&&(d=setTimeout(()=>void C(),Math.max(Ar,e*.8)))},S=async e=>{for(let t=1;;t++)try{return await e.reconnect({cols:n.columns||80,rows:n.rows||24})}catch(e){if(t>=3||e instanceof x)throw e;await new Promise(e=>setTimeout(e,500*2**t))}},C=async()=>{let e=r;if(!(o||i||a||!e)){o=!0,clearTimeout(d);try{await e.close(),r=await S(e);for(let e of v.splice(0))r.write(e)}catch(t){i||(c=t instanceof x?`the session ended`:`could not reattach: ${t.message}`),o=!1,r!==e&&await r?.close(),h();return}if(o=!1,i){await r.close();return}_(),b()}},w=e=>{if(!r)return;let t=e.indexOf(29);if(t===-1){y(e);return}y(e.subarray(0,t)),s=!0,r.close().finally(h)};if(r=await e.attach({cols:n.columns||80,rows:n.rows||24,handlers:{onData:e=>{n.write(Buffer.from(e.buffer,e.byteOffset,e.byteLength))},onExit:e=>{a=!0;let t=e.exitCode===void 0?``:` (code ${e.exitCode})`;n.write(`\r\n[interactive session exited${t}]\r\n`),r?.close().finally(h)},onError:e=>{n.write(`\r\n[terminal stream error: ${e.message}]\r\n`)},onClose:()=>{if(o||i)return;let e=Date.now();s||a?h():e-u<Ar?(c=`the connection keeps closing`,h()):(u=e,C())}}}),b(),t.setRawMode(!0),t.resume(),t.on(`data`,w),process.on(`SIGWINCH`,_),process.on(`SIGINT`,g),process.on(`SIGTERM`,g),process.on(`exit`,m),await p,console.log(),a){l(`Interactive session ended.`);return}l(`Detached — ${c??`the session keeps running`}.`)}function Mr(){let t=new N(`agent`).description(`Interact with AI agent`);return t.command(`prompt <idOrMessage> [message]`).description("Send a single prompt to the agent. With one arg it's the prompt and the box comes from `tangle use` / --box / TANGLE_SANDBOX; with two it's <id> <message>.").option(`--box <id>`,`Target sandbox (overrides the active one)`).option(`--session <id>`,`Continue existing session`).option(`--model <model>`,`Model to use`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`300000`).option(`--stream`,`Stream response in real-time`).option(`--interactive`,`Spawn the harness's interactive TUI in the sandbox, inject this prompt, and print a link to watch + drive the live session in the browser (omit for the default headless run)`).option(`--harness <name>`,`Harness that executes this run (claude-code, codex, kimi-code, opencode, pi, amp, hermes). Defaults to the sandbox's configured backend. The box ships all harnesses, so this is a per-run choice.`).option(`--profile <source>`,`Agent profile to run: a local JSON path, an https URL, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--skills <ref...>`,`Attach skills (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>] to pull from a repo`).option(`--tools <ref...>`,`Attach tools (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--system-prompt <text>`,`Override the agent's system prompt for this run`).option(`--connection <spec>`,"Grant a hub connection to the agent as MCP tools (repeatable). The connection is a connection id or a provider name. Modes: <connection>:<cap1>,<cap2> (least privilege, recommended), <connection>:* (all of one connection), or *:* (all connections). List connections with `tangle hub connections`; paths with `tangle hub tools search <keyword>`.",zn,[]).option(`--allow-writes`,"Pre-approve every WRITE action of each granted --connection so the agent can write unattended (reads are already allowed; destructive actions still prompt). Revert with `tangle hub permissions revert-writes`.").option(`--no-hub-key`,`Do not auto-mint a platform Hub key for --allow-writes; use the stored credential as-is`).action(async(t,n,r)=>{let i=n===void 0?t:n,a=n===void 0?pn(r.box):t,{context:o,client:c}=G(r),u=await Kt({profileSource:r.profile,systemPrompt:r.systemPrompt,skills:r.skills,tools:r.tools});await kr(r);let d=Tr(r.connection);r.allowWrites&&await Or(r);let p=u||d?{...u,...d?.profile}:void 0,m=r.harness;r.interactive&&m&&Er(m,a,i);let h=p||m||r.model?{...m?{type:m}:{},...p?{profile:p}:{},...r.model?{model:{model:r.model}}:{}}:void 0,g=await q(c,o,a);if(g=await J(g),r.interactive){let t=r.session??`int-${be()}`,n=m??(await g.backend.status()).type;Er(n,g.id,i);let a=Dr(g.id,t,n,p,r.model,i),c=g.session(t).interactive(),u=f(`Starting interactive ${n} session...`);u.start();let d;try{d=await c.start(a)}finally{u.stop()}let h=d.ref.preparationReceipt.harness,_=d.state===`running`?d.streamUrl:void 0,v=`${vr(o.baseUrl)}/dashboard/sandbox/${encodeURIComponent(g.id)}?interactive=${encodeURIComponent(d.ref.run.sessionId)}`;if(r.json){e({state:d.state,sessionId:d.ref.run.sessionId,harness:h,..._?{streamUrl:_}:{},webUrl:v});return}if(l(`Interactive ${h} session ${d.state}.`),console.log(),d.state===`running`&&(s({"Watch & drive":v}),console.log()),d.state===`exited`){l(`The initial prompt completed with reason: ${d.reason}.`);return}l(`Open the link to watch the agent and type to take over.`),process.stdin.isTTY===!0&&process.stdout.isTTY===!0&&(console.log(),l(`Attaching to the live session — press Ctrl-] to detach.`),await jr(c));return}if(r.stream){r.json||(l(`Streaming response...`),console.log());let t=Date.now(),n=await wr(g.streamPrompt(i,{sessionId:r.session,timeoutMs:Number.parseInt(r.timeout,10),...h?{backend:h}:{}}),t,!r.json);r.json?(e({...n.outcome.result,...n.response?{response:n.response}:{},...n.outcome.tokenUsage?{tokenUsage:n.outcome.tokenUsage}:{},durationMs:Date.now()-t}),n.outcome.result.success||(process.exitCode=1)):(n.printed>0&&console.log(),Cr(n.outcome))}else{let t=f(`Processing prompt...`);t.start();let n=r.session??`prompt-${be()}`,a=Number.parseInt(r.timeout,10),o=await g.prompt(i,{sessionId:n,timeoutMs:a,...h?{backend:h}:{}}),c=await br(g,n,o,a);if(t.stop(),r.json)e({...o,sessionId:n,...c}),o.success===!1&&(process.exitCode=1);else if(o.success===!1){for(let e of c?.partial??[])console.log(e);yr(o,`Agent prompt failed`),c&&console.error(`The run stopped in the box at the same limit; files it wrote stay there.\nContinue it:  ${c.next}`)}else console.log(o.response),console.log(),s({Duration:`${o.durationMs}ms`,"Input Tokens":o.usage?.inputTokens,"Output Tokens":o.usage?.outputTokens})}}),t.addCommand(ur()),t.addCommand(gr()),t}async function Nr(e){let t=e.timeoutMs??1e4,n=e.baseUrl.replace(/\/$/,``),r=`${n}/v1/account/me`;try{let n=await fetch(r,{headers:{Accept:`application/json`,Authorization:`Bearer ${e.apiKey}`},signal:AbortSignal.timeout(t)});if(!n.ok){let e=await Fr(n);throw n.status===401||n.status===403?new b(e||`Invalid API key`):n.status>=500?new O(e||`Sandbox API returned an unexpected error`,{status:n.status}):Error(e||`Credential validation failed with status ${n.status}`)}let i=await n.json();if(!i.success||!i.data)throw Error(`Sandbox API returned an invalid account response`);return{customerId:i.data.customer_id,billingOwnerId:typeof i.data.billing_owner_id==`string`?i.data.billing_owner_id:void 0,apiKeyId:typeof i.data.api_key_id==`string`||i.data.api_key_id===null?i.data.api_key_id:void 0,billingDelegationAuthorized:typeof i.data.billing_delegation_authorized==`boolean`?i.data.billing_delegation_authorized:void 0,email:i.data.email,name:i.data.name,tier:i.data.tier,createdAt:i.data.created_at}}catch(e){throw e instanceof b||e instanceof O||e instanceof A?e:e instanceof Error&&e.name===`AbortError`?new A(`Timed out validating credentials against ${n}`,{timeoutMs:t}):e instanceof Error&&!(e instanceof TypeError)?e:new S(`Failed to reach ${n}`,{cause:Pr(e)})}}function Pr(e){return e instanceof Error?e:void 0}async function Fr(e){let t=await e.text();if(t)try{let e=JSON.parse(t);return e.error?.message??e.message??t}catch{return t}}function Ir(e){return e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`).replace(/'/g,`&#39;`)}function Lr(e){if(!zr(e.hostHeader))return{kind:`host-mismatch`};let t;try{t=new URL(e.requestUrl??`/`,`http://127.0.0.1`)}catch{return{kind:`not-found`}}if(t.pathname!==`/callback`)return{kind:`not-found`};if(t.searchParams.get(`state`)!==e.expectedState)return{kind:`state-mismatch`};let n=t.searchParams.get(`error`);if(n)return{kind:`error`,reason:n};let r=t.searchParams.get(`grant_token`);return r?{kind:`ok`,token:r}:{kind:`missing-token`}}async function Rr(e){e.signal?.throwIfAborted();let t=e.timeoutMs??12e4,n=e.baseUrl.replace(/\/$/,``),r=await import(`node:http`),i=ye(32).toString(`hex`),a=null,o=null,s=new Promise((e,t)=>{a=e,o=t}),c=r.createServer((e,t)=>{try{let n=Lr({hostHeader:e.headers.host,requestUrl:e.url,expectedState:i});switch(n.kind){case`host-mismatch`:t.writeHead(421,{"content-type":`text/plain; charset=utf-8`}),t.end(`Misdirected request`);return;case`not-found`:t.writeHead(404,{"content-type":`text/plain; charset=utf-8`}),t.end(`Not found`);return;case`state-mismatch`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(Ur(`State mismatch — refusing login`)),o?.(Error(`Browser login state mismatch — refusing potentially hijacked callback`));return;case`error`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(Ur(n.reason)),o?.(Error(`Browser login failed: ${n.reason}`));return;case`missing-token`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(Ur(null)),o?.(Error(`Browser login did not return a grant token`));return;case`ok`:t.writeHead(200,{"content-type":`text/html; charset=utf-8`}),t.end(Ur(null)),a?.(n.token);return}}catch(e){o?.(e instanceof Error?e:Error(`Browser login callback failed`))}});await new Promise((e,t)=>{c.once(`error`,t),c.listen(0,`127.0.0.1`,()=>e())});try{let r=c.address();if(!r||typeof r==`string`)throw Error(`Failed to bind local callback server`);let a=new URL(`http://127.0.0.1:${r.port}/callback`);a.searchParams.set(`state`,i);let o=new URL(`${n}/auth/cli/login`);o.searchParams.set(`callback_url`,a.toString()),e.provider&&o.searchParams.set(`provider`,e.provider);let l=await Hr(o.toString());e.onLoginUrl?.({loginUrl:o.toString(),browserOpened:l});let u=await Vr({baseUrl:n,grantToken:await Br(s,t,e.signal),timeoutMs:t,signal:e.signal});return{apiKey:u.apiKey,email:u.email,name:u.name,tier:u.tier}}finally{e.signal?.aborted&&c.closeAllConnections(),await new Promise((e,t)=>{c.close(n=>{if(n){t(n);return}e()})}).catch(()=>void 0)}}function zr(e){if(!e)return!1;let t=e.toLowerCase().match(/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/);if(!t)return!1;let n=t[1];return n===`127.0.0.1`||n===`localhost`||n===`[::1]`}async function Br(e,t,n){let r=new AbortController;try{return await Promise.race([e,nt(t,void 0,{signal:AbortSignal.any([r.signal,...n?[n]:[]])}).then(()=>{throw new A(`Timed out waiting for browser login to complete`,{timeoutMs:t})})])}finally{r.abort()}}async function Vr(e){let t=await fetch(`${e.baseUrl}/auth/cli/exchange`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({grant_token:e.grantToken}),signal:AbortSignal.any([AbortSignal.timeout(e.timeoutMs),...e.signal?[e.signal]:[]])}).catch(t=>{throw new S(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),n=await t.json().catch(()=>null);if(!t.ok||!n?.success||!n.data?.api_key)throw Error(n?.error?.message||`Failed to exchange browser login grant`);return{apiKey:n.data.api_key,email:n.data.email,name:n.data.name,tier:n.data.tier}}async function Hr(e){let{spawn:t}=await import(`node:child_process`),n=process.platform===`darwin`?[`open`,e]:process.platform===`win32`?[`cmd`,`/c`,`start`,``,e]:[`xdg-open`,e];return await new Promise(e=>{let r=t(n[0],n.slice(1),{detached:!0,stdio:`ignore`});r.once(`error`,()=>e(!1)),r.once(`spawn`,()=>{r.unref(),e(!0)})})}function Ur(e){return`<!doctype html>
+`),Error(t?`No answer on stdin. Pass ${t} to skip the confirmation.`:`No answer on stdin.`);return[`y`,`yes`].includes(n.toLowerCase())}async function mr(e,t,n){let r=await dr(`${e}${t?` [${t}]`:``}: `,!1,n);if(r===void 0)throw Error(`No answer on stdin.`);return r||t||``}async function hr(e,t=`secret`){if(process.stdin.isTTY)throw Error(e?`${e} reads ${t} from stdin, but stdin is a terminal; pipe it in`:`Cannot read ${t} from stdin when stdin is a TTY`);return(await nt(process.stdin)).toString(`utf8`).replace(/\r?\n$/,``)}function gr(){let t=new N(`profile`).description(`Create, inspect, and validate portable agent profiles`);return t.command(`create [output]`).description(`Create a profile — interactively (a wizard), or fully via flags`).option(`--name <name>`,`Profile name (when set, skips the wizard)`).option(`--description <text>`,`Profile description`).option(`--model <model>`,`Model (provider/model)`).option(`--system-prompt <text>`,`System prompt`).option(`--skills <ref...>`,`Skill refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--tools <ref...>`,`Tool refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--harness <name>`,`Harness hint shown in the run command`).action(async(t,n)=>{let r=n.name,i=n.description,a=n.harness,o=n.model,s=n.systemPrompt,c=n.skills??[],u=n.tools??[];if(!r&&process.stdin.isTTY&&(r=await mr(`Profile name`,`my-agent`),i=await mr(`Description (optional)`)||void 0,a=await mr(`Harness`,`claude-code`)||void 0,o=await mr(`Model (optional, provider/model)`)||void 0,s=await mr(`System prompt (optional)`)||void 0,c=await _r(`Skill ref (local path or github:..., blank to finish)`),u=await _r(`Tool ref (blank to finish)`)),!r)throw Error(process.stdin.isTTY?`Profile name is required.`:"`agent profile create` needs at least --name in a non-interactive shell (no TTY to prompt). Pass --name <name> (and optionally --model/--skills/--tools/--system-prompt).");let d=Ht({model:o,systemPrompt:s,skills:c,tools:u}),f=Wt({...r?{name:r}:{},...i?{description:i}:{},...d??{},...a?{harness:a}:{}},`new profile`);if(n.json){e(f);return}let p=t??`agent-profile.json`;He(p,`${JSON.stringify(f,null,2)}\n`),l(`Wrote ${p}`),l(`Run it: tangle agent prompt <box> --profile ${p}${a?` --harness ${a}`:``}`)}),t.command(`show <source>`).description(`Load and print a profile (local path, https URL, or github:owner/repo/path[@ref])`).action(async t=>{try{e(await Ut(t))}catch(e){H(e,!0)}}),t.command(`validate <source>`).description(`Validate a profile against the canonical AgentProfile schema`).action(async(t,n)=>{let r=await Ut(t),i=typeof r.name==`string`?r.name:`(unnamed)`;n.json?e({ok:!0,name:i}):l(`Profile valid: "${i}"`)}),t}async function _r(e){let t=[];for(;;){let n=await mr(e);if(!n)break;t.push(n)}return t}function vr(e){return(process.env.TANGLE_SANDBOX_WEB_URL?.trim()||e).replace(/\/+$/,``)}function yr(e,t){if(process.exitCode=1,e.status===`blocked_on_approval`){console.error(j.yellow(`⚠ Blocked on a hub approval.`));let t=e.approval?.approvalId;console.error(t?`Approve it:  tangle hub approvals approve ${t}`:"Approve the pending request (`tangle hub approvals`), then re-run.");return}if(e.status===`awaiting_question`){console.error(j.yellow(`⚠ Agent is awaiting an answer to a question.`)),console.error(`Re-run with --interactive to answer it, or answer programmatically via box.session(<id>).answer(<questionId>, { ... }).`);return}if(e.status===`awaiting_interaction`){console.error(j.yellow(`⚠ Agent is awaiting a response.`)),console.error(`Open an interactive session, or answer the canonical interaction through the Sandbox SDK.`);return}if(e.status===`awaiting_plan_decision`){console.error(j.yellow(`⚠ Agent is awaiting a plan decision.`)),console.error(`Approve or reject the pending plan before continuing.`);return}console.error(j.red(`✗ ${e.error&&e.error.length>0?e.error:t}`))}async function br(e,t,n,r){if(n.errorCode!==`TIMEOUT`)return;let i=n.executionId,a=Ne(t);if(!n.error?.startsWith(`Prompt stream timed out`))return{partial:[],note:`A gateway timed out; the run may still be going in the box. Read it with the Sandbox SDK: box.session(${a}).messages()`};if(!i)return{partial:[],note:`Nothing ran: the box never admitted this turn.`};let o=e.session(t).messages(),s=xe(5e3,[],{ref:!1});return{partial:(await Promise.race([o,s]).catch(()=>[])).filter(e=>e.role===`assistant`&&e.id.startsWith(i)).flatMap(e=>e.parts).flatMap(e=>{if(e.type===`text`&&typeof e.text==`string`)return[e.text];let t=e.state;return e.type===`tool`?[`[tool ${String(e.tool)}: ${t?.status??`unknown`}]`]:[]}),note:`The run stopped in the box at the same limit; files it wrote stay there.`,next:`tangle agent prompt ${Ne(e.id)} 'continue' --session ${a} --timeout ${r*2}`}}function xr(e){let t=e.part;if(t?.type===`text`)return t.text??t.content??void 0}function Sr(e){return e.finalText??e.response??e.output??e.content??e.text??void 0}function Cr(e){if(!e.result.success){yr(e.result,`Agent run failed`);return}let t=Date.now()-e.startedAt,n=e.tokenUsage,r=[`${t}ms`,n?.inputTokens===void 0?void 0:`${n.inputTokens} in`,n?.outputTokens===void 0?void 0:`${n.outputTokens} out`].filter(e=>!!e);console.log(j.green(`✓ Done`),j.dim(`(${r.join(`, `)})`))}async function wr(e,t,n=!0){let r=``,i,a=ne(),o=e=>{if(e.startsWith(r)){let t=e.slice(r.length);t&&n&&process.stdout.write(t)}else n&&process.stdout.write(e);r=e};try{for await(let t of e)switch(a.observe(t),t.type){case`token`:{let e=t.data?.value;typeof e==`string`&&(n&&process.stdout.write(e),r+=e);break}case`message.part.updated`:{let e=xr(t.data);typeof e==`string`&&e.length>0&&o(e);break}case`raw`:break;case`result`:i=t.data;break}}catch(e){a.observe({type:`error`,data:{message:e instanceof Error?e.message:String(e)}})}if(r.length===0&&i){let e=Sr(i);typeof e==`string`&&e.length>0&&(n&&process.stdout.write(e),r=e)}return{outcome:{result:a.finish(),startedAt:t,tokenUsage:i?.tokenUsage},resultData:i,printed:r.length,...r.length>0?{response:r}:{}}}function Tr(e){let t=Vn(e??[]);if(t.length!==0)return{profile:{connections:t}}}function Er(e,t,n){if(!Bt(e)||Rt.has(e))return;let r=`Harness "${e}" takes no opening prompt, so it has no interactive session; run the task headless.`;throw new B(`USAGE_INVALID`,r,r,`tangle agent prompt ${Ne(t)} ${Ne(n)} --harness ${e}`)}function Dr(e,t,n,r,i,a){let o={...r??{},harness:n,...i?{model:{...r?.model??{},default:i}}:{}},s={profile:o,requestedProfileDigest:Oe(o),initialPrompt:a};return{...s,run:Ee({provider:`tangle-sandbox`,environmentId:e,sessionId:t,executionId:`interactive-execution-${t}`},s)}}async function Or(e){let t=Vn(e.connection??[]);if(t.length===0)throw Error(`--allow-writes needs at least one --connection to grant writes for.`);if(t.some(e=>e.connectionId===`*`))throw Error("--allow-writes needs explicit --connection ids; the `*:*` wildcard can't be bulk-granted. Grant per connection, e.g. --connection conn_x:* --allow-writes.");let n=await K({hubKey:e.hubKey});for(let r of t){let t=await n.permissions.allowWrites(r.connectionId);e.json||l(`Allowed ${t.writeActions} write action${t.writeActions===1?``:`s`} for connection ${r.connectionId} (${t.granted} newly granted).`)}e.json||l(`Revert anytime: ${t.map(e=>`tangle hub permissions revert-writes --connection ${e.connectionId}`).join(`  ·  `)}`)}async function kr(e){!e.connection||e.connection.length===0||(e.connection=await Bn(e.connection,()=>K({hubKey:e.hubKey})))}const Ar=15e3;async function jr(e){let t=process.stdin,n=process.stdout,r=null,i=!1,a=!1,o=!1,s=!1,c,u=0,d,f,p=new Promise(e=>{f=e}),m=()=>{try{t.setRawMode(!1)}catch{}t.pause()},h=()=>{i||(i=!0,clearTimeout(d),m(),t.off(`data`,w),process.off(`SIGWINCH`,_),process.off(`SIGINT`,g),process.off(`SIGTERM`,g),process.off(`exit`,m),f())},g=e=>{s=!0,Promise.resolve(r?.close()).finally(()=>{h(),process.exit(e===`SIGTERM`?143:130)})},_=()=>{r?.isOpen&&!o&&r.resize(n.columns||80,n.rows||24)},v=[],y=e=>{if(e.length!==0){try{if(!o&&r?.isOpen)return r.write(e)}catch{}v.push(e),C()}},b=()=>{clearTimeout(d);let e=r?.authorityLifetimeMs;e!==void 0&&(d=setTimeout(()=>void C(),Math.max(Ar,e*.8)))},S=async e=>{for(let t=1;;t++)try{return await e.reconnect({cols:n.columns||80,rows:n.rows||24})}catch(e){if(t>=3||e instanceof x)throw e;await new Promise(e=>setTimeout(e,500*2**t))}},C=async()=>{let e=r;if(!(o||i||a||!e)){o=!0,clearTimeout(d);try{await e.close(),r=await S(e);for(let e of v.splice(0))r.write(e)}catch(t){i||(c=t instanceof x?`the session ended`:`could not reattach: ${t.message}`),o=!1,r!==e&&await r?.close(),h();return}if(o=!1,i){await r.close();return}_(),b()}},w=e=>{if(!r)return;let t=e.indexOf(29);if(t===-1){y(e);return}y(e.subarray(0,t)),s=!0,r.close().finally(h)};if(r=await e.attach({cols:n.columns||80,rows:n.rows||24,handlers:{onData:e=>{n.write(Buffer.from(e.buffer,e.byteOffset,e.byteLength))},onExit:e=>{a=!0;let t=e.exitCode===void 0?``:` (code ${e.exitCode})`;n.write(`\r\n[interactive session exited${t}]\r\n`),r?.close().finally(h)},onError:e=>{n.write(`\r\n[terminal stream error: ${e.message}]\r\n`)},onClose:()=>{if(o||i)return;let e=Date.now();s||a?h():e-u<Ar?(c=`the connection keeps closing`,h()):(u=e,C())}}}),b(),t.setRawMode(!0),t.resume(),t.on(`data`,w),process.on(`SIGWINCH`,_),process.on(`SIGINT`,g),process.on(`SIGTERM`,g),process.on(`exit`,m),await p,console.log(),a){l(`Interactive session ended.`);return}l(`Detached — ${c??`the session keeps running`}.`)}function Mr(){let t=new N(`agent`).description(`Interact with AI agent`);return t.command(`prompt <idOrMessage> [message]`).description("Send a single prompt to the agent. With one arg it's the prompt and the box comes from `tangle use` / --box / TANGLE_SANDBOX; with two it's <id> <message>.").option(`--box <id>`,`Target sandbox (overrides the active one)`).option(`--session <id>`,`Continue existing session`).option(`--model <model>`,`Model to use`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`300000`).option(`--stream`,`Stream response in real-time`).option(`--interactive`,`Spawn the harness's interactive TUI in the sandbox, inject this prompt, and print a link to watch + drive the live session in the browser (omit for the default headless run)`).option(`--harness <name>`,`Harness that executes this run (claude-code, codex, kimi-code, opencode, pi, amp, hermes). Defaults to the sandbox's configured backend. The box ships all harnesses, so this is a per-run choice.`).option(`--profile <source>`,`Agent profile to run: a local JSON path, an https URL, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--skills <ref...>`,`Attach skills (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>] to pull from a repo`).option(`--tools <ref...>`,`Attach tools (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--system-prompt <text>`,`Override the agent's system prompt for this run`).option(`--connection <spec>`,"Grant a hub connection to the agent as MCP tools (repeatable). The connection is a connection id or a provider name. Modes: <connection>:<cap1>,<cap2> (least privilege, recommended), <connection>:* (all of one connection), or *:* (all connections). List connections with `tangle hub connections`; paths with `tangle hub tools search <keyword>`.",zn,[]).option(`--allow-writes`,"Pre-approve every WRITE action of each granted --connection so the agent can write unattended (reads are already allowed; destructive actions still prompt). Revert with `tangle hub permissions revert-writes`.").option(`--no-hub-key`,`Do not auto-mint a platform Hub key for --allow-writes; use the stored credential as-is`).action(async(t,n,r)=>{let i=n===void 0?t:n,a=n===void 0?pn(r.box):t,{context:o,client:c}=G(r),u=await Kt({profileSource:r.profile,systemPrompt:r.systemPrompt,skills:r.skills,tools:r.tools});await kr(r);let d=Tr(r.connection);r.allowWrites&&await Or(r);let p=u||d?{...u,...d?.profile}:void 0,m=r.harness;r.interactive&&m&&Er(m,a,i);let h=p||m||r.model?{...m?{type:m}:{},...p?{profile:p}:{},...r.model?{model:{model:r.model}}:{}}:void 0,g=await q(c,o,a);if(g=await J(g),r.interactive){let t=r.session??`int-${be()}`,n=m??(await g.backend.status()).type;Er(n,g.id,i);let a=Dr(g.id,t,n,p,r.model,i),c=g.session(t).interactive(),u=f(`Starting interactive ${n} session...`);u.start();let d;try{d=await c.start(a)}finally{u.stop()}let h=d.ref.preparationReceipt.harness,_=d.state===`running`?d.streamUrl:void 0,v=`${vr(o.baseUrl)}/dashboard/sandbox/${encodeURIComponent(g.id)}?interactive=${encodeURIComponent(d.ref.run.sessionId)}`;if(r.json){e({state:d.state,sessionId:d.ref.run.sessionId,harness:h,..._?{streamUrl:_}:{},webUrl:v});return}if(l(`Interactive ${h} session ${d.state}.`),console.log(),d.state===`running`&&(s({"Watch & drive":v}),console.log()),d.state===`exited`){l(`The initial prompt completed with reason: ${d.reason}.`);return}l(`Open the link to watch the agent and type to take over.`),process.stdin.isTTY===!0&&process.stdout.isTTY===!0&&(console.log(),l(`Attaching to the live session — press Ctrl-] to detach.`),await jr(c));return}if(r.stream){r.json||(l(`Streaming response...`),console.log());let t=Date.now(),n=await wr(g.streamPrompt(i,{sessionId:r.session,timeoutMs:Number.parseInt(r.timeout,10),...h?{backend:h}:{}}),t,!r.json);r.json?(e({...n.outcome.result,...n.response?{response:n.response}:{},...n.outcome.tokenUsage?{tokenUsage:n.outcome.tokenUsage}:{},durationMs:Date.now()-t}),n.outcome.result.success||(process.exitCode=1)):(n.printed>0&&console.log(),Cr(n.outcome))}else{let t=f(`Processing prompt...`);t.start();let n=r.session??`prompt-${be()}`,a=Number.parseInt(r.timeout,10),o=await g.prompt(i,{sessionId:n,timeoutMs:a,...h?{backend:h}:{}}),c=await br(g,n,o,a);if(t.stop(),r.json)e({...o,sessionId:n,...c}),o.success===!1&&(process.exitCode=1);else if(o.success===!1){for(let e of c?.partial??[])console.log(e);yr(o,`Agent prompt failed`),c&&console.error(c.note),c?.next&&console.error(`Continue it:  ${c.next}`)}else console.log(o.response),console.log(),s({Duration:`${o.durationMs}ms`,"Input Tokens":o.usage?.inputTokens,"Output Tokens":o.usage?.outputTokens})}}),t.addCommand(ur()),t.addCommand(gr()),t}async function Nr(e){let t=e.timeoutMs??1e4,n=e.baseUrl.replace(/\/$/,``),r=`${n}/v1/account/me`;try{let n=await fetch(r,{headers:{Accept:`application/json`,Authorization:`Bearer ${e.apiKey}`},signal:AbortSignal.timeout(t)});if(!n.ok){let e=await Fr(n);throw n.status===401||n.status===403?new b(e||`Invalid API key`):n.status>=500?new O(e||`Sandbox API returned an unexpected error`,{status:n.status}):Error(e||`Credential validation failed with status ${n.status}`)}let i=await n.json();if(!i.success||!i.data)throw Error(`Sandbox API returned an invalid account response`);return{customerId:i.data.customer_id,billingOwnerId:typeof i.data.billing_owner_id==`string`?i.data.billing_owner_id:void 0,apiKeyId:typeof i.data.api_key_id==`string`||i.data.api_key_id===null?i.data.api_key_id:void 0,billingDelegationAuthorized:typeof i.data.billing_delegation_authorized==`boolean`?i.data.billing_delegation_authorized:void 0,email:i.data.email,name:i.data.name,tier:i.data.tier,createdAt:i.data.created_at}}catch(e){throw e instanceof b||e instanceof O||e instanceof A?e:e instanceof Error&&e.name===`AbortError`?new A(`Timed out validating credentials against ${n}`,{timeoutMs:t}):e instanceof Error&&!(e instanceof TypeError)?e:new S(`Failed to reach ${n}`,{cause:Pr(e)})}}function Pr(e){return e instanceof Error?e:void 0}async function Fr(e){let t=await e.text();if(t)try{let e=JSON.parse(t);return e.error?.message??e.message??t}catch{return t}}function Ir(e){return e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`).replace(/'/g,`&#39;`)}function Lr(e){if(!zr(e.hostHeader))return{kind:`host-mismatch`};let t;try{t=new URL(e.requestUrl??`/`,`http://127.0.0.1`)}catch{return{kind:`not-found`}}if(t.pathname!==`/callback`)return{kind:`not-found`};if(t.searchParams.get(`state`)!==e.expectedState)return{kind:`state-mismatch`};let n=t.searchParams.get(`error`);if(n)return{kind:`error`,reason:n};let r=t.searchParams.get(`grant_token`);return r?{kind:`ok`,token:r}:{kind:`missing-token`}}async function Rr(e){e.signal?.throwIfAborted();let t=e.timeoutMs??12e4,n=e.baseUrl.replace(/\/$/,``),r=await import(`node:http`),i=ye(32).toString(`hex`),a=null,o=null,s=new Promise((e,t)=>{a=e,o=t}),c=r.createServer((e,t)=>{try{let n=Lr({hostHeader:e.headers.host,requestUrl:e.url,expectedState:i});switch(n.kind){case`host-mismatch`:t.writeHead(421,{"content-type":`text/plain; charset=utf-8`}),t.end(`Misdirected request`);return;case`not-found`:t.writeHead(404,{"content-type":`text/plain; charset=utf-8`}),t.end(`Not found`);return;case`state-mismatch`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(Ur(`State mismatch — refusing login`)),o?.(Error(`Browser login state mismatch — refusing potentially hijacked callback`));return;case`error`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(Ur(n.reason)),o?.(Error(`Browser login failed: ${n.reason}`));return;case`missing-token`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(Ur(null)),o?.(Error(`Browser login did not return a grant token`));return;case`ok`:t.writeHead(200,{"content-type":`text/html; charset=utf-8`}),t.end(Ur(null)),a?.(n.token);return}}catch(e){o?.(e instanceof Error?e:Error(`Browser login callback failed`))}});await new Promise((e,t)=>{c.once(`error`,t),c.listen(0,`127.0.0.1`,()=>e())});try{let r=c.address();if(!r||typeof r==`string`)throw Error(`Failed to bind local callback server`);let a=new URL(`http://127.0.0.1:${r.port}/callback`);a.searchParams.set(`state`,i);let o=new URL(`${n}/auth/cli/login`);o.searchParams.set(`callback_url`,a.toString()),e.provider&&o.searchParams.set(`provider`,e.provider);let l=await Hr(o.toString());e.onLoginUrl?.({loginUrl:o.toString(),browserOpened:l});let u=await Vr({baseUrl:n,grantToken:await Br(s,t,e.signal),timeoutMs:t,signal:e.signal});return{apiKey:u.apiKey,email:u.email,name:u.name,tier:u.tier}}finally{e.signal?.aborted&&c.closeAllConnections(),await new Promise((e,t)=>{c.close(n=>{if(n){t(n);return}e()})}).catch(()=>void 0)}}function zr(e){if(!e)return!1;let t=e.toLowerCase().match(/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/);if(!t)return!1;let n=t[1];return n===`127.0.0.1`||n===`localhost`||n===`[::1]`}async function Br(e,t,n){let r=new AbortController;try{return await Promise.race([e,xe(t,void 0,{signal:AbortSignal.any([r.signal,...n?[n]:[]])}).then(()=>{throw new A(`Timed out waiting for browser login to complete`,{timeoutMs:t})})])}finally{r.abort()}}async function Vr(e){let t=await fetch(`${e.baseUrl}/auth/cli/exchange`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({grant_token:e.grantToken}),signal:AbortSignal.any([AbortSignal.timeout(e.timeoutMs),...e.signal?[e.signal]:[]])}).catch(t=>{throw new S(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),n=await t.json().catch(()=>null);if(!t.ok||!n?.success||!n.data?.api_key)throw Error(n?.error?.message||`Failed to exchange browser login grant`);return{apiKey:n.data.api_key,email:n.data.email,name:n.data.name,tier:n.data.tier}}async function Hr(e){let{spawn:t}=await import(`node:child_process`),n=process.platform===`darwin`?[`open`,e]:process.platform===`win32`?[`cmd`,`/c`,`start`,``,e]:[`xdg-open`,e];return await new Promise(e=>{let r=t(n[0],n.slice(1),{detached:!0,stdio:`ignore`});r.once(`error`,()=>e(!1)),r.once(`spawn`,()=>{r.unref(),e(!0)})})}function Ur(e){return`<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
@@ -130,7 +130,7 @@ await connect(new StdioServerTransport());`;case`claude-desktop`:return`// Add t
   <body>
     <p>${e?`Sandbox CLI login failed: ${Ir(e)}`:`Sandbox CLI login complete. You can close this window.`}</p>
   </body>
-</html>`}const Wr=15*6e4,Gr=`sandbox`;function Kr(e){return Number.isFinite(e)&&e>0?e:Wr}async function qr(e){let t=e.timeoutMs??Wr,n=Date.now(),r=await Jr({baseUrl:e.baseUrl,app:e.app??Gr,timeoutMs:t,provider:e.provider});for(e.onInstructions?.({userCode:r.user_code,verificationUrl:r.verification_uri,verificationUrlComplete:r.verification_uri_complete,expiresIn:r.expires_in,intervalSeconds:r.interval});;){if(Date.now()-n>t)throw new A(`Timed out waiting for device authorization to complete`,{timeoutMs:t});let i=await Yr({baseUrl:e.baseUrl,app:e.app??Gr,deviceCode:r.device_code,timeoutMs:t});if(i.status===`approved`)return i.data;let a=i.intervalSeconds*1e3;await new Promise(e=>setTimeout(e,a))}}async function Jr(e){let t=Kr(e.timeoutMs),n=e.app!==Gr,r=await fetch(`${Xr(e.baseUrl)}${n?`/cross-site/device/start`:`/auth/cli/device/start`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,...e.provider?{provider:e.provider}:{}}:e.provider?{provider:e.provider}:{}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new S(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),i=await r.json().catch(()=>null);if(!r.ok||!i?.success||!i.data?.device_code)throw Error(i?.error?.message||`Failed to start device login`);return i.data}async function Yr(e){let t=Kr(e.timeoutMs),n=e.app!==Gr,r=await fetch(`${Xr(e.baseUrl)}${n?`/cross-site/device/poll`:`/auth/cli/device/poll`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,device_code:e.deviceCode}:{device_code:e.deviceCode}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new S(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),i=await r.json().catch(()=>null);if(r.status===428&&i?.error?.code===`AUTHORIZATION_PENDING`)return{status:`pending`,intervalSeconds:typeof i.data?.interval==`number`&&i.data.interval>0?i.data.interval:5};if(!r.ok||!i?.success||!i.data?.api_key||!i.data.email)throw Error(i?.error?.message||`Failed to complete device authorization`);return{status:`approved`,data:{apiKey:i.data.api_key,email:i.data.email,name:i.data.name,tier:i.data.tier}}}function Xr(e){return e.replace(/\/$/,``)}async function Zr(e){let t=e.apiKey,n=ai(e.app??`sandbox`),i=oi(n,e.profile),a=ii(e.provider),o=n===`solve`?On(e.baseUrl):Cn(e.baseUrl,i),c=e.browser!==!1,u=(t,a)=>{ti({profile:i,apiKey:t,baseUrl:e.baseUrl?o:void 0,activate:n===`sandbox`}),Ln(),r(`Authenticated`),s({Profile:i,Email:a.email,Tier:a.tier,"Base URL":o}),l(ni)};if(t&&!nn(t)){d(`Invalid API key format. Keys should start with 'sk_' or 'sk-tan-'.`),process.exit(1);return}if(g(),!t){let t=c&&n===`sandbox`,r=f(t?`Starting browser login...`:`Starting device login...`);r.start();let i;try{i=t?await Rr({baseUrl:o,provider:a,signal:e.signal,onLoginUrl:({loginUrl:e,browserOpened:t})=>{r.stop(),l(t?`Browser login opened.`:`Open this URL to continue browser login:`),console.log(e)}}):await qr({baseUrl:o,app:n,provider:a,onInstructions:({userCode:e,verificationUrl:t,verificationUrlComplete:i})=>{r.stop(),l(`Complete login in a browser on any device:`),s({"Verification URL":t,"Verification URL (prefilled)":i,"Device Code":e}),n===`solve`&&c&&Hr(i)}})}finally{r.stop()}u(i.apiKey,i);return}let p=f(`Validating credentials...`);p.start();let m=await Nr({apiKey:t,baseUrl:o});p.stop(),u(t,m)}function Qr(){let t=new N(`auth`).description(`Manage authentication`);return t.command(`login`).description(`Authenticate with browser login, device code, or an API key`).option(`--no-browser`,`Use device-code login instead of opening a browser`).option(`--profile <name>`,`Profile name`).option(`--provider <provider>`,`Identity provider (github, google, microsoft)`).option(`--app <app>`,`Product to authorize (sandbox or solve)`,`sandbox`).action(Zr),t.command(`logout`).description(`Remove stored credentials`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to remove (sandbox or solve)`,`sandbox`).action(e=>{let t=oi(ai(e.app),e.profile);_n(t),Ln(),r(`Logged out successfully.`),l(`Credentials removed for profile '${t}'.`)}),t.command(`status`).description(`Show current authentication status`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to check (sandbox or solve)`,`sandbox`).action(async t=>{let n=ai(t.app),i=oi(n,t.profile),a=n===`solve`?bn(t.apiKey,i):yn(t.apiKey,i),o=n===`solve`?On(t.baseUrl):Cn(t.baseUrl,i),u=n===`solve`?Sn(t.apiKey,i):xn(t.apiKey,i);if(!a){if(t.json){e({authenticated:!1,reason:`missing_credentials`,profile:i,baseUrl:o,credentialSource:null});return}d(`Not authenticated`),l(`Run 'tangle auth login --profile ${i}' to authenticate.`),process.exit(1)}let p=t.json?null:f(`Checking credentials...`);p?.start();try{let d=await Nr({apiKey:a,baseUrl:o}),f=n===`solve`?null:await $n({...t.apiKey===void 0?{}:{apiKey:t.apiKey},...t.profile===void 0?{}:{profile:t.profile},sandboxBaseUrl:o});p?.stop();let m=f!==null&&!f.reachable&&f.refused,h=!m,g=f!==null&&!f.reachable&&!f.refused;if(t.json){e({authenticated:h,profile:i,baseUrl:o,credentialSource:u,account:d,...f?{sandbox:{authenticated:!0},platform:f}:{}}),h||process.exit(1);return}m?c(`Authenticated for sandbox only`):g?c(`Authenticated — the platform is unreachable right now`):r(`Authenticated`),s({Profile:i,Credentials:`configured`,"Base URL":o,Source:ei(u),Email:d.email,Tier:d.tier,...f?{Platform:f.reachable?`reachable (${f.baseUrl})`:`UNREACHABLE — ${f.reason}`}:{}}),g&&l(`Platform commands (keys, workflows, hub) will not work until the platform answers again. The stored credential is not the cause and does not need replacing.`),h||(l("Platform commands (keys, workflows, hub) will not work until this resolves. Set TANGLE_API_KEY to a key you minted in the console, or run `tangle auth login` again."),process.exit(1))}catch(n){p?.stop(),t.json&&(e({authenticated:!1,profile:i,baseUrl:o,credentialSource:u,error:n instanceof Error?n.message:String(n)}),process.exit(1)),n instanceof b?d(`Stored credentials are invalid.`):c(`Stored credentials found, but validation could not complete.`),s({Profile:i,Credentials:`configured`,"Base URL":o,Source:ei(u),Error:n instanceof Error?n.message:String(n)}),process.exit(1)}}),t.addCommand($r()),t}function $r(){let t=new N(`profiles`).description(`Manage CLI profiles`);return t.command(`list`).description(`List configured profiles`).action(t=>{let n=mn();if(t.json){e(n);return}if(n.length===0){l(`No profiles found.`);return}i([`Profile`,`Active`,`Base URL`,`Credentials`,`Source`],n.map(e=>[e.name,e.active?`yes`:`no`,e.baseUrl,e.hasApiKey?`configured`:`none`,e.apiKeySource]))}),t.command(`use <name>`).description(`Set the active profile`).action(e=>{sn(e);let t=hn(e);r(`Active profile set to '${t.name}'.`),s({"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`})}),t.command(`current`).description(`Show the active profile`).action(t=>{let n=hn();if(t.json){e({name:n.name,active:n.active,baseUrl:n.baseUrl,credentialSource:n.credentialSource});return}s({Profile:n.name,"Base URL":n.baseUrl,Credentials:n.credentialSource===`none`?`missing`:`configured`,Source:ei(n.credentialSource)})}),t}function ei(e){switch(e){case`flag`:return`command flag`;case`env`:return`environment`;case`keychain`:return`OS keychain`;case`file`:return`credentials file`;default:return`unknown`}}function ti(e){let t=gn(e.profile,{apiKey:e.apiKey,...e.baseUrl?{baseUrl:e.baseUrl}:{}});e.activate!==!1&&sn(e.profile),an(e.baseUrl&&e.profile===`default`?{baseUrl:e.baseUrl}:{}),ni=ri(e.profile,t)}let ni=`Credentials updated.`;function ri(e,t){return t===`keychain`?e===`default`?`API key saved to the OS keychain for the default profile`:`API key saved to the OS keychain for profile '${e}'`:t===`file`?e===`default`?`API key saved to ~/.tangle/credentials.json for the default profile`:`API key saved to ~/.tangle/credentials.json for profile '${e}'`:`Profile '${e}' updated.`}function ii(e){if(e===void 0||e===`github`||e===`google`||e===`microsoft`)return e;throw Error(`--provider must be one of: github, google, microsoft`)}function ai(e){if(e===void 0||e===`sandbox`||e===`solve`)return e??`sandbox`;throw Error(`--app must be one of: sandbox, solve`)}function oi(e,t){return $t(e,t)}function si(){let n=new N(`backend`).description(`Manage sandbox AI agent backend`);return n.command(`status <sandboxId-or-name>`).description(`Get backend agent status`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching backend status...`);a.start();let o=await(await q(i,r,t)).backend.status();a.stop(),n.json?e(o):(l(`Backend Type: ${o.type}`),l(`Status: ${o.status}`),o.version&&l(`Version: ${o.version}`),o.error&&l(`Error: ${o.error}`),o.capabilities&&l(`Capabilities: ${JSON.stringify(o.capabilities)}`))}),n.command(`configure <sandboxId-or-name>`).description(`Update backend configuration`).option(`--model <model>`,`Model id (e.g. provider/model)`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=f(`Updating backend config...`);o.start();let s=await q(a,i,t),c=n.model?{model:n.model}:{};await s.backend.updateConfig(c),o.stop(),r(`Backend configuration updated`),n.json&&e(c)}),n.command(`mcp-status <sandboxId-or-name>`).description(`Get status of MCP servers`).action(async(n,r)=>{let{context:i,client:a}=G(r),o=f(`Fetching MCP status...`);o.start();let s=await(await q(a,i,n)).backend.getMcpStatus();if(o.stop(),r.json)e(s);else{let e=Object.entries(s);e.length===0?l(`No MCP servers configured`):t(e.map(([e,t])=>{let n=t;return{name:e,status:n.status,error:n.error??``}}),[{key:`name`,header:`Name`,width:24},{key:`status`,header:`Status`,width:12},{key:`error`,header:`Error`,width:40}])}}),n.command(`restart <sandboxId-or-name>`).description(`Restart the backend agent`).action(async(e,t)=>{let{context:n,client:i}=G(t),a=f(`Restarting backend...`);a.start(),await(await q(i,n,e)).backend.restart(),a.stop(),r(`Backend restarted`)}),n}function ci(e){let t=e.indexOf(`=`);if(t<=0)throw Error(`Invalid --task "${e}": expected format id=message (e.g. t1=summarize README)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!n||!r)throw Error(`Invalid --task "${e}": id and message must be non-empty`);return{id:n,message:r}}function li(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--tasks file is not valid JSON: ${e.message}`)}let n=Array.isArray(t)?t:t?.tasks;if(!Array.isArray(n))throw Error(`--tasks file must contain an array or an object with a "tasks" array`);return n.map((e,t)=>{if(!e||typeof e!=`object`)throw Error(`--tasks[${t}] must be an object`);let n=e,r=typeof n.id==`string`?n.id.trim():``,i=typeof n.message==`string`?n.message:``;if(!r)throw Error(`--tasks[${t}].id must be a non-empty string`);if(!i.trim())throw Error(`--tasks[${t}].message must be a non-empty string`);let a={id:r,message:i};if(n.context!==void 0&&(typeof n.context!=`object`||n.context===null||Array.isArray(n.context)))throw Error(`--tasks[${t}].context must be a JSON object`);if(n.context!==void 0&&(a.context=n.context),n.timeoutMs!==void 0&&(!Number.isInteger(n.timeoutMs)||n.timeoutMs<=0))throw Error(`--tasks[${t}].timeoutMs must be a positive integer`);return n.timeoutMs!==void 0&&(a.timeoutMs=n.timeoutMs),a})}function ui(e){let t=e.readFile??(e=>Re(e,`utf8`)),n=[];e.file&&n.push(...li(t(e.file)));for(let t of e.inline??[])n.push(ci(t));if(n.length===0)throw Error(`No tasks provided. Use --tasks <file> and/or --task id=message.`);let r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate task id: ${e.id}`);r.add(e.id)}return n}const di=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function fi(e){let t=e.trim(),n=t.indexOf(`/`);if(n<=0||n===t.length-1)throw Error(`--model must be in the form provider/model (got "${e}")`);return{provider:t.slice(0,n),model:t.slice(n+1)}}function pi(e){let t=e.indexOf(`=`);if(t<=0||t===e.length-1)throw Error(`Invalid --backend "${e}": expected format id=type (e.g. primary=opencode)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!di.test(n))throw Error(`Invalid backend id "${n}": use 1-128 letters, numbers, dots, underscores, or hyphens, starting with a letter or number`);if(!r||r.includes(`=`))throw Error(`Invalid --backend "${e}": type must be a non-empty backend name`);return{id:n,type:r}}function mi(e,t){if(!e||e.length===0)throw Error(`No backends provided. Use --backend id=type or --request <file>.`);let n=e.map(pi),r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate backend id: ${e.id}`);r.add(e.id)}if(t&&n.length!==1)throw Error(`--model requires exactly one backend; use a profile to configure models for multiple backends`);return t&&(n[0]={...n[0],model:fi(t)}),n}function hi(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--request file is not valid JSON: ${e.message}`)}try{return se(t)}catch(e){throw Error(`--request file is not a valid batch request: ${e.message}`)}}function gi(e,t,n){return n?`${e} [${t}]`:e}function _i(e){let t=new Map;for(let n of e)t.set(n.taskId,(t.get(n.taskId)??0)+1);return new Set([...t.entries()].filter(([,e])=>e>1).map(([e])=>e))}function vi(){let t=new N(`batch`).description(`Run multiple agent tasks in parallel across sandboxes`);return t.command(`run`).description(`Execute a batch of tasks. Provide tasks via --tasks <file.json> and/or repeated --task id=message flags.`).option(`--tasks <file>`,`Path to a JSON file with an array of tasks (or {tasks: [...]})`).option(`--request <file>`,`Path to a complete batch request JSON file`).option(`--task <id=message>`,`Inline task, id=message. Repeatable.`,(e,t=[])=>[...t,e],[]).option(`--stream`,`Stream per-task events as they arrive`).option(`-t, --timeout <ms>`,`Per-task timeout in milliseconds`,`300000`).option(`--persistent`,`Keep sandboxes alive after completion`,!1).option(`--reuse-key <key>`,`Stable workspace identity required by --persistent`).option(`--replay-only`,`Rejoin existing keyed work; refuse missing custody`).option(`--idempotency-key <key>`,`Retry identity; keyed runs continue after disconnect`).option(`--backend <id=type>`,`Backend identity and type. Required and repeatable without --request.`,(e,t=[])=>[...t,e],[]).option(`--model <provider/model>`,`Model override when exactly one backend is selected`).action(async(t,n)=>{let r=new AbortController,i=!1,a=()=>{i||(i=!0,l(`Cancel requested — stopping stream...`),r.abort())};process.on(`SIGINT`,a),process.on(`SIGTERM`,a);try{let i;if(t.request){let e=[`tasks`,`task`,`backend`,`model`,`timeout`,`persistent`,`reuseKey`].filter(e=>n.getOptionValueSource(e)===`cli`);if(e.length>0){let t={reuseKey:`reuse-key`};throw Error(`--request cannot be combined with ${e.map(e=>`--${t[e]??e}`).join(`, `)}`)}i=hi(Re(t.request,`utf8`))}else{let e=ui({file:t.tasks,inline:t.task}),n=mi(t.backend,t.model),r=Number(t.timeout);if(!Number.isInteger(r)||r<=0)throw Error(`--timeout must be a positive integer number of milliseconds`);let a=!!t.persistent;if(a&&!t.reuseKey)throw Error(`--persistent requires --reuse-key`);if(!a&&t.reuseKey)throw Error(`--reuse-key requires --persistent`);i=se({tasks:e,timeoutMs:r,backends:n,...a?{persistent:!0,reuseKey:t.reuseKey}:{persistent:!1}})}let{tasks:a,backends:o}=i,{client:c}=G(t),u={signal:r.signal,replayOnly:!!t.replayOnly,...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}},d;if(t.stream){let e=t.json?console.error:console.log;l(`Streaming batch of ${a.length} task(s)...`),e();let n=c.streamBatch(i,u),r=o.length>1;for(;;){let t=await n.next();if(t.done){d=t.value;break}let i=t.value;switch(i.type){case`batch.started`:{let e=i.data;l(`Batch started (${e.taskCount} tasks, ${e.backendCount} backends)`);break}case`task.started`:{let t=i.data;e(j.dim(`→ ${gi(t.taskId,t.backendId,r)} started`));break}case`task.retry`:{let t=i.data;e(j.yellow(`↻ ${gi(t.taskId,t.backendId,r)} retry ${t.attempt}: ${t.error}`));break}case`task.completed`:{let t=i.data;e(j.green(`✓ ${gi(t.taskId,t.backendId,r)} completed in ${t.durationMs}ms`+(t.retries?` (${t.retries} retries)`:``)));break}case`task.failed`:{let t=i.data;e(j.red(`✗ ${gi(t.taskId,t.backendId,r)} failed: ${t.error}`));break}}}e()}else l(`Running batch of ${a.length} task(s)...`),d=await c.runBatch(i,u),t.json||console.log();if(t.json)e(d);else if(s({"Total tasks":d.totalTasks,"Total backends":d.totalBackends,"Total executions":d.totalExecutions,Succeeded:d.totalSuccess,Failed:d.totalFailure,"Total retries":d.totalRetries,"Success rate":`${d.successRate.toFixed(1)}%`}),!t.stream&&d.results.length>0){let e=_i(d.results);console.log(),console.log(j.bold(`Task Results`)),console.log(j.dim(`─`.repeat(40)));for(let t of d.results){let n=t.success?j.green(`✓`):j.red(`✗`),r=t.success?t.usage.inputTokens+t.usage.outputTokens:0,i=r>0?` • ${r} tokens`:``;console.log(`${n} ${gi(t.taskId,t.backendId,e.has(t.taskId))} ${j.dim(`(${t.durationMs}ms, ${t.retries} retries${i})`)}`),t.success||console.log(j.red(`    ${t.error}`))}}d.totalFailure>0&&(process.exitCode=1)}catch(n){let r=n instanceof Error&&`batchCustody`in n?n.batchCustody:void 0;if(r?.acceptance===`accepted`&&!(r.cleanup?.mode===`release`&&r.cleanup.isComplete)&&l(`Batch accepted; retirement receipt unproved.`),i){console.log(),l(`Batch cancelled.`),t.json&&n instanceof Error&&`batchCustody`in n&&e({ok:!1,batchCustody:n.batchCustody}),process.exitCode=130;return}H(n,t.json)}finally{process.off(`SIGINT`,a),process.off(`SIGTERM`,a)}}),t}function yi(){let n=new N(`branch`).description(`Branch a running sandbox into copy-on-write children`);return n.command(`create <sandbox-id-or-name>`).description(`Branch a running sandbox into N copy-on-write children`).option(`--count <n>`,`Number of children to create`,`1`).option(`--idempotency-key <key>`,`Retry identity: the same key and count replays the first fan-out and creates no second one`).action(async(n,i)=>{let a=Number.parseInt(i.count,10);if(!Number.isInteger(a)||a<1)throw Error(`--count must be an integer >= 1 (got ${i.count})`);let{context:o,client:s}=G(i),u=f(`Branching into ${a} child(ren)...`);u.start();let d=await q(s,o,n),p=await d.fork(a,{...i.idempotencyKey?{idempotencyKey:i.idempotencyKey}:{}}),m=p.children;u.stop(),i.json?e({children:m.map(e=>({sandboxId:e.id})),requestedCount:p.requestedCount,materializedCount:p.materializedCount,complete:p.complete,...p.idempotency?{idempotency:p.idempotency}:{}}):(p.complete?r(`Branched ${m.length} child(ren) from ${d.id}`):c(`Branched ${p.materializedCount} of ${p.requestedCount} requested child(ren) from ${d.id}`),p.idempotency?.outcome===`replayed`&&l(`Replayed an earlier fan-out under this key; created none.`),t(m.map(e=>({sandboxId:e.id})),[{key:`sandboxId`,header:`Child Sandbox`,width:28}]))}),n}const bi=[`codex`,`claude-code`,`nanoclaw`,`kimi-code`,`opencode`,`pi`,`openclaw`,`hermes`],xi=`https://intelligence.tangle.tools/v1/otlp`,Si=[`codex`,`claude-code`],Ci=[`codex`,`claude-code`,`nanoclaw`],wi=[`SessionStart`,`UserPromptSubmit`,`PreToolUse`,`PostToolUse`,`Stop`],Ti={codex:{kind:`native`,surface:`codex`,label:`Codex`,buildFiles:zi},"claude-code":{kind:`native`,surface:`claude-code`,label:`Claude Code`,buildFiles:Bi},nanoclaw:{kind:`native`,surface:`nanoclaw`,label:`NanoClaw`,buildFiles:Bi},"kimi-code":{kind:`manual`,surface:`kimi-code`,label:`Kimi Code`,reason:`Kimi Code loads hooks through an explicit config file, so use standard OTLP env wiring until the native config adapter is verified.`},opencode:{kind:`manual`,surface:`opencode`,label:`OpenCode`,reason:`OpenCode hooks run as plugins; use standard OTLP env wiring until the native plugin adapter is verified.`},pi:{kind:`manual`,surface:`pi`,label:`Pi`,reason:`Pi hooks run through TypeScript extensions; use standard OTLP env wiring until the native extension adapter is verified.`},openclaw:{kind:`manual`,surface:`openclaw`,label:`OpenClaw`,reason:`OpenClaw project hooks require user opt-in; use standard OTLP env wiring until the hook toggle and adapter are verified.`},hermes:{kind:`manual`,surface:`hermes`,label:`Hermes`,reason:`Hermes project plugins require explicit enablement; use standard OTLP env wiring until the plugin adapter is verified.`}};function Ei(e){let t=e.split(`,`).map(e=>e.trim()).filter(Boolean).flatMap(e=>Ri(e));return t.length===0?[...Si]:$i(t)}function Di(e){return Object.hasOwn(Ti,e)}function Oi(e=process.cwd()){return le(he(e))||`agent-workspace`}function ki(){return M(I(),`.tangle`,`intelligence.json`)}function Ai(e=ki()){if(!Ie(e))return null;let t=Xi(e),n=ea(t,`apiKey`),r=ea(t,`endpoint`),i=ea(t,`serviceName`),a=ea(t,`environment`);if(!n||!r||!i||!a)throw Error(`${e} is missing apiKey, endpoint, serviceName, or environment`);return{apiKey:n,endpoint:r,serviceName:i,environment:a}}async function ji(e){let t=he(e.workspace),n=ki(),r=Ei(e.selection),i=[],a=[],o=[],s={apiKey:e.apiKey,endpoint:Li(e.endpoint),serviceName:e.serviceName,environment:e.environment};e.dryRun||qi(n,s),o.push(n);for(let n of r){let r=Ti[n];if(r.kind===`manual`){a.push({agent:r.surface,label:r.label,reason:r.reason});continue}i.push(r.surface);let s=t=>Mi(e.hookCommand,r.surface,t);for(let n of r.buildFiles(s)){let r=M(t,n.relPath);if(e.dryRun){o.push(r);continue}Yi(r,JSON.parse(n.content),n.mode),o.push(r)}}return!e.smoke||e.dryRun?{configPath:n,written:o,agents:r,nativeAgents:i,manual:a}:{configPath:n,written:o,agents:r,nativeAgents:i,manual:a,smokeTraceId:await Pi({agent:i[0]??r[0]??`codex`,event:`install.smoke`,endpoint:s.endpoint,apiKey:s.apiKey,serviceName:s.serviceName,environment:s.environment,sessionId:`install-smoke-${Date.now()}`,payload:{source:`tangle intelligence connect`}})}}function Mi(e,t,n){return`${e.trim()} --agent ${t} --event ${n} --non-blocking`}function Ni(e){let t=BigInt(Date.now())*1000000n,n=na(16),r=na(8),i=e.sessionId??Vi(e.payload),a={"service.name":e.serviceName,"deployment.environment":e.environment,"tangle.agent.surface":e.agent,"tangle.agent.hook.event":e.event,"tangle.agent.hook.source":`local-hook`,...Hi(e.payload)};return i&&(a[`session.id`]=i,a[`gen_ai.conversation.id`]=i,a[`tangle.sessionId`]=i),{body:{resourceSpans:[{resource:{attributes:[ra(`service.name`,e.serviceName),ra(`deployment.environment`,e.environment),ra(`tangle.agent.surface`,e.agent)]},scopeSpans:[{scope:{name:`tangle.intelligence.agent-hook`,version:`1.0.0`},spans:[{traceId:n,spanId:r,name:`agent.${e.agent}.${e.event}`,kind:1,startTimeUnixNano:t.toString(),endTimeUnixNano:(t+1000000n).toString(),attributes:Object.entries(a).map(([e,t])=>ra(e,t)),status:{code:1}}]}]}]},traceId:n}}async function Pi(e){let{body:t,traceId:n}=Ni(e),r=await fetch(`${Li(e.endpoint)}/v1/traces`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(t)});if(!r.ok){let e=await r.text().catch(()=>``);throw Error(`OTLP smoke ingest failed: ${r.status}${e?` ${e}`:``}`)}return n}function Fi(e){return Li(e).replace(/\/v1\/otlp$/,``).replace(/\/+$/,``)}async function Ii(e){let t=`${Fi(e.endpoint)}/v1/onboarding/status`,n=await fetch(t,{headers:{Authorization:`Bearer ${e.apiKey}`},signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`onboarding status request failed: ${n.status}${e?` ${e}`:``}`)}let r=await n.json();return{tracesSeen:!!r.tracesSeen,contentSeen:!!r.contentSeen,lastSeenAt:typeof r.lastSeenAt==`string`?r.lastSeenAt:null,windowDays:typeof r.windowDays==`number`?r.windowDays:7,byAgent:r.byAgent&&typeof r.byAgent==`object`?r.byAgent:{}}}function Li(e){let t=e.trim().replace(/\/+$/,``);return t.endsWith(`/v1/traces`)?t.slice(0,-10):t.endsWith(`/v1/logs`)?t.slice(0,-8):t}function Ri(e){switch(e){case`local`:case`both`:return[...Si];case`all`:return[...Ci];case`claude`:return[`claude-code`];case`kimi`:return[`kimi-code`];default:if(Di(e))return[e];throw Error(`agent must be one of: local, all, both, ${bi.join(`, `)}`)}}function zi(e){let t=Object.fromEntries(wi.map(t=>[t,[{command:e(t),timeoutMs:3e3,blocking:!1,matcher:`*`}]]));return[{relPath:`.codex/hooks.json`,content:JSON.stringify({hooks:t},null,2)}]}function Bi(e){let t=Object.fromEntries(wi.map(t=>[t,[{matcher:`*`,hooks:[{type:`command`,command:e(t),timeout:3}]}]]));return[{relPath:`.claude/settings.json`,content:JSON.stringify({hooks:t},null,2)}]}function Vi(e){return Wi(e,[`session.id`,`sessionId`,`session_id`,`conversationId`,`conversation_id`,`threadId`,`thread_id`,`transcriptId`,`transcript_id`])||process.env.TANGLE_SESSION_ID||process.env.CODEX_THREAD_ID||process.env.CLAUDE_SESSION_ID||process.env.OPENCODE_SESSION_ID}function Hi(e){let t={},n=Ui(e,[`tool.name`,`toolName`,`tool_name`,`tool`]),r=Ui(e,[`command`,`cmd`,`shell_command`,`shellCommand`]),i=Ui(e,[`tool.input`,`toolInput`,`tool_input`,`input`,`arguments`,`args`]),a=Ui(e,[`tool.output`,`toolOutput`,`tool_output`,`output`,`result`]),o=Ui(e,[`tool.exit_code`,`exitCode`,`exit_code`,`status`]),s=Ui(e,[`tool.error.message`,`errorMessage`,`error_message`,`error`]);return n&&(t[`tool.name`]=n),r&&(t[`process.command`]=r),i&&(t[`tool.input.summary`]=i),a&&(t[`tool.output.summary`]=a),o&&(t[`tool.exit_code`]=o),s&&(t[`tool.error.message`]=s),t}function Ui(e,t){let n=Gi(e,t);if(n===void 0)return null;if(typeof n==`string`)return Ki(n);if(typeof n==`number`||typeof n==`boolean`||typeof n==`bigint`)return String(n);try{return Ki(JSON.stringify(n))}catch{return null}}function Wi(e,t){let n=Gi(e,t);return typeof n==`string`&&n.length>0?n:void 0}function Gi(e,t){if(typeof e!=`object`||!e)return;let n=[e],r=new Set;for(;n.length;){let e=n.pop();if(typeof e!=`object`||!e||r.has(e))continue;r.add(e);let i=e;for(let e of t){let t=i[e];if(t!=null&&t!==``)return t}for(let e of Object.values(i))typeof e==`object`&&e&&n.push(e)}}function Ki(e){return e.length>4096?`${e.slice(0,4093)}...`:e}function qi(e,t){Ji(e,`${JSON.stringify(t,null,2)}\n`)}function Ji(e,t){Le(ue(e),{mode:448,recursive:!0});let n=`${e}.${process.pid}.tmp`;Ve(n,t,{mode:384}),Be(n,e)}function Yi(e,t,n){Le(ue(e),{recursive:!0});let r=Zi(Xi(e),t);Ve(e,`${JSON.stringify(r,null,2)}\n`,{mode:n??420})}function Xi(e){if(!Ie(e))return{};let t=JSON.parse(Re(e,`utf8`));if(!ta(t))throw Error(`${e} must contain a JSON object`);return t}function Zi(e,t){let n={...e};for(let[e,r]of Object.entries(t)){let t=n[e];ta(t)&&ta(r)?n[e]=Zi(t,r):Array.isArray(t)&&Array.isArray(r)?n[e]=Qi([...t,...r]):n[e]=r}return n}function Qi(e){let t=new Set,n=[];for(let r of e){let e=JSON.stringify(r);t.has(e)||(t.add(e),n.push(r))}return n}function $i(e){return[...new Set(e)]}function ea(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function ta(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null)}function na(e){return ye(e).toString(`hex`)}function ra(e,t){return{key:e,value:{stringValue:t}}}const ia=`tangle.opencode-exporter`,aa=16384;function oa(e){return e.length<=aa?e:`${e.slice(0,aa-1)}…`}function sa(e,t){return{key:e,value:{stringValue:t}}}function ca(e){if(!e||typeof e!=`object`)return null;let t=e,n=lt(t.type);return n?{type:n,properties:t.properties&&typeof t.properties==`object`?t.properties:void 0}:null}function la(e,t){let n=[sa(`event.name`,e),sa(`gen_ai.system`,`opencode`),sa(`service.name`,`opencode`)];return t&&(n.push(sa(`session.id`,t)),n.push(sa(`gen_ai.conversation.id`,t))),n}function ua(e){if(!e)return null;let t=e.part,n=e.info;return lt(t?.sessionID)??lt(n?.sessionID)??lt(e.sessionID)??null}function da(e,t){let n=lt(e.role)??lt(e.info?.role);if(n)return n.toLowerCase();let r=lt(e.messageID),i=t?.(r)??null;return i?i.toLowerCase():null}function fa(e,t,n){let r=[],i=ua(e.properties),a=(n,r)=>({timeUnixNano:t,severityNumber:9,severityText:`INFO`,...n===null?{}:{body:{stringValue:oa(n)}},attributes:[...la(e.type,i),...r]});if(e.type===`message.part.updated`){let t=e.properties?.part;if(!t)return r;let i=lt(t.type);if(i===`text`||i===`reasoning`){let e=lt(t.text);if(e){let i=da(t,n)===`user`?it:rt;r.push(a(e,[sa(i,oa(e))]))}return r}if(i===`tool`){let e=lt(t.tool),n=t.state,i=ut(n?.input),o=ut(n?.output),s=lt(n?.error)??(typeof n?.error==`object`&&n?.error!==null?ut(n.error):null);if(e||i){let t=[];e&&t.push(sa(ot,e)),i&&t.push(sa(at,oa(i))),r.push(a(null,t))}let c=o??s;if(c){let t=[sa(st,oa(c))];e&&t.push(sa(ot,e)),r.push(a(c,t))}return r}return r}if(e.type===`session.next.text.delta`||e.type===`session.next.text.ended`){let t=e.properties??{},n=lt(t.text)??(e.type===`session.next.text.delta`?lt(t.delta):null);return n&&r.push(a(n,[sa(rt,oa(n))])),r}return r}function pa(e=process.env.OTEL_RESOURCE_ATTRIBUTES){if(!e)return null;for(let t of e.split(`,`)){let e=t.indexOf(`=`);if(e===-1||t.slice(0,e).trim()!==ct)continue;let n=t.slice(e+1).trim();if(n.length>0)return n}return null}function ma(e,t){if(e.length===0)return null;let n=[sa(`service.name`,`opencode`),sa(`gen_ai.system`,`opencode`),sa(`telemetry.sdk.name`,ia)];return t&&t.trim().length>0&&n.push(sa(ct,t.trim())),{resourceLogs:[{resource:{attributes:n},scopeLogs:[{scope:{name:ia,version:`1.0.0`},logRecords:e}]}]}}function ha(e){return(e??process.env.OPENCODE_BASE_URL??`http://127.0.0.1:4096`).replace(/\/+$/,``)}async function ga(e){let t=Li(e.endpoint),n=await(e.fetchImpl??fetch)(`${t}/v1/logs`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(e.request),signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`OpenCode OTLP logs ingest failed: ${n.status}${e?` ${e}`:``}`)}}var _a=class extends Error{partial;constructor(e,t){let n=e instanceof Error?e.message:String(e);super(n),this.name=`OpencodeExporterError`,this.partial=t,e instanceof Error&&(this.cause=e)}};function va(){return(BigInt(Date.now())*1000000n).toString()}async function ya(e){let t=ha(e.opencodeBaseUrl),n=e.nowUnixNano??va,r=e.fetchImpl??fetch,i=e.subjectKey===void 0?pa():e.subjectKey,a=await r(`${t}/event`,{headers:{Accept:`text/event-stream`},signal:e.signal});if(!a.ok){let e=await a.text().catch(()=>``);throw Error(`OpenCode event subscribe failed: ${a.status} at ${t}/event${e?` ${e}`:``}. Is OpenCode running with 'opencode serve'?`)}if(!a.body)throw Error(`OpenCode event stream at ${t}/event returned no body — cannot subscribe`);let o={eventsSeen:0,contentEventsExported:0,recordsExported:0},s=new Map,c=e=>e?s.get(e)??null:null;try{for await(let t of oe(a.body,{signal:e.signal})){o.eventsSeen++;let a=ca(t.data);if(!a)continue;if(a.type===`message.updated`){let e=a.properties?.info,t=lt(e?.id),n=lt(e?.role);t&&n&&s.set(t,n);continue}let l=fa(a,n(),c),u=ma(l,i);u&&(await ga({endpoint:e.endpoint,apiKey:e.apiKey,request:u,timeoutMs:e.postTimeoutMs,fetchImpl:r}),o.contentEventsExported++,o.recordsExported+=l.length,e.onExport?.({eventType:a.type,records:l.length}))}}catch(e){if(e instanceof Error&&(e.name===`AbortError`||e.message.toLowerCase().includes(`abort`)))return o;throw new _a(e,o)}return o}function ba(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}const xa=[`claude-code`,`codex`,`opencode`,`openclaw`,`hermes`,`nanoclaw`],Sa={"claude-code":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,openclaw:`OpenClaw`,hermes:`Hermes`,nanoclaw:`NanoClaw`};function Ca(e){return xa.includes(e)}function wa(e){return Ie(e)?Re(e,`utf8`):``}function Ta(e,t){Le(ue(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;Ve(n,t,{mode:384}),Pe(n,384),Be(n,e)}const Ea=`# >>> tangle intelligence (claude-code) >>>`,Da=`# <<< tangle intelligence (claude-code) <<<`,Oa={full:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`},{key:`OTEL_LOG_TOOL_CONTENT`,comment:`full tool input+output bodies`},{key:`OTEL_LOG_RAW_API_BODIES`,comment:`full prompt+completion JSON (richest)`}],prompts:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`}],metadata:[]};function ka(e,t){return t===`env`?e:/\s/.test(e)?`"${e}"`:e}function Aa(e,t){let n=t===`shell`?`export `:t===`dockerfile`?`ENV `:``,r=[];for(let i of e){if(i.kind===`blank`){t===`shell`&&r.push(``);continue}if(i.kind===`comment`){t===`shell`&&r.push(`# ${i.text}`);continue}let e=t===`shell`&&i.comment?`   # ${i.comment}`:``;r.push(`${n}${i.key}=${ka(i.value,t)}${e}`)}return r.join(`
+</html>`}const Wr=15*6e4,Gr=`sandbox`;function Kr(e){return Number.isFinite(e)&&e>0?e:Wr}async function qr(e){let t=e.timeoutMs??Wr,n=Date.now(),r=await Jr({baseUrl:e.baseUrl,app:e.app??Gr,timeoutMs:t,provider:e.provider});for(e.onInstructions?.({userCode:r.user_code,verificationUrl:r.verification_uri,verificationUrlComplete:r.verification_uri_complete,expiresIn:r.expires_in,intervalSeconds:r.interval});;){if(Date.now()-n>t)throw new A(`Timed out waiting for device authorization to complete`,{timeoutMs:t});let i=await Yr({baseUrl:e.baseUrl,app:e.app??Gr,deviceCode:r.device_code,timeoutMs:t});if(i.status===`approved`)return i.data;let a=i.intervalSeconds*1e3;await new Promise(e=>setTimeout(e,a))}}async function Jr(e){let t=Kr(e.timeoutMs),n=e.app!==Gr,r=await fetch(`${Xr(e.baseUrl)}${n?`/cross-site/device/start`:`/auth/cli/device/start`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,...e.provider?{provider:e.provider}:{}}:e.provider?{provider:e.provider}:{}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new S(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),i=await r.json().catch(()=>null);if(!r.ok||!i?.success||!i.data?.device_code)throw Error(i?.error?.message||`Failed to start device login`);return i.data}async function Yr(e){let t=Kr(e.timeoutMs),n=e.app!==Gr,r=await fetch(`${Xr(e.baseUrl)}${n?`/cross-site/device/poll`:`/auth/cli/device/poll`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,device_code:e.deviceCode}:{device_code:e.deviceCode}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new S(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),i=await r.json().catch(()=>null);if(r.status===428&&i?.error?.code===`AUTHORIZATION_PENDING`)return{status:`pending`,intervalSeconds:typeof i.data?.interval==`number`&&i.data.interval>0?i.data.interval:5};if(!r.ok||!i?.success||!i.data?.api_key||!i.data.email)throw Error(i?.error?.message||`Failed to complete device authorization`);return{status:`approved`,data:{apiKey:i.data.api_key,email:i.data.email,name:i.data.name,tier:i.data.tier}}}function Xr(e){return e.replace(/\/$/,``)}async function Zr(e){let t=e.apiKey,n=ai(e.app??`sandbox`),i=oi(n,e.profile),a=ii(e.provider),o=n===`solve`?On(e.baseUrl):Cn(e.baseUrl,i),c=e.browser!==!1,u=(t,a)=>{ti({profile:i,apiKey:t,baseUrl:e.baseUrl?o:void 0,activate:n===`sandbox`}),Ln(),r(`Authenticated`),s({Profile:i,Email:a.email,Tier:a.tier,"Base URL":o}),l(ni)};if(t&&!nn(t)){d(`Invalid API key format. Keys should start with 'sk_' or 'sk-tan-'.`),process.exit(1);return}if(g(),!t){let t=c&&n===`sandbox`,r=f(t?`Starting browser login...`:`Starting device login...`);r.start();let i;try{i=t?await Rr({baseUrl:o,provider:a,signal:e.signal,onLoginUrl:({loginUrl:e,browserOpened:t})=>{r.stop(),l(t?`Browser login opened.`:`Open this URL to continue browser login:`),console.log(e)}}):await qr({baseUrl:o,app:n,provider:a,onInstructions:({userCode:e,verificationUrl:t,verificationUrlComplete:i})=>{r.stop(),l(`Complete login in a browser on any device:`),s({"Verification URL":t,"Verification URL (prefilled)":i,"Device Code":e}),n===`solve`&&c&&Hr(i)}})}finally{r.stop()}u(i.apiKey,i);return}let p=f(`Validating credentials...`);p.start();let m=await Nr({apiKey:t,baseUrl:o});p.stop(),u(t,m)}function Qr(){let t=new N(`auth`).description(`Manage authentication`);return t.command(`login`).description(`Authenticate with browser login, device code, or an API key`).option(`--no-browser`,`Use device-code login instead of opening a browser`).option(`--profile <name>`,`Profile name`).option(`--provider <provider>`,`Identity provider (github, google, microsoft)`).option(`--app <app>`,`Product to authorize (sandbox or solve)`,`sandbox`).action(Zr),t.command(`logout`).description(`Remove stored credentials`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to remove (sandbox or solve)`,`sandbox`).action(e=>{let t=oi(ai(e.app),e.profile);_n(t),Ln(),r(`Logged out successfully.`),l(`Credentials removed for profile '${t}'.`)}),t.command(`status`).description(`Show current authentication status`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to check (sandbox or solve)`,`sandbox`).action(async t=>{let n=ai(t.app),i=oi(n,t.profile),a=n===`solve`?bn(t.apiKey,i):yn(t.apiKey,i),o=n===`solve`?On(t.baseUrl):Cn(t.baseUrl,i),u=n===`solve`?Sn(t.apiKey,i):xn(t.apiKey,i);if(!a){if(t.json){e({authenticated:!1,reason:`missing_credentials`,profile:i,baseUrl:o,credentialSource:null});return}d(`Not authenticated`),l(`Run 'tangle auth login --profile ${i}' to authenticate.`),process.exit(1)}let p=t.json?null:f(`Checking credentials...`);p?.start();try{let d=await Nr({apiKey:a,baseUrl:o}),f=n===`solve`?null:await $n({...t.apiKey===void 0?{}:{apiKey:t.apiKey},...t.profile===void 0?{}:{profile:t.profile},sandboxBaseUrl:o});p?.stop();let m=f!==null&&!f.reachable&&f.refused,h=!m,g=f!==null&&!f.reachable&&!f.refused;if(t.json){e({authenticated:h,profile:i,baseUrl:o,credentialSource:u,account:d,...f?{sandbox:{authenticated:!0},platform:f}:{}}),h||process.exit(1);return}m?c(`Authenticated for sandbox only`):g?c(`Authenticated — the platform is unreachable right now`):r(`Authenticated`),s({Profile:i,Credentials:`configured`,"Base URL":o,Source:ei(u),Email:d.email,Tier:d.tier,...f?{Platform:f.reachable?`reachable (${f.baseUrl})`:`UNREACHABLE — ${f.reason}`}:{}}),g&&l(`Platform commands (keys, workflows, hub) will not work until the platform answers again. The stored credential is not the cause and does not need replacing.`),h||(l("Platform commands (keys, workflows, hub) will not work until this resolves. Set TANGLE_API_KEY to a key you minted in the console, or run `tangle auth login` again."),process.exit(1))}catch(n){p?.stop(),t.json&&(e({authenticated:!1,profile:i,baseUrl:o,credentialSource:u,error:n instanceof Error?n.message:String(n)}),process.exit(1)),n instanceof b?d(`Stored credentials are invalid.`):c(`Stored credentials found, but validation could not complete.`),s({Profile:i,Credentials:`configured`,"Base URL":o,Source:ei(u),Error:n instanceof Error?n.message:String(n)}),process.exit(1)}}),t.addCommand($r()),t}function $r(){let t=new N(`profiles`).description(`Manage CLI profiles`);return t.command(`list`).description(`List configured profiles`).action(t=>{let n=mn();if(t.json){e(n);return}if(n.length===0){l(`No profiles found.`);return}i([`Profile`,`Active`,`Base URL`,`Credentials`,`Source`],n.map(e=>[e.name,e.active?`yes`:`no`,e.baseUrl,e.hasApiKey?`configured`:`none`,e.apiKeySource]))}),t.command(`use <name>`).description(`Set the active profile`).action(e=>{sn(e);let t=hn(e);r(`Active profile set to '${t.name}'.`),s({"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`})}),t.command(`current`).description(`Show the active profile`).action(t=>{let n=hn();if(t.json){e({name:n.name,active:n.active,baseUrl:n.baseUrl,credentialSource:n.credentialSource});return}s({Profile:n.name,"Base URL":n.baseUrl,Credentials:n.credentialSource===`none`?`missing`:`configured`,Source:ei(n.credentialSource)})}),t}function ei(e){switch(e){case`flag`:return`command flag`;case`env`:return`environment`;case`keychain`:return`OS keychain`;case`file`:return`credentials file`;default:return`unknown`}}function ti(e){let t=gn(e.profile,{apiKey:e.apiKey,...e.baseUrl?{baseUrl:e.baseUrl}:{}});e.activate!==!1&&sn(e.profile),an(e.baseUrl&&e.profile===`default`?{baseUrl:e.baseUrl}:{}),ni=ri(e.profile,t)}let ni=`Credentials updated.`;function ri(e,t){return t===`keychain`?e===`default`?`API key saved to the OS keychain for the default profile`:`API key saved to the OS keychain for profile '${e}'`:t===`file`?e===`default`?`API key saved to ~/.tangle/credentials.json for the default profile`:`API key saved to ~/.tangle/credentials.json for profile '${e}'`:`Profile '${e}' updated.`}function ii(e){if(e===void 0||e===`github`||e===`google`||e===`microsoft`)return e;throw Error(`--provider must be one of: github, google, microsoft`)}function ai(e){if(e===void 0||e===`sandbox`||e===`solve`)return e??`sandbox`;throw Error(`--app must be one of: sandbox, solve`)}function oi(e,t){return $t(e,t)}function si(){let n=new N(`backend`).description(`Manage sandbox AI agent backend`);return n.command(`status <sandboxId-or-name>`).description(`Get backend agent status`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching backend status...`);a.start();let o=await(await q(i,r,t)).backend.status();a.stop(),n.json?e(o):(l(`Backend Type: ${o.type}`),l(`Status: ${o.status}`),o.version&&l(`Version: ${o.version}`),o.error&&l(`Error: ${o.error}`),o.capabilities&&l(`Capabilities: ${JSON.stringify(o.capabilities)}`))}),n.command(`configure <sandboxId-or-name>`).description(`Update backend configuration`).option(`--model <model>`,`Model id (e.g. provider/model)`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=f(`Updating backend config...`);o.start();let s=await q(a,i,t),c=n.model?{model:n.model}:{};await s.backend.updateConfig(c),o.stop(),r(`Backend configuration updated`),n.json&&e(c)}),n.command(`mcp-status <sandboxId-or-name>`).description(`Get status of MCP servers`).action(async(n,r)=>{let{context:i,client:a}=G(r),o=f(`Fetching MCP status...`);o.start();let s=await(await q(a,i,n)).backend.getMcpStatus();if(o.stop(),r.json)e(s);else{let e=Object.entries(s);e.length===0?l(`No MCP servers configured`):t(e.map(([e,t])=>{let n=t;return{name:e,status:n.status,error:n.error??``}}),[{key:`name`,header:`Name`,width:24},{key:`status`,header:`Status`,width:12},{key:`error`,header:`Error`,width:40}])}}),n.command(`restart <sandboxId-or-name>`).description(`Restart the backend agent`).action(async(e,t)=>{let{context:n,client:i}=G(t),a=f(`Restarting backend...`);a.start(),await(await q(i,n,e)).backend.restart(),a.stop(),r(`Backend restarted`)}),n}function ci(e){let t=e.indexOf(`=`);if(t<=0)throw Error(`Invalid --task "${e}": expected format id=message (e.g. t1=summarize README)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!n||!r)throw Error(`Invalid --task "${e}": id and message must be non-empty`);return{id:n,message:r}}function li(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--tasks file is not valid JSON: ${e.message}`)}let n=Array.isArray(t)?t:t?.tasks;if(!Array.isArray(n))throw Error(`--tasks file must contain an array or an object with a "tasks" array`);return n.map((e,t)=>{if(!e||typeof e!=`object`)throw Error(`--tasks[${t}] must be an object`);let n=e,r=typeof n.id==`string`?n.id.trim():``,i=typeof n.message==`string`?n.message:``;if(!r)throw Error(`--tasks[${t}].id must be a non-empty string`);if(!i.trim())throw Error(`--tasks[${t}].message must be a non-empty string`);let a={id:r,message:i};if(n.context!==void 0&&(typeof n.context!=`object`||n.context===null||Array.isArray(n.context)))throw Error(`--tasks[${t}].context must be a JSON object`);if(n.context!==void 0&&(a.context=n.context),n.timeoutMs!==void 0&&(!Number.isInteger(n.timeoutMs)||n.timeoutMs<=0))throw Error(`--tasks[${t}].timeoutMs must be a positive integer`);return n.timeoutMs!==void 0&&(a.timeoutMs=n.timeoutMs),a})}function ui(e){let t=e.readFile??(e=>ze(e,`utf8`)),n=[];e.file&&n.push(...li(t(e.file)));for(let t of e.inline??[])n.push(ci(t));if(n.length===0)throw Error(`No tasks provided. Use --tasks <file> and/or --task id=message.`);let r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate task id: ${e.id}`);r.add(e.id)}return n}const di=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function fi(e){let t=e.trim(),n=t.indexOf(`/`);if(n<=0||n===t.length-1)throw Error(`--model must be in the form provider/model (got "${e}")`);return{provider:t.slice(0,n),model:t.slice(n+1)}}function pi(e){let t=e.indexOf(`=`);if(t<=0||t===e.length-1)throw Error(`Invalid --backend "${e}": expected format id=type (e.g. primary=opencode)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!di.test(n))throw Error(`Invalid backend id "${n}": use 1-128 letters, numbers, dots, underscores, or hyphens, starting with a letter or number`);if(!r||r.includes(`=`))throw Error(`Invalid --backend "${e}": type must be a non-empty backend name`);return{id:n,type:r}}function mi(e,t){if(!e||e.length===0)throw Error(`No backends provided. Use --backend id=type or --request <file>.`);let n=e.map(pi),r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate backend id: ${e.id}`);r.add(e.id)}if(t&&n.length!==1)throw Error(`--model requires exactly one backend; use a profile to configure models for multiple backends`);return t&&(n[0]={...n[0],model:fi(t)}),n}function hi(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--request file is not valid JSON: ${e.message}`)}try{return se(t)}catch(e){throw Error(`--request file is not a valid batch request: ${e.message}`)}}function gi(e,t,n){return n?`${e} [${t}]`:e}function _i(e){let t=new Map;for(let n of e)t.set(n.taskId,(t.get(n.taskId)??0)+1);return new Set([...t.entries()].filter(([,e])=>e>1).map(([e])=>e))}function vi(){let t=new N(`batch`).description(`Run multiple agent tasks in parallel across sandboxes`);return t.command(`run`).description(`Execute a batch of tasks. Provide tasks via --tasks <file.json> and/or repeated --task id=message flags.`).option(`--tasks <file>`,`Path to a JSON file with an array of tasks (or {tasks: [...]})`).option(`--request <file>`,`Path to a complete batch request JSON file`).option(`--task <id=message>`,`Inline task, id=message. Repeatable.`,(e,t=[])=>[...t,e],[]).option(`--stream`,`Stream per-task events as they arrive`).option(`-t, --timeout <ms>`,`Per-task timeout in milliseconds`,`300000`).option(`--persistent`,`Keep sandboxes alive after completion`,!1).option(`--reuse-key <key>`,`Stable workspace identity required by --persistent`).option(`--replay-only`,`Rejoin existing keyed work; refuse missing custody`).option(`--idempotency-key <key>`,`Retry identity; keyed runs continue after disconnect`).option(`--backend <id=type>`,`Backend identity and type. Required and repeatable without --request.`,(e,t=[])=>[...t,e],[]).option(`--model <provider/model>`,`Model override when exactly one backend is selected`).action(async(t,n)=>{let r=new AbortController,i=!1,a=()=>{i||(i=!0,l(`Cancel requested — stopping stream...`),r.abort())};process.on(`SIGINT`,a),process.on(`SIGTERM`,a);try{let i;if(t.request){let e=[`tasks`,`task`,`backend`,`model`,`timeout`,`persistent`,`reuseKey`].filter(e=>n.getOptionValueSource(e)===`cli`);if(e.length>0){let t={reuseKey:`reuse-key`};throw Error(`--request cannot be combined with ${e.map(e=>`--${t[e]??e}`).join(`, `)}`)}i=hi(ze(t.request,`utf8`))}else{let e=ui({file:t.tasks,inline:t.task}),n=mi(t.backend,t.model),r=Number(t.timeout);if(!Number.isInteger(r)||r<=0)throw Error(`--timeout must be a positive integer number of milliseconds`);let a=!!t.persistent;if(a&&!t.reuseKey)throw Error(`--persistent requires --reuse-key`);if(!a&&t.reuseKey)throw Error(`--reuse-key requires --persistent`);i=se({tasks:e,timeoutMs:r,backends:n,...a?{persistent:!0,reuseKey:t.reuseKey}:{persistent:!1}})}let{tasks:a,backends:o}=i,{client:c}=G(t),u={signal:r.signal,replayOnly:!!t.replayOnly,...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}},d;if(t.stream){let e=t.json?console.error:console.log;l(`Streaming batch of ${a.length} task(s)...`),e();let n=c.streamBatch(i,u),r=o.length>1;for(;;){let t=await n.next();if(t.done){d=t.value;break}let i=t.value;switch(i.type){case`batch.started`:{let e=i.data;l(`Batch started (${e.taskCount} tasks, ${e.backendCount} backends)`);break}case`task.started`:{let t=i.data;e(j.dim(`→ ${gi(t.taskId,t.backendId,r)} started`));break}case`task.retry`:{let t=i.data;e(j.yellow(`↻ ${gi(t.taskId,t.backendId,r)} retry ${t.attempt}: ${t.error}`));break}case`task.completed`:{let t=i.data;e(j.green(`✓ ${gi(t.taskId,t.backendId,r)} completed in ${t.durationMs}ms`+(t.retries?` (${t.retries} retries)`:``)));break}case`task.failed`:{let t=i.data;e(j.red(`✗ ${gi(t.taskId,t.backendId,r)} failed: ${t.error}`));break}}}e()}else l(`Running batch of ${a.length} task(s)...`),d=await c.runBatch(i,u),t.json||console.log();if(t.json)e(d);else if(s({"Total tasks":d.totalTasks,"Total backends":d.totalBackends,"Total executions":d.totalExecutions,Succeeded:d.totalSuccess,Failed:d.totalFailure,"Total retries":d.totalRetries,"Success rate":`${d.successRate.toFixed(1)}%`}),!t.stream&&d.results.length>0){let e=_i(d.results);console.log(),console.log(j.bold(`Task Results`)),console.log(j.dim(`─`.repeat(40)));for(let t of d.results){let n=t.success?j.green(`✓`):j.red(`✗`),r=t.success?t.usage.inputTokens+t.usage.outputTokens:0,i=r>0?` • ${r} tokens`:``;console.log(`${n} ${gi(t.taskId,t.backendId,e.has(t.taskId))} ${j.dim(`(${t.durationMs}ms, ${t.retries} retries${i})`)}`),t.success||console.log(j.red(`    ${t.error}`))}}d.totalFailure>0&&(process.exitCode=1)}catch(n){let r=n instanceof Error&&`batchCustody`in n?n.batchCustody:void 0;if(r?.acceptance===`accepted`&&!(r.cleanup?.mode===`release`&&r.cleanup.isComplete)&&l(`Batch accepted; retirement receipt unproved.`),i){console.log(),l(`Batch cancelled.`),t.json&&n instanceof Error&&`batchCustody`in n&&e({ok:!1,batchCustody:n.batchCustody}),process.exitCode=130;return}H(n,t.json)}finally{process.off(`SIGINT`,a),process.off(`SIGTERM`,a)}}),t}function yi(){let n=new N(`branch`).description(`Branch a running sandbox into copy-on-write children`);return n.command(`create <sandbox-id-or-name>`).description(`Branch a running sandbox into N copy-on-write children`).option(`--count <n>`,`Number of children to create`,`1`).option(`--idempotency-key <key>`,`Retry identity: the same key and count replays the first fan-out and creates no second one`).action(async(n,i)=>{let a=Number.parseInt(i.count,10);if(!Number.isInteger(a)||a<1)throw Error(`--count must be an integer >= 1 (got ${i.count})`);let{context:o,client:s}=G(i),u=f(`Branching into ${a} child(ren)...`);u.start();let d=await q(s,o,n),p=await d.fork(a,{...i.idempotencyKey?{idempotencyKey:i.idempotencyKey}:{}}),m=p.children;u.stop(),i.json?e({children:m.map(e=>({sandboxId:e.id})),requestedCount:p.requestedCount,materializedCount:p.materializedCount,complete:p.complete,...p.idempotency?{idempotency:p.idempotency}:{}}):(p.complete?r(`Branched ${m.length} child(ren) from ${d.id}`):c(`Branched ${p.materializedCount} of ${p.requestedCount} requested child(ren) from ${d.id}`),p.idempotency?.outcome===`replayed`&&l(`Replayed an earlier fan-out under this key; created none.`),t(m.map(e=>({sandboxId:e.id})),[{key:`sandboxId`,header:`Child Sandbox`,width:28}]))}),n}const bi=[`codex`,`claude-code`,`nanoclaw`,`kimi-code`,`opencode`,`pi`,`openclaw`,`hermes`],xi=`https://intelligence.tangle.tools/v1/otlp`,Si=[`codex`,`claude-code`],Ci=[`codex`,`claude-code`,`nanoclaw`],wi=[`SessionStart`,`UserPromptSubmit`,`PreToolUse`,`PostToolUse`,`Stop`],Ti={codex:{kind:`native`,surface:`codex`,label:`Codex`,buildFiles:zi},"claude-code":{kind:`native`,surface:`claude-code`,label:`Claude Code`,buildFiles:Bi},nanoclaw:{kind:`native`,surface:`nanoclaw`,label:`NanoClaw`,buildFiles:Bi},"kimi-code":{kind:`manual`,surface:`kimi-code`,label:`Kimi Code`,reason:`Kimi Code loads hooks through an explicit config file, so use standard OTLP env wiring until the native config adapter is verified.`},opencode:{kind:`manual`,surface:`opencode`,label:`OpenCode`,reason:`OpenCode hooks run as plugins; use standard OTLP env wiring until the native plugin adapter is verified.`},pi:{kind:`manual`,surface:`pi`,label:`Pi`,reason:`Pi hooks run through TypeScript extensions; use standard OTLP env wiring until the native extension adapter is verified.`},openclaw:{kind:`manual`,surface:`openclaw`,label:`OpenClaw`,reason:`OpenClaw project hooks require user opt-in; use standard OTLP env wiring until the hook toggle and adapter are verified.`},hermes:{kind:`manual`,surface:`hermes`,label:`Hermes`,reason:`Hermes project plugins require explicit enablement; use standard OTLP env wiring until the plugin adapter is verified.`}};function Ei(e){let t=e.split(`,`).map(e=>e.trim()).filter(Boolean).flatMap(e=>Ri(e));return t.length===0?[...Si]:$i(t)}function Di(e){return Object.hasOwn(Ti,e)}function Oi(e=process.cwd()){return le(he(e))||`agent-workspace`}function ki(){return M(I(),`.tangle`,`intelligence.json`)}function Ai(e=ki()){if(!Le(e))return null;let t=Xi(e),n=ea(t,`apiKey`),r=ea(t,`endpoint`),i=ea(t,`serviceName`),a=ea(t,`environment`);if(!n||!r||!i||!a)throw Error(`${e} is missing apiKey, endpoint, serviceName, or environment`);return{apiKey:n,endpoint:r,serviceName:i,environment:a}}async function ji(e){let t=he(e.workspace),n=ki(),r=Ei(e.selection),i=[],a=[],o=[],s={apiKey:e.apiKey,endpoint:Li(e.endpoint),serviceName:e.serviceName,environment:e.environment};e.dryRun||qi(n,s),o.push(n);for(let n of r){let r=Ti[n];if(r.kind===`manual`){a.push({agent:r.surface,label:r.label,reason:r.reason});continue}i.push(r.surface);let s=t=>Mi(e.hookCommand,r.surface,t);for(let n of r.buildFiles(s)){let r=M(t,n.relPath);if(e.dryRun){o.push(r);continue}Yi(r,JSON.parse(n.content),n.mode),o.push(r)}}return!e.smoke||e.dryRun?{configPath:n,written:o,agents:r,nativeAgents:i,manual:a}:{configPath:n,written:o,agents:r,nativeAgents:i,manual:a,smokeTraceId:await Pi({agent:i[0]??r[0]??`codex`,event:`install.smoke`,endpoint:s.endpoint,apiKey:s.apiKey,serviceName:s.serviceName,environment:s.environment,sessionId:`install-smoke-${Date.now()}`,payload:{source:`tangle intelligence connect`}})}}function Mi(e,t,n){return`${e.trim()} --agent ${t} --event ${n} --non-blocking`}function Ni(e){let t=BigInt(Date.now())*1000000n,n=na(16),r=na(8),i=e.sessionId??Vi(e.payload),a={"service.name":e.serviceName,"deployment.environment":e.environment,"tangle.agent.surface":e.agent,"tangle.agent.hook.event":e.event,"tangle.agent.hook.source":`local-hook`,...Hi(e.payload)};return i&&(a[`session.id`]=i,a[`gen_ai.conversation.id`]=i,a[`tangle.sessionId`]=i),{body:{resourceSpans:[{resource:{attributes:[ra(`service.name`,e.serviceName),ra(`deployment.environment`,e.environment),ra(`tangle.agent.surface`,e.agent)]},scopeSpans:[{scope:{name:`tangle.intelligence.agent-hook`,version:`1.0.0`},spans:[{traceId:n,spanId:r,name:`agent.${e.agent}.${e.event}`,kind:1,startTimeUnixNano:t.toString(),endTimeUnixNano:(t+1000000n).toString(),attributes:Object.entries(a).map(([e,t])=>ra(e,t)),status:{code:1}}]}]}]},traceId:n}}async function Pi(e){let{body:t,traceId:n}=Ni(e),r=await fetch(`${Li(e.endpoint)}/v1/traces`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(t)});if(!r.ok){let e=await r.text().catch(()=>``);throw Error(`OTLP smoke ingest failed: ${r.status}${e?` ${e}`:``}`)}return n}function Fi(e){return Li(e).replace(/\/v1\/otlp$/,``).replace(/\/+$/,``)}async function Ii(e){let t=`${Fi(e.endpoint)}/v1/onboarding/status`,n=await fetch(t,{headers:{Authorization:`Bearer ${e.apiKey}`},signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`onboarding status request failed: ${n.status}${e?` ${e}`:``}`)}let r=await n.json();return{tracesSeen:!!r.tracesSeen,contentSeen:!!r.contentSeen,lastSeenAt:typeof r.lastSeenAt==`string`?r.lastSeenAt:null,windowDays:typeof r.windowDays==`number`?r.windowDays:7,byAgent:r.byAgent&&typeof r.byAgent==`object`?r.byAgent:{}}}function Li(e){let t=e.trim().replace(/\/+$/,``);return t.endsWith(`/v1/traces`)?t.slice(0,-10):t.endsWith(`/v1/logs`)?t.slice(0,-8):t}function Ri(e){switch(e){case`local`:case`both`:return[...Si];case`all`:return[...Ci];case`claude`:return[`claude-code`];case`kimi`:return[`kimi-code`];default:if(Di(e))return[e];throw Error(`agent must be one of: local, all, both, ${bi.join(`, `)}`)}}function zi(e){let t=Object.fromEntries(wi.map(t=>[t,[{command:e(t),timeoutMs:3e3,blocking:!1,matcher:`*`}]]));return[{relPath:`.codex/hooks.json`,content:JSON.stringify({hooks:t},null,2)}]}function Bi(e){let t=Object.fromEntries(wi.map(t=>[t,[{matcher:`*`,hooks:[{type:`command`,command:e(t),timeout:3}]}]]));return[{relPath:`.claude/settings.json`,content:JSON.stringify({hooks:t},null,2)}]}function Vi(e){return Wi(e,[`session.id`,`sessionId`,`session_id`,`conversationId`,`conversation_id`,`threadId`,`thread_id`,`transcriptId`,`transcript_id`])||process.env.TANGLE_SESSION_ID||process.env.CODEX_THREAD_ID||process.env.CLAUDE_SESSION_ID||process.env.OPENCODE_SESSION_ID}function Hi(e){let t={},n=Ui(e,[`tool.name`,`toolName`,`tool_name`,`tool`]),r=Ui(e,[`command`,`cmd`,`shell_command`,`shellCommand`]),i=Ui(e,[`tool.input`,`toolInput`,`tool_input`,`input`,`arguments`,`args`]),a=Ui(e,[`tool.output`,`toolOutput`,`tool_output`,`output`,`result`]),o=Ui(e,[`tool.exit_code`,`exitCode`,`exit_code`,`status`]),s=Ui(e,[`tool.error.message`,`errorMessage`,`error_message`,`error`]);return n&&(t[`tool.name`]=n),r&&(t[`process.command`]=r),i&&(t[`tool.input.summary`]=i),a&&(t[`tool.output.summary`]=a),o&&(t[`tool.exit_code`]=o),s&&(t[`tool.error.message`]=s),t}function Ui(e,t){let n=Gi(e,t);if(n===void 0)return null;if(typeof n==`string`)return Ki(n);if(typeof n==`number`||typeof n==`boolean`||typeof n==`bigint`)return String(n);try{return Ki(JSON.stringify(n))}catch{return null}}function Wi(e,t){let n=Gi(e,t);return typeof n==`string`&&n.length>0?n:void 0}function Gi(e,t){if(typeof e!=`object`||!e)return;let n=[e],r=new Set;for(;n.length;){let e=n.pop();if(typeof e!=`object`||!e||r.has(e))continue;r.add(e);let i=e;for(let e of t){let t=i[e];if(t!=null&&t!==``)return t}for(let e of Object.values(i))typeof e==`object`&&e&&n.push(e)}}function Ki(e){return e.length>4096?`${e.slice(0,4093)}...`:e}function qi(e,t){Ji(e,`${JSON.stringify(t,null,2)}\n`)}function Ji(e,t){Re(ue(e),{mode:448,recursive:!0});let n=`${e}.${process.pid}.tmp`;He(n,t,{mode:384}),Ve(n,e)}function Yi(e,t,n){Re(ue(e),{recursive:!0});let r=Zi(Xi(e),t);He(e,`${JSON.stringify(r,null,2)}\n`,{mode:n??420})}function Xi(e){if(!Le(e))return{};let t=JSON.parse(ze(e,`utf8`));if(!ta(t))throw Error(`${e} must contain a JSON object`);return t}function Zi(e,t){let n={...e};for(let[e,r]of Object.entries(t)){let t=n[e];ta(t)&&ta(r)?n[e]=Zi(t,r):Array.isArray(t)&&Array.isArray(r)?n[e]=Qi([...t,...r]):n[e]=r}return n}function Qi(e){let t=new Set,n=[];for(let r of e){let e=JSON.stringify(r);t.has(e)||(t.add(e),n.push(r))}return n}function $i(e){return[...new Set(e)]}function ea(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function ta(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null)}function na(e){return ye(e).toString(`hex`)}function ra(e,t){return{key:e,value:{stringValue:t}}}const ia=`tangle.opencode-exporter`,aa=16384;function oa(e){return e.length<=aa?e:`${e.slice(0,aa-1)}…`}function sa(e,t){return{key:e,value:{stringValue:t}}}function ca(e){if(!e||typeof e!=`object`)return null;let t=e,n=lt(t.type);return n?{type:n,properties:t.properties&&typeof t.properties==`object`?t.properties:void 0}:null}function la(e,t){let n=[sa(`event.name`,e),sa(`gen_ai.system`,`opencode`),sa(`service.name`,`opencode`)];return t&&(n.push(sa(`session.id`,t)),n.push(sa(`gen_ai.conversation.id`,t))),n}function ua(e){if(!e)return null;let t=e.part,n=e.info;return lt(t?.sessionID)??lt(n?.sessionID)??lt(e.sessionID)??null}function da(e,t){let n=lt(e.role)??lt(e.info?.role);if(n)return n.toLowerCase();let r=lt(e.messageID),i=t?.(r)??null;return i?i.toLowerCase():null}function fa(e,t,n){let r=[],i=ua(e.properties),a=(n,r)=>({timeUnixNano:t,severityNumber:9,severityText:`INFO`,...n===null?{}:{body:{stringValue:oa(n)}},attributes:[...la(e.type,i),...r]});if(e.type===`message.part.updated`){let t=e.properties?.part;if(!t)return r;let i=lt(t.type);if(i===`text`||i===`reasoning`){let e=lt(t.text);if(e){let i=da(t,n)===`user`?it:rt;r.push(a(e,[sa(i,oa(e))]))}return r}if(i===`tool`){let e=lt(t.tool),n=t.state,i=ut(n?.input),o=ut(n?.output),s=lt(n?.error)??(typeof n?.error==`object`&&n?.error!==null?ut(n.error):null);if(e||i){let t=[];e&&t.push(sa(ot,e)),i&&t.push(sa(at,oa(i))),r.push(a(null,t))}let c=o??s;if(c){let t=[sa(st,oa(c))];e&&t.push(sa(ot,e)),r.push(a(c,t))}return r}return r}if(e.type===`session.next.text.delta`||e.type===`session.next.text.ended`){let t=e.properties??{},n=lt(t.text)??(e.type===`session.next.text.delta`?lt(t.delta):null);return n&&r.push(a(n,[sa(rt,oa(n))])),r}return r}function pa(e=process.env.OTEL_RESOURCE_ATTRIBUTES){if(!e)return null;for(let t of e.split(`,`)){let e=t.indexOf(`=`);if(e===-1||t.slice(0,e).trim()!==ct)continue;let n=t.slice(e+1).trim();if(n.length>0)return n}return null}function ma(e,t){if(e.length===0)return null;let n=[sa(`service.name`,`opencode`),sa(`gen_ai.system`,`opencode`),sa(`telemetry.sdk.name`,ia)];return t&&t.trim().length>0&&n.push(sa(ct,t.trim())),{resourceLogs:[{resource:{attributes:n},scopeLogs:[{scope:{name:ia,version:`1.0.0`},logRecords:e}]}]}}function ha(e){return(e??process.env.OPENCODE_BASE_URL??`http://127.0.0.1:4096`).replace(/\/+$/,``)}async function ga(e){let t=Li(e.endpoint),n=await(e.fetchImpl??fetch)(`${t}/v1/logs`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(e.request),signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`OpenCode OTLP logs ingest failed: ${n.status}${e?` ${e}`:``}`)}}var _a=class extends Error{partial;constructor(e,t){let n=e instanceof Error?e.message:String(e);super(n),this.name=`OpencodeExporterError`,this.partial=t,e instanceof Error&&(this.cause=e)}};function va(){return(BigInt(Date.now())*1000000n).toString()}async function ya(e){let t=ha(e.opencodeBaseUrl),n=e.nowUnixNano??va,r=e.fetchImpl??fetch,i=e.subjectKey===void 0?pa():e.subjectKey,a=await r(`${t}/event`,{headers:{Accept:`text/event-stream`},signal:e.signal});if(!a.ok){let e=await a.text().catch(()=>``);throw Error(`OpenCode event subscribe failed: ${a.status} at ${t}/event${e?` ${e}`:``}. Is OpenCode running with 'opencode serve'?`)}if(!a.body)throw Error(`OpenCode event stream at ${t}/event returned no body — cannot subscribe`);let o={eventsSeen:0,contentEventsExported:0,recordsExported:0},s=new Map,c=e=>e?s.get(e)??null:null;try{for await(let t of oe(a.body,{signal:e.signal})){o.eventsSeen++;let a=ca(t.data);if(!a)continue;if(a.type===`message.updated`){let e=a.properties?.info,t=lt(e?.id),n=lt(e?.role);t&&n&&s.set(t,n);continue}let l=fa(a,n(),c),u=ma(l,i);u&&(await ga({endpoint:e.endpoint,apiKey:e.apiKey,request:u,timeoutMs:e.postTimeoutMs,fetchImpl:r}),o.contentEventsExported++,o.recordsExported+=l.length,e.onExport?.({eventType:a.type,records:l.length}))}}catch(e){if(e instanceof Error&&(e.name===`AbortError`||e.message.toLowerCase().includes(`abort`)))return o;throw new _a(e,o)}return o}function ba(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}const xa=[`claude-code`,`codex`,`opencode`,`openclaw`,`hermes`,`nanoclaw`],Sa={"claude-code":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,openclaw:`OpenClaw`,hermes:`Hermes`,nanoclaw:`NanoClaw`};function Ca(e){return xa.includes(e)}function wa(e){return Le(e)?ze(e,`utf8`):``}function Ta(e,t){Re(ue(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;He(n,t,{mode:384}),Fe(n,384),Ve(n,e)}const Ea=`# >>> tangle intelligence (claude-code) >>>`,Da=`# <<< tangle intelligence (claude-code) <<<`,Oa={full:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`},{key:`OTEL_LOG_TOOL_CONTENT`,comment:`full tool input+output bodies`},{key:`OTEL_LOG_RAW_API_BODIES`,comment:`full prompt+completion JSON (richest)`}],prompts:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`}],metadata:[]};function ka(e,t){return t===`env`?e:/\s/.test(e)?`"${e}"`:e}function Aa(e,t){let n=t===`shell`?`export `:t===`dockerfile`?`ENV `:``,r=[];for(let i of e){if(i.kind===`blank`){t===`shell`&&r.push(``);continue}if(i.kind===`comment`){t===`shell`&&r.push(`# ${i.text}`);continue}let e=t===`shell`&&i.comment?`   # ${i.comment}`:``;r.push(`${n}${i.key}=${ka(i.value,t)}${e}`)}return r.join(`
 `)}function ja(e){let t=Li(e.endpoint),n=e.apiKey??"${TANGLE_API_KEY}",r=e.content??`full`,i=e.format??`shell`,a=[{kind:`comment`,text:`Enable + point Claude Code at Tangle (JSON protocol — matches our adapter)`},{kind:`set`,key:`CLAUDE_CODE_ENABLE_TELEMETRY`,value:`1`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_PROTOCOL`,value:`http/json`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_ENDPOINT`,value:t},{kind:`set`,key:`OTEL_EXPORTER_OTLP_HEADERS`,value:`Authorization=Bearer ${n}`}];e.projectKey?a.push({kind:`blank`},{kind:`comment`,text:`Groups your runs into a project so Tangle can roll up + automate per-project:`},{kind:`set`,key:`OTEL_RESOURCE_ATTRIBUTES`,value:`tangle.subject.key=${e.projectKey}`}):a.push({kind:`blank`},{kind:`comment`,text:`Label this project so Tangle rolls up + automates per-project (pick your own):`},{kind:`comment`,text:`  export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=<your project>`}),a.push({kind:`blank`},{kind:`comment`,text:`CONTENT rides LOG EVENTS, so the logs exporter is MANDATORY.`},{kind:`set`,key:`OTEL_LOGS_EXPORTER`,value:`otlp`,comment:`required for prompt/completion/tool content`},{kind:`set`,key:`OTEL_METRICS_EXPORTER`,value:`otlp`,comment:`tokens / cost`},{kind:`set`,key:`OTEL_TRACES_EXPORTER`,value:`otlp`,comment:`spans (beta)`},{kind:`blank`});let o=Oa[r];if(o.length===0)a.push({kind:`comment`,text:`Content gates intentionally OFF (metadata-only: tokens, durations, tool names — no prompt/completion/tool bodies).`});else{a.push({kind:`comment`,text:`THE CONTENT GATES (all default OFF):`});for(let e of o)a.push({kind:`set`,key:e.key,value:`1`,comment:e.comment})}return Aa(a,i)}function Ma(e){return[Ea,ja(e),Da].join(`
 `)}function Na(e,t){let n=e.indexOf(Ea);if(n!==-1){let r=e.indexOf(Da,n);if(r===-1)throw Error(`shell rc has a '${Ea}' marker without its closing '${Da}' — fix it by hand and re-run`);let i=r+43,a=`${e.slice(0,n)}${t}${e.slice(i)}`;return{contents:a,changed:a!==e}}return{contents:`${e.length===0?``:Pa(e)}${t}\n`,changed:!0}}function Pa(e){return e.endsWith(`
@@ -139,19 +139,19 @@ await connect(new StdioServerTransport());`;case`claude-desktop`:return`// Add t
 `))Ba(r)?(t.push(n),n={header:r.trim(),body:[]}):n.body.push(r);return t.push(n),t.length>1&&t[0].header===null&&t[0].body.every(e=>e.trim()===``)&&t.shift(),t}function Ba(e){let t=e.trim();return t.startsWith(`[`)&&t.endsWith(`]`)&&!t.includes(`=`)||t.startsWith(`[[`)&&t.endsWith(`]]`)}function Va(e){let t=[];for(let n of e)n.header!==null&&t.push(n.header),t.push(...n.body);return t.join(`
 `)}function Ha(e){return[{key:`environment`,line:`environment = "prod"`},{key:`log_user_prompt`,line:`log_user_prompt = true`},{key:`exporter`,line:`exporter = { otlp-http = { endpoint = "${Li(e.endpoint)}/v1/logs", protocol = "json", headers = { "Authorization" = "Bearer ${e.apiKey??"${TANGLE_API_KEY}"}" } } }`}]}function Ua(e){let t=e.trim();if(t===``||t.startsWith(`#`))return null;let n=t.indexOf(`=`);if(n===-1)return null;let r=t.slice(0,n).trim();return/^[A-Za-z0-9_-]+$/.test(r)?r:null}function Wa(e,t){let n=Ha(t),r=new Set(n.map(e=>e.key));if(e.trim()===``)return{contents:`${[`[otel]`,...n.map(e=>e.line)].join(`
 `)}\n`,changed:!0};let i=za(e),a=i.find(e=>e.header===`[otel]`);if(!a){let t={header:`[otel]`,body:n.map(e=>e.line)},r=i[i.length-1];r&&!Ga(r)&&r.body.push(``),i.push(t);let a=Ka(Va(i));return{contents:a,changed:a!==Ka(e)}}let o=a.body.filter(e=>{let t=Ua(e);return t===null||!r.has(t)}),s=[];for(;o.length>0&&o[o.length-1].trim()===``;)s.unshift(o.pop());a.body=[...o,...n.map(e=>e.line),...s];let c=Ka(Va(i));return{contents:c,changed:c!==Ka(e)}}function Ga(e){return e.body.length>0&&e.body[e.body.length-1].trim()===``}function Ka(e){return e.endsWith(`
-`)?e:`${e}\n`}function qa(e){let t=M(I(),`.codex`,`config.toml`),{contents:n,changed:i}=Wa(wa(t),{endpoint:e.endpoint,apiKey:e.apiKey});if(!e.write){console.log(n.trimEnd());return}if(!i){r(`${t} already has the Tangle [otel] block — nothing to change.`);return}Ta(t,n),r(`Merged the Tangle [otel] block into ${t}.`),l("Codex emits content on the logs signal (codex.* events). Set TANGLE_API_KEY in your env before running if you kept the ${TANGLE_API_KEY} reference."),l(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=${e.projectKey??`<your project>`} before running codex.`)}function Ja(e){switch(e){case`claude-code`:return`Claude Code: set OTEL_LOGS_EXPORTER=otlp and the four OTEL_LOG_* gates (OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_TOOL_CONTENT, OTEL_LOG_RAW_API_BODIES).`;case`codex`:return`Codex: set log_user_prompt = true in [otel] (default false redacts content).`;case`opencode`:return`OpenCode: a standalone install emits nothing without the tangle-opencode-exporter shim; inside a Tangle sandbox it is already instrumented.`;case`openclaw`:case`hermes`:case`nanoclaw`:return`${Sa[e]}: no native OTLP exporter and no standalone server to subscribe to — run it inside a Tangle sandbox, where the sidecar adapter exports its content with gen_ai.system=${e}. A bare standalone install emits metadata only.`}}async function Ya(e){let t=Date.now()+e.timeoutSeconds*1e3,n=3e3,r=Math.min(e.timeoutSeconds*1e3,1e4),i=f(`Checking whether content is flowing…`);i.start();let a;try{for(;;){try{a=await Ii({endpoint:e.endpoint,apiKey:e.apiKey,timeoutMs:r})}catch(e){if(Date.now()>=t)throw e;await nt(n);continue}if(a.contentSeen||Date.now()>=t)break;await nt(n)}}finally{i.stop()}if(!a)throw Error(`onboarding status check returned no result`);Xa(a,e.agent),a.contentSeen||(process.exitCode=1)}function Xa(e,t){if(e.contentSeen){r(`Content flowing — Tangle Intelligence can analyze this feed.`),s({"Last seen":e.lastSeenAt??`just now`,Window:`${e.windowDays}d`});return}if(e.tracesSeen){c(`Metadata-only — traces are arriving but carry no content. You missed a content gate.`);let n=t?[t]:Object.keys(e.byAgent).filter(Ca),r=n.length>0?n:xa;for(let n of r){let r=e.byAgent[n];(t||!r||r.tracesSeen&&!r.contentSeen)&&l(Ja(n))}return}c(`No traces yet for your tenant. Run your agent once on a real task, then re-run --verify.`),t&&l(Ja(t))}function Za(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??yn(void 0);if(!t)throw Error(`No Tangle API key found. Pass --api-key, set TANGLE_API_KEY, or run: tangle auth login`);return t}function Qa(){return new N(`connect`).description(`Connect a local coding agent's telemetry to Tangle Intelligence, content on (for SDK integration snippets, see 'tangle agent connect')`).argument(`[agent]`,`claude-code | codex | opencode | openclaw | hermes | nanoclaw`).option(`--endpoint <url>`,`OTLP endpoint base`,xi).option(`-p, --project <key>`,`Project label (tangle.subject.key) to group runs; omit to set it yourself`).option(`--rc <path>`,`Shell rc file to append the Claude Code env block to`).option(`--no-write`,`Print the config instead of writing files (Claude Code / Codex)`).option(`--inline-key`,"Embed the resolved API key literally in the config (default: keep ${TANGLE_API_KEY})").option(`--verify`,`Poll onboarding status and report whether CONTENT is flowing`).option(`--timeout <seconds>`,`Verify poll timeout in seconds`,`120`).option(`--run`,`OpenCode only: run the content exporter against a live OpenCode server until interrupted`).option(`--opencode-url <url>`,`OpenCode server base URL for --run (or set OPENCODE_BASE_URL)`).option(`--format <kind>`,`Claude Code output: shell (export block) | env (.env / docker --env-file) | dockerfile (ENV lines). env/dockerfile are the cron/container path — printed to stdout, no shell-rc edit, no TTY`,`shell`).option(`--content <tier>`,`Claude Code content tier: full (everything) | prompts (task+prompts+tool-args) | metadata (telemetry on, content off)`,`full`).action(async(e,t)=>{let n=Li(t.endpoint);if(t.run){if((e?eo(e):`opencode`)!==`opencode`)throw Error(`--run is OpenCode-only: it runs the content exporter against a live OpenCode server. Other agents export natively once configured.`);await io({endpoint:n,apiKey:Za(t.apiKey),opencodeUrl:t.opencodeUrl});return}if(t.verify){await Ya({endpoint:n,apiKey:Za(t.apiKey),agent:e?eo(e):void 0,timeoutSeconds:ba(t.timeout,`--timeout`)});return}let r=e?eo(e):await to(),i=t.inlineKey?Za(t.apiKey):void 0;r===`claude-code`?await Ra({endpoint:n,apiKey:i,projectKey:t.project,rcPath:t.rc,write:t.write!==!1,content:La(t.content),format:Ia(t.format)}):r===`codex`?qa({endpoint:n,apiKey:i,projectKey:t.project,write:t.write!==!1}):r===`opencode`?no({endpoint:n}):ro(r,{endpoint:n}),console.log(),l(`Run your agent on a real task, then verify content is flowing: tangle connect ${r} --verify`)})}function $a(){return new N(`opencode-exporter`).description(`Export a running OpenCode's content to Tangle Intelligence (standalone shim)`).option(`--endpoint <url>`,`OTLP endpoint base`,xi).option(`--opencode-url <url>`,`OpenCode server base URL (or set OPENCODE_BASE_URL)`).action(async e=>{await io({endpoint:Li(e.endpoint),apiKey:Za(e.apiKey),opencodeUrl:e.opencodeUrl})})}function eo(e){if(Ca(e))return e;throw Error(`Unknown agent '${e}'. Choose one of: ${xa.join(`, `)}`)}async function to(){if(!process.stdin.isTTY)throw Error(`Specify an agent: tangle connect <${xa.join(`|`)}>`);console.log(`Which coding agent are you connecting?`),xa.forEach((e,t)=>{console.log(`  ${t+1}) ${Sa[e]} (${e})`)});let e=await mr(`Enter a number or name`,`1`);return xa[Number.parseInt(e,10)-1]||eo(e.trim())}function no(e){let t=Li(e.endpoint);c(`OpenCode has no native OTel exporter, so a standalone install emits nothing without a shim.`),console.log(),s({"Inside a Tangle sandbox":`already instrumented — our adapter exports OpenCode's event-stream content. Nothing to do.`,Standalone:`run 'tangle connect opencode --run' alongside a running OpenCode, exporting to ${t}.`}),console.log(),l(`Start OpenCode in server mode ('opencode serve'), then in another terminal run: tangle connect opencode --run`),l(`The exporter subscribes to OpenCode's SSE event bus and exports content-bearing OTLP (prompt/completion/tool content) to Tangle. Verify with: tangle connect opencode --verify`),l(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting the exporter.`)}function ro(e,t){let n=Li(t.endpoint),r=Sa[e];c(`${r} has no native OTel exporter, so a standalone install emits nothing without instrumentation.`),console.log(),s({"Inside a Tangle sandbox":`already instrumented — the sidecar adapter exports ${r}'s prompt/completion/tool content (gen_ai.system=${e}) to ${n}. Nothing to do.`,Standalone:`${r} exposes no OTLP and no event-bus server; run it inside a Tangle sandbox to capture content.`}),console.log(),l(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting ${r}.`),l(`Verify content is flowing: tangle connect ${e} --verify`)}async function io(e){let t=ha(e.opencodeUrl),n=new AbortController,i=()=>n.abort();process.on(`SIGINT`,i),process.on(`SIGTERM`,i),l(`Subscribing to OpenCode at ${t} — exporting content to Tangle.`),l(`Run OpenCode tasks now. Press Ctrl-C to stop.`),console.log();let a=0,o;try{o=await ya({endpoint:e.endpoint,apiKey:e.apiKey,opencodeBaseUrl:t,signal:n.signal,onExport:({eventType:e,records:t})=>{a+=t,l(`exported ${t} record(s) from ${e} (total ${a})`)}})}catch(e){if(e instanceof _a){let{recordsExported:t,contentEventsExported:n}=e.partial;console.log(),c(`Exporter failed after exporting ${t} content record(s) from ${n} event(s): ${e.message}`)}throw e}finally{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)}if(console.log(),o.contentEventsExported===0){c(`Saw ${o.eventsSeen} event(s) but none carried content. Run a real OpenCode task (a prompt that produces text or a tool call), then re-run.`);return}r(`Exported ${o.recordsExported} content record(s) from ${o.contentEventsExported} event(s).`),l(`Verify it landed: tangle connect opencode --verify`)}function ao(){let t=new N(`environments`).alias(`env`).description(`Manage sandbox environments`);return t.command(`list`).alias(`ls`).description(`List available environments`).action(async t=>{let{client:n}=G(t),r=f(`Fetching environments...`);t.json||r.start();let a=await n.environments.list();r.stop(),t.json?e(a):a.length===0?console.log(`No environments found`):i([`ID`,`Description`,`Version`,`Runtimes`],a.map(e=>[e.id,e.description??``,e.version,e.runtimes.join(`, `)]))}),t.command(`get`).description(`Get environment details`).argument(`<id>`,`Environment ID`).action(async(t,n)=>{let{client:r}=G(n),i=f(`Fetching environment...`);n.json||i.start();let a=await r.environments.get(t);if(i.stop(),!a){console.error(`Environment not found: ${t}`),process.exit(1);return}n.json?e(a):(console.log(`ID:          ${a.id}`),console.log(`Description: ${a.description??`-`}`),console.log(`Version:     ${a.version}`),console.log(`Runtimes:    ${a.runtimes.join(`, `)}`),a.base&&console.log(`Base:        ${a.base}`))}),t}const oo=F.string().trim().toLowerCase().min(1).max(64).regex(/^[a-z][a-z0-9-]*$/),so=F.string().trim().toLowerCase().min(1).max(128).regex(/^[a-z0-9][a-z0-9._-]*$/),co=F.object({kind:so,count:F.number().int().positive().default(1),vramGb:F.number().positive().optional()}).strict();F.object({command:F.string().min(1).max(8192),timeoutMs:F.number().int().positive().max(2147453647).optional(),env:F.record(F.string(),F.string()).optional(),cwd:F.string().min(1).max(2048).optional()}).strict(),F.object({refresh:F.enum([`true`,`false`]).optional(),acceleratorKind:so.optional(),acceleratorCount:F.coerce.number().pipe(co.shape.count.unwrap()).optional(),acceleratorVramGb:F.coerce.number().positive().optional()}).strict(),F.object({maxSpendUsd:F.number().positive().max(1e4).optional(),maxLifetimeSeconds:F.number().int().positive().max(1440*60).optional()}).strict().refine(e=>e.maxSpendUsd!==void 0||e.maxLifetimeSeconds!==void 0,`Renewal requires a lifetime or spend cap`);const lo=F.object({provider:oo.optional(),image:F.string().min(1).max(512).optional(),env:F.record(F.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/),F.string()).optional(),diskGb:F.number().int().positive().optional(),volumeGb:F.number().int().nonnegative().optional(),volumeMountPath:F.string().startsWith(`/`).max(2048).optional(),region:F.string().min(1).max(128).optional(),manifest:F.record(F.string(),F.unknown()).optional(),command:F.array(F.string().max(8192)).min(1).max(256).optional(),ports:F.array(F.number().int().min(1).max(65535)).max(32).optional(),endpoint:F.object({port:F.number().int().min(1).max(65535),healthPath:F.string().regex(/^\/(?![/\\])/).refine(e=>![`\r`,`
-`,`	`].some(t=>e.includes(t))).max(2048).optional()}).strict().optional(),allowSpot:F.boolean().optional(),maxHourlyUsd:F.number().positive().optional(),weights:F.object({manifestSha:F.string().regex(/^[a-f0-9]{64}$/),sizeBytes:F.number().int().positive().safe()}).strict().optional(),arms:F.array(F.unknown()).min(1).max(256).optional(),maxSpendUsd:F.number().positive().max(1e4),maxLifetimeSeconds:F.number().int().positive().max(1440*60),idleTimeoutSeconds:F.number().int().positive().optional()}).strict();lo.extend({accelerator:co});const uo=co,fo=oo;F.object({...lo.omit({env:!0}).shape,id:F.string(),projectRef:F.string(),ownerUserId:F.string(),productId:F.string().optional(),provider:fo,providerLeaseId:F.string().optional(),providerInstanceType:F.string().optional(),endpointUrl:F.string().optional(),status:F.enum([`provisioning`,`ready`,`detaching`,`destroyed`,`failed`]),accelerator:uo,providerCostPerHourUsd:F.number().optional(),customerPricePerHourUsd:F.number().optional(),estimatedProviderCostUsd:F.number().optional(),estimatedCustomerCostUsd:F.number().optional(),providerSelection:F.object({strategy:F.enum([`explicit`,`cheapest`,`ranked`]),selectedProvider:fo,requestedProvider:fo.optional(),candidates:F.array(F.object({provider:fo,accelerator:uo,providerInstanceType:F.string().optional(),region:F.string().optional(),pricingSource:F.enum([`live`,`configured`]).optional(),providerCostPerHourUsd:F.number(),customerPricePerHourUsd:F.number(),maxLifetimeSeconds:F.number(),estimatedProviderCostUsd:F.number(),estimatedCustomerCostUsd:F.number()})),rejected:F.array(F.object({provider:fo,error:F.string()}))}).optional(),createdAt:F.string(),updatedAt:F.string(),readyAt:F.string().optional(),startedAt:F.string().optional(),lastUsedAt:F.string().optional(),destroyedAt:F.string().optional(),failure:F.string().optional(),billing:F.object({seconds:F.number(),providerCostUsd:F.number(),customerCostUsd:F.number(),providerCostPerHourUsd:F.number(),customerPricePerHourUsd:F.number(),startedAt:F.string(),stoppedAt:F.string()}).optional()});function po(e){return{kind:xo(e.kind),count:e.count?bo(e.count,`--accelerator-count`):1,...e.memory?{vramGb:Co(e.memory,`--accelerator-memory`)}:{}}}function mo(e,t,n){if(!t&&Object.values(e).some(Boolean))throw Error(n);return t?go(e,`--gpu-`):void 0}function ho(e){return{...go(e,`--`),accelerator:po({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory})}}function go(e,t){let{provider:n,image:r,env:i,maxSpendUsd:a,maxLifetime:o,idleTimeout:s}=e;if(!a||!o)throw Error(`--accelerator-kind requires ${t}max-spend-usd and ${t}max-lifetime`);return{...n?{provider:So(n,`${t}provider`)}:{},...r?{image:r}:{},...i?{env:yo(i,`${t}env`,`env`)}:{},maxSpendUsd:Co(a,`${t}max-spend-usd`),maxLifetimeSeconds:bo(o,`${t}max-lifetime`),...s?{idleTimeoutSeconds:bo(s,`${t}idle-timeout`)}:{}}}function _o(e){return e.length===1?e[0]:e.map(Me).join(` `)}function vo(e){return{timeoutMs:e.timeout?bo(String(e.timeout),`--timeout`):void 0,env:e.env?yo(e.env,`--env`,`env`):void 0}}function yo(e,t,n){let r={};for(let i of e){let[e,...a]=i.split(`=`);if(!e||a.length===0)throw Error(`${t} expects ${n} values in KEY=VALUE format`);r[e]=a.join(`=`)}return r}function bo(e,t){if(!/^\d+$/.test(e))throw Error(`${t} must be a positive integer`);let n=Number.parseInt(e,10);if(Number.isNaN(n)||n<1)throw Error(`${t} must be a positive integer`);return n}function xo(e){let t=so.safeParse(e);if(t.success)return t.data;throw Error(`--accelerator-kind must contain only letters, numbers, dots, underscores, or hyphens`)}function So(e,t){let n=oo.safeParse(e);if(n.success)return n.data;throw Error(`${t} must start with a letter and contain only letters, numbers, or hyphens`)}function Co(e,t){if(!/^(?:\d+|\d+\.\d+|\.\d+)$/.test(e))throw Error(`${t} must be a positive number`);let n=Number.parseFloat(e);if(!Number.isFinite(n)||n<=0)throw Error(`${t} must be a positive number`);return n}function wo(){return new N(`exec`).description(`Execute a command in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command...>`,`Command and arguments, or one shell script`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`60000`).allowUnknownOption(!0).action(async(t,n,r)=>{try{let{context:i,client:a}=G(r),o=_o(n),s=yo(r.env??[],`--env`,`env`),c=f(`Executing: ${o}`);r.json||c.start();let l=await q(a,i,t);l=await J(l);let u=await l.exec(o,{cwd:r.cwd,env:Object.keys(s).length>0?s:void 0,timeoutMs:Number.parseInt(r.timeout,10)});c.stop(),r.json?e(u):(u.stdout&&process.stdout.write(u.stdout),u.stderr&&process.stderr.write(u.stderr)),u.exitCode!==0&&(process.exitCode=u.exitCode)}catch(e){if(e instanceof S){let t=`Exec transport lost before command status was confirmed. Remote command status is unknown. Original error: ${e.message}. For long-running commands, use \`tangle process spawn\`, \`tangle process logs\`, and \`tangle process kill --tree\`.`;return H(Error(t,{cause:e}))}H(e)}})}function To(n){n.command(`capabilities`).description(`List fleet drivers and their supported features`).action(async n=>{let{client:r}=G(n),i=f(`Fetching capabilities...`);i.start();let a=await r.fleets.capabilities();i.stop(),n.json?e(a):t(a.drivers,[{key:`driverType`,header:`Driver`,width:16},{key:`sharedWorkspace`,header:`Shared WS`,width:12},{key:`accelerators`,header:`Accel`,width:8},{key:`queueTimings`,header:`Queue`,width:8}])}),n.command(`usage <fleet-id>`).description(`Show fleet usage and reliability insights`).action(async(t,n)=>{let{client:r}=G(n),i=f(`Fetching usage...`);i.start();let a=await r.fleets.usage(t);if(i.stop(),n.json)e(a);else if(s({"Fleet ID":a.usage.fleetId,Status:a.usage.status,Machines:a.usage.machineCount,Running:a.usage.runningMachines,Failed:a.usage.failedMachines,"Runtime (ms)":a.usage.meteredUsage?.runtimeMs,"Reliability score":a.insights.reliabilityScore,"Failure rate":a.insights.failureRate}),a.insights.recommendedActions.length>0){console.log(`
-Recommended actions:`);for(let e of a.insights.recommendedActions)console.log(`  - ${e}`)}}),n.command(`cost <fleet-id>`).description(`Show the fleet's cost estimate`).action(async(t,n)=>{let{client:r}=G(n),i=f(`Estimating cost...`);i.start();let a=await r.fleets.cost(t);i.stop(),n.json?e(a):s({Plan:a.plan,Currency:a.currency,"Hourly (USD)":a.hourlyUsd,"Max lifetime (s)":a.maxLifetimeSeconds,"Estimated max lifetime (USD)":a.estimatedMaxLifetimeUsd,Machines:a.requestedResources.machines,"Total CPU":a.requestedResources.totalCpu,"Total memory (MB)":a.requestedResources.totalMemoryMb})})}function Eo(e){return[...e.entries()].map(([e,t])=>({machineId:e,sandboxId:t.id,status:t.status}))}function Do(n){n.command(`list <fleet-id>`).description(`List the machines of one fleet (fleet id is required)`).option(`--status <status>`,`Filter machines by status`).action(async(n,r)=>{let{client:i}=G(r),a=f(`Fetching fleet...`);a.start();let o=await i.fleets.list({fleetId:n,status:r.status});a.stop();let s=Eo(o.machines);r.json?e({fleetId:o.fleetId,machines:s}):t(s,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}])}),n.command(`get <fleet-id>`).description(`Show one fleet's manifest (server record)`).action(async(n,r)=>{let{client:i}=G(r),a=f(`Fetching manifest...`);a.start();let o=await i.fleets.manifest(n);a.stop(),r.json?e(o):(s({"Fleet ID":o.fleetId??o.id,Machines:o.machines.length,"Workspace mode":o.workspace?.mode,"Workspace status":o.workspace?.status,"Max lifetime (s)":o.policy?.maxLifetimeSeconds,"Max spend (USD)":o.policy?.maxSpendUsd,Created:o.createdAt,Updated:o.updatedAt}),t(o.machines,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`role`,header:`Role`,width:14},{key:`status`,header:`Status`,width:14}]))}),n.command(`delete <fleet-id>`).description(`Delete a fleet's machine sandboxes and its record`).option(`--continue-on-error`,`Keep deleting remaining machines if one delete fails`).action(async(t,n)=>{let{client:i}=G(n),a=f(`Deleting fleet...`);a.start(),await i.fleets.delete(t,{continueOnError:n.continueOnError}),a.stop(),n.json?e({success:!0,fleetId:t}):r(`Fleet deleted: ${t}`)}),n.command(`reap`).description(`TTL cleanup of all expired fleets (fleet-wide)`).option(`--dry-run`,`Report what would be reaped without deleting`).action(async n=>{let{client:r}=G(n),i=f(`Reaping expired fleets...`);i.start();let a=await r.fleets.reapExpired({dryRun:n.dryRun});i.stop(),n.json?e(a):(s({"Dry run":a.dryRun,Expired:a.expired,Deleted:a.deleted}),t(a.fleets,[{key:`fleetId`,header:`Fleet`,width:24},{key:`expiredAt`,header:`Expired`,width:18},{key:`deleted`,header:`Deleted`,width:10}]))}),n.command(`reconcile`).description(`Drop fleet records whose underlying sandboxes vanished`).option(`--dry-run`,`Report orphans without removing them`).action(async n=>{let{client:r}=G(n),i=f(`Reconciling fleets...`);i.start();let a=await r.fleets.reconcile({dryRun:n.dryRun});i.stop(),n.json?e(a):(s({"Dry run":a.dryRun,Checked:a.checked,Orphaned:a.orphaned,Removed:a.removed}),t(a.machines,[{key:`fleetId`,header:`Fleet`,width:24},{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`removed`,header:`Removed`,width:10}]))})}async function Oo(e,t){let n=await Zn({apiKey:t.apiKey,baseUrl:t.baseUrl??En()}),r=await fetch(`${n.baseUrl}/v1/agent-profiles/${encodeURIComponent(e)}`,{headers:{authorization:`Bearer ${n.token}`,accept:`application/json`}});if(!r.ok){let t=await r.text().catch(()=>``);throw r.status===404?Error(`profile '${e}' not found in the platform catalog (it may be a built-in, a stored profile you own, or neither — run 'tangle profile list' to see what is available)`):Error(`platform returned ${r.status}: ${t.slice(0,200)}`)}let i=await r.json();if(!i.definition||typeof i.definition!=`object`)throw Error(`profile '${e}' resolved but has no definition — the catalog entry is malformed`);return i.definition}async function ko(e){let t=typeof e.envVarName==`string`&&e.envVarName.length>0?e.envVarName:null,n=!!e.fromStdin;if(t&&n)throw Error(`Pass either ${e.flagPrefix}-env or ${e.flagPrefix}-stdin, not both`);if(t){let n=process.env[t];if(!n||n.length===0)throw Error(`${e.flagPrefix}-env points at ${t}, but that environment variable is empty or unset`);return n}if(n){let t=await hr();if(t.length===0)throw Error(`${e.flagPrefix}-stdin received empty input on stdin`);return t}}function Ao(e){if(e.secret===void 0)return;let t=e.backend===`claude-code`?`token`:e.backend===`codex`?`bundle`:void 0;if(!t)throw Error(`--cli-auth needs --backend claude-code or --backend codex`);if(e.apiKeyGiven)throw Error(`--cli-auth cannot be combined with --backend-api-key-env or --backend-api-key-stdin`);return{account:`cli`,secretEnv:e.secret,format:t}}function jo(e){if(e!==void 0)return e.map(e=>{if(e.includes(`@`)||e.includes(`:`))throw Error(`--secret ${e}: bare secret names only (box delivery). For proxy custody use --proxy-secret with a canonical binding`);return e})}function Mo(e,t){let n={};return e.cpu!==void 0&&(n.cpuCores=bo(e.cpu,`--cpu`)),e.memory!==void 0&&(n.memoryMB=bo(e.memory,`--memory`)),e.disk!==void 0&&(n.diskGB=bo(e.disk,`--disk`)),t&&(n.accelerator=t),Object.keys(n).length>0?n:void 0}function No(e){let t=e.split(`/`);return t.length>=2?{provider:t[0],model:t.slice(1).join(`/`)}:{model:e}}function Po(e){let t={};for(let n of e){let[e,...r]=n.split(`=`);if(!e||r.length===0)throw Error(`--metadata expects values in KEY=VALUE or KEY=JSON format`);t[e]=Fo(r.join(`=`))}return t}function Fo(e){try{return JSON.parse(e)}catch{return e}}function Io(e,t){if(!(!e.gitUrl&&!e.gitRef&&!e.gitDepth&&!e.gitSparse&&!t)){if(!e.gitUrl||typeof e.gitUrl!=`string`)throw Error(`--git-url is required when using git provisioning options`);return{url:e.gitUrl,ref:typeof e.gitRef==`string`?e.gitRef:void 0,depth:typeof e.gitDepth==`string`?bo(e.gitDepth,`--git-depth`):void 0,sparse:Array.isArray(e.gitSparse)?e.gitSparse:void 0,auth:t?{token:t}:void 0}}}function Lo(e,t){if(!(!e.storageType&&!e.storageBucket&&!e.storageEndpoint&&!e.storageRegion&&!e.storagePrefix&&!e.storageAccessKeyId&&!t)){if(typeof e.storageType!=`string`||typeof e.storageBucket!=`string`||typeof e.storageAccessKeyId!=`string`||!t)throw Error(`Storage config requires --storage-type, --storage-bucket, --storage-access-key-id, and one of --storage-secret-access-key-env / --storage-secret-access-key-stdin`);return{type:Ro(e.storageType),bucket:e.storageBucket,endpoint:typeof e.storageEndpoint==`string`?e.storageEndpoint:void 0,region:typeof e.storageRegion==`string`?e.storageRegion:void 0,prefix:typeof e.storagePrefix==`string`?e.storagePrefix:void 0,credentials:{accessKeyId:e.storageAccessKeyId,secretAccessKey:t}}}}function Ro(e){if(e===`s3`||e===`gcs`||e===`r2`)return e;throw Error(`--storage-type must be one of s3, gcs, or r2`)}function zo(e){if(e===void 0)return;let t=[];for(let n of e){let e=n,r=`--proxy-secret <json>`;if(n.startsWith(`@`)){let t=n.slice(1);r=`--proxy-secret @${t}`;try{e=Re(t,`utf8`)}catch{throw Error(`${r}: file could not be read`)}}let i;try{i=JSON.parse(e)}catch(e){throw Error(`${r}: not valid JSON (${e instanceof Error?e.message:String(e)})`)}if(Array.isArray(i))t.push(...i);else if(typeof i==`object`&&i)t.push(i);else throw Error(`${r}: expected a binding object or an array of bindings`)}let n=xe.parse(t);return n.length>0?n:void 0}function Bo(e){l(`  Status: ${e.status}`),l(`  Provider: ${e.provider}`),l(`  GPU: ${e.accelerator.kind} x ${e.accelerator.count}`),e.customerPricePerHourUsd!==void 0&&l(`  Customer price: $${e.customerPricePerHourUsd}/hr`),e.estimatedCustomerCostUsd!==void 0&&l(`  Max estimate: $${e.estimatedCustomerCostUsd}`),e.billing&&(l(`  Billed seconds: ${e.billing.seconds}`),l(`  Customer cost: $${e.billing.customerCostUsd}`))}function Vo(e){e.result.stdout&&process.stdout.write(e.result.stdout),e.result.stderr&&process.stderr.write(e.result.stderr),l(`Exit code: ${e.result.exitCode}`)}function Ho(n){let i=n.command(`gpu`).description(`Manage on-demand GPU leases for a sandbox`);i.command(`providers <id-or-name>`).description(`List GPU clouds, whether each credential works, and current prices`).option(`--accelerator-kind <kind>`,`Price this GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).action(async(n,r)=>{let{context:i,client:a}=G(r),o=f(`Checking GPU providers...`);o.start();let s=await(await q(a,i,n)).gpu.providers(r.acceleratorKind?{accelerator:po({kind:r.acceleratorKind,count:r.acceleratorCount,memory:r.acceleratorMemory})}:{});if(o.stop(),r.json){e(s);return}t(s.statuses.map(e=>({provider:e.provider,state:e.state,gpu:e.estimate?.providerInstanceType??``,usdHr:e.estimate?e.estimate.customerPricePerHourUsd.toFixed(4):``,pricing:e.estimate?.pricingSource??``,needs:e.envVars.join(` `)})),[{key:`provider`,header:`Provider`},{key:`state`,header:`State`},{key:`gpu`,header:`GPU`},{key:`usdHr`,header:`$/hr`},{key:`pricing`,header:`Price`},{key:`needs`,header:`Needs`}]);for(let e of s.statuses){let t=e.state===`credential-invalid`?e.credential?.detail:e.estimateError;t&&l(`${e.provider}: ${t}`)}s.usable.length===0&&l(`No GPU provider is usable on this deployment: set the variables in Needs for one provider on the server.`)}),i.command(`attach <id-or-name>`).description(`Attach a temporary GPU worker to a sandbox`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=f(`Attaching GPU lease...`);o.start();let s=await(await q(a,i,t)).gpu.attach(ho(n));o.stop(),n.json?e(s):(r(`GPU lease attached: ${s.id}`),Bo(s))}),i.command(`run <id-or-name> <command...>`).description(`Attach a GPU, run a command or script, then destroy it`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker and command (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).action(async(t,n,i)=>{let a,o,s,c;try{let{context:e,client:r}=G(i),s=await q(r,e,t),c=f(`Attaching GPU lease...`);c.start(),a=await s.gpu.attach(ho(i)),c.stop();let l=f(`Running GPU command...`);l.start(),o=await s.gpu.exec(a.id,{command:_o(n),...vo(i),cwd:i.cwd}),l.stop(),i.json||Vo(o)}catch(e){s=e}finally{if(a)try{let{context:e,client:n}=G(i);a=await(await q(n,e,t)).gpu.detach(a.id)}catch(e){c=e}}if(s){H(s),c&&H(c);return}if(c){H(c);return}i.json?e({lease:a,result:o}):a&&r(`GPU lease detached: ${a.id}`);let l=o?.result.exitCode;l&&l!==0&&(process.exitCode=l)}),i.command(`list <id-or-name>`).description(`List GPU leases attached to a sandbox`).action(async(n,r)=>{let{context:i,client:a}=G(r),o=f(`Fetching GPU leases...`);o.start();let s=await(await q(a,i,n)).gpu.list();o.stop(),r.json?e(s):s.length===0?l(`No GPU leases attached.`):t(s.map(e=>({id:e.id,status:e.status,provider:e.provider,accelerator:`${e.accelerator.kind}x${e.accelerator.count}`,customerUsdHr:e.customerPricePerHourUsd??``})),[{key:`id`,header:`ID`,width:28},{key:`status`,header:`Status`,width:12},{key:`provider`,header:`Provider`,width:12},{key:`accelerator`,header:`GPU`,width:24},{key:`customerUsdHr`,header:`$/hr`,width:10}])}),i.command(`exec <id-or-name> <lease-id> <command...>`).description(`Run a command or script on an attached GPU lease`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).action(async(t,n,r,i)=>{let{context:a,client:o}=G(i),s=f(`Running GPU command...`);s.start();let c=await(await q(o,a,t)).gpu.exec(n,{command:_o(r),...vo(i),cwd:i.cwd});s.stop(),i.json?e(c):Vo(c)}),i.command(`detach <id-or-name> <lease-id>`).description(`Detach and destroy a GPU lease`).action(async(t,n,i)=>{let{context:a,client:o}=G(i),s=f(`Detaching GPU lease...`);s.start();let c=await(await q(o,a,t)).gpu.detach(n);s.stop(),i.json?e(c):(r(`GPU lease detached: ${c.id}`),Bo(c))})}function Uo(t,n){if(n){e(t);return}if(!t.id){t.kind===`snapshot`&&t.result?.snapshot?r(`Snapshot created: ${t.result.snapshot.snapshotId}`):r(`Sandbox ${t.sandboxId} stopped.`);return}r(`${t.kind===`snapshot`?`Snapshot`:`Stop`} of sandbox ${t.sandboxId} accepted.`),l(`Operation: ${t.id}`),l(`Status: ${t.statusUrl}`)}function Wo(e){return`${e.name} (${e.id})`}async function Go(e,t){if(t.startsWith(`team_`))return e.teams.get(t);let n=(await e.teams.list()).filter(e=>e.name.toLowerCase()===t.toLowerCase());if(n.length===0)throw Error(`Team not found: ${t}`);if(n.length>1)throw Error(`Team name is ambiguous: ${t}. Use a team id instead.`);return n[0]}async function Ko(e,t,n){if(t)return Go(e,t);let r=kn(n);if(!r.activeTeamId)throw Error("No active team. Run `tangle team switch <team>` or pass `--team <team>`.");return e.teams.get(r.activeTeamId)}function qo(e,t){An({id:e.id,name:e.name},t)}function Jo(e){jn(e)}async function Yo(e){if(e.explicitTeam&&e.personal)throw Error(`--team and --personal cannot be used together`);if(!e.personal)return e.explicitTeam?(await Go(e.client,e.explicitTeam)).id:e.activeTeamId}async function Xo(e){if([!!e.explicitTeam,!!e.personal,!!e.allScopes].filter(Boolean).length>1)throw Error(`--team, --personal, and --all-scopes are mutually exclusive`);if(e.allScopes)return`all`;if(e.personal)return`personal`;if(e.explicitTeam)return`team:${(await Go(e.client,e.explicitTeam)).id}`;if(e.activeTeamId)return`team:${e.activeTeamId}`}function Zo(e){if(!e)return e;let t={...e};for(let e of[`authToken`,`execToken`])t[e]!==void 0&&(t[e]=`[REDACTED]`);return t}function Qo(n){n.command(`attestation <id-or-name>`).description(`Fetch TEE attestation evidence for a sandbox`).option(`--nonce <hex|auto>`,`Nonce to bind into a fresh attestation report; use auto to generate one`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=n.nonce===`auto`?ie():n.nonce,s=f(`Fetching TEE attestation...`);s.start();let c=await(await q(a,i,t)).getTeeAttestation(o?{attestationNonce:o}:void 0);s.stop(),n.json?e(c):(r(`Attestation fetched for ${t}`),console.log(`TEE type: ${c.attestation.tee_type}`),console.log(`Evidence bytes: ${c.attestation.evidence.length}`),console.log(`Measurement bytes: ${c.attestation.measurement.length}`),console.log(`Timestamp: ${c.attestation.timestamp}`),c.attestationNonce&&console.log(`Nonce: ${c.attestationNonce}`))}),n.command(`list`).description(`List all sandboxes`).option(`-s, --status <status>`,`Filter by status (running, stopped, all)`).option(`-l, --limit <n>`,`Limit results`,`50`).option(`--team <team>`,`List sandboxes for a team by id or name`).option(`--personal`,`List personal sandboxes`).option(`--all-scopes`,`List personal and team sandboxes`).action(async n=>{let{context:r,client:i}=G(n),a=f(`Fetching sandboxes...`);a.start();let o=await Xo({client:i,explicitTeam:n.team,personal:n.personal,allScopes:n.allScopes,activeTeamId:r.activeTeamId}),s=await i.list({status:n.status===`all`?void 0:n.status,limit:Number.parseInt(n.limit,10),scope:o});a.stop(),n.json?e(s):t(s.map(e=>({id:e.id,status:e.status,createdAt:e.createdAt,name:e.name??``})),[{key:`id`,header:`ID`,width:24},{key:`status`,header:`Status`,width:14},{key:`createdAt`,header:`Created`,width:16},{key:`name`,header:`Name`,width:20}])}),n.command(`get <id-or-name>`).description(`Get sandbox details`).option(`--profile`,`Show the active agent profile provenance (name, hash, skills)`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching sandbox...`);a.start();let o=await q(i,r,t);if(a.stop(),n.profile){let e=o.getProfileProvenance?.();e?(l(`Agent profile provenance:`),l(`  Base profile: ${e.base.name??`(inline)`} (${e.base.sha256.slice(0,12)}...)`),l(`  Effective:    ${e.effective.name??`(inline)`} (${e.effective.sha256.slice(0,12)}...)`),l(`  Materialized: ${e.materializedAt}`),e.base.sha256!==e.effective.sha256&&l(`  ⚠ Profile changed since creation (base ≠ effective)`)):l(`No profile materialized (bare sandbox). Create with --profile <name> to install one.`);return}n.json?e(o):u({id:o.id,name:o.name,status:o.status,resources:o.resources,createdAt:o.createdAt?.toISOString(),expiresAt:o.expiresAt?.toISOString(),connection:o.connection})}),n.command(`shapes`).description(`List the named sandbox sizes, the default, and this account's ceiling`).action(async n=>{let{client:r}=G(n),i=await r.shapes();if(n.json){e(i);return}let a=e=>e.cpuCores<=i.ceiling.cpuCores&&e.memoryMB<=i.ceiling.memoryMB&&e.diskGB<=i.ceiling.diskGB;t(i.presets.map(e=>({name:e.name===i.default?`${e.name} (default)`:e.name,cpu:e.cpuCores,memory:`${e.memoryMB} MB`,disk:`${e.diskGB} GB`,available:a(e)?`yes`:e.name===i.default?`clamped to ceiling`:`above ceiling`})),[{key:`name`,header:`Shape`,width:18},{key:`cpu`,header:`vCPU`,width:6},{key:`memory`,header:`Memory`,width:10},{key:`disk`,header:`Disk`,width:8},{key:`available`,header:`Available`,width:14}]),l(`Ceiling for this account: ${o(i.ceiling)}`)}),n.command(`delete <id-or-name>`).description(`Delete a sandbox`).option(`-f, --force`,`Skip confirmation`).option(`--name`,`Treat the reference as a sandbox name`).addOption(new _e(`--until <state>`,`Wait for physical removal`).choices([`removed`])).option(`--retry-cleanup`,`Retry server-side cleanup after the sandbox disappeared from get/list`).action(async(e,t)=>{if(!t.force&&!await pr(`Delete sandbox ${e}? [y/N] `,`--force`)){l(`Cancelled.`);return}let{context:n,client:i}=G(t),a=f(`Deleting sandbox...`);a.start();let o=await or(i,n,e,{retryCleanup:t.retryCleanup,name:t.name,until:t.until});a.stop(),r(o===`already_absent`?`Sandbox ${e} was already gone.`:`Sandbox ${e} deleted.`)}),n.command(`stop <id-or-name>`).description(`Stop a running sandbox`).option(`--name`,`Treat the reference as a sandbox name`).option(`--no-wait`,`Return once the stop is accepted and print the operation to poll`).action(async(e,t)=>{let{context:n,client:i}=G(t),a=f(`Stopping sandbox...`);a.start();let o=await q(i,n,e,{nameOnly:t.name});if(t.wait===!1){let e=await o.stop({wait:!1});a.stop(),Uo(e.info,!!t.json);return}await o.stop(),a.stop(),r(`Sandbox ${e} stopped.`)}),n.command(`resume <id-or-name>`).description(`Resume a stopped sandbox`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`-t, --timeout <ms>`,`Resume timeout in milliseconds; a cold resume re-provisions the sandbox, so this defaults higher than other commands (default 120000)`,`120000`).action(async(e,t)=>{let n=Number.parseInt(t.timeout,10);if(!Number.isFinite(n)||n<=0)throw Error(`--timeout must be a positive number of milliseconds`);let i=U({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:n}),a=W(i),o=f(`Resuming sandbox...`);o.start();let s=await q(a,i,e);await s.resume({timeoutMs:n}),t.wait&&(o.text=`Waiting for sandbox to start...`,await s.waitFor(`running`,{timeoutMs:n})),o.stop(),r(`Sandbox ${s.id} resumed.`)})}function $o(t){t.command(`create`).option(`--cpu-features <flags>`,`Required Linux CPU flags, comma-separated`).description(`Create a new sandbox`).option(`-n, --name <name>`,`Sandbox name`).option(`-e, --environment <environment>`,es).addOption(ts()).option(`--bare`,`Create a bare sandbox without the agent runtime`).option(`--ssh`,`Enable SSH access`).option(`--ssh-key <key>`,`SSH public key for authentication`).option(`--ssh-keys <names...>`,`Stored SSH key names or IDs for authentication`).option(`--ssh-key-file <paths...>`,`SSH public key file paths for authentication`).option(`--web-terminal`,`Enable web terminal`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--secret <names...>`,`Secrets selected by bare name for box delivery (value in the sandbox env). For proxy custody use --proxy-secret`).option(`--proxy-secret <bindings...>`,`Canonical proxy custody binding(s): one binding as inline JSON, or @file with a JSON array. The value stays at the egress proxy and is redeemed only within the binding's scope (hosts/methods/paths/TTL); the box reads a placeholder. Repeatable`).option(`--metadata <entries...>`,`Metadata entries (KEY=VALUE or KEY=JSON)`).option(`--cpu <cores>`,"CPU cores (omit for the platform default; see `sandbox shapes`)").option(`--memory <mb>`,`Memory in MB (omit for the platform default)`).option(`--disk <gb>`,`Disk size in GB (omit for the platform default)`).option(`--accelerator-kind <kind>`,`Accelerator kind, for example nvidia-h100 or amd-mi300x`).option(`--accelerator-count <count>`,`Accelerator device count`,`1`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--gpu-provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum customer spend for the create-time GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum create-time GPU lease lifetime in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy the create-time GPU lease after this many idle seconds`).option(`--lifetime <seconds>`,`Max wall-clock lifetime before the sandbox is suspended — stopped, not deleted; resume it within the cold window (default 3600 = 1h). Raise it for long sessions, e.g. --lifetime 7200`,`3600`).option(`--idle-timeout <seconds>`,"Idle time before the sandbox is stopped — not deleted (default 900 = 15m). Resume it later with `tangle sandbox resume <id-or-name>`, or it auto-resumes on next use. Raise it for demos, e.g. --idle-timeout 3600",`900`).option(`--from-snapshot <id>`,`Create the sandbox from a snapshot`).option(`--public-template <id-or-slug>`,`Create the sandbox from a published public template`).option(`--public-template-version <id>`,`Pin creation to a specific published public-template version`).option(`--billing-owner <userId>`,`Platform user that pays for the sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--team <team>`,`Create in a team by id or name`).option(`--personal`,`Create a personal sandbox even when a team is active`).option(`--git-url <url>`,`Git repository URL to clone during provisioning`).option(`--git-ref <ref>`,`Git branch, tag, or commit to checkout`).option(`--git-depth <depth>`,`Git clone depth`).option(`--git-sparse <paths...>`,`Sparse checkout paths`).option(`--git-token-env <name>`,`Name of an environment variable containing the Git HTTPS auth token`).option(`--git-token-stdin`,`Read the Git HTTPS auth token from stdin`).option(`--storage-type <type>`,`BYOS3 storage type (s3, gcs, r2)`).option(`--storage-bucket <name>`,`BYOS3 bucket name`).option(`--storage-endpoint <url>`,`BYOS3 endpoint URL`).option(`--storage-region <region>`,`BYOS3 region`).option(`--storage-prefix <prefix>`,`BYOS3 path prefix`).option(`--storage-access-key-id <id>`,`BYOS3 access key ID`).option(`--storage-secret-access-key-env <name>`,`Name of an environment variable containing the BYOS3 secret access key`).option(`--storage-secret-access-key-stdin`,`Read the BYOS3 secret access key from stdin`).addOption(new _e(`--driver <type>`,`Run on Tangle network operators instead of the platform's hosts (--tee needs it)`).choices([`tangle`])).option(`--backend <type>`,`Backend agent type (${y.join(`, `)})`).option(`--backend-model <model>`,`Model override (format: provider/model)`).addOption(new _e(`--reasoning-effort <level>`,`Reasoning effort for the backend's model; overrides the profile's model.reasoningEffort`).choices(Se)).option(`--backend-api-key-env <name>`,`Name of an environment variable containing the BYOK backend API key`).option(`--backend-api-key-stdin`,`Read the BYOK backend API key from stdin`).option(`--cli-auth <secret>`,"Run --backend claude-code or codex on your own subscription: the stored secret holding a `claude setup-token` token or a Codex auth.json (see `tangle secret create`)").option(`--profile <path>`,`Path to an AgentProfile JSON file to install as the sandbox's backend profile (carries skills, tools, MCP, model). Use with --backend; the profile's inline skills materialize into the harness's native skill directory on first turn`).option(`--profile-stdin`,`Read the AgentProfile JSON from stdin instead of a file (use with --profile)`).option(`--tee <type>`,`Require a TEE backend (any, tdx, nitro, sev-snp, phala-dstack)`).option(`--sealed`,`Request TEE sealed-secret support`).option(`--attestation-nonce <hex|auto>`,`Deploy-time attestation nonce; use auto to generate one`).option(`--attestation-refresh`,`Generate a fresh deploy-time attestation nonce when --tee is set`).option(`--require-attestation`,`Fail unless TEE attestation evidence is returned`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`--timeout <ms>`,`HTTP timeout in milliseconds`,`30000`).action(async t=>{let n=await ko({envVarName:t.gitTokenEnv,fromStdin:t.gitTokenStdin,flagPrefix:`--git-token`}),i=await ko({envVarName:t.storageSecretAccessKeyEnv,fromStdin:t.storageSecretAccessKeyStdin,flagPrefix:`--storage-secret-access-key`}),a=await ko({envVarName:t.backendApiKeyEnv,fromStdin:t.backendApiKeyStdin,flagPrefix:`--backend-api-key`}),o=Ao({secret:t.cliAuth,backend:t.backend,apiKeyGiven:a!==void 0}),s;if(t.profileStdin){let e=await hr(`--profile-stdin`,`the AgentProfile JSON`);try{s=JSON.parse(e)}catch{H(Error(`--profile-stdin: the input is not valid JSON`));return}}else if(t.profile){let e=String(t.profile);if(e.startsWith(`.`)||e.startsWith(`/`)||e.endsWith(`.json`))try{s=JSON.parse(Re(e,`utf8`))}catch(t){H(Error(`--profile ${e}: ${t.message}`));return}else try{s=await Oo(e,t)}catch(t){H(Error(`--profile ${e}: ${t.message}`));return}}s=rs(s,t.reasoningEffort);let c=U({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:t.timeout?Number.parseInt(t.timeout,10):void 0}),l=W(c),d=f(`Creating sandbox...`);d.start();let p=await Yo({client:l,explicitTeam:t.team,personal:t.personal,activeTeamId:c.activeTeamId}),m=yo(t.env??[],`--env`,`env`),h=t.metadata?Po(t.metadata):void 0,g=Io(t,n),_=Lo(t,i),v=t.acceleratorKind?po({kind:String(t.acceleratorKind),count:String(t.acceleratorCount),memory:typeof t.acceleratorMemory==`string`?t.acceleratorMemory:void 0}):void 0,y=mo({provider:typeof t.gpuProvider==`string`?t.gpuProvider:void 0,image:typeof t.gpuWorkerImage==`string`?t.gpuWorkerImage:void 0,env:Array.isArray(t.gpuEnv)?t.gpuEnv:void 0,maxSpendUsd:typeof t.gpuMaxSpendUsd==`string`?t.gpuMaxSpendUsd:void 0,maxLifetime:typeof t.gpuMaxLifetime==`string`?t.gpuMaxLifetime:void 0,idleTimeout:typeof t.gpuIdleTimeout==`string`?t.gpuIdleTimeout:void 0},!!v,`Create-time GPU lease flags require --accelerator-kind`),b=t.driver?{type:`tangle`}:void 0,x=t.backend||t.backendModel||s?{...t.backend?{type:ae(t.backend)}:{},...s?{profile:s}:{},model:t.backendModel||a||o?{...t.backendModel?No(t.backendModel):{},apiKey:a,...o?{cliAuth:o}:{}}:void 0}:void 0,S=jo(t.secret),C=o?[...new Set([...S??[],o.secretEnv])]:S,w=zo(t.proxySecret),T=Mo(t,v),ee=t.sshKeyFile??(t.ssh&&!t.sshKey&&!t.sshKeys?.length?[ns()]:[]),E=[...t.sshKey?[t.sshKey]:[],...ee.map(e=>Re(e,`utf8`).trim())],D={name:t.name,environment:t.environment,runtime:t.runtime,cpuFeatures:t.cpuFeatures?.split(`,`).map(e=>e.trim()),bare:t.bare||void 0,sshEnabled:t.ssh||!!t.sshKey||E.length>0||!!t.sshKeys?.length,sshPublicKeys:E.length>0?E:void 0,sshKeyIds:t.sshKeys,webTerminalEnabled:t.webTerminal,env:Object.keys(m).length>0?m:void 0,git:g,...T?{resources:T}:{},gpuLease:y,maxLifetimeSeconds:Number.parseInt(t.lifetime,10),idleTimeoutSeconds:Number.parseInt(t.idleTimeout,10),storage:_,fromSnapshot:t.fromSnapshot,publicTemplateId:t.publicTemplate,publicTemplateVersionId:t.publicTemplateVersion,teamId:p,...t.billingOwner?{billingOwnerId:t.billingOwner}:{},secrets:C,...w?{proxySecrets:w}:{},metadata:h,driver:b,backend:x},O=t.tee?{tee:t.tee,sealed:t.sealed||void 0,attestationRefresh:t.attestationRefresh||t.attestationNonce===`auto`||void 0}:void 0,k=O?await re(l,{...D,confidential:O,attestationNonce:t.attestationNonce??(t.attestationRefresh?`auto`:void 0),requireAttestation:t.requireAttestation??!0}):void 0,A=k?.sandbox??await l.create(D);t.wait&&(d.text=`Waiting for sandbox to start...`,await A.waitFor(`running`,{timeoutMs:12e4}),await A.refresh()),d.stop(),t.json?e({id:A.id,name:A.name,status:A.status,resources:A.resources,createdAt:A.createdAt,expiresAt:A.expiresAt,connection:Zo(A.connection),teamId:p,gpuLease:A.gpuLease,confidential:O,attestation:k?.attestation,attestationNonce:k?.attestationNonce}):(r(`Sandbox created: ${A.id}`),u({id:A.id,name:A.name,status:A.status,resources:A.resources,createdAt:A.createdAt?.toISOString(),expiresAt:A.expiresAt?.toISOString(),connection:A.connection}),p&&console.log(`Team: ${p}`),A.gpuLease&&(console.log(`GPU lease: ${A.gpuLease.id}`),Bo(A.gpuLease)),O&&(console.log(`TEE: ${O.tee}`),console.log(`Attestation: ${k?.attestation?`present`:`not returned`}`),k?.attestationNonce&&console.log(`Attestation nonce: ${k.attestationNonce}`)))})}const es="A catalog environment, a container image reference, or a built image ID. Firecracker runs only images pinned by repository@sha256 that the cell's Firecracker hosts carry; `environments list` shows each image's runtimes";function ts(){return new _e(`--runtime <runtime>`,`Isolation on the platform's hosts: docker runs a container on the host kernel, firecracker a microVM with its own kernel. Omit for the platform default`).choices(ee)}function ns(){let e=[`id_ed25519`,`id_ecdsa`,`id_rsa`].map(e=>`${I()}/.ssh/${e}.pub`),t=e.find(e=>Ie(e));if(!t)throw Error(`--ssh needs a public key and found none at ${e.join(`, `)}. Run ssh-keygen -t ed25519, or pass --ssh-key-file.`);return t}function rs(e,t){if(!t)return e;let n=e?.model??{};return{...e,model:{...n,reasoningEffort:t}}}function is(e){if(e.spec){let t=JSON.parse(Re(e.spec,`utf8`));return{base:{fleetId:e.fleetId,defaults:t.defaults,policy:t.policy,workspace:t.workspace,metadata:t.metadata},machines:t.machines??[]}}let t=ss(e),n=cs(e,!!t?.accelerator),r={...e.environment?{environment:e.environment}:{},...t?{resources:t}:{},...e.runtime?{runtime:e.runtime}:{},...n?{gpuLease:n}:{},...e.backend?{backend:{type:e.backend}}:{}},i=ls(e),a=Math.max(1,Number(e.count)||1),o=Array.from({length:a},(e,t)=>({machineId:`worker-${t+1}`}));return{base:{fleetId:e.fleetId,defaults:Object.keys(r).length>0?r:void 0,policy:i,workspace:{mode:e.workspace}},machines:o}}function as(e){let{base:t,machines:n}=is(e);return{...t,machines:n}}function os(e){let{base:t,machines:n}=is(e);return{...t,workers:n}}function ss(e){let t={};if(e.cpu&&(t.cpuCores=Number(e.cpu)),e.memory&&(t.memoryMB=Number(e.memory)),e.disk&&(t.diskGB=Number(e.disk)),e.acceleratorKind)t.accelerator=po({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory});else if(e.acceleratorCount||e.acceleratorMemory)throw Error(`--accelerator-count and --accelerator-memory require --accelerator-kind`);return Object.keys(t).length>0?t:void 0}function cs(e,t){return mo({provider:e.gpuProvider,image:e.gpuWorkerImage,env:e.gpuEnv,maxSpendUsd:e.gpuMaxSpendUsd,maxLifetime:e.gpuMaxLifetime,idleTimeout:e.gpuIdleTimeout},t,`Fleet GPU lease flags require --accelerator-kind`)}function ls(e){let t={};return e.maxSpendUsd&&(t.maxSpendUsd=Number(e.maxSpendUsd)),e.maxLifetime&&(t.maxLifetimeSeconds=Number(e.maxLifetime)),Object.keys(t).length>0?t:void 0}function us(n){n.command(`create`).description(`Create a sandbox fleet`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--count <n>`,`Number of worker machines`,`1`).option(`--environment <environment>`,es).addOption(ts()).option(`--cpu <cores>`,`CPU cores per machine`).option(`--memory <mb>`,`Memory in MB per machine`).option(`--disk <gb>`,`Disk in GB per machine`).option(`--accelerator-kind <kind>`,`Accelerator kind per machine, for example nvidia-l4 or nvidia-h100`).option(`--accelerator-count <count>`,`Accelerator devices per machine`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--gpu-provider <provider>`,`GPU cloud provider per machine; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for each GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum spend per machine GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum GPU lease lifetime per machine in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy each GPU lease after this many idle seconds`).option(`--backend <id>`,`Agent backend type`).option(`--workspace <mode>`,`Workspace mode: isolated (no driver supports shared yet)`,`isolated`).option(`--max-spend-usd <n>`,`Fleet spend cap in USD (policy)`).option(`--max-lifetime <s>`,`Max machine lifetime in seconds (policy)`).option(`--spec <file.json>`,`Path to a JSON file describing the fleet (overrides synthesized machines)`).option(`--coordinator`,`Create a coordinator + workers fleet (routes to createWithCoordinator)`).action(async n=>{let{client:i}=G(n),a=f(`Creating fleet...`);a.start();let o=n.coordinator?await i.fleets.createWithCoordinator(os(n)):await i.fleets.create(as(n));a.stop();let s=Eo(o.machines);n.json?e({fleetId:o.fleetId,machines:s}):(r(`Fleet created: ${o.fleetId}`),t(s,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}]))})}function ds(n){n.command(`exec <fleet-id> <command>`).description(`Run a shell command across the fleet's machines`).option(`--machine <id...>`,`Restrict to a subset of machine ids (default: all)`).option(`--cwd <dir>`,`Working directory for the command`).option(`--timeout <ms>`,`Per-machine timeout in milliseconds`).option(`--max-concurrent <n>`,`Max concurrent dispatches`).action(async(n,r,i)=>{let{client:a}=G(i),o=f(`Dispatching command...`);o.start();let s=await(await a.fleets.list({fleetId:n})).dispatchExecDetailed(r,{machines:i.machine,cwd:i.cwd,timeoutMs:i.timeout?Number(i.timeout):void 0,maxConcurrent:i.maxConcurrent?Number(i.maxConcurrent):void 0});if(o.stop(),i.json)e(s);else{t(s.results.map(e=>({machineId:e.machineId,ok:e.ok,exitCode:e.result?.exitCode,durationMs:e.durationMs})),[{key:`machineId`,header:`Machine`,width:20},{key:`ok`,header:`OK`,width:6},{key:`exitCode`,header:`Exit`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14}]);for(let e of s.results){let t=e.result?.stdout,n=e.result?.stderr;t&&(console.log(`\n[${e.machineId}] stdout:`),console.log(t)),n&&(console.log(`\n[${e.machineId}] stderr:`),console.log(n)),e.error&&console.log(`\n[${e.machineId}] error: ${e.error.message}`)}}s.results.some(e=>e.ok===!1)&&(process.exitCode=1)}),n.command(`run [prompt]`).description(`Create a fleet of agents, run one turn on every agent, print each result, then delete the fleet`).requiredOption(`--agents <n|file>`,`Number of agents, or a JSON file with an array of agent specs (agentId, harness, model, profile or { profileId, revision }, task)`).option(`--placement <mode>`,`auto (pack by sandbox memory), dedicated (one sandbox per agent), or a number of agents per sandbox`,`auto`).option(`--model <id>`,`Model every agent runs, e.g. gpt-4.1-mini`).option(`--memory <mb>`,`Memory in MB per sandbox; auto placement packs by it`).option(`--environment <environment>`,`Environment for each sandbox`).option(`--max-spend-usd <usd>`,`Budget for the fleet in USD, enforced by the Platform on the fleet's own key`).option(`--timeout <ms>`,`Per-agent turn timeout in milliseconds`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--parent-fleet <id>`,`Fleet that spawns this one; its cap must cover this cap`).option(`--parent-agent <id>`,`Agent of --parent-fleet that spawns this one`).option(`--keep`,`Keep the fleet after the run instead of deleting it`).action(async(t,n)=>{let i=/^\d+$/.test(n.agents)?Number(n.agents):JSON.parse(Re(n.agents,`utf8`));if(!Array.isArray(i)&&t===void 0)throw Error(`A prompt is required unless --agents names a file whose agents carry tasks`);let{client:a}=G(n);if(!!n.parentFleet!=!!n.parentAgent)throw Error(`--parent-fleet and --parent-agent go together`);let o=n.placement===`auto`||n.placement===`dedicated`?n.placement:{agentsPerSandbox:Number(n.placement)},c=n.maxSpendUsd?Number(n.maxSpendUsd):void 0,l=f(`Creating fleet...`);l.start();let u=Date.now(),d=await a.fleets.create({fleetId:n.fleetId,agents:i,placement:o,defaults:{...n.environment?{environment:n.environment}:{},...n.memory?{resources:{memoryMB:Number(n.memory)}}:{},...n.model?{backend:{type:`opencode`,model:{model:n.model}}}:{}},...c===void 0?{}:{budgetUsd:c},...n.parentFleet?{parent:{fleetId:n.parentFleet,agentId:n.parentAgent}}:{}}),p=Date.now()-u;l.stop(),n.json||r(`Fleet ${d.fleetId}: ${d.agents.length} agents on ${d.machines.size} sandboxes in ${p} ms`);let m=[],h;try{for await(let e of d.run(t,{timeoutMs:n.timeout?Number(n.timeout):void 0})){if(e.type===`agent.finished`&&!n.json){let t=e.result;console.log(`[${t.agentId}] ${t.harness??`default`}/${t.model??`default`} ${t.status} ${t.durationMs}ms ${t.costUsd===void 0?`no cost reported`:`$${t.costUsd.toFixed(5)}`} ${t.result?.response??t.error??``}`)}e.type===`fleet.finished`&&(m=e.results,h=e.spend)}}finally{n.keep||await d.delete({continueOnError:!0})}n.json?e({fleetId:d.fleetId,createMs:p,sandboxes:d.machines.size,results:m,spend:h,deleted:!n.keep}):s({fleetId:d.fleetId,completed:m.filter(e=>e.status===`completed`).length,agents:m.length,spend:JSON.stringify(h),deleted:!n.keep}),m.some(e=>e.status!==`completed`)&&(process.exitCode=1)}),n.command(`cancel <fleet-id>`).description(`Interrupt every agent of a fleet and cancel its child fleets; sandboxes keep running`).action(async(t,n)=>{let{client:i}=G(n),a=await(await i.fleets.list({fleetId:t})).cancel();n.json?e({fleetId:t,...a}):r(`Fleet ${t}: interrupted ${a.interrupted} agents, cancelled ${a.children} child fleets`)})}const fs=[`list`,`create`,`delete`,`exec`,`prompt`,`read`,`write`];function ps(e){if(!(!e||e.length===0)){for(let t of e)if(!fs.includes(t))throw Error(`Invalid token action '${t}'. Allowed: ${fs.join(`, `)}`);return e}}function ms(e){return e.length<=12?`****`:`${e.slice(0,6)}...${e.slice(-4)} (masked — use --json for full value)`}function hs(t){t.command(`token <fleet-id>`).description(`Mint a scoped fleet bearer token (treated as a secret)`).option(`--action <a...>`,`Allowed actions: list create delete exec prompt read write (prompt grants nothing since fleet prompt dispatch was removed)`).option(`--ttl-minutes <n>`,`Token lifetime in minutes`).action(async(t,n)=>{let{client:r}=G(n),i=f(`Minting fleet token...`);i.start();let a=await r.fleets.createToken(t,{actions:ps(n.action),ttlMinutes:n.ttlMinutes?Number(n.ttlMinutes):void 0});i.stop(),n.json?e(a):(s({"Fleet ID":a.fleetId,Token:ms(a.token),"Expires at":new Date(a.expiresAt).toISOString(),Actions:a.actions.join(`, `)}),console.log(`
-Re-run with --json to print the full token value.`))})}function gs(){let n=new N(`workspace`).description(`Manage a fleet's shared workspace`);return n.command(`snapshot <fleet-id>`).description(`Snapshot the fleet's shared workspace`).action(async(t,n)=>{let{client:i}=G(n),a=f(`Creating workspace snapshot...`);a.start();let o=await i.fleets.createWorkspaceSnapshot(t);a.stop(),n.json?e(o):r(`Workspace snapshot created: ${o.snapshotId??o.id}`)}),n.command(`restore <fleet-id> <snapshot-id>`).description(`Restore the fleet's shared workspace from a snapshot`).action(async(t,n,i)=>{let{client:a}=G(i),o=f(`Restoring workspace...`);o.start();let s=await a.fleets.restoreWorkspaceSnapshot(t,n);o.stop(),i.json?e(s):r(`Workspace restored from ${s.snapshotId??n}`)}),n.command(`reconcile <fleet-id>`).description(`Re-mount the shared workspace on all fleet machines`).action(async(n,r)=>{let{client:i}=G(r),a=f(`Reconciling workspace...`);a.start();let o=await i.fleets.reconcileWorkspace(n);a.stop(),r.json?e(o):(s({"Fleet ID":o.fleetId,Checked:o.checked,"Orphaned mounts":o.orphanedMounts}),t(o.machines,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`mounted`,header:`Mounted`,width:10}]))}),n}function _s(){let e=new N(`fleet`).description(`Manage sandbox fleets`);return us(e),Do(e),e.addCommand(gs()),ds(e),To(e),hs(e),e}function vs(){let t=new N(`fs`).description(`File system operations on sandboxes`);return t.command(`upload`).description(`Upload a file to a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<local-path>`,`Local file path`).argument(`<remote-path>`,`Remote destination path`).action(async(t,n,r,i)=>{let{context:a,client:o}=G(i),s=await q(o,a,t);if(s=await J(s),!Ne.existsSync(n))throw Error(`Local file not found: ${n}`);let c=Ne.statSync(n),l=Date.now();i.json||console.error(`Uploading ${n} to ${r}...`),await s.fs.upload(n,r,{onProgress:e=>{if(i.json)return;let t=e.percentage.toFixed(1);process.stderr.write(`\rProgress: ${t}% (${e.bytesUploaded}/${e.totalBytes} bytes)`)}});let u=Date.now()-l;i.json||console.error(``),i.json?e({success:!0,localPath:n,remotePath:r,size:c.size,durationMs:u}):console.log(`✓ Uploaded ${c.size} bytes in ${u}ms`)}),t.command(`download`).description(`Download a file from a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<remote-path>`,`Remote file path`).argument(`<local-path>`,`Local destination path`).action(async(t,n,r,i)=>{let{context:a,client:o}=G(i),s=await q(o,a,t);s=await J(s);let c=Date.now();i.json||console.error(`Downloading ${n} to ${r}...`),await s.fs.download(n,r,{onProgress:e=>{if(i.json)return;let t=e.percentage.toFixed(1);process.stderr.write(`\rProgress: ${t}% (${e.bytesDownloaded}/${e.totalBytes} bytes)`)}});let l=Date.now()-c,u=Ne.statSync(r);i.json||console.error(``),i.json?e({success:!0,remotePath:n,localPath:r,size:u.size,durationMs:l}):console.log(`✓ Downloaded ${u.size} bytes in ${l}ms`)}),t.command(`ls`).description(`List directory contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`[path]`,`Directory path`,`.`).option(`-l, --long`,`Show detailed information`).option(`-a, --all`,`Include hidden files`).action(async(t,n,r)=>{let{context:a,client:o}=G(r),s=await q(o,a,t);s=await J(s);let c=await s.fs.list(n,{all:r.all,long:r.long});if(r.json)e(c);else if(r.long)i([`Mode`,`Owner`,`Group`,`Size`,`Modified`,`Name`],c.map(e=>{let t=e.isDir?`d`:e.isSymlink?`l`:`-`,n=ys(e.permissions),r=e.isDir?`<DIR>`:bs(e.size),i=e.modTime.toLocaleDateString();return[t+n,e.owner,e.group,r,i,e.name]}));else{let e=c.map(e=>e.isDir?`${e.name}/`:e.name);console.log(e.join(`  `))}}),t.command(`stat`).description(`Get file or directory information`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file or directory`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o);let s=await o.fs.stat(n);r.json?e(s):(console.log(`  File: ${s.name}`),console.log(`  Path: ${s.path}`),console.log(`  Size: ${bs(s.size)} (${s.size} bytes)`),console.log(`  Type: ${s.isDir?`directory`:s.isSymlink?`symlink`:`file`}`),console.log(`  Mode: ${ys(s.permissions)} (${s.permissions.toString(8)})`),console.log(`  Owner: ${s.owner}`),console.log(`  Group: ${s.group}`),console.log(`  Modified: ${s.modTime.toISOString()}`),console.log(`  Accessed: ${s.accessTime.toISOString()}`))}),t.command(`cat`).description(`Print file contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o);let s=await o.read(n);r.json?e({path:n,content:s}):console.log(s)}),t.command(`rm`).description(`Delete a file or directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to delete`).option(`-r, --recursive`,`Delete directories recursively`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o),await o.fs.delete(n,{recursive:r.recursive}),r.json?e({success:!0,path:n,deleted:!0}):console.log(`✓ Deleted: ${n}`)}),t.command(`mkdir`).description(`Create a directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Directory path to create`).option(`-p, --parents`,`Create parent directories as needed`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o),await o.fs.mkdir(n,{recursive:r.parents}),r.json?e({success:!0,path:n,created:!0}):console.log(`✓ Created: ${n}`)}),t.command(`exists`).description(`Check if a path exists`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to check`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o);let s=await o.fs.exists(n);r.json?e({path:n,exists:s}):(console.log(s?`exists`:`not found`),process.exit(+!s))}),t}function ys(e){let t=[`r`,`w`,`x`],n=``;for(let r=2;r>=0;r--){let i=r*3;for(let r=0;r<3;r++)n+=e>>i+(2-r)&1?t[r]:`-`}return n}function bs(e){let t=[`B`,`KB`,`MB`,`GB`,`TB`],n=e,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r++;return r===0?`${n}${t[r]}`:`${n.toFixed(1)}${t[r]}`}function xs(){let t=new N(`git`).description(`Git operations in a sandbox workspace`);return t.command(`status`).description(`Show git repository status`).argument(`<id-or-name>`,`Sandbox ID or name`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching status...`);n.json||a.start();let o=await q(i,r,t);o=await J(o);let s=await o.git.status();if(a.stop(),n.json)e(s);else if(!s.isRepo)console.log(`No git repository in the sandbox workspace.`);else{if(console.log(`Branch:    ${s.branch??`unknown`}`),console.log(`HEAD:      ${s.head.slice(0,7)||`(no commits)`}`),console.log(`Dirty:     ${s.isDirty?`yes`:`no`}`),s.ahead&&console.log(`Ahead:     ${s.ahead}`),s.behind&&console.log(`Behind:    ${s.behind}`),s.staged.length>0){console.log(`\nStaged (${s.staged.length}):`);for(let e of s.staged)console.log(`  + ${e}`)}if(s.modified.length>0){console.log(`\nModified (${s.modified.length}):`);for(let e of s.modified)console.log(`  M ${e}`)}if(s.untracked.length>0){console.log(`\nUntracked (${s.untracked.length}):`);for(let e of s.untracked)console.log(`  ? ${e}`)}}}),t.command(`log`).description(`Show commit log`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`-n, --limit <count>`,`Max commits to show`,`10`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching log...`);n.json||a.start();let o=await q(i,r,t);o=await J(o);let s=await o.git.log(Number.parseInt(n.limit,10));if(a.stop(),n.json)e(s);else if(s.length===0)console.log(`No commits found`);else for(let e of s)console.log(`${e.shortSha} ${e.message.split(`
+`)?e:`${e}\n`}function qa(e){let t=M(I(),`.codex`,`config.toml`),{contents:n,changed:i}=Wa(wa(t),{endpoint:e.endpoint,apiKey:e.apiKey});if(!e.write){console.log(n.trimEnd());return}if(!i){r(`${t} already has the Tangle [otel] block — nothing to change.`);return}Ta(t,n),r(`Merged the Tangle [otel] block into ${t}.`),l("Codex emits content on the logs signal (codex.* events). Set TANGLE_API_KEY in your env before running if you kept the ${TANGLE_API_KEY} reference."),l(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=${e.projectKey??`<your project>`} before running codex.`)}function Ja(e){switch(e){case`claude-code`:return`Claude Code: set OTEL_LOGS_EXPORTER=otlp and the four OTEL_LOG_* gates (OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_TOOL_CONTENT, OTEL_LOG_RAW_API_BODIES).`;case`codex`:return`Codex: set log_user_prompt = true in [otel] (default false redacts content).`;case`opencode`:return`OpenCode: a standalone install emits nothing without the tangle-opencode-exporter shim; inside a Tangle sandbox it is already instrumented.`;case`openclaw`:case`hermes`:case`nanoclaw`:return`${Sa[e]}: no native OTLP exporter and no standalone server to subscribe to — run it inside a Tangle sandbox, where the sidecar adapter exports its content with gen_ai.system=${e}. A bare standalone install emits metadata only.`}}async function Ya(e){let t=Date.now()+e.timeoutSeconds*1e3,n=3e3,r=Math.min(e.timeoutSeconds*1e3,1e4),i=f(`Checking whether content is flowing…`);i.start();let a;try{for(;;){try{a=await Ii({endpoint:e.endpoint,apiKey:e.apiKey,timeoutMs:r})}catch(e){if(Date.now()>=t)throw e;await xe(n);continue}if(a.contentSeen||Date.now()>=t)break;await xe(n)}}finally{i.stop()}if(!a)throw Error(`onboarding status check returned no result`);Xa(a,e.agent),a.contentSeen||(process.exitCode=1)}function Xa(e,t){if(e.contentSeen){r(`Content flowing — Tangle Intelligence can analyze this feed.`),s({"Last seen":e.lastSeenAt??`just now`,Window:`${e.windowDays}d`});return}if(e.tracesSeen){c(`Metadata-only — traces are arriving but carry no content. You missed a content gate.`);let n=t?[t]:Object.keys(e.byAgent).filter(Ca),r=n.length>0?n:xa;for(let n of r){let r=e.byAgent[n];(t||!r||r.tracesSeen&&!r.contentSeen)&&l(Ja(n))}return}c(`No traces yet for your tenant. Run your agent once on a real task, then re-run --verify.`),t&&l(Ja(t))}function Za(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??yn(void 0);if(!t)throw Error(`No Tangle API key found. Pass --api-key, set TANGLE_API_KEY, or run: tangle auth login`);return t}function Qa(){return new N(`connect`).description(`Connect a local coding agent's telemetry to Tangle Intelligence, content on (for SDK integration snippets, see 'tangle agent connect')`).argument(`[agent]`,`claude-code | codex | opencode | openclaw | hermes | nanoclaw`).option(`--endpoint <url>`,`OTLP endpoint base`,xi).option(`-p, --project <key>`,`Project label (tangle.subject.key) to group runs; omit to set it yourself`).option(`--rc <path>`,`Shell rc file to append the Claude Code env block to`).option(`--no-write`,`Print the config instead of writing files (Claude Code / Codex)`).option(`--inline-key`,"Embed the resolved API key literally in the config (default: keep ${TANGLE_API_KEY})").option(`--verify`,`Poll onboarding status and report whether CONTENT is flowing`).option(`--timeout <seconds>`,`Verify poll timeout in seconds`,`120`).option(`--run`,`OpenCode only: run the content exporter against a live OpenCode server until interrupted`).option(`--opencode-url <url>`,`OpenCode server base URL for --run (or set OPENCODE_BASE_URL)`).option(`--format <kind>`,`Claude Code output: shell (export block) | env (.env / docker --env-file) | dockerfile (ENV lines). env/dockerfile are the cron/container path — printed to stdout, no shell-rc edit, no TTY`,`shell`).option(`--content <tier>`,`Claude Code content tier: full (everything) | prompts (task+prompts+tool-args) | metadata (telemetry on, content off)`,`full`).action(async(e,t)=>{let n=Li(t.endpoint);if(t.run){if((e?eo(e):`opencode`)!==`opencode`)throw Error(`--run is OpenCode-only: it runs the content exporter against a live OpenCode server. Other agents export natively once configured.`);await io({endpoint:n,apiKey:Za(t.apiKey),opencodeUrl:t.opencodeUrl});return}if(t.verify){await Ya({endpoint:n,apiKey:Za(t.apiKey),agent:e?eo(e):void 0,timeoutSeconds:ba(t.timeout,`--timeout`)});return}let r=e?eo(e):await to(),i=t.inlineKey?Za(t.apiKey):void 0;r===`claude-code`?await Ra({endpoint:n,apiKey:i,projectKey:t.project,rcPath:t.rc,write:t.write!==!1,content:La(t.content),format:Ia(t.format)}):r===`codex`?qa({endpoint:n,apiKey:i,projectKey:t.project,write:t.write!==!1}):r===`opencode`?no({endpoint:n}):ro(r,{endpoint:n}),console.log(),l(`Run your agent on a real task, then verify content is flowing: tangle connect ${r} --verify`)})}function $a(){return new N(`opencode-exporter`).description(`Export a running OpenCode's content to Tangle Intelligence (standalone shim)`).option(`--endpoint <url>`,`OTLP endpoint base`,xi).option(`--opencode-url <url>`,`OpenCode server base URL (or set OPENCODE_BASE_URL)`).action(async e=>{await io({endpoint:Li(e.endpoint),apiKey:Za(e.apiKey),opencodeUrl:e.opencodeUrl})})}function eo(e){if(Ca(e))return e;throw Error(`Unknown agent '${e}'. Choose one of: ${xa.join(`, `)}`)}async function to(){if(!process.stdin.isTTY)throw Error(`Specify an agent: tangle connect <${xa.join(`|`)}>`);console.log(`Which coding agent are you connecting?`),xa.forEach((e,t)=>{console.log(`  ${t+1}) ${Sa[e]} (${e})`)});let e=await mr(`Enter a number or name`,`1`);return xa[Number.parseInt(e,10)-1]||eo(e.trim())}function no(e){let t=Li(e.endpoint);c(`OpenCode has no native OTel exporter, so a standalone install emits nothing without a shim.`),console.log(),s({"Inside a Tangle sandbox":`already instrumented — our adapter exports OpenCode's event-stream content. Nothing to do.`,Standalone:`run 'tangle connect opencode --run' alongside a running OpenCode, exporting to ${t}.`}),console.log(),l(`Start OpenCode in server mode ('opencode serve'), then in another terminal run: tangle connect opencode --run`),l(`The exporter subscribes to OpenCode's SSE event bus and exports content-bearing OTLP (prompt/completion/tool content) to Tangle. Verify with: tangle connect opencode --verify`),l(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting the exporter.`)}function ro(e,t){let n=Li(t.endpoint),r=Sa[e];c(`${r} has no native OTel exporter, so a standalone install emits nothing without instrumentation.`),console.log(),s({"Inside a Tangle sandbox":`already instrumented — the sidecar adapter exports ${r}'s prompt/completion/tool content (gen_ai.system=${e}) to ${n}. Nothing to do.`,Standalone:`${r} exposes no OTLP and no event-bus server; run it inside a Tangle sandbox to capture content.`}),console.log(),l(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting ${r}.`),l(`Verify content is flowing: tangle connect ${e} --verify`)}async function io(e){let t=ha(e.opencodeUrl),n=new AbortController,i=()=>n.abort();process.on(`SIGINT`,i),process.on(`SIGTERM`,i),l(`Subscribing to OpenCode at ${t} — exporting content to Tangle.`),l(`Run OpenCode tasks now. Press Ctrl-C to stop.`),console.log();let a=0,o;try{o=await ya({endpoint:e.endpoint,apiKey:e.apiKey,opencodeBaseUrl:t,signal:n.signal,onExport:({eventType:e,records:t})=>{a+=t,l(`exported ${t} record(s) from ${e} (total ${a})`)}})}catch(e){if(e instanceof _a){let{recordsExported:t,contentEventsExported:n}=e.partial;console.log(),c(`Exporter failed after exporting ${t} content record(s) from ${n} event(s): ${e.message}`)}throw e}finally{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)}if(console.log(),o.contentEventsExported===0){c(`Saw ${o.eventsSeen} event(s) but none carried content. Run a real OpenCode task (a prompt that produces text or a tool call), then re-run.`);return}r(`Exported ${o.recordsExported} content record(s) from ${o.contentEventsExported} event(s).`),l(`Verify it landed: tangle connect opencode --verify`)}function ao(){let t=new N(`environments`).alias(`env`).description(`Manage sandbox environments`);return t.command(`list`).alias(`ls`).description(`List available environments`).action(async t=>{let{client:n}=G(t),r=f(`Fetching environments...`);t.json||r.start();let a=await n.environments.list();r.stop(),t.json?e(a):a.length===0?console.log(`No environments found`):i([`ID`,`Description`,`Version`,`Runtimes`],a.map(e=>[e.id,e.description??``,e.version,e.runtimes.join(`, `)]))}),t.command(`get`).description(`Get environment details`).argument(`<id>`,`Environment ID`).action(async(t,n)=>{let{client:r}=G(n),i=f(`Fetching environment...`);n.json||i.start();let a=await r.environments.get(t);if(i.stop(),!a){console.error(`Environment not found: ${t}`),process.exit(1);return}n.json?e(a):(console.log(`ID:          ${a.id}`),console.log(`Description: ${a.description??`-`}`),console.log(`Version:     ${a.version}`),console.log(`Runtimes:    ${a.runtimes.join(`, `)}`),a.base&&console.log(`Base:        ${a.base}`))}),t}const oo=F.string().trim().toLowerCase().min(1).max(64).regex(/^[a-z][a-z0-9-]*$/),so=F.string().trim().toLowerCase().min(1).max(128).regex(/^[a-z0-9][a-z0-9._-]*$/),co=F.object({kind:so,count:F.number().int().positive().default(1),vramGb:F.number().positive().optional()}).strict();F.object({command:F.string().min(1).max(8192),timeoutMs:F.number().int().positive().max(2147453647).optional(),env:F.record(F.string(),F.string()).optional(),cwd:F.string().min(1).max(2048).optional()}).strict(),F.object({refresh:F.enum([`true`,`false`]).optional(),acceleratorKind:so.optional(),acceleratorCount:F.coerce.number().pipe(co.shape.count.unwrap()).optional(),acceleratorVramGb:F.coerce.number().positive().optional()}).strict(),F.object({maxSpendUsd:F.number().positive().max(1e4).optional(),maxLifetimeSeconds:F.number().int().positive().max(1440*60).optional()}).strict().refine(e=>e.maxSpendUsd!==void 0||e.maxLifetimeSeconds!==void 0,`Renewal requires a lifetime or spend cap`);const lo=F.object({provider:oo.optional(),image:F.string().min(1).max(512).optional(),env:F.record(F.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/),F.string()).optional(),diskGb:F.number().int().positive().optional(),volumeGb:F.number().int().nonnegative().optional(),volumeMountPath:F.string().startsWith(`/`).max(2048).optional(),region:F.string().min(1).max(128).optional(),manifest:F.record(F.string(),F.unknown()).optional(),command:F.array(F.string().max(8192)).min(1).max(256).optional(),ports:F.array(F.number().int().min(1).max(65535)).max(32).optional(),endpoint:F.object({port:F.number().int().min(1).max(65535),healthPath:F.string().regex(/^\/(?![/\\])/).refine(e=>![`\r`,`
+`,`	`].some(t=>e.includes(t))).max(2048).optional()}).strict().optional(),allowSpot:F.boolean().optional(),maxHourlyUsd:F.number().positive().optional(),weights:F.object({manifestSha:F.string().regex(/^[a-f0-9]{64}$/),sizeBytes:F.number().int().positive().safe()}).strict().optional(),arms:F.array(F.unknown()).min(1).max(256).optional(),maxSpendUsd:F.number().positive().max(1e4),maxLifetimeSeconds:F.number().int().positive().max(1440*60),idleTimeoutSeconds:F.number().int().positive().optional()}).strict();lo.extend({accelerator:co});const uo=co,fo=oo;F.object({...lo.omit({env:!0}).shape,id:F.string(),projectRef:F.string(),ownerUserId:F.string(),productId:F.string().optional(),provider:fo,providerLeaseId:F.string().optional(),providerInstanceType:F.string().optional(),endpointUrl:F.string().optional(),status:F.enum([`provisioning`,`ready`,`detaching`,`destroyed`,`failed`]),accelerator:uo,providerCostPerHourUsd:F.number().optional(),customerPricePerHourUsd:F.number().optional(),estimatedProviderCostUsd:F.number().optional(),estimatedCustomerCostUsd:F.number().optional(),providerSelection:F.object({strategy:F.enum([`explicit`,`cheapest`,`ranked`]),selectedProvider:fo,requestedProvider:fo.optional(),candidates:F.array(F.object({provider:fo,accelerator:uo,providerInstanceType:F.string().optional(),region:F.string().optional(),pricingSource:F.enum([`live`,`configured`]).optional(),providerCostPerHourUsd:F.number(),customerPricePerHourUsd:F.number(),maxLifetimeSeconds:F.number(),estimatedProviderCostUsd:F.number(),estimatedCustomerCostUsd:F.number()})),rejected:F.array(F.object({provider:fo,error:F.string()}))}).optional(),createdAt:F.string(),updatedAt:F.string(),readyAt:F.string().optional(),startedAt:F.string().optional(),lastUsedAt:F.string().optional(),destroyedAt:F.string().optional(),failure:F.string().optional(),billing:F.object({seconds:F.number(),providerCostUsd:F.number(),customerCostUsd:F.number(),providerCostPerHourUsd:F.number(),customerPricePerHourUsd:F.number(),startedAt:F.string(),stoppedAt:F.string()}).optional()});function po(e){return{kind:xo(e.kind),count:e.count?bo(e.count,`--accelerator-count`):1,...e.memory?{vramGb:Co(e.memory,`--accelerator-memory`)}:{}}}function mo(e,t,n){if(!t&&Object.values(e).some(Boolean))throw Error(n);return t?go(e,`--gpu-`):void 0}function ho(e){return{...go(e,`--`),accelerator:po({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory})}}function go(e,t){let{provider:n,image:r,env:i,maxSpendUsd:a,maxLifetime:o,idleTimeout:s}=e;if(!a||!o)throw Error(`--accelerator-kind requires ${t}max-spend-usd and ${t}max-lifetime`);return{...n?{provider:So(n,`${t}provider`)}:{},...r?{image:r}:{},...i?{env:yo(i,`${t}env`,`env`)}:{},maxSpendUsd:Co(a,`${t}max-spend-usd`),maxLifetimeSeconds:bo(o,`${t}max-lifetime`),...s?{idleTimeoutSeconds:bo(s,`${t}idle-timeout`)}:{}}}function _o(e){return e.length===1?e[0]:e.map(Ne).join(` `)}function vo(e){return{timeoutMs:e.timeout?bo(String(e.timeout),`--timeout`):void 0,env:e.env?yo(e.env,`--env`,`env`):void 0}}function yo(e,t,n){let r={};for(let i of e){let[e,...a]=i.split(`=`);if(!e||a.length===0)throw Error(`${t} expects ${n} values in KEY=VALUE format`);r[e]=a.join(`=`)}return r}function bo(e,t){if(!/^\d+$/.test(e))throw Error(`${t} must be a positive integer`);let n=Number.parseInt(e,10);if(Number.isNaN(n)||n<1)throw Error(`${t} must be a positive integer`);return n}function xo(e){let t=so.safeParse(e);if(t.success)return t.data;throw Error(`--accelerator-kind must contain only letters, numbers, dots, underscores, or hyphens`)}function So(e,t){let n=oo.safeParse(e);if(n.success)return n.data;throw Error(`${t} must start with a letter and contain only letters, numbers, or hyphens`)}function Co(e,t){if(!/^(?:\d+|\d+\.\d+|\.\d+)$/.test(e))throw Error(`${t} must be a positive number`);let n=Number.parseFloat(e);if(!Number.isFinite(n)||n<=0)throw Error(`${t} must be a positive number`);return n}function wo(){return new N(`exec`).description(`Execute a command in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command...>`,`Command and arguments, or one shell script`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`60000`).allowUnknownOption(!0).action(async(t,n,r)=>{try{let{context:i,client:a}=G(r),o=_o(n),s=yo(r.env??[],`--env`,`env`),c=f(`Executing: ${o}`);r.json||c.start();let l=await q(a,i,t);l=await J(l);let u=await l.exec(o,{cwd:r.cwd,env:Object.keys(s).length>0?s:void 0,timeoutMs:Number.parseInt(r.timeout,10)});c.stop(),r.json?e(u):(u.stdout&&process.stdout.write(u.stdout),u.stderr&&process.stderr.write(u.stderr)),u.exitCode!==0&&(process.exitCode=u.exitCode)}catch(e){if(e instanceof S){let t=`Exec transport lost before command status was confirmed. Remote command status is unknown. Original error: ${e.message}. For long-running commands, use \`tangle process spawn\`, \`tangle process logs\`, and \`tangle process kill --tree\`.`;return H(Error(t,{cause:e}))}H(e)}})}function To(n){n.command(`capabilities`).description(`List fleet drivers and their supported features`).action(async n=>{let{client:r}=G(n),i=f(`Fetching capabilities...`);i.start();let a=await r.fleets.capabilities();i.stop(),n.json?e(a):t(a.drivers,[{key:`driverType`,header:`Driver`,width:16},{key:`sharedWorkspace`,header:`Shared WS`,width:12},{key:`accelerators`,header:`Accel`,width:8},{key:`queueTimings`,header:`Queue`,width:8}])}),n.command(`usage <fleet-id>`).description(`Show fleet usage and reliability insights`).action(async(t,n)=>{let{client:r}=G(n),i=f(`Fetching usage...`);i.start();let a=await r.fleets.usage(t);if(i.stop(),n.json)e(a);else if(s({"Fleet ID":a.usage.fleetId,Status:a.usage.status,Machines:a.usage.machineCount,Running:a.usage.runningMachines,Failed:a.usage.failedMachines,"Runtime (ms)":a.usage.meteredUsage?.runtimeMs,"Reliability score":a.insights.reliabilityScore,"Failure rate":a.insights.failureRate}),a.insights.recommendedActions.length>0){console.log(`
+Recommended actions:`);for(let e of a.insights.recommendedActions)console.log(`  - ${e}`)}}),n.command(`cost <fleet-id>`).description(`Show the fleet's cost estimate`).action(async(t,n)=>{let{client:r}=G(n),i=f(`Estimating cost...`);i.start();let a=await r.fleets.cost(t);i.stop(),n.json?e(a):s({Plan:a.plan,Currency:a.currency,"Hourly (USD)":a.hourlyUsd,"Max lifetime (s)":a.maxLifetimeSeconds,"Estimated max lifetime (USD)":a.estimatedMaxLifetimeUsd,Machines:a.requestedResources.machines,"Total CPU":a.requestedResources.totalCpu,"Total memory (MB)":a.requestedResources.totalMemoryMb})})}function Eo(e){return[...e.entries()].map(([e,t])=>({machineId:e,sandboxId:t.id,status:t.status}))}function Do(n){n.command(`list <fleet-id>`).description(`List the machines of one fleet (fleet id is required)`).option(`--status <status>`,`Filter machines by status`).action(async(n,r)=>{let{client:i}=G(r),a=f(`Fetching fleet...`);a.start();let o=await i.fleets.list({fleetId:n,status:r.status});a.stop();let s=Eo(o.machines);r.json?e({fleetId:o.fleetId,machines:s}):t(s,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}])}),n.command(`get <fleet-id>`).description(`Show one fleet's manifest (server record)`).action(async(n,r)=>{let{client:i}=G(r),a=f(`Fetching manifest...`);a.start();let o=await i.fleets.manifest(n);a.stop(),r.json?e(o):(s({"Fleet ID":o.fleetId??o.id,Machines:o.machines.length,"Workspace mode":o.workspace?.mode,"Workspace status":o.workspace?.status,"Max lifetime (s)":o.policy?.maxLifetimeSeconds,"Max spend (USD)":o.policy?.maxSpendUsd,Created:o.createdAt,Updated:o.updatedAt}),t(o.machines,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`role`,header:`Role`,width:14},{key:`status`,header:`Status`,width:14}]))}),n.command(`delete <fleet-id>`).description(`Delete a fleet's machine sandboxes and its record`).option(`--continue-on-error`,`Keep deleting remaining machines if one delete fails`).action(async(t,n)=>{let{client:i}=G(n),a=f(`Deleting fleet...`);a.start(),await i.fleets.delete(t,{continueOnError:n.continueOnError}),a.stop(),n.json?e({success:!0,fleetId:t}):r(`Fleet deleted: ${t}`)}),n.command(`reap`).description(`TTL cleanup of all expired fleets (fleet-wide)`).option(`--dry-run`,`Report what would be reaped without deleting`).action(async n=>{let{client:r}=G(n),i=f(`Reaping expired fleets...`);i.start();let a=await r.fleets.reapExpired({dryRun:n.dryRun});i.stop(),n.json?e(a):(s({"Dry run":a.dryRun,Expired:a.expired,Deleted:a.deleted}),t(a.fleets,[{key:`fleetId`,header:`Fleet`,width:24},{key:`expiredAt`,header:`Expired`,width:18},{key:`deleted`,header:`Deleted`,width:10}]))}),n.command(`reconcile`).description(`Drop fleet records whose underlying sandboxes vanished`).option(`--dry-run`,`Report orphans without removing them`).action(async n=>{let{client:r}=G(n),i=f(`Reconciling fleets...`);i.start();let a=await r.fleets.reconcile({dryRun:n.dryRun});i.stop(),n.json?e(a):(s({"Dry run":a.dryRun,Checked:a.checked,Orphaned:a.orphaned,Removed:a.removed}),t(a.machines,[{key:`fleetId`,header:`Fleet`,width:24},{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`removed`,header:`Removed`,width:10}]))})}async function Oo(e,t){let n=await Zn({apiKey:t.apiKey,baseUrl:t.baseUrl??En()}),r=await fetch(`${n.baseUrl}/v1/agent-profiles/${encodeURIComponent(e)}`,{headers:{authorization:`Bearer ${n.token}`,accept:`application/json`}});if(!r.ok){let t=await r.text().catch(()=>``);throw r.status===404?Error(`profile '${e}' not found in the platform catalog (it may be a built-in, a stored profile you own, or neither — run 'tangle profile list' to see what is available)`):Error(`platform returned ${r.status}: ${t.slice(0,200)}`)}let i=await r.json();if(!i.definition||typeof i.definition!=`object`)throw Error(`profile '${e}' resolved but has no definition — the catalog entry is malformed`);return i.definition}async function ko(e){let t=typeof e.envVarName==`string`&&e.envVarName.length>0?e.envVarName:null,n=!!e.fromStdin;if(t&&n)throw Error(`Pass either ${e.flagPrefix}-env or ${e.flagPrefix}-stdin, not both`);if(t){let n=process.env[t];if(!n||n.length===0)throw Error(`${e.flagPrefix}-env points at ${t}, but that environment variable is empty or unset`);return n}if(n){let t=await hr();if(t.length===0)throw Error(`${e.flagPrefix}-stdin received empty input on stdin`);return t}}function Ao(e){if(e.secret===void 0)return;let t=e.backend===`claude-code`?`token`:e.backend===`codex`?`bundle`:void 0;if(!t)throw Error(`--cli-auth needs --backend claude-code or --backend codex`);if(e.apiKeyGiven)throw Error(`--cli-auth cannot be combined with --backend-api-key-env or --backend-api-key-stdin`);return{account:`cli`,secretEnv:e.secret,format:t}}function jo(e){if(e!==void 0)return e.map(e=>{if(e.includes(`@`)||e.includes(`:`))throw Error(`--secret ${e}: bare secret names only (box delivery). For proxy custody use --proxy-secret with a canonical binding`);return e})}function Mo(e,t){let n={};return e.cpu!==void 0&&(n.cpuCores=bo(e.cpu,`--cpu`)),e.memory!==void 0&&(n.memoryMB=bo(e.memory,`--memory`)),e.disk!==void 0&&(n.diskGB=bo(e.disk,`--disk`)),t&&(n.accelerator=t),Object.keys(n).length>0?n:void 0}function No(e){let t=e.split(`/`);return t.length>=2?{provider:t[0],model:t.slice(1).join(`/`)}:{model:e}}function Po(e){let t={};for(let n of e){let[e,...r]=n.split(`=`);if(!e||r.length===0)throw Error(`--metadata expects values in KEY=VALUE or KEY=JSON format`);t[e]=Fo(r.join(`=`))}return t}function Fo(e){try{return JSON.parse(e)}catch{return e}}function Io(e,t){if(!(!e.gitUrl&&!e.gitRef&&!e.gitDepth&&!e.gitSparse&&!t)){if(!e.gitUrl||typeof e.gitUrl!=`string`)throw Error(`--git-url is required when using git provisioning options`);return{url:e.gitUrl,ref:typeof e.gitRef==`string`?e.gitRef:void 0,depth:typeof e.gitDepth==`string`?bo(e.gitDepth,`--git-depth`):void 0,sparse:Array.isArray(e.gitSparse)?e.gitSparse:void 0,auth:t?{token:t}:void 0}}}function Lo(e,t){if(!(!e.storageType&&!e.storageBucket&&!e.storageEndpoint&&!e.storageRegion&&!e.storagePrefix&&!e.storageAccessKeyId&&!t)){if(typeof e.storageType!=`string`||typeof e.storageBucket!=`string`||typeof e.storageAccessKeyId!=`string`||!t)throw Error(`Storage config requires --storage-type, --storage-bucket, --storage-access-key-id, and one of --storage-secret-access-key-env / --storage-secret-access-key-stdin`);return{type:Ro(e.storageType),bucket:e.storageBucket,endpoint:typeof e.storageEndpoint==`string`?e.storageEndpoint:void 0,region:typeof e.storageRegion==`string`?e.storageRegion:void 0,prefix:typeof e.storagePrefix==`string`?e.storagePrefix:void 0,credentials:{accessKeyId:e.storageAccessKeyId,secretAccessKey:t}}}}function Ro(e){if(e===`s3`||e===`gcs`||e===`r2`)return e;throw Error(`--storage-type must be one of s3, gcs, or r2`)}function zo(e){if(e===void 0)return;let t=[];for(let n of e){let e=n,r=`--proxy-secret <json>`;if(n.startsWith(`@`)){let t=n.slice(1);r=`--proxy-secret @${t}`;try{e=ze(t,`utf8`)}catch{throw Error(`${r}: file could not be read`)}}let i;try{i=JSON.parse(e)}catch(e){throw Error(`${r}: not valid JSON (${e instanceof Error?e.message:String(e)})`)}if(Array.isArray(i))t.push(...i);else if(typeof i==`object`&&i)t.push(i);else throw Error(`${r}: expected a binding object or an array of bindings`)}let n=Se.parse(t);return n.length>0?n:void 0}function Bo(e){l(`  Status: ${e.status}`),l(`  Provider: ${e.provider}`),l(`  GPU: ${e.accelerator.kind} x ${e.accelerator.count}`),e.customerPricePerHourUsd!==void 0&&l(`  Customer price: $${e.customerPricePerHourUsd}/hr`),e.estimatedCustomerCostUsd!==void 0&&l(`  Max estimate: $${e.estimatedCustomerCostUsd}`),e.billing&&(l(`  Billed seconds: ${e.billing.seconds}`),l(`  Customer cost: $${e.billing.customerCostUsd}`))}function Vo(e){e.result.stdout&&process.stdout.write(e.result.stdout),e.result.stderr&&process.stderr.write(e.result.stderr),l(`Exit code: ${e.result.exitCode}`)}function Ho(n){let i=n.command(`gpu`).description(`Manage on-demand GPU leases for a sandbox`);i.command(`providers <id-or-name>`).description(`List GPU clouds, whether each credential works, and current prices`).option(`--accelerator-kind <kind>`,`Price this GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).action(async(n,r)=>{let{context:i,client:a}=G(r),o=f(`Checking GPU providers...`);o.start();let s=await(await q(a,i,n)).gpu.providers(r.acceleratorKind?{accelerator:po({kind:r.acceleratorKind,count:r.acceleratorCount,memory:r.acceleratorMemory})}:{});if(o.stop(),r.json){e(s);return}t(s.statuses.map(e=>({provider:e.provider,state:e.state,gpu:e.estimate?.providerInstanceType??``,usdHr:e.estimate?e.estimate.customerPricePerHourUsd.toFixed(4):``,pricing:e.estimate?.pricingSource??``,needs:e.envVars.join(` `)})),[{key:`provider`,header:`Provider`},{key:`state`,header:`State`},{key:`gpu`,header:`GPU`},{key:`usdHr`,header:`$/hr`},{key:`pricing`,header:`Price`},{key:`needs`,header:`Needs`}]);for(let e of s.statuses){let t=e.state===`credential-invalid`?e.credential?.detail:e.estimateError;t&&l(`${e.provider}: ${t}`)}s.usable.length===0&&l(`No GPU provider is usable on this deployment: set the variables in Needs for one provider on the server.`)}),i.command(`attach <id-or-name>`).description(`Attach a temporary GPU worker to a sandbox`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=f(`Attaching GPU lease...`);o.start();let s=await(await q(a,i,t)).gpu.attach(ho(n));o.stop(),n.json?e(s):(r(`GPU lease attached: ${s.id}`),Bo(s))}),i.command(`run <id-or-name> <command...>`).description(`Attach a GPU, run a command or script, then destroy it`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker and command (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).action(async(t,n,i)=>{let a,o,s,c;try{let{context:e,client:r}=G(i),s=await q(r,e,t),c=f(`Attaching GPU lease...`);c.start(),a=await s.gpu.attach(ho(i)),c.stop();let l=f(`Running GPU command...`);l.start(),o=await s.gpu.exec(a.id,{command:_o(n),...vo(i),cwd:i.cwd}),l.stop(),i.json||Vo(o)}catch(e){s=e}finally{if(a)try{let{context:e,client:n}=G(i);a=await(await q(n,e,t)).gpu.detach(a.id)}catch(e){c=e}}if(s){H(s),c&&H(c);return}if(c){H(c);return}i.json?e({lease:a,result:o}):a&&r(`GPU lease detached: ${a.id}`);let l=o?.result.exitCode;l&&l!==0&&(process.exitCode=l)}),i.command(`list <id-or-name>`).description(`List GPU leases attached to a sandbox`).action(async(n,r)=>{let{context:i,client:a}=G(r),o=f(`Fetching GPU leases...`);o.start();let s=await(await q(a,i,n)).gpu.list();o.stop(),r.json?e(s):s.length===0?l(`No GPU leases attached.`):t(s.map(e=>({id:e.id,status:e.status,provider:e.provider,accelerator:`${e.accelerator.kind}x${e.accelerator.count}`,customerUsdHr:e.customerPricePerHourUsd??``})),[{key:`id`,header:`ID`,width:28},{key:`status`,header:`Status`,width:12},{key:`provider`,header:`Provider`,width:12},{key:`accelerator`,header:`GPU`,width:24},{key:`customerUsdHr`,header:`$/hr`,width:10}])}),i.command(`exec <id-or-name> <lease-id> <command...>`).description(`Run a command or script on an attached GPU lease`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).action(async(t,n,r,i)=>{let{context:a,client:o}=G(i),s=f(`Running GPU command...`);s.start();let c=await(await q(o,a,t)).gpu.exec(n,{command:_o(r),...vo(i),cwd:i.cwd});s.stop(),i.json?e(c):Vo(c)}),i.command(`detach <id-or-name> <lease-id>`).description(`Detach and destroy a GPU lease`).action(async(t,n,i)=>{let{context:a,client:o}=G(i),s=f(`Detaching GPU lease...`);s.start();let c=await(await q(o,a,t)).gpu.detach(n);s.stop(),i.json?e(c):(r(`GPU lease detached: ${c.id}`),Bo(c))})}function Uo(t,n){if(n){e(t);return}if(!t.id){t.kind===`snapshot`&&t.result?.snapshot?r(`Snapshot created: ${t.result.snapshot.snapshotId}`):r(`Sandbox ${t.sandboxId} stopped.`);return}r(`${t.kind===`snapshot`?`Snapshot`:`Stop`} of sandbox ${t.sandboxId} accepted.`),l(`Operation: ${t.id}`),l(`Status: ${t.statusUrl}`)}function Wo(e){return`${e.name} (${e.id})`}async function Go(e,t){if(t.startsWith(`team_`))return e.teams.get(t);let n=(await e.teams.list()).filter(e=>e.name.toLowerCase()===t.toLowerCase());if(n.length===0)throw Error(`Team not found: ${t}`);if(n.length>1)throw Error(`Team name is ambiguous: ${t}. Use a team id instead.`);return n[0]}async function Ko(e,t,n){if(t)return Go(e,t);let r=kn(n);if(!r.activeTeamId)throw Error("No active team. Run `tangle team switch <team>` or pass `--team <team>`.");return e.teams.get(r.activeTeamId)}function qo(e,t){An({id:e.id,name:e.name},t)}function Jo(e){jn(e)}async function Yo(e){if(e.explicitTeam&&e.personal)throw Error(`--team and --personal cannot be used together`);if(!e.personal)return e.explicitTeam?(await Go(e.client,e.explicitTeam)).id:e.activeTeamId}async function Xo(e){if([!!e.explicitTeam,!!e.personal,!!e.allScopes].filter(Boolean).length>1)throw Error(`--team, --personal, and --all-scopes are mutually exclusive`);if(e.allScopes)return`all`;if(e.personal)return`personal`;if(e.explicitTeam)return`team:${(await Go(e.client,e.explicitTeam)).id}`;if(e.activeTeamId)return`team:${e.activeTeamId}`}function Zo(e){if(!e)return e;let t={...e};for(let e of[`authToken`,`execToken`])t[e]!==void 0&&(t[e]=`[REDACTED]`);return t}function Qo(n){n.command(`attestation <id-or-name>`).description(`Fetch TEE attestation evidence for a sandbox`).option(`--nonce <hex|auto>`,`Nonce to bind into a fresh attestation report; use auto to generate one`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=n.nonce===`auto`?ie():n.nonce,s=f(`Fetching TEE attestation...`);s.start();let c=await(await q(a,i,t)).getTeeAttestation(o?{attestationNonce:o}:void 0);s.stop(),n.json?e(c):(r(`Attestation fetched for ${t}`),console.log(`TEE type: ${c.attestation.tee_type}`),console.log(`Evidence bytes: ${c.attestation.evidence.length}`),console.log(`Measurement bytes: ${c.attestation.measurement.length}`),console.log(`Timestamp: ${c.attestation.timestamp}`),c.attestationNonce&&console.log(`Nonce: ${c.attestationNonce}`))}),n.command(`list`).description(`List all sandboxes`).option(`-s, --status <status>`,`Filter by status (running, stopped, all)`).option(`-l, --limit <n>`,`Limit results`,`50`).option(`--team <team>`,`List sandboxes for a team by id or name`).option(`--personal`,`List personal sandboxes`).option(`--all-scopes`,`List personal and team sandboxes`).action(async n=>{let{context:r,client:i}=G(n),a=f(`Fetching sandboxes...`);a.start();let o=await Xo({client:i,explicitTeam:n.team,personal:n.personal,allScopes:n.allScopes,activeTeamId:r.activeTeamId}),s=await i.list({status:n.status===`all`?void 0:n.status,limit:Number.parseInt(n.limit,10),scope:o});a.stop(),n.json?e(s):t(s.map(e=>({id:e.id,status:e.status,createdAt:e.createdAt,name:e.name??``})),[{key:`id`,header:`ID`,width:24},{key:`status`,header:`Status`,width:14},{key:`createdAt`,header:`Created`,width:16},{key:`name`,header:`Name`,width:20}])}),n.command(`get <id-or-name>`).description(`Get sandbox details`).option(`--profile`,`Show the active agent profile provenance (name, hash, skills)`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching sandbox...`);a.start();let o=await q(i,r,t);if(a.stop(),n.profile){let e=o.getProfileProvenance?.();e?(l(`Agent profile provenance:`),l(`  Base profile: ${e.base.name??`(inline)`} (${e.base.sha256.slice(0,12)}...)`),l(`  Effective:    ${e.effective.name??`(inline)`} (${e.effective.sha256.slice(0,12)}...)`),l(`  Materialized: ${e.materializedAt}`),e.base.sha256!==e.effective.sha256&&l(`  ⚠ Profile changed since creation (base ≠ effective)`)):l(`No profile materialized (bare sandbox). Create with --profile <name> to install one.`);return}n.json?e(o):u({id:o.id,name:o.name,status:o.status,resources:o.resources,createdAt:o.createdAt?.toISOString(),expiresAt:o.expiresAt?.toISOString(),connection:o.connection})}),n.command(`shapes`).description(`List the named sandbox sizes, the default, and this account's ceiling`).action(async n=>{let{client:r}=G(n),i=await r.shapes();if(n.json){e(i);return}let a=e=>e.cpuCores<=i.ceiling.cpuCores&&e.memoryMB<=i.ceiling.memoryMB&&e.diskGB<=i.ceiling.diskGB;t(i.presets.map(e=>({name:e.name===i.default?`${e.name} (default)`:e.name,cpu:e.cpuCores,memory:`${e.memoryMB} MB`,disk:`${e.diskGB} GB`,available:a(e)?`yes`:e.name===i.default?`clamped to ceiling`:`above ceiling`})),[{key:`name`,header:`Shape`,width:18},{key:`cpu`,header:`vCPU`,width:6},{key:`memory`,header:`Memory`,width:10},{key:`disk`,header:`Disk`,width:8},{key:`available`,header:`Available`,width:14}]),l(`Ceiling for this account: ${o(i.ceiling)}`)}),n.command(`delete <id-or-name>`).description(`Delete a sandbox`).option(`-f, --force`,`Skip confirmation`).option(`--name`,`Treat the reference as a sandbox name`).addOption(new _e(`--until <state>`,`Wait for physical removal`).choices([`removed`])).option(`--retry-cleanup`,`Retry server-side cleanup after the sandbox disappeared from get/list`).action(async(e,t)=>{if(!t.force&&!await pr(`Delete sandbox ${e}? [y/N] `,`--force`)){l(`Cancelled.`);return}let{context:n,client:i}=G(t),a=f(`Deleting sandbox...`);a.start();let o=await or(i,n,e,{retryCleanup:t.retryCleanup,name:t.name,until:t.until});a.stop(),r(o===`already_absent`?`Sandbox ${e} was already gone.`:`Sandbox ${e} deleted.`)}),n.command(`stop <id-or-name>`).description(`Stop a running sandbox`).option(`--name`,`Treat the reference as a sandbox name`).option(`--no-wait`,`Return once the stop is accepted and print the operation to poll`).action(async(e,t)=>{let{context:n,client:i}=G(t),a=f(`Stopping sandbox...`);a.start();let o=await q(i,n,e,{nameOnly:t.name});if(t.wait===!1){let e=await o.stop({wait:!1});a.stop(),Uo(e.info,!!t.json);return}await o.stop(),a.stop(),r(`Sandbox ${e} stopped.`)}),n.command(`resume <id-or-name>`).description(`Resume a stopped sandbox`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`-t, --timeout <ms>`,`Resume timeout in milliseconds; a cold resume re-provisions the sandbox, so this defaults higher than other commands (default 120000)`,`120000`).action(async(e,t)=>{let n=Number.parseInt(t.timeout,10);if(!Number.isFinite(n)||n<=0)throw Error(`--timeout must be a positive number of milliseconds`);let i=U({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:n}),a=W(i),o=f(`Resuming sandbox...`);o.start();let s=await q(a,i,e);await s.resume({timeoutMs:n}),t.wait&&(o.text=`Waiting for sandbox to start...`,await s.waitFor(`running`,{timeoutMs:n})),o.stop(),r(`Sandbox ${s.id} resumed.`)})}function $o(t){t.command(`create`).option(`--cpu-features <flags>`,`Required Linux CPU flags, comma-separated`).description(`Create a new sandbox`).option(`-n, --name <name>`,`Sandbox name`).option(`-e, --environment <environment>`,es).addOption(ts()).option(`--bare`,`Create a bare sandbox without the agent runtime`).option(`--ssh`,`Enable SSH access`).option(`--ssh-key <key>`,`SSH public key for authentication`).option(`--ssh-keys <names...>`,`Stored SSH key names or IDs for authentication`).option(`--ssh-key-file <paths...>`,`SSH public key file paths for authentication`).option(`--web-terminal`,`Enable web terminal`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--secret <names...>`,`Secrets selected by bare name for box delivery (value in the sandbox env). For proxy custody use --proxy-secret`).option(`--proxy-secret <bindings...>`,`Canonical proxy custody binding(s): one binding as inline JSON, or @file with a JSON array. The value stays at the egress proxy and is redeemed only within the binding's scope (hosts/methods/paths/TTL); the box reads a placeholder. Repeatable`).option(`--metadata <entries...>`,`Metadata entries (KEY=VALUE or KEY=JSON)`).option(`--cpu <cores>`,"CPU cores (omit for the platform default; see `sandbox shapes`)").option(`--memory <mb>`,`Memory in MB (omit for the platform default)`).option(`--disk <gb>`,`Disk size in GB (omit for the platform default)`).option(`--accelerator-kind <kind>`,`Accelerator kind, for example nvidia-h100 or amd-mi300x`).option(`--accelerator-count <count>`,`Accelerator device count`,`1`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--gpu-provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum customer spend for the create-time GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum create-time GPU lease lifetime in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy the create-time GPU lease after this many idle seconds`).option(`--lifetime <seconds>`,`Max wall-clock lifetime before the sandbox is suspended — stopped, not deleted; resume it within the cold window (default 3600 = 1h). Raise it for long sessions, e.g. --lifetime 7200`,`3600`).option(`--idle-timeout <seconds>`,"Idle time before the sandbox is stopped — not deleted (default 900 = 15m). Resume it later with `tangle sandbox resume <id-or-name>`, or it auto-resumes on next use. Raise it for demos, e.g. --idle-timeout 3600",`900`).option(`--from-snapshot <id>`,`Create the sandbox from a snapshot`).option(`--public-template <id-or-slug>`,`Create the sandbox from a published public template`).option(`--public-template-version <id>`,`Pin creation to a specific published public-template version`).option(`--billing-owner <userId>`,`Platform user that pays for the sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--team <team>`,`Create in a team by id or name`).option(`--personal`,`Create a personal sandbox even when a team is active`).option(`--git-url <url>`,`Git repository URL to clone during provisioning`).option(`--git-ref <ref>`,`Git branch, tag, or commit to checkout`).option(`--git-depth <depth>`,`Git clone depth`).option(`--git-sparse <paths...>`,`Sparse checkout paths`).option(`--git-token-env <name>`,`Name of an environment variable containing the Git HTTPS auth token`).option(`--git-token-stdin`,`Read the Git HTTPS auth token from stdin`).option(`--storage-type <type>`,`BYOS3 storage type (s3, gcs, r2)`).option(`--storage-bucket <name>`,`BYOS3 bucket name`).option(`--storage-endpoint <url>`,`BYOS3 endpoint URL`).option(`--storage-region <region>`,`BYOS3 region`).option(`--storage-prefix <prefix>`,`BYOS3 path prefix`).option(`--storage-access-key-id <id>`,`BYOS3 access key ID`).option(`--storage-secret-access-key-env <name>`,`Name of an environment variable containing the BYOS3 secret access key`).option(`--storage-secret-access-key-stdin`,`Read the BYOS3 secret access key from stdin`).addOption(new _e(`--driver <type>`,`Run on Tangle network operators instead of the platform's hosts (--tee needs it)`).choices([`tangle`])).option(`--backend <type>`,`Backend agent type (${y.join(`, `)})`).option(`--backend-model <model>`,`Model override (format: provider/model)`).addOption(new _e(`--reasoning-effort <level>`,`Reasoning effort for the backend's model; overrides the profile's model.reasoningEffort`).choices(Ce)).option(`--backend-api-key-env <name>`,`Name of an environment variable containing the BYOK backend API key`).option(`--backend-api-key-stdin`,`Read the BYOK backend API key from stdin`).option(`--cli-auth <secret>`,"Run --backend claude-code or codex on your own subscription: the stored secret holding a `claude setup-token` token or a Codex auth.json (see `tangle secret create`)").option(`--profile <path>`,`Path to an AgentProfile JSON file to install as the sandbox's backend profile (carries skills, tools, MCP, model). Use with --backend; the profile's inline skills materialize into the harness's native skill directory on first turn`).option(`--profile-stdin`,`Read the AgentProfile JSON from stdin instead of a file (use with --profile)`).option(`--tee <type>`,`Require a TEE backend (any, tdx, nitro, sev-snp, phala-dstack)`).option(`--sealed`,`Request TEE sealed-secret support`).option(`--attestation-nonce <hex|auto>`,`Deploy-time attestation nonce; use auto to generate one`).option(`--attestation-refresh`,`Generate a fresh deploy-time attestation nonce when --tee is set`).option(`--require-attestation`,`Fail unless TEE attestation evidence is returned`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`--timeout <ms>`,`HTTP timeout in milliseconds`,`30000`).action(async t=>{let n=await ko({envVarName:t.gitTokenEnv,fromStdin:t.gitTokenStdin,flagPrefix:`--git-token`}),i=await ko({envVarName:t.storageSecretAccessKeyEnv,fromStdin:t.storageSecretAccessKeyStdin,flagPrefix:`--storage-secret-access-key`}),a=await ko({envVarName:t.backendApiKeyEnv,fromStdin:t.backendApiKeyStdin,flagPrefix:`--backend-api-key`}),o=Ao({secret:t.cliAuth,backend:t.backend,apiKeyGiven:a!==void 0}),s;if(t.profileStdin){let e=await hr(`--profile-stdin`,`the AgentProfile JSON`);try{s=JSON.parse(e)}catch{H(Error(`--profile-stdin: the input is not valid JSON`));return}}else if(t.profile){let e=String(t.profile);if(e.startsWith(`.`)||e.startsWith(`/`)||e.endsWith(`.json`))try{s=JSON.parse(ze(e,`utf8`))}catch(t){H(Error(`--profile ${e}: ${t.message}`));return}else try{s=await Oo(e,t)}catch(t){H(Error(`--profile ${e}: ${t.message}`));return}}s=rs(s,t.reasoningEffort);let c=U({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:t.timeout?Number.parseInt(t.timeout,10):void 0}),l=W(c),d=f(`Creating sandbox...`);d.start();let p=await Yo({client:l,explicitTeam:t.team,personal:t.personal,activeTeamId:c.activeTeamId}),m=yo(t.env??[],`--env`,`env`),h=t.metadata?Po(t.metadata):void 0,g=Io(t,n),_=Lo(t,i),v=t.acceleratorKind?po({kind:String(t.acceleratorKind),count:String(t.acceleratorCount),memory:typeof t.acceleratorMemory==`string`?t.acceleratorMemory:void 0}):void 0,y=mo({provider:typeof t.gpuProvider==`string`?t.gpuProvider:void 0,image:typeof t.gpuWorkerImage==`string`?t.gpuWorkerImage:void 0,env:Array.isArray(t.gpuEnv)?t.gpuEnv:void 0,maxSpendUsd:typeof t.gpuMaxSpendUsd==`string`?t.gpuMaxSpendUsd:void 0,maxLifetime:typeof t.gpuMaxLifetime==`string`?t.gpuMaxLifetime:void 0,idleTimeout:typeof t.gpuIdleTimeout==`string`?t.gpuIdleTimeout:void 0},!!v,`Create-time GPU lease flags require --accelerator-kind`),b=t.driver?{type:`tangle`}:void 0,x=t.backend||t.backendModel||s?{...t.backend?{type:ae(t.backend)}:{},...s?{profile:s}:{},model:t.backendModel||a||o?{...t.backendModel?No(t.backendModel):{},apiKey:a,...o?{cliAuth:o}:{}}:void 0}:void 0,S=jo(t.secret),C=o?[...new Set([...S??[],o.secretEnv])]:S,w=zo(t.proxySecret),T=Mo(t,v),ee=t.sshKeyFile??(t.ssh&&!t.sshKey&&!t.sshKeys?.length?[ns()]:[]),E=[...t.sshKey?[t.sshKey]:[],...ee.map(e=>ze(e,`utf8`).trim())],D={name:t.name,environment:t.environment,runtime:t.runtime,cpuFeatures:t.cpuFeatures?.split(`,`).map(e=>e.trim()),bare:t.bare||void 0,sshEnabled:t.ssh||!!t.sshKey||E.length>0||!!t.sshKeys?.length,sshPublicKeys:E.length>0?E:void 0,sshKeyIds:t.sshKeys,webTerminalEnabled:t.webTerminal,env:Object.keys(m).length>0?m:void 0,git:g,...T?{resources:T}:{},gpuLease:y,maxLifetimeSeconds:Number.parseInt(t.lifetime,10),idleTimeoutSeconds:Number.parseInt(t.idleTimeout,10),storage:_,fromSnapshot:t.fromSnapshot,publicTemplateId:t.publicTemplate,publicTemplateVersionId:t.publicTemplateVersion,teamId:p,...t.billingOwner?{billingOwnerId:t.billingOwner}:{},secrets:C,...w?{proxySecrets:w}:{},metadata:h,driver:b,backend:x},O=t.tee?{tee:t.tee,sealed:t.sealed||void 0,attestationRefresh:t.attestationRefresh||t.attestationNonce===`auto`||void 0}:void 0,k=O?await re(l,{...D,confidential:O,attestationNonce:t.attestationNonce??(t.attestationRefresh?`auto`:void 0),requireAttestation:t.requireAttestation??!0}):void 0,A=k?.sandbox??await l.create(D);t.wait&&(d.text=`Waiting for sandbox to start...`,await A.waitFor(`running`,{timeoutMs:12e4}),await A.refresh()),d.stop(),t.json?e({id:A.id,name:A.name,status:A.status,resources:A.resources,createdAt:A.createdAt,expiresAt:A.expiresAt,connection:Zo(A.connection),teamId:p,gpuLease:A.gpuLease,confidential:O,attestation:k?.attestation,attestationNonce:k?.attestationNonce}):(r(`Sandbox created: ${A.id}`),u({id:A.id,name:A.name,status:A.status,resources:A.resources,createdAt:A.createdAt?.toISOString(),expiresAt:A.expiresAt?.toISOString(),connection:A.connection}),p&&console.log(`Team: ${p}`),A.gpuLease&&(console.log(`GPU lease: ${A.gpuLease.id}`),Bo(A.gpuLease)),O&&(console.log(`TEE: ${O.tee}`),console.log(`Attestation: ${k?.attestation?`present`:`not returned`}`),k?.attestationNonce&&console.log(`Attestation nonce: ${k.attestationNonce}`)))})}const es="A catalog environment, a container image reference, or a built image ID. Firecracker runs only images pinned by repository@sha256 that the cell's Firecracker hosts carry; `environments list` shows each image's runtimes";function ts(){return new _e(`--runtime <runtime>`,`Isolation on the platform's hosts: docker runs a container on the host kernel, firecracker a microVM with its own kernel. Omit for the platform default`).choices(ee)}function ns(){let e=[`id_ed25519`,`id_ecdsa`,`id_rsa`].map(e=>`${I()}/.ssh/${e}.pub`),t=e.find(e=>Le(e));if(!t)throw Error(`--ssh needs a public key and found none at ${e.join(`, `)}. Run ssh-keygen -t ed25519, or pass --ssh-key-file.`);return t}function rs(e,t){if(!t)return e;let n=e?.model??{};return{...e,model:{...n,reasoningEffort:t}}}function is(e){if(e.spec){let t=JSON.parse(ze(e.spec,`utf8`));return{base:{fleetId:e.fleetId,defaults:t.defaults,policy:t.policy,workspace:t.workspace,metadata:t.metadata},machines:t.machines??[]}}let t=ss(e),n=cs(e,!!t?.accelerator),r={...e.environment?{environment:e.environment}:{},...t?{resources:t}:{},...e.runtime?{runtime:e.runtime}:{},...n?{gpuLease:n}:{},...e.backend?{backend:{type:e.backend}}:{}},i=ls(e),a=Math.max(1,Number(e.count)||1),o=Array.from({length:a},(e,t)=>({machineId:`worker-${t+1}`}));return{base:{fleetId:e.fleetId,defaults:Object.keys(r).length>0?r:void 0,policy:i,workspace:{mode:e.workspace}},machines:o}}function as(e){let{base:t,machines:n}=is(e);return{...t,machines:n}}function os(e){let{base:t,machines:n}=is(e);return{...t,workers:n}}function ss(e){let t={};if(e.cpu&&(t.cpuCores=Number(e.cpu)),e.memory&&(t.memoryMB=Number(e.memory)),e.disk&&(t.diskGB=Number(e.disk)),e.acceleratorKind)t.accelerator=po({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory});else if(e.acceleratorCount||e.acceleratorMemory)throw Error(`--accelerator-count and --accelerator-memory require --accelerator-kind`);return Object.keys(t).length>0?t:void 0}function cs(e,t){return mo({provider:e.gpuProvider,image:e.gpuWorkerImage,env:e.gpuEnv,maxSpendUsd:e.gpuMaxSpendUsd,maxLifetime:e.gpuMaxLifetime,idleTimeout:e.gpuIdleTimeout},t,`Fleet GPU lease flags require --accelerator-kind`)}function ls(e){let t={};return e.maxSpendUsd&&(t.maxSpendUsd=Number(e.maxSpendUsd)),e.maxLifetime&&(t.maxLifetimeSeconds=Number(e.maxLifetime)),Object.keys(t).length>0?t:void 0}function us(n){n.command(`create`).description(`Create a sandbox fleet`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--count <n>`,`Number of worker machines`,`1`).option(`--environment <environment>`,es).addOption(ts()).option(`--cpu <cores>`,`CPU cores per machine`).option(`--memory <mb>`,`Memory in MB per machine`).option(`--disk <gb>`,`Disk in GB per machine`).option(`--accelerator-kind <kind>`,`Accelerator kind per machine, for example nvidia-l4 or nvidia-h100`).option(`--accelerator-count <count>`,`Accelerator devices per machine`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--gpu-provider <provider>`,`GPU cloud provider per machine; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for each GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum spend per machine GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum GPU lease lifetime per machine in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy each GPU lease after this many idle seconds`).option(`--backend <id>`,`Agent backend type`).option(`--workspace <mode>`,`Workspace mode: isolated (no driver supports shared yet)`,`isolated`).option(`--max-spend-usd <n>`,`Fleet spend cap in USD (policy)`).option(`--max-lifetime <s>`,`Max machine lifetime in seconds (policy)`).option(`--spec <file.json>`,`Path to a JSON file describing the fleet (overrides synthesized machines)`).option(`--coordinator`,`Create a coordinator + workers fleet (routes to createWithCoordinator)`).action(async n=>{let{client:i}=G(n),a=f(`Creating fleet...`);a.start();let o=n.coordinator?await i.fleets.createWithCoordinator(os(n)):await i.fleets.create(as(n));a.stop();let s=Eo(o.machines);n.json?e({fleetId:o.fleetId,machines:s}):(r(`Fleet created: ${o.fleetId}`),t(s,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}]))})}function ds(n){n.command(`exec <fleet-id> <command>`).description(`Run a shell command across the fleet's machines`).option(`--machine <id...>`,`Restrict to a subset of machine ids (default: all)`).option(`--cwd <dir>`,`Working directory for the command`).option(`--timeout <ms>`,`Per-machine timeout in milliseconds`).option(`--max-concurrent <n>`,`Max concurrent dispatches`).action(async(n,r,i)=>{let{client:a}=G(i),o=f(`Dispatching command...`);o.start();let s=await(await a.fleets.list({fleetId:n})).dispatchExecDetailed(r,{machines:i.machine,cwd:i.cwd,timeoutMs:i.timeout?Number(i.timeout):void 0,maxConcurrent:i.maxConcurrent?Number(i.maxConcurrent):void 0});if(o.stop(),i.json)e(s);else{t(s.results.map(e=>({machineId:e.machineId,ok:e.ok,exitCode:e.result?.exitCode,durationMs:e.durationMs})),[{key:`machineId`,header:`Machine`,width:20},{key:`ok`,header:`OK`,width:6},{key:`exitCode`,header:`Exit`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14}]);for(let e of s.results){let t=e.result?.stdout,n=e.result?.stderr;t&&(console.log(`\n[${e.machineId}] stdout:`),console.log(t)),n&&(console.log(`\n[${e.machineId}] stderr:`),console.log(n)),e.error&&console.log(`\n[${e.machineId}] error: ${e.error.message}`)}}s.results.some(e=>e.ok===!1)&&(process.exitCode=1)}),n.command(`run [prompt]`).description(`Create a fleet of agents, run one turn on every agent, print each result, then delete the fleet`).requiredOption(`--agents <n|file>`,`Number of agents, or a JSON file with an array of agent specs (agentId, harness, model, profile or { profileId, revision }, task)`).option(`--placement <mode>`,`auto (pack by sandbox memory), dedicated (one sandbox per agent), or a number of agents per sandbox`,`auto`).option(`--model <id>`,`Model every agent runs, e.g. gpt-4.1-mini`).option(`--memory <mb>`,`Memory in MB per sandbox; auto placement packs by it`).option(`--environment <environment>`,`Environment for each sandbox`).option(`--max-spend-usd <usd>`,`Budget for the fleet in USD, enforced by the Platform on the fleet's own key`).option(`--timeout <ms>`,`Per-agent turn timeout in milliseconds`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--parent-fleet <id>`,`Fleet that spawns this one; its cap must cover this cap`).option(`--parent-agent <id>`,`Agent of --parent-fleet that spawns this one`).option(`--keep`,`Keep the fleet after the run instead of deleting it`).action(async(t,n)=>{let i=/^\d+$/.test(n.agents)?Number(n.agents):JSON.parse(ze(n.agents,`utf8`));if(!Array.isArray(i)&&t===void 0)throw Error(`A prompt is required unless --agents names a file whose agents carry tasks`);let{client:a}=G(n);if(!!n.parentFleet!=!!n.parentAgent)throw Error(`--parent-fleet and --parent-agent go together`);let o=n.placement===`auto`||n.placement===`dedicated`?n.placement:{agentsPerSandbox:Number(n.placement)},c=n.maxSpendUsd?Number(n.maxSpendUsd):void 0,l=f(`Creating fleet...`);l.start();let u=Date.now(),d=await a.fleets.create({fleetId:n.fleetId,agents:i,placement:o,defaults:{...n.environment?{environment:n.environment}:{},...n.memory?{resources:{memoryMB:Number(n.memory)}}:{},...n.model?{backend:{type:`opencode`,model:{model:n.model}}}:{}},...c===void 0?{}:{budgetUsd:c},...n.parentFleet?{parent:{fleetId:n.parentFleet,agentId:n.parentAgent}}:{}}),p=Date.now()-u;l.stop(),n.json||r(`Fleet ${d.fleetId}: ${d.agents.length} agents on ${d.machines.size} sandboxes in ${p} ms`);let m=[],h;try{for await(let e of d.run(t,{timeoutMs:n.timeout?Number(n.timeout):void 0})){if(e.type===`agent.finished`&&!n.json){let t=e.result;console.log(`[${t.agentId}] ${t.harness??`default`}/${t.model??`default`} ${t.status} ${t.durationMs}ms ${t.costUsd===void 0?`no cost reported`:`$${t.costUsd.toFixed(5)}`} ${t.result?.response??t.error??``}`)}e.type===`fleet.finished`&&(m=e.results,h=e.spend)}}finally{n.keep||await d.delete({continueOnError:!0})}n.json?e({fleetId:d.fleetId,createMs:p,sandboxes:d.machines.size,results:m,spend:h,deleted:!n.keep}):s({fleetId:d.fleetId,completed:m.filter(e=>e.status===`completed`).length,agents:m.length,spend:JSON.stringify(h),deleted:!n.keep}),m.some(e=>e.status!==`completed`)&&(process.exitCode=1)}),n.command(`cancel <fleet-id>`).description(`Interrupt every agent of a fleet and cancel its child fleets; sandboxes keep running`).action(async(t,n)=>{let{client:i}=G(n),a=await(await i.fleets.list({fleetId:t})).cancel();n.json?e({fleetId:t,...a}):r(`Fleet ${t}: interrupted ${a.interrupted} agents, cancelled ${a.children} child fleets`)})}const fs=[`list`,`create`,`delete`,`exec`,`prompt`,`read`,`write`];function ps(e){if(!(!e||e.length===0)){for(let t of e)if(!fs.includes(t))throw Error(`Invalid token action '${t}'. Allowed: ${fs.join(`, `)}`);return e}}function ms(e){return e.length<=12?`****`:`${e.slice(0,6)}...${e.slice(-4)} (masked — use --json for full value)`}function hs(t){t.command(`token <fleet-id>`).description(`Mint a scoped fleet bearer token (treated as a secret)`).option(`--action <a...>`,`Allowed actions: list create delete exec prompt read write (prompt grants nothing since fleet prompt dispatch was removed)`).option(`--ttl-minutes <n>`,`Token lifetime in minutes`).action(async(t,n)=>{let{client:r}=G(n),i=f(`Minting fleet token...`);i.start();let a=await r.fleets.createToken(t,{actions:ps(n.action),ttlMinutes:n.ttlMinutes?Number(n.ttlMinutes):void 0});i.stop(),n.json?e(a):(s({"Fleet ID":a.fleetId,Token:ms(a.token),"Expires at":new Date(a.expiresAt).toISOString(),Actions:a.actions.join(`, `)}),console.log(`
+Re-run with --json to print the full token value.`))})}function gs(){let n=new N(`workspace`).description(`Manage a fleet's shared workspace`);return n.command(`snapshot <fleet-id>`).description(`Snapshot the fleet's shared workspace`).action(async(t,n)=>{let{client:i}=G(n),a=f(`Creating workspace snapshot...`);a.start();let o=await i.fleets.createWorkspaceSnapshot(t);a.stop(),n.json?e(o):r(`Workspace snapshot created: ${o.snapshotId??o.id}`)}),n.command(`restore <fleet-id> <snapshot-id>`).description(`Restore the fleet's shared workspace from a snapshot`).action(async(t,n,i)=>{let{client:a}=G(i),o=f(`Restoring workspace...`);o.start();let s=await a.fleets.restoreWorkspaceSnapshot(t,n);o.stop(),i.json?e(s):r(`Workspace restored from ${s.snapshotId??n}`)}),n.command(`reconcile <fleet-id>`).description(`Re-mount the shared workspace on all fleet machines`).action(async(n,r)=>{let{client:i}=G(r),a=f(`Reconciling workspace...`);a.start();let o=await i.fleets.reconcileWorkspace(n);a.stop(),r.json?e(o):(s({"Fleet ID":o.fleetId,Checked:o.checked,"Orphaned mounts":o.orphanedMounts}),t(o.machines,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`mounted`,header:`Mounted`,width:10}]))}),n}function _s(){let e=new N(`fleet`).description(`Manage sandbox fleets`);return us(e),Do(e),e.addCommand(gs()),ds(e),To(e),hs(e),e}function vs(){let t=new N(`fs`).description(`File system operations on sandboxes`);return t.command(`upload`).description(`Upload a file to a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<local-path>`,`Local file path`).argument(`<remote-path>`,`Remote destination path`).action(async(t,n,r,i)=>{let{context:a,client:o}=G(i),s=await q(o,a,t);if(s=await J(s),!Pe.existsSync(n))throw Error(`Local file not found: ${n}`);let c=Pe.statSync(n),l=Date.now();i.json||console.error(`Uploading ${n} to ${r}...`),await s.fs.upload(n,r,{onProgress:e=>{if(i.json)return;let t=e.percentage.toFixed(1);process.stderr.write(`\rProgress: ${t}% (${e.bytesUploaded}/${e.totalBytes} bytes)`)}});let u=Date.now()-l;i.json||console.error(``),i.json?e({success:!0,localPath:n,remotePath:r,size:c.size,durationMs:u}):console.log(`✓ Uploaded ${c.size} bytes in ${u}ms`)}),t.command(`download`).description(`Download a file from a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<remote-path>`,`Remote file path`).argument(`<local-path>`,`Local destination path`).action(async(t,n,r,i)=>{let{context:a,client:o}=G(i),s=await q(o,a,t);s=await J(s);let c=Date.now();i.json||console.error(`Downloading ${n} to ${r}...`),await s.fs.download(n,r,{onProgress:e=>{if(i.json)return;let t=e.percentage.toFixed(1);process.stderr.write(`\rProgress: ${t}% (${e.bytesDownloaded}/${e.totalBytes} bytes)`)}});let l=Date.now()-c,u=Pe.statSync(r);i.json||console.error(``),i.json?e({success:!0,remotePath:n,localPath:r,size:u.size,durationMs:l}):console.log(`✓ Downloaded ${u.size} bytes in ${l}ms`)}),t.command(`ls`).description(`List directory contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`[path]`,`Directory path`,`.`).option(`-l, --long`,`Show detailed information`).option(`-a, --all`,`Include hidden files`).action(async(t,n,r)=>{let{context:a,client:o}=G(r),s=await q(o,a,t);s=await J(s);let c=await s.fs.list(n,{all:r.all,long:r.long});if(r.json)e(c);else if(r.long)i([`Mode`,`Owner`,`Group`,`Size`,`Modified`,`Name`],c.map(e=>{let t=e.isDir?`d`:e.isSymlink?`l`:`-`,n=ys(e.permissions),r=e.isDir?`<DIR>`:bs(e.size),i=e.modTime.toLocaleDateString();return[t+n,e.owner,e.group,r,i,e.name]}));else{let e=c.map(e=>e.isDir?`${e.name}/`:e.name);console.log(e.join(`  `))}}),t.command(`stat`).description(`Get file or directory information`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file or directory`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o);let s=await o.fs.stat(n);r.json?e(s):(console.log(`  File: ${s.name}`),console.log(`  Path: ${s.path}`),console.log(`  Size: ${bs(s.size)} (${s.size} bytes)`),console.log(`  Type: ${s.isDir?`directory`:s.isSymlink?`symlink`:`file`}`),console.log(`  Mode: ${ys(s.permissions)} (${s.permissions.toString(8)})`),console.log(`  Owner: ${s.owner}`),console.log(`  Group: ${s.group}`),console.log(`  Modified: ${s.modTime.toISOString()}`),console.log(`  Accessed: ${s.accessTime.toISOString()}`))}),t.command(`cat`).description(`Print file contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o);let s=await o.read(n);r.json?e({path:n,content:s}):console.log(s)}),t.command(`rm`).description(`Delete a file or directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to delete`).option(`-r, --recursive`,`Delete directories recursively`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o),await o.fs.delete(n,{recursive:r.recursive}),r.json?e({success:!0,path:n,deleted:!0}):console.log(`✓ Deleted: ${n}`)}),t.command(`mkdir`).description(`Create a directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Directory path to create`).option(`-p, --parents`,`Create parent directories as needed`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o),await o.fs.mkdir(n,{recursive:r.parents}),r.json?e({success:!0,path:n,created:!0}):console.log(`✓ Created: ${n}`)}),t.command(`exists`).description(`Check if a path exists`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to check`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=await q(a,i,t);o=await J(o);let s=await o.fs.exists(n);r.json?e({path:n,exists:s}):(console.log(s?`exists`:`not found`),process.exit(+!s))}),t}function ys(e){let t=[`r`,`w`,`x`],n=``;for(let r=2;r>=0;r--){let i=r*3;for(let r=0;r<3;r++)n+=e>>i+(2-r)&1?t[r]:`-`}return n}function bs(e){let t=[`B`,`KB`,`MB`,`GB`,`TB`],n=e,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r++;return r===0?`${n}${t[r]}`:`${n.toFixed(1)}${t[r]}`}function xs(){let t=new N(`git`).description(`Git operations in a sandbox workspace`);return t.command(`status`).description(`Show git repository status`).argument(`<id-or-name>`,`Sandbox ID or name`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching status...`);n.json||a.start();let o=await q(i,r,t);o=await J(o);let s=await o.git.status();if(a.stop(),n.json)e(s);else if(!s.isRepo)console.log(`No git repository in the sandbox workspace.`);else{if(console.log(`Branch:    ${s.branch??`unknown`}`),console.log(`HEAD:      ${s.head.slice(0,7)||`(no commits)`}`),console.log(`Dirty:     ${s.isDirty?`yes`:`no`}`),s.ahead&&console.log(`Ahead:     ${s.ahead}`),s.behind&&console.log(`Behind:    ${s.behind}`),s.staged.length>0){console.log(`\nStaged (${s.staged.length}):`);for(let e of s.staged)console.log(`  + ${e}`)}if(s.modified.length>0){console.log(`\nModified (${s.modified.length}):`);for(let e of s.modified)console.log(`  M ${e}`)}if(s.untracked.length>0){console.log(`\nUntracked (${s.untracked.length}):`);for(let e of s.untracked)console.log(`  ? ${e}`)}}}),t.command(`log`).description(`Show commit log`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`-n, --limit <count>`,`Max commits to show`,`10`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching log...`);n.json||a.start();let o=await q(i,r,t);o=await J(o);let s=await o.git.log(Number.parseInt(n.limit,10));if(a.stop(),n.json)e(s);else if(s.length===0)console.log(`No commits found`);else for(let e of s)console.log(`${e.shortSha} ${e.message.split(`
 `)[0]} (${e.author}, ${e.date.toLocaleDateString()})`)}),t.command(`diff`).description(`Show diff`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--ref <ref>`,`Ref to diff against`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching diff...`);n.json||a.start();let o=await q(i,r,t);o=await J(o);let s=await o.git.diff(n.ref);a.stop(),n.json?e(s):s.raw?console.log(s.raw):console.log(`${s.additions} additions, ${s.deletions} deletions across ${s.files.length} files`)}),t.command(`add`).description(`Stage files`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<paths...>`,`Paths to stage`).action(async(e,t,n)=>{let{context:i,client:a}=G(n),o=await q(a,i,e);o=await J(o),await o.git.add(t),r(`Staged: ${t.join(`, `)}`)}),t.command(`commit`).description(`Create a commit`).argument(`<id-or-name>`,`Sandbox ID or name`).requiredOption(`-m, --message <msg>`,`Commit message`).option(`--amend`,`Amend the previous commit`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=await q(a,i,t);o=await J(o);let s=await o.git.commit(n.message,{amend:n.amend});n.json?e(s):r(`Committed: ${s.shortSha} ${s.message}`)}),t.command(`push`).description(`Push to remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--force`,`Force push`).action(async(e,t)=>{let{context:n,client:i}=G(t),a=f(`Pushing...`);a.start();let o=await q(i,n,e);o=await J(o),await o.git.push({force:t.force}),a.stop(),r(`Pushed to remote`)}),t.command(`pull`).description(`Pull from remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--rebase`,`Rebase instead of merge`).action(async(e,t)=>{let{context:n,client:i}=G(t),a=f(`Pulling...`);a.start();let o=await q(i,n,e);o=await J(o),await o.git.pull({rebase:t.rebase}),a.stop(),r(`Pulled from remote`)}),t.command(`branches`).description(`List branches`).argument(`<id-or-name>`,`Sandbox ID or name`).action(async(t,n)=>{let{context:r,client:a}=G(n),o=f(`Fetching branches...`);n.json||o.start();let s=await q(a,r,t);s=await J(s);let c=await s.git.branches();o.stop(),n.json?e(c):c.length===0?console.log(`No branches found`):i([`Name`,`Current`,`Remote`],c.map(e=>[e.name,e.current?`* `:`  `,e.upstream??`-`]))}),t.command(`checkout`).description(`Checkout a branch or ref`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<ref>`,`Branch name or ref`).option(`-b, --create`,`Create a new branch`).action(async(e,t,n)=>{let{context:i,client:a}=G(n),o=await q(a,i,e);o=await J(o),await o.git.checkout(t,{create:n.create}),r(`Checked out: ${t}${n.create?` (new)`:``}`)}),t}function Ss(e,t=16){if(!Number.isInteger(t)||t<=0||t>64)throw TypeError(`stableHashHex: lengthHex must be in [1, 64] (got ${t})`);let n=typeof e==`string`?e:JSON.stringify(e,(e,t)=>{if(t&&typeof t==`object`&&!Array.isArray(t)){let e={},n=t;for(let t of Object.keys(n).sort())e[t]=n[t];return e}return t});return ve(`sha256`).update(n).digest(`hex`).slice(0,t)}Object.freeze([`HS256`]),Object.freeze([`RS256`]);async function Cs(e,t,n=`tangle --help`){let r=new AbortController,i=e??r.signal,a=()=>{r.abort(),process.stderr.write(`Stopping…
-`)};e||(process.once(`SIGINT`,a),process.once(`SIGTERM`,a));try{return i.throwIfAborted(),await t(i)}catch(e){if(!i.aborted||e instanceof B&&e.code===`RUN_STOPPED`)throw e;let t=new B(`RUN_STOPPED`,`Command interrupted`,`A stop request ended this execution`,n);throw e instanceof Error&&`runId`in e&&typeof e.runId==`string`&&Object.assign(t,{runId:e.runId}),t}finally{e||(process.off(`SIGINT`,a),process.off(`SIGTERM`,a))}}function ws(e,t){for(let[n,r]of Object.entries(t)){let t=e.gates?.find(e=>e.id===n);if(!t||!t.choices.includes(r))throw new B(`GATE_CHOICE_INVALID`,`Invalid choice for gate '${n}'`,t?`Choose one of: ${t.choices.join(`, `)}`:`The graph does not declare this gate`,`tangle graph run --help`)}}function Ts(e,t){let n=t.signal;return async r=>{let i=Object.hasOwn(e,r.gate)?e[r.gate]:void 0,a=`--param ${Me(`gate.${r.gate}=<choice>`)}`,o=`${r.question} Choose one of: ${r.choices.join(`, `)}`,s=()=>new B(`GATE_ANSWER_REQUIRED`,`Gate '${r.gate}' needs an answer. ${o}. Pass ${a}`,o,`tangle graph run <graph> ${a}`);if(i!==void 0)return{kind:`choose`,choice:i,by:`cli:param`};if(t.json||!process.stdin.isTTY)throw s();let c;try{c=await mr(`${r.question} [${r.choices.join(` / `)}]`,void 0,n)}catch{if(n.aborted)return{kind:`stop`,reason:`Gate input interrupted or timed out`,by:`cli:terminal`};throw s()}if(!r.choices.includes(c))throw s();return{kind:`choose`,choice:c,by:`cli:terminal`}}}const Es=()=>import(`./dist-CzrZj_46.mjs`);async function Ds(e,t,n,r){if(e==null)return;let{graphKnowledgeBindingSchema:i,graphKnowledgeResolver:a}=await Es(),o=i.parse(e);if(o.kind!==`local`)throw Error(`A local graph needs a pinned local Knowledge binding; Hub generations require the hosted workflow owner`);return a({binding:o,storeRoot:M(t,`knowledge`),signal:r,record:async e=>n.put({executionId:e.context.nodeId,purpose:`executor-native-evidence`,bytes:Buffer.from(JSON.stringify(e))}),recordProposal:async e=>n.put({executionId:e.context.nodeId,purpose:`task-output`,bytes:Buffer.from(JSON.stringify(e))})})}function Os(t){let n=t.command(`knowledge`).description(`Exact measured Knowledge candidate transitions`);n.command(`bind <root>`).description(`Identify exact bytes of an existing local Knowledge store`).action(async t=>e(await(await Es()).pinLocalGraphKnowledge(t)));for(let t of[`promote`,`restore`])n.command(`${t} <binding> <candidate>`).description(`${t} the exact measured local Knowledge candidate through its owner`).action(async(n,r)=>{let{graphKnowledgeBindingSchema:i,transitionGraphKnowledge:a}=await Es(),o=i.parse(JSON.parse(await L(n,`utf8`))),s=await a(o,JSON.parse(await L(r,`utf8`)),t);e({...s,nextBinding:{...o,sourceDigest:`sha256:${s.mutation.afterHash}`}})})}const ks=()=>new _e(`--mcp-secret <key=variable>`,`Private local MCP secret reference binding; repeatable, values are never recorded`).argParser((e,t)=>[...t,e]).default([]);function As(e=[]){let t=new Map;for(let n of e){let e=n.indexOf(`=`),r=n.slice(0,e).trim(),i=n.slice(e+1).trim();if(e<1||!r||!/^[A-Za-z_][A-Za-z0-9_]*$/.test(i)||t.has(r)&&t.get(r)!==i)throw new B(`GRAPH_MCP_SECRET_BINDING`,`Invalid private MCP credential binding`,`Use one unambiguous key=ENVIRONMENT_VARIABLE per declared secret reference`,`tangle graph run --help`);t.set(r,i)}return Object.fromEntries(t)}async function js(e){try{return Je.parse(JSON.parse(await L(e,`utf8`)))}catch(e){throw new B(`GRAPH_MCP_POLICY_INVALID`,`The graph MCP policy is invalid`,e instanceof Error?e.message:String(e),`tangle graph run --help`)}}const Ms=[`claude-code`,`opencode`,`codex`,`kimi-code`,`prime`],Ns=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function Ps(e){let t=Oe(e);if(t)return t;throw Error(`--model '${e}' has no provider. Pass a canonical id, for example 'google/${e}'.`)}function Fs(e){let t=e.harness??`claude-code`;if(!Ms.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${Ms.join(`, `)}.`);let n=Is(e.maxTokens,2e5,`--max-tokens`),r=Is(e.maxIterations,50,`--max-iterations`),i=e.maxWorkers===void 0?void 0:Is(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:n,maxIterations:r,...i===void 0?{}:{maxWorkers:i}}}function Is(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function Ls(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function Rs(e){let t=e.spentTotal,n=e.kind===`no-winner`?``:e.out;return{text:typeof n==`string`?n:typeof n==`object`&&n&&`content`in n&&typeof n.content==`string`?n.content:JSON.stringify(n),tokenUsage:{input:t.tokensKnown===!1?null:t.tokens.input,output:t.tokensKnown===!1?null:t.tokens.output},costUsd:t.usdKnown===!1?null:t.usd,status:e.kind===`no-winner`?`no-winner (${e.reason})`:`winner`}}let zs=null;function Bs(){return zs??=import(`@tangle-network/agent-runtime/kernel`).catch(e=>{throw zs=null,e?.code===`ERR_MODULE_NOT_FOUND`?new B(`RUNTIME_UNAVAILABLE`,`Agent Runtime could not be loaded`,e.message,`npm install -g @tangle-network/sandbox-cli@latest`):e}),zs}async function Vs(e,t,n){let r=U({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=W(r),{budget:a,perWorker:o}=Ls(t),s=[],c={async create(e){let{TANGLE_API_KEY:t,...r}=e?.env??{},a=await i.create(e?.env?{...e,env:r}:e);return s.push({id:a.id,status:`spawned`}),n.json||l(`worker ${a.id} spawned`),a}},u=await Bs(),d=u.workerFromBackend({backend:`sandbox`,sandboxClient:c,maxIterations:1}),f=(e,n)=>d({...e,harness:t.harness},n),p={name:`supervisor`,harness:`cli-base`,model:{default:t.model??`gemini-3.5-flash-lite`,provider:t.model?Ps(t.model):`google`},tools:{agent_runtime_coordination_spawn_worker:!0,agent_runtime_coordination_observe_agent:!0}},m={routerBaseUrl:Ns,routerKey:r.apiKey},h=Rs(await u.supervise(p,{goal:e},{budget:a,makeWorkerAgent:f,router:m,...o?{perWorker:o}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${be()}`})),g=h.status===`winner`?`settled`:`failed`;for(let e of s)e.status=g,n.json||l(`worker ${e.id} settled (${e.status})`);return{task:e,result:h.text,workers:s,tokenUsage:h.tokenUsage,costUsd:h.costUsd,status:h.status}}function Hs(){let t=new N(`supervise`);return t.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${Ms.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).action(async(t,n)=>{let r=Fs({harness:n.harness,model:n.model,maxTokens:n.maxTokens,maxIterations:n.maxIterations,maxWorkers:n.maxWorkers});n.json||(l(`Supervising: ${t}`),l(`harness=${r.harness} budget=${r.maxTokens}tok/${r.maxIterations}it`),console.log());let i=await Vs(t,r,{apiKey:n.apiKey,baseUrl:n.baseUrl,json:n.json});if(n.json){e(i),i.status!==`winner`&&(process.exitCode=1);return}if(console.log(),i.result&&(console.log(i.result),console.log()),s({"Input Tokens":i.tokenUsage.input??`Unavailable`,"Output Tokens":i.tokenUsage.output??`Unavailable`,Cost:i.costUsd===null?`Unavailable`:`$${i.costUsd.toFixed(4)}`}),i.status!==`winner`)throw Error(`Supervisor finished without a winner: ${i.status}`)}),t}function Us(e,t){let n=me(e,t);return n!==`..`&&!n.startsWith(`..${ge}`)&&!fe(n)}const Ws=()=>import(`@tangle-network/agent-eval/campaign`),Gs=()=>import(`@tangle-network/agent-runtime/candidate-execution`),Ks=`graph-task-workspaces`,qs=F.number().int().positive().max(2**53-1),Js=F.strictObject({maxArchiveBytes:qs.optional(),maxEmbeddedArtifactBytes:qs.optional(),maxFiles:qs.optional(),maxFileBytes:qs.optional(),maxTotalFileBytes:qs.optional(),maxPathBytes:qs.optional(),maxRepositoryBundleBytes:qs.optional()}),Ys=we.shape,Xs=F.strictObject({snapshot:F.strictObject({kind:Ys.kind,digest:Ys.digest,manifest:Ce,archive:Ce}).superRefine((e,t)=>{(e.digest!==e.manifest.sha256||!e.manifest.byteLength||!e.archive.byteLength)&&t.addIssue({code:`custom`,message:`The canonical workspace manifest, digest and archive must agree`})}),capture:F.strictObject({mode:F.literal(`git-working-tree`),runtimeVersion:F.string().min(1),limits:Js}),gaps:F.tuple([F.literal(`environment-and-toolchain-not-snapshotted`),F.literal(`git-ignored-files-excluded`)])}),Zs=e=>P(Xs.parse(e));function Qs(e){for(let t of[e.snapshot.manifest,e.snapshot.archive])if(t.locator.kind!==`private-cas`||t.locator.namespace!==Ks)throw Error(`Task workspace artifacts require their original local private CAS; cross-backend activation is unsupported`)}async function $s(){let e=M(I(),`.tangle`);return await ft(e,{recursive:!0,mode:448}),R(e)}const ec=async e=>(await import(`@tangle-network/agent-runtime/kernel`)).createPrivateCasArtifactPort(M(e,`artifacts`),Ks);async function tc(e){let t=await mt(he(e),Fe.O_RDONLY|Fe.O_NOFOLLOW);try{if(!(await t.stat()).isFile())throw Error(`Task workspace reference must be a regular file`);let e=Xs.parse(JSON.parse(await t.readFile(`utf8`)));return Qs(e),e}finally{await t.close()}}async function nc(e,t={}){t.signal?.throwIfAborted();let n=he(e),r=await dt(n);if(!r.isDirectory()||r.isSymbolicLink())throw Error(`Task workspace must be one real repository root`);let i=await R(n),a=await R(I()),o=await $s();if(i===a||i===ue(i)||Us(o,i)||Us(i,o))throw Error(`Task workspace capture cannot include the home, filesystem or private evidence root`);let{release:s}=(await Ws()).acquireSingleRunLock({lockPath:`${i}.graph-workspace.lock`});try{let e=Js.parse(t.limits??{}),n=await(await Gs()).captureAgentWorkspaceSnapshot(i,{includeRepository:!0,repositoryContents:`working-tree`,limits:e,artifactPersistence:{executionId:be(),outputArtifacts:await ec(o),signal:t.signal}}),r=v(`@tangle-network/agent-runtime`,import.meta.url);if(!r)throw Error(`Cannot identify the Runtime workspace archive owner`);let a=JSON.parse(await L(r,`utf8`));return Xs.parse({snapshot:n,capture:{mode:`git-working-tree`,runtimeVersion:a.version,limits:e},gaps:[`environment-and-toolchain-not-snapshotted`,`git-ignored-files-excluded`]})}finally{s()}}async function rc(e,t){let n=F.uuid().parse(t.runId),r=Xs.parse(e);Qs(r);let i=await $s(),a=M(i,`workspaces`);if(await ft(a,{recursive:!0,mode:448}),await R(a)!==a)throw Error(`Task workspace allocation root redirects elsewhere`);let o=M(a,n),{release:s}=(await Ws()).acquireSingleRunLock({lockPath:`${o}.lock`});try{t.signal?.throwIfAborted();let e=`${o}.task-workspace.json`,a;try{a=JSON.parse(await L(e,`utf8`))}catch(e){if(e.code!==`ENOENT`)throw e}let c=Zs(r);if(a!==void 0){let e=F.strictObject({runId:F.uuid(),identity:F.string()}).parse(a);if(e.runId!==n||e.identity!==c||t.resumeCwd!==void 0&&he(t.resumeCwd)!==o||await R(o)!==o||!(await dt(o)).isDirectory())throw Error(`The retained task workspace no longer names this exact native run allocation`)}else{if(t.resumeCwd!==void 0)throw Error(`The retained task workspace allocation receipt is missing`);await(await Gs()).materializeAgentWorkspaceSnapshot({snapshot:r.snapshot,artifacts:await ec(i),destination:o,limits:r.capture.limits,signal:t.signal}),await z(e,JSON.stringify({runId:n,identity:c}),{flag:`wx`,mode:384,flush:!0})}if(!t.validationOnly||a!==void 0)return{cwd:o,release:s};let l=await Promise.all([dt(o,{bigint:!0}),dt(e,{bigint:!0})]);return{cwd:o,release:async()=>{try{for(let[t,r]of[o,e].entries()){let e=await dt(r,{bigint:!0});if(!(t===0?e.isDirectory():e.isFile())||e.dev!==l[t]?.dev||e.ino!==l[t]?.ino||await R(r)!==r)throw Error(`Validation allocation ${n} changed; retained`)}if(P(JSON.parse(await L(e,`utf8`)))!==P({runId:n,identity:c}))throw Error(`Validation allocation ${n} receipt changed; retained`);try{throw await dt(M(i,`runs`,n)),Error(`Validation allocation ${n} has run state; retained`)}catch(e){if(e.code!==`ENOENT`)throw e}await ht(o,{recursive:!0}),await ht(e)}finally{s()}}}}catch(e){throw s(),e}}function ic(t){t.command(`workspace`).description(`Capture immutable local task files for graph replay`).command(`capture <repository>`).description(`Capture Git HEAD, index, tracked and unignored files into private local artifacts`).requiredOption(`--output <file>`,`New reference file outside the source repository`).option(`--limits <file>`,`JSON overrides for the maintained Runtime archive limits`).action(async(t,n)=>{let r=await R(he(t)),i=M(await R(ue(he(n.output))),le(he(n.output)));if(Us(r,i))throw Error(`The task reference must be written outside the original workspace`);try{throw await dt(i),Error(`Task workspace reference already exists; choose a new output file`)}catch(e){if(e.code!==`ENOENT`)throw e}let a=await nc(r,{limits:n.limits?Js.parse(JSON.parse(await L(n.limits,`utf8`))):void 0});await z(i,JSON.stringify(a),{flag:`wx`,mode:384,flush:!0}),e(a)})}const ac=F.string().regex(/^[a-f0-9]{64}$/),oc=F.strictObject({version:F.literal(1),runId:F.uuid(),file:F.string().refine(fe),cwd:F.string().refine(fe),sourceDigest:ac,source:F.string().optional(),graphDigest:ac,params:F.record(F.string(),F.unknown()),trigger:F.record(F.string(),F.unknown()).optional(),gateChoices:F.record(F.string(),F.string()).optional(),startedAt:F.iso.datetime(),seat:F.string().optional(),mcpPolicy:Ye.optional(),taskWorkspace:Xs.optional()});async function sc(e){let t=await Bs(),n=t.graphRegistry(M(I(),`.tangle`,`graph-registry`)),r=await t.loadGraph(n,e.graphDigest);if(!r)throw Error(`Retained execution graph is unavailable; configuration is unknown`);let i=t.validateStoredGraph(r);if(i.digest!==e.graphDigest)throw Error(`Retained execution graph changed its identity`);return P({mcpPolicy:Ye.parse(e.mcpPolicy??{}),nodes:i.nodes.map(({id:e,profile:t})=>({id:e,harness:t.harness??null,model:t.model??null,seats:t.seats??null,connections:t.connections??null}))})}function Y(e){throw new B(`GRAPH_RESUME_REFUSED`,`The graph run cannot be resumed`,e,`tangle graph run --help`)}async function cc(e){F.uuid().safeParse(e).success||Y(`Use a recorded graph run ID`);let t;try{let n=M(await R(M(I(),`.tangle`)),`runs`,e);await R(n)!==n&&Y(`The run directory redirects elsewhere`),t=await mt(M(n,`input.json`),Fe.O_RDONLY|Fe.O_NOFOLLOW),(await t.stat()).isFile()||Y(`The run input is not a regular file`);let r=oc.parse(JSON.parse(await t.readFile(`utf8`)));return r.runId!==e&&Y(`The recorded run identity changed`),r.source!==void 0&&uc(r,r.source),r}catch(e){if(e instanceof B)throw e;return Y(`The private recorded run input is missing or invalid`)}finally{await t?.close()}}async function lc(e,t){let n=t.source??await L(t.file,`utf8`);uc(t,n),await z(M(e,`input.json`),JSON.stringify({...t,source:n}),{flag:`wx`,mode:384,flush:!0})}function uc(e,t){return ve(`sha256`).update(t).digest(`hex`)!==e.sourceDigest&&Y(`The retained graph source does not match this run`),t}async function dc(e){return uc(e,e.source??await L(e.file,`utf8`))}function fc(e,t,n,r,i={}){e.sourceDigest!==n&&Y(`The authored graph source changed`),t.cloud&&Y(`A local run cannot move to cloud execution`),Object.entries(r).some(([t,n])=>!Object.hasOwn(e.params,t)||P(n)!==P(e.params[t]))&&Y(`A recorded graph parameter changed`),Object.entries(i).some(([t,n])=>e.gateChoices?.[t]!==n)&&Y(`A recorded gate choice changed`),t.seat!==void 0&&t.seat!==e.seat&&Y(`The recorded graph seat override changed`),t.mcpPolicy!==void 0&&(e.mcpPolicy===void 0||P(t.mcpPolicy)!==P(e.mcpPolicy))&&Y(`The recorded graph MCP policy changed`)}const pc=e=>Object.entries(e).map(([e,t])=>`${e}=${typeof t==`string`?t:JSON.stringify(t)}`),mc=`claude,codex,kimi,opencode,gemini,pi`;function hc(e,t){let n;return async(r,{node:i,lastCandidate:a})=>{t.throwIfAborted();let o;try{o=r===void 0?void 0:ke(r)}catch(e){throw e instanceof Error&&Object.assign(e,{node:i,seat:r,fixCommand:`tangle graph run --help`}),e}n??=import(`cli-bridge`).then(({listLocalModels:n,loadConfig:r})=>n({cwd:e,signal:t,config:r({...process.env,BRIDGE_BACKENDS:mc,BRIDGE_SUBSCRIPTIONS_ONLY:`1`})}));let s=await n;t.throwIfAborted();let c=e=>e.authentication?.status===`authenticated`&&e.authentication.authMode===`subscription`,l=o?.harness??s.find(e=>e.provider&&c(e))?.backend,u=s.filter(e=>e.backend===l),d=u.filter(c),f=o?u.find(e=>e.id===`${o.harness}/${o.model}`)??d.find(e=>e.provider===o.provider):d.find(e=>e.default)??d.find(e=>e.recommended)??d[0];if(!f||!c(f)){if(a===!1)return;let e=f?.authentication??u[0]?.authentication??(o?void 0:s.find(e=>e.authentication?.fix)?.authentication);throw Object.assign(new B(o?`SEAT_NOT_LOGGED_IN`:`SEAT_NONE_DETECTED`,`Node '${i}' has no available subscription${o?` for ${o.harness}`:``}`,e?`Selected provider: ${e.status} (${e.authMode})`:`No authenticated subscription route was detected`,e?.fix??`tangle graph run --help`),{node:i,seat:r})}let p=o?.harness??ke(f.id).harness,m=o?.provider??f.provider,h=o?.model??f.id.slice(p.length+1);if(!m||!h)throw new B(`MODEL_PROVIDER_MISMATCH`,`Node '${i}' has an unresolved model provider`,`Bridge has no configured provider for ${r??p}`,`tangle graph run --help`);return{harness:p,provider:m,model:h,selector:{kind:`all-eligible`},...o?.reasoningEffort===void 0?{}:{reasoningEffort:o.reasoningEffort}}}}const gc=gt(We);function _c(e,t,n=`tangle graph run --help`){throw new B(`SEAT_NONE_DETECTED`,e,t,n)}function vc(e){let t=[];for(let n of e.nodes)for(let e of n.check?.egress??[]){let n=e.trim().toLowerCase();if(n){if(/[\s*]|\/|:\/\//u.test(n))throw new B(`GRAPH_EGRESS_HOST`,`Graph egress host "${e.trim()}" is not a DNS hostname`,`A check egress entry has whitespace, a wildcard, or a URL`,`tangle graph run --help`);t.includes(n)||t.push(n)}}return t.length>0?t.join(`,`):void 0}function yc(e){return e.some(e=>(e.profile?.seats?.length??0)>0)}function bc(e){let t=e?.trim();if(t)return/\s/u.test(t)&&_c(`A seat account, command, or credential must be a single token`,`The seat command is an executable path, not a shell line`),t}function xc(e){let t=bc(e.seatAccount),n=bc(e.seatCommand),r=bc(e.seatCredential);return r&&!n&&!t&&_c(`A seat credential needs a seat command`,`The credential is an argument to the configured command`,`tangle graph run --seat-command <program>`),{...t?{account:t}:{},...n?{command:n}:{},...r?{credential:r}:{}}}async function Sc(e,t,n){if(e.account)return e.account;e.command||_c(`This graph needs a seat account or a seat command`,`No account was authored and no seat command is configured`,`tangle graph run --seat-account <account>`);let r=``;try{r=(await gc(e.command,[t,...e.credential?[e.credential]:[]],{timeout:3e4,maxBuffer:4096,signal:n,encoding:`utf8`})).stdout}catch(e){n.throwIfAborted();let t=e.code===`ENOENT`;_c(t?`The seat command was not found`:`The seat command failed`,t?`The configured executable is not on PATH`:`The seat command exited without an account id`)}let i=r.trim();return(!i||/\s/u.test(i))&&_c(`The seat command did not print an account id`,`The command must print one account id and nothing else`),i}function Cc(e,t,n){let r=new Map;return async i=>{n.throwIfAborted();let a=i.stage.harness,o=i.stage.selector.kind===`seat`?i.stage.selector.id.trim():``,s=`${a}\0${t.credential??``}`,c=o||t.account||r.get(s)||await Sc(t,a,n);!o&&!t.account&&r.set(s,c),(!c||/\s/u.test(c)||i.resumeSeatId!==void 0&&i.resumeSeatId!==c)&&_c(`Node '${i.nodeId}' has no seat account`,`The authored seat, account flag, or seat command did not yield one`);let{createCliBridgeProvider:l}=await import(`@tangle-network/agent-provider-cli-bridge`);return{seat:c,backend:{backend:`provider`,provider:l({baseUrl:e.bridgeUrl,bearerToken:e.bridgeBearer}),defaults:{workspace:{cwd:{base:`host`,path:e.cwd}}},runtime:`cli`,outputFormat:`json`,destroyOnSettle:!0,requireTerminalEvent:!0}}}}function X(e){return tr({signal:e.signal,...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.baseUrl===void 0?{}:{baseUrl:e.baseUrl}})}const wc=F.object({version:F.literal(1),type:F.enum([`state`,`ack`,`error`,`event`]),requestId:F.string().optional(),operationId:F.string().optional(),command:F.string().optional(),code:F.string().optional(),message:F.string().optional(),result:F.unknown().optional()}).passthrough(),Tc=F.object({state:F.object({runConfiguration:F.unknown()}),view:F.object({capabilities:F.record(F.string(),F.object({available:F.boolean(),reason:F.string().optional()}))})}),Ec=F.object({status:F.enum([`completed`,`failed`,`cancelled`]),analysis:F.object({id:F.string().min(1)}).passthrough(),source:F.object({runtimeRun:F.unknown()}).passthrough()}).passthrough(),Dc=`TANGLE_GRAPH_ANALYSIS_SOURCE`;async function Oc(e,t,n){if(!e.startsWith(`wfrun_`)){let t=M(await R(M(I(),`.tangle`)),`runs`,e);if(await R(t)!==t)throw new B(`RUN_NOT_FOUND`,`The run directory redirects elsewhere`,`Use the recorded local run directory`,`tangle graph inspect --help`);return{source:`runtime:${e}@${t}`,env:{},schema:F.object({runId:F.literal(e),runDir:F.literal(t)})}}let r={signal:n,...t.apiKey===void 0?{}:{apiKey:t.apiKey},...t.baseUrl===void 0?{}:{baseUrl:t.baseUrl}},i=await X(r),a=F.object({id:F.literal(e),workflowId:F.string(),revUsed:F.number().int(),execution:F.object({kind:F.literal(`graph`),sourceSha:F.string(),authoredGraphDigest:F.string(),graphDigest:F.string()}),runtime:F.object({snapshot:F.object({supervisors:F.tuple([F.object({id:F.string()})])})})}).parse(await i.workflows.getRun(e,{signal:n})),o=a.runtime.snapshot.supervisors[0];if(!o)throw new B(`BRAID_RPC_FAILED`,`The cloud run has no retained Runtime root`,`Wait for execution evidence before analysis`,`tangle graph inspect ${e}`);let s=await Zn(r);if(new URL(s.baseUrl.replace(/\/+$/,``)).href!==new URL(i.baseUrl.replace(/\/+$/,``)).href)throw new B(`AUTH_REQUIRED`,`The analysis source origin changed`,`Use the same authenticated platform origin`,`tangle auth status --json`);return{source:`runtime:${e}@${Dc}`,env:{[Dc]:JSON.stringify({url:`${s.baseUrl.replace(/\/+$/,``)}/v1/workflows/runs/${encodeURIComponent(e)}`,headers:{Authorization:`Bearer ${s.token}`}})},schema:F.object({runId:F.literal(e),remoteEndpointEnv:F.literal(Dc),checkpoint:F.object({workflowId:F.literal(a.workflowId),runtimeRunId:F.literal(o.id),revUsed:F.literal(a.revUsed),sourceSha:F.literal(a.execution.sourceSha),authoredGraphDigest:F.literal(a.execution.authoredGraphDigest),graphDigest:F.literal(a.execution.graphDigest)})})}}async function kc(e,t){if(!e.startsWith(`wfrun_`)&&!F.uuid().safeParse(e).success)throw new B(`RUN_NOT_FOUND`,`Use a recorded graph run ID`,`The run identifier is invalid`,`tangle graph inspect --help`);if(!Number.isSafeInteger(t.timeout)||t.timeout<1)throw new B(`INVALID_TIMEOUT`,`Use a positive analysis timeout`,`The timeout must be an integer number of milliseconds`,`tangle graph analyze --help`);let n=t.profile;if(!n?.trim())throw new B(`USAGE_INVALID`,`Select the canonical analysis profile`,`Graph analysis requires an existing canonical AgentProfile reference`,`tangle graph analyze `+e+` --profile <name|path>`);let r=/^(?:\.\.?)[/\\]/.test(n)?he(process.cwd(),n):n;return Cs(t.signal,async n=>{let i=await Oc(e,t,n),a=i.source;return $l({signal:n,errorRunId:e},async n=>{let o=await n.bridge(),s=await pt(M(n.runDir,`analysis-`)),c=M(s,`config.json`),l=M(s,`database.key`),u=M(s,`state.sqlite`),d=`connection-owned-graph-bridge`,f=new Date().toISOString();await z(l,ye(32),{mode:384,flag:`wx`}),await z(c,JSON.stringify({format:`braid-startup-config`,schemaVersion:2,profile:r,connectionId:d,connections:[{id:d,name:`Graph analysis`,kind:`cli-bridge`,endpoint:o.bridgeUrl,providerOptions:{transport:`local`},createdAt:f,updatedAt:f,lastHealth:{status:`unknown`}}]}),{mode:384,flag:`wx`});let p=n.signal,m=`op-${be()}`,h=`op-${be()}`,g=`${m}:initialize`,_=`${m}:analyze`,v=`${m}:shutdown`,y={version:1,requestId:g,command:`initialize`,params:{workspace:n.cwd,subscribe:!1}},b={version:1,requestId:_,operationId:m,command:`analyze`,params:{source:a,recipe:`all`,totalTimeoutMs:t.timeout}},x={version:1,requestId:v,operationId:h,command:`shutdown`,params:{mode:`wait`}},S,C,w,T,ee={transform:e=>{let t=wc.parse(e);return t.type===`error`||t.type===`state`&&t.requestId===g||t.type===`ack`&&[_,v].includes(t.requestId??``)?t:null},onError:e=>{T??=e},onEvent:e=>{e.type===`error`&&(T??=new B(e.code??`BRAID_RPC_FAILED`,`Braid refused graph analysis`,e.message??`The RPC response omitted its cause`,`tangle graph analyze --help`)),e.requestId===g&&e.type===`state`&&(S??=e),e.requestId===_&&e.type===`ack`&&(C??=e),e.requestId===v&&e.type===`ack`&&(w??=e)}},E=await je({command:process.env.BRAID_BIN??`braid`,args:[`rpc`,`--workspace`,n.cwd,`--config`,c,`--profile`,r,`--database-key-file`,l],cwd:n.cwd,env:{...i.env,BRAID_STATE_PATH:u,BRAID_CLI_BRIDGE_ENDPOINT:o.bridgeUrl,BRAID_CLI_BRIDGE_AUTH:o.bridgeBearer},timeoutMs:t.timeout,signal:p,ownProcessGroup:!0},ee,{stdin:[y,...t.dryRun?[]:[b],x].map(e=>JSON.stringify(e)).join(`
+`)};e||(process.once(`SIGINT`,a),process.once(`SIGTERM`,a));try{return i.throwIfAborted(),await t(i)}catch(e){if(!i.aborted||e instanceof B&&e.code===`RUN_STOPPED`)throw e;let t=new B(`RUN_STOPPED`,`Command interrupted`,`A stop request ended this execution`,n);throw e instanceof Error&&`runId`in e&&typeof e.runId==`string`&&Object.assign(t,{runId:e.runId}),t}finally{e||(process.off(`SIGINT`,a),process.off(`SIGTERM`,a))}}function ws(e,t){for(let[n,r]of Object.entries(t)){let t=e.gates?.find(e=>e.id===n);if(!t||!t.choices.includes(r))throw new B(`GATE_CHOICE_INVALID`,`Invalid choice for gate '${n}'`,t?`Choose one of: ${t.choices.join(`, `)}`:`The graph does not declare this gate`,`tangle graph run --help`)}}function Ts(e,t){let n=t.signal;return async r=>{let i=Object.hasOwn(e,r.gate)?e[r.gate]:void 0,a=`--param ${Ne(`gate.${r.gate}=<choice>`)}`,o=`${r.question} Choose one of: ${r.choices.join(`, `)}`,s=()=>new B(`GATE_ANSWER_REQUIRED`,`Gate '${r.gate}' needs an answer. ${o}. Pass ${a}`,o,`tangle graph run <graph> ${a}`);if(i!==void 0)return{kind:`choose`,choice:i,by:`cli:param`};if(t.json||!process.stdin.isTTY)throw s();let c;try{c=await mr(`${r.question} [${r.choices.join(` / `)}]`,void 0,n)}catch{if(n.aborted)return{kind:`stop`,reason:`Gate input interrupted or timed out`,by:`cli:terminal`};throw s()}if(!r.choices.includes(c))throw s();return{kind:`choose`,choice:c,by:`cli:terminal`}}}const Es=()=>import(`./dist-CzrZj_46.mjs`);async function Ds(e,t,n,r){if(e==null)return;let{graphKnowledgeBindingSchema:i,graphKnowledgeResolver:a}=await Es(),o=i.parse(e);if(o.kind!==`local`)throw Error(`A local graph needs a pinned local Knowledge binding; Hub generations require the hosted workflow owner`);return a({binding:o,storeRoot:M(t,`knowledge`),signal:r,record:async e=>n.put({executionId:e.context.nodeId,purpose:`executor-native-evidence`,bytes:Buffer.from(JSON.stringify(e))}),recordProposal:async e=>n.put({executionId:e.context.nodeId,purpose:`task-output`,bytes:Buffer.from(JSON.stringify(e))})})}function Os(t){let n=t.command(`knowledge`).description(`Exact measured Knowledge candidate transitions`);n.command(`bind <root>`).description(`Identify exact bytes of an existing local Knowledge store`).action(async t=>e(await(await Es()).pinLocalGraphKnowledge(t)));for(let t of[`promote`,`restore`])n.command(`${t} <binding> <candidate>`).description(`${t} the exact measured local Knowledge candidate through its owner`).action(async(n,r)=>{let{graphKnowledgeBindingSchema:i,transitionGraphKnowledge:a}=await Es(),o=i.parse(JSON.parse(await L(n,`utf8`))),s=await a(o,JSON.parse(await L(r,`utf8`)),t);e({...s,nextBinding:{...o,sourceDigest:`sha256:${s.mutation.afterHash}`}})})}const ks=()=>new _e(`--mcp-secret <key=variable>`,`Private local MCP secret reference binding; repeatable, values are never recorded`).argParser((e,t)=>[...t,e]).default([]);function As(e=[]){let t=new Map;for(let n of e){let e=n.indexOf(`=`),r=n.slice(0,e).trim(),i=n.slice(e+1).trim();if(e<1||!r||!/^[A-Za-z_][A-Za-z0-9_]*$/.test(i)||t.has(r)&&t.get(r)!==i)throw new B(`GRAPH_MCP_SECRET_BINDING`,`Invalid private MCP credential binding`,`Use one unambiguous key=ENVIRONMENT_VARIABLE per declared secret reference`,`tangle graph run --help`);t.set(r,i)}return Object.fromEntries(t)}async function js(e){try{return Ye.parse(JSON.parse(await L(e,`utf8`)))}catch(e){throw new B(`GRAPH_MCP_POLICY_INVALID`,`The graph MCP policy is invalid`,e instanceof Error?e.message:String(e),`tangle graph run --help`)}}const Ms=[`claude-code`,`opencode`,`codex`,`kimi-code`,`prime`],Ns=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function Ps(e){let t=ke(e);if(t)return t;throw Error(`--model '${e}' has no provider. Pass a canonical id, for example 'google/${e}'.`)}function Fs(e){let t=e.harness??`claude-code`;if(!Ms.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${Ms.join(`, `)}.`);let n=Is(e.maxTokens,2e5,`--max-tokens`),r=Is(e.maxIterations,50,`--max-iterations`),i=e.maxWorkers===void 0?void 0:Is(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:n,maxIterations:r,...i===void 0?{}:{maxWorkers:i}}}function Is(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function Ls(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function Rs(e){let t=e.spentTotal,n=e.kind===`no-winner`?``:e.out;return{text:typeof n==`string`?n:typeof n==`object`&&n&&`content`in n&&typeof n.content==`string`?n.content:JSON.stringify(n),tokenUsage:{input:t.tokensKnown===!1?null:t.tokens.input,output:t.tokensKnown===!1?null:t.tokens.output},costUsd:t.usdKnown===!1?null:t.usd,status:e.kind===`no-winner`?`no-winner (${e.reason})`:`winner`}}let zs=null;function Bs(){return zs??=import(`@tangle-network/agent-runtime/kernel`).catch(e=>{throw zs=null,e?.code===`ERR_MODULE_NOT_FOUND`?new B(`RUNTIME_UNAVAILABLE`,`Agent Runtime could not be loaded`,e.message,`npm install -g @tangle-network/sandbox-cli@latest`):e}),zs}async function Vs(e,t,n){let r=U({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=W(r),{budget:a,perWorker:o}=Ls(t),s=[],c={async create(e){let{TANGLE_API_KEY:t,...r}=e?.env??{},a=await i.create(e?.env?{...e,env:r}:e);return s.push({id:a.id,status:`spawned`}),n.json||l(`worker ${a.id} spawned`),a}},u=await Bs(),d=u.workerFromBackend({backend:`sandbox`,sandboxClient:c,maxIterations:1}),f=(e,n)=>d({...e,harness:t.harness},n),p={name:`supervisor`,harness:`cli-base`,model:{default:t.model??`gemini-3.5-flash-lite`,provider:t.model?Ps(t.model):`google`},tools:{agent_runtime_coordination_spawn_worker:!0,agent_runtime_coordination_observe_agent:!0}},m={routerBaseUrl:Ns,routerKey:r.apiKey},h=Rs(await u.supervise(p,{goal:e},{budget:a,makeWorkerAgent:f,router:m,...o?{perWorker:o}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${be()}`})),g=h.status===`winner`?`settled`:`failed`;for(let e of s)e.status=g,n.json||l(`worker ${e.id} settled (${e.status})`);return{task:e,result:h.text,workers:s,tokenUsage:h.tokenUsage,costUsd:h.costUsd,status:h.status}}function Hs(){let t=new N(`supervise`);return t.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${Ms.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).action(async(t,n)=>{let r=Fs({harness:n.harness,model:n.model,maxTokens:n.maxTokens,maxIterations:n.maxIterations,maxWorkers:n.maxWorkers});n.json||(l(`Supervising: ${t}`),l(`harness=${r.harness} budget=${r.maxTokens}tok/${r.maxIterations}it`),console.log());let i=await Vs(t,r,{apiKey:n.apiKey,baseUrl:n.baseUrl,json:n.json});if(n.json){e(i),i.status!==`winner`&&(process.exitCode=1);return}if(console.log(),i.result&&(console.log(i.result),console.log()),s({"Input Tokens":i.tokenUsage.input??`Unavailable`,"Output Tokens":i.tokenUsage.output??`Unavailable`,Cost:i.costUsd===null?`Unavailable`:`$${i.costUsd.toFixed(4)}`}),i.status!==`winner`)throw Error(`Supervisor finished without a winner: ${i.status}`)}),t}function Us(e,t){let n=me(e,t);return n!==`..`&&!n.startsWith(`..${ge}`)&&!fe(n)}const Ws=()=>import(`@tangle-network/agent-eval/campaign`),Gs=()=>import(`@tangle-network/agent-runtime/candidate-execution`),Ks=`graph-task-workspaces`,qs=F.number().int().positive().max(2**53-1),Js=F.strictObject({maxArchiveBytes:qs.optional(),maxEmbeddedArtifactBytes:qs.optional(),maxFiles:qs.optional(),maxFileBytes:qs.optional(),maxTotalFileBytes:qs.optional(),maxPathBytes:qs.optional(),maxRepositoryBundleBytes:qs.optional()}),Ys=Te.shape,Xs=F.strictObject({snapshot:F.strictObject({kind:Ys.kind,digest:Ys.digest,manifest:we,archive:we}).superRefine((e,t)=>{(e.digest!==e.manifest.sha256||!e.manifest.byteLength||!e.archive.byteLength)&&t.addIssue({code:`custom`,message:`The canonical workspace manifest, digest and archive must agree`})}),capture:F.strictObject({mode:F.literal(`git-working-tree`),runtimeVersion:F.string().min(1),limits:Js}),gaps:F.tuple([F.literal(`environment-and-toolchain-not-snapshotted`),F.literal(`git-ignored-files-excluded`)])}),Zs=e=>P(Xs.parse(e));function Qs(e){for(let t of[e.snapshot.manifest,e.snapshot.archive])if(t.locator.kind!==`private-cas`||t.locator.namespace!==Ks)throw Error(`Task workspace artifacts require their original local private CAS; cross-backend activation is unsupported`)}async function $s(){let e=M(I(),`.tangle`);return await ft(e,{recursive:!0,mode:448}),R(e)}const ec=async e=>(await import(`@tangle-network/agent-runtime/kernel`)).createPrivateCasArtifactPort(M(e,`artifacts`),Ks);async function tc(e){let t=await mt(he(e),Ie.O_RDONLY|Ie.O_NOFOLLOW);try{if(!(await t.stat()).isFile())throw Error(`Task workspace reference must be a regular file`);let e=Xs.parse(JSON.parse(await t.readFile(`utf8`)));return Qs(e),e}finally{await t.close()}}async function nc(e,t={}){t.signal?.throwIfAborted();let n=he(e),r=await dt(n);if(!r.isDirectory()||r.isSymbolicLink())throw Error(`Task workspace must be one real repository root`);let i=await R(n),a=await R(I()),o=await $s();if(i===a||i===ue(i)||Us(o,i)||Us(i,o))throw Error(`Task workspace capture cannot include the home, filesystem or private evidence root`);let{release:s}=(await Ws()).acquireSingleRunLock({lockPath:`${i}.graph-workspace.lock`});try{let e=Js.parse(t.limits??{}),n=await(await Gs()).captureAgentWorkspaceSnapshot(i,{includeRepository:!0,repositoryContents:`working-tree`,limits:e,artifactPersistence:{executionId:be(),outputArtifacts:await ec(o),signal:t.signal}}),r=v(`@tangle-network/agent-runtime`,import.meta.url);if(!r)throw Error(`Cannot identify the Runtime workspace archive owner`);let a=JSON.parse(await L(r,`utf8`));return Xs.parse({snapshot:n,capture:{mode:`git-working-tree`,runtimeVersion:a.version,limits:e},gaps:[`environment-and-toolchain-not-snapshotted`,`git-ignored-files-excluded`]})}finally{s()}}async function rc(e,t){let n=F.uuid().parse(t.runId),r=Xs.parse(e);Qs(r);let i=await $s(),a=M(i,`workspaces`);if(await ft(a,{recursive:!0,mode:448}),await R(a)!==a)throw Error(`Task workspace allocation root redirects elsewhere`);let o=M(a,n),{release:s}=(await Ws()).acquireSingleRunLock({lockPath:`${o}.lock`});try{t.signal?.throwIfAborted();let e=`${o}.task-workspace.json`,a;try{a=JSON.parse(await L(e,`utf8`))}catch(e){if(e.code!==`ENOENT`)throw e}let c=Zs(r);if(a!==void 0){let e=F.strictObject({runId:F.uuid(),identity:F.string()}).parse(a);if(e.runId!==n||e.identity!==c||t.resumeCwd!==void 0&&he(t.resumeCwd)!==o||await R(o)!==o||!(await dt(o)).isDirectory())throw Error(`The retained task workspace no longer names this exact native run allocation`)}else{if(t.resumeCwd!==void 0)throw Error(`The retained task workspace allocation receipt is missing`);await(await Gs()).materializeAgentWorkspaceSnapshot({snapshot:r.snapshot,artifacts:await ec(i),destination:o,limits:r.capture.limits,signal:t.signal}),await z(e,JSON.stringify({runId:n,identity:c}),{flag:`wx`,mode:384,flush:!0})}if(!t.validationOnly||a!==void 0)return{cwd:o,release:s};let l=await Promise.all([dt(o,{bigint:!0}),dt(e,{bigint:!0})]);return{cwd:o,release:async()=>{try{for(let[t,r]of[o,e].entries()){let e=await dt(r,{bigint:!0});if(!(t===0?e.isDirectory():e.isFile())||e.dev!==l[t]?.dev||e.ino!==l[t]?.ino||await R(r)!==r)throw Error(`Validation allocation ${n} changed; retained`)}if(P(JSON.parse(await L(e,`utf8`)))!==P({runId:n,identity:c}))throw Error(`Validation allocation ${n} receipt changed; retained`);try{throw await dt(M(i,`runs`,n)),Error(`Validation allocation ${n} has run state; retained`)}catch(e){if(e.code!==`ENOENT`)throw e}await ht(o,{recursive:!0}),await ht(e)}finally{s()}}}}catch(e){throw s(),e}}function ic(t){t.command(`workspace`).description(`Capture immutable local task files for graph replay`).command(`capture <repository>`).description(`Capture Git HEAD, index, tracked and unignored files into private local artifacts`).requiredOption(`--output <file>`,`New reference file outside the source repository`).option(`--limits <file>`,`JSON overrides for the maintained Runtime archive limits`).action(async(t,n)=>{let r=await R(he(t)),i=M(await R(ue(he(n.output))),le(he(n.output)));if(Us(r,i))throw Error(`The task reference must be written outside the original workspace`);try{throw await dt(i),Error(`Task workspace reference already exists; choose a new output file`)}catch(e){if(e.code!==`ENOENT`)throw e}let a=await nc(r,{limits:n.limits?Js.parse(JSON.parse(await L(n.limits,`utf8`))):void 0});await z(i,JSON.stringify(a),{flag:`wx`,mode:384,flush:!0}),e(a)})}const ac=F.string().regex(/^[a-f0-9]{64}$/),oc=F.strictObject({version:F.literal(1),runId:F.uuid(),file:F.string().refine(fe),cwd:F.string().refine(fe),sourceDigest:ac,source:F.string().optional(),graphDigest:ac,params:F.record(F.string(),F.unknown()),trigger:F.record(F.string(),F.unknown()).optional(),gateChoices:F.record(F.string(),F.string()).optional(),startedAt:F.iso.datetime(),seat:F.string().optional(),mcpPolicy:Xe.optional(),taskWorkspace:Xs.optional()});async function sc(e){let t=await Bs(),n=t.graphRegistry(M(I(),`.tangle`,`graph-registry`)),r=await t.loadGraph(n,e.graphDigest);if(!r)throw Error(`Retained execution graph is unavailable; configuration is unknown`);let i=t.validateStoredGraph(r);if(i.digest!==e.graphDigest)throw Error(`Retained execution graph changed its identity`);return P({mcpPolicy:Xe.parse(e.mcpPolicy??{}),nodes:i.nodes.map(({id:e,profile:t})=>({id:e,harness:t.harness??null,model:t.model??null,seats:t.seats??null,connections:t.connections??null}))})}function Y(e){throw new B(`GRAPH_RESUME_REFUSED`,`The graph run cannot be resumed`,e,`tangle graph run --help`)}async function cc(e){F.uuid().safeParse(e).success||Y(`Use a recorded graph run ID`);let t;try{let n=M(await R(M(I(),`.tangle`)),`runs`,e);await R(n)!==n&&Y(`The run directory redirects elsewhere`),t=await mt(M(n,`input.json`),Ie.O_RDONLY|Ie.O_NOFOLLOW),(await t.stat()).isFile()||Y(`The run input is not a regular file`);let r=oc.parse(JSON.parse(await t.readFile(`utf8`)));return r.runId!==e&&Y(`The recorded run identity changed`),r.source!==void 0&&uc(r,r.source),r}catch(e){if(e instanceof B)throw e;return Y(`The private recorded run input is missing or invalid`)}finally{await t?.close()}}async function lc(e,t){let n=t.source??await L(t.file,`utf8`);uc(t,n),await z(M(e,`input.json`),JSON.stringify({...t,source:n}),{flag:`wx`,mode:384,flush:!0})}function uc(e,t){return ve(`sha256`).update(t).digest(`hex`)!==e.sourceDigest&&Y(`The retained graph source does not match this run`),t}async function dc(e){return uc(e,e.source??await L(e.file,`utf8`))}function fc(e,t,n,r,i={}){e.sourceDigest!==n&&Y(`The authored graph source changed`),t.cloud&&Y(`A local run cannot move to cloud execution`),Object.entries(r).some(([t,n])=>!Object.hasOwn(e.params,t)||P(n)!==P(e.params[t]))&&Y(`A recorded graph parameter changed`),Object.entries(i).some(([t,n])=>e.gateChoices?.[t]!==n)&&Y(`A recorded gate choice changed`),t.seat!==void 0&&t.seat!==e.seat&&Y(`The recorded graph seat override changed`),t.mcpPolicy!==void 0&&(e.mcpPolicy===void 0||P(t.mcpPolicy)!==P(e.mcpPolicy))&&Y(`The recorded graph MCP policy changed`)}const pc=e=>Object.entries(e).map(([e,t])=>`${e}=${typeof t==`string`?t:JSON.stringify(t)}`),mc=`claude,codex,kimi,opencode,gemini,pi`;function hc(e,t){let n;return async(r,{node:i,lastCandidate:a})=>{t.throwIfAborted();let o;try{o=r===void 0?void 0:Ae(r)}catch(e){throw e instanceof Error&&Object.assign(e,{node:i,seat:r,fixCommand:`tangle graph run --help`}),e}n??=import(`cli-bridge`).then(({listLocalModels:n,loadConfig:r})=>n({cwd:e,signal:t,config:r({...process.env,BRIDGE_BACKENDS:mc,BRIDGE_SUBSCRIPTIONS_ONLY:`1`})}));let s=await n;t.throwIfAborted();let c=e=>e.authentication?.status===`authenticated`&&e.authentication.authMode===`subscription`,l=o?.harness??s.find(e=>e.provider&&c(e))?.backend,u=s.filter(e=>e.backend===l),d=u.filter(c),f=o?u.find(e=>e.id===`${o.harness}/${o.model}`)??d.find(e=>e.provider===o.provider):d.find(e=>e.default)??d.find(e=>e.recommended)??d[0];if(!f||!c(f)){if(a===!1)return;let e=f?.authentication??u[0]?.authentication??(o?void 0:s.find(e=>e.authentication?.fix)?.authentication);throw Object.assign(new B(o?`SEAT_NOT_LOGGED_IN`:`SEAT_NONE_DETECTED`,`Node '${i}' has no available subscription${o?` for ${o.harness}`:``}`,e?`Selected provider: ${e.status} (${e.authMode})`:`No authenticated subscription route was detected`,e?.fix??`tangle graph run --help`),{node:i,seat:r})}let p=o?.harness??Ae(f.id).harness,m=o?.provider??f.provider,h=o?.model??f.id.slice(p.length+1);if(!m||!h)throw new B(`MODEL_PROVIDER_MISMATCH`,`Node '${i}' has an unresolved model provider`,`Bridge has no configured provider for ${r??p}`,`tangle graph run --help`);return{harness:p,provider:m,model:h,selector:{kind:`all-eligible`},...o?.reasoningEffort===void 0?{}:{reasoningEffort:o.reasoningEffort}}}}const gc=gt(Ge);function _c(e,t,n=`tangle graph run --help`){throw new B(`SEAT_NONE_DETECTED`,e,t,n)}function vc(e){let t=[];for(let n of e.nodes)for(let e of n.check?.egress??[]){let n=e.trim().toLowerCase();if(n){if(/[\s*]|\/|:\/\//u.test(n))throw new B(`GRAPH_EGRESS_HOST`,`Graph egress host "${e.trim()}" is not a DNS hostname`,`A check egress entry has whitespace, a wildcard, or a URL`,`tangle graph run --help`);t.includes(n)||t.push(n)}}return t.length>0?t.join(`,`):void 0}function yc(e){return e.some(e=>(e.profile?.seats?.length??0)>0)}function bc(e){let t=e?.trim();if(t)return/\s/u.test(t)&&_c(`A seat account, command, or credential must be a single token`,`The seat command is an executable path, not a shell line`),t}function xc(e){let t=bc(e.seatAccount),n=bc(e.seatCommand),r=bc(e.seatCredential);return r&&!n&&!t&&_c(`A seat credential needs a seat command`,`The credential is an argument to the configured command`,`tangle graph run --seat-command <program>`),{...t?{account:t}:{},...n?{command:n}:{},...r?{credential:r}:{}}}async function Sc(e,t,n){if(e.account)return e.account;e.command||_c(`This graph needs a seat account or a seat command`,`No account was authored and no seat command is configured`,`tangle graph run --seat-account <account>`);let r=``;try{r=(await gc(e.command,[t,...e.credential?[e.credential]:[]],{timeout:3e4,maxBuffer:4096,signal:n,encoding:`utf8`})).stdout}catch(e){n.throwIfAborted();let t=e.code===`ENOENT`;_c(t?`The seat command was not found`:`The seat command failed`,t?`The configured executable is not on PATH`:`The seat command exited without an account id`)}let i=r.trim();return(!i||/\s/u.test(i))&&_c(`The seat command did not print an account id`,`The command must print one account id and nothing else`),i}function Cc(e,t,n){let r=new Map;return async i=>{n.throwIfAborted();let a=i.stage.harness,o=i.stage.selector.kind===`seat`?i.stage.selector.id.trim():``,s=`${a}\0${t.credential??``}`,c=o||t.account||r.get(s)||await Sc(t,a,n);!o&&!t.account&&r.set(s,c),(!c||/\s/u.test(c)||i.resumeSeatId!==void 0&&i.resumeSeatId!==c)&&_c(`Node '${i.nodeId}' has no seat account`,`The authored seat, account flag, or seat command did not yield one`);let{createCliBridgeProvider:l}=await import(`@tangle-network/agent-provider-cli-bridge`);return{seat:c,backend:{backend:`provider`,provider:l({baseUrl:e.bridgeUrl,bearerToken:e.bridgeBearer}),defaults:{workspace:{cwd:{base:`host`,path:e.cwd}}},runtime:`cli`,outputFormat:`json`,destroyOnSettle:!0,requireTerminalEvent:!0}}}}function X(e){return tr({signal:e.signal,...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.baseUrl===void 0?{}:{baseUrl:e.baseUrl}})}const wc=F.object({version:F.literal(1),type:F.enum([`state`,`ack`,`error`,`event`]),requestId:F.string().optional(),operationId:F.string().optional(),command:F.string().optional(),code:F.string().optional(),message:F.string().optional(),result:F.unknown().optional()}).passthrough(),Tc=F.object({state:F.object({runConfiguration:F.unknown()}),view:F.object({capabilities:F.record(F.string(),F.object({available:F.boolean(),reason:F.string().optional()}))})}),Ec=F.object({status:F.enum([`completed`,`failed`,`cancelled`]),analysis:F.object({id:F.string().min(1)}).passthrough(),source:F.object({runtimeRun:F.unknown()}).passthrough()}).passthrough(),Dc=`TANGLE_GRAPH_ANALYSIS_SOURCE`;async function Oc(e,t,n){if(!e.startsWith(`wfrun_`)){let t=M(await R(M(I(),`.tangle`)),`runs`,e);if(await R(t)!==t)throw new B(`RUN_NOT_FOUND`,`The run directory redirects elsewhere`,`Use the recorded local run directory`,`tangle graph inspect --help`);return{source:`runtime:${e}@${t}`,env:{},schema:F.object({runId:F.literal(e),runDir:F.literal(t)})}}let r={signal:n,...t.apiKey===void 0?{}:{apiKey:t.apiKey},...t.baseUrl===void 0?{}:{baseUrl:t.baseUrl}},i=await X(r),a=F.object({id:F.literal(e),workflowId:F.string(),revUsed:F.number().int(),execution:F.object({kind:F.literal(`graph`),sourceSha:F.string(),authoredGraphDigest:F.string(),graphDigest:F.string()}),runtime:F.object({snapshot:F.object({supervisors:F.tuple([F.object({id:F.string()})])})})}).parse(await i.workflows.getRun(e,{signal:n})),o=a.runtime.snapshot.supervisors[0];if(!o)throw new B(`BRAID_RPC_FAILED`,`The cloud run has no retained Runtime root`,`Wait for execution evidence before analysis`,`tangle graph inspect ${e}`);let s=await Zn(r);if(new URL(s.baseUrl.replace(/\/+$/,``)).href!==new URL(i.baseUrl.replace(/\/+$/,``)).href)throw new B(`AUTH_REQUIRED`,`The analysis source origin changed`,`Use the same authenticated platform origin`,`tangle auth status --json`);return{source:`runtime:${e}@${Dc}`,env:{[Dc]:JSON.stringify({url:`${s.baseUrl.replace(/\/+$/,``)}/v1/workflows/runs/${encodeURIComponent(e)}`,headers:{Authorization:`Bearer ${s.token}`}})},schema:F.object({runId:F.literal(e),remoteEndpointEnv:F.literal(Dc),checkpoint:F.object({workflowId:F.literal(a.workflowId),runtimeRunId:F.literal(o.id),revUsed:F.literal(a.revUsed),sourceSha:F.literal(a.execution.sourceSha),authoredGraphDigest:F.literal(a.execution.authoredGraphDigest),graphDigest:F.literal(a.execution.graphDigest)})})}}async function kc(e,t){if(!e.startsWith(`wfrun_`)&&!F.uuid().safeParse(e).success)throw new B(`RUN_NOT_FOUND`,`Use a recorded graph run ID`,`The run identifier is invalid`,`tangle graph inspect --help`);if(!Number.isSafeInteger(t.timeout)||t.timeout<1)throw new B(`INVALID_TIMEOUT`,`Use a positive analysis timeout`,`The timeout must be an integer number of milliseconds`,`tangle graph analyze --help`);let n=t.profile;if(!n?.trim())throw new B(`USAGE_INVALID`,`Select the canonical analysis profile`,`Graph analysis requires an existing canonical AgentProfile reference`,`tangle graph analyze `+e+` --profile <name|path>`);let r=/^(?:\.\.?)[/\\]/.test(n)?he(process.cwd(),n):n;return Cs(t.signal,async n=>{let i=await Oc(e,t,n),a=i.source;return $l({signal:n,errorRunId:e},async n=>{let o=await n.bridge(),s=await pt(M(n.runDir,`analysis-`)),c=M(s,`config.json`),l=M(s,`database.key`),u=M(s,`state.sqlite`),d=`connection-owned-graph-bridge`,f=new Date().toISOString();await z(l,ye(32),{mode:384,flag:`wx`}),await z(c,JSON.stringify({format:`braid-startup-config`,schemaVersion:2,profile:r,connectionId:d,connections:[{id:d,name:`Graph analysis`,kind:`cli-bridge`,endpoint:o.bridgeUrl,providerOptions:{transport:`local`},createdAt:f,updatedAt:f,lastHealth:{status:`unknown`}}]}),{mode:384,flag:`wx`});let p=n.signal,m=`op-${be()}`,h=`op-${be()}`,g=`${m}:initialize`,_=`${m}:analyze`,v=`${m}:shutdown`,y={version:1,requestId:g,command:`initialize`,params:{workspace:n.cwd,subscribe:!1}},b={version:1,requestId:_,operationId:m,command:`analyze`,params:{source:a,recipe:`all`,totalTimeoutMs:t.timeout}},x={version:1,requestId:v,operationId:h,command:`shutdown`,params:{mode:`wait`}},S,C,w,T,ee={transform:e=>{let t=wc.parse(e);return t.type===`error`||t.type===`state`&&t.requestId===g||t.type===`ack`&&[_,v].includes(t.requestId??``)?t:null},onError:e=>{T??=e},onEvent:e=>{e.type===`error`&&(T??=new B(e.code??`BRAID_RPC_FAILED`,`Braid refused graph analysis`,e.message??`The RPC response omitted its cause`,`tangle graph analyze --help`)),e.requestId===g&&e.type===`state`&&(S??=e),e.requestId===_&&e.type===`ack`&&(C??=e),e.requestId===v&&e.type===`ack`&&(w??=e)}},E=await Me({command:process.env.BRAID_BIN??`braid`,args:[`rpc`,`--workspace`,n.cwd,`--config`,c,`--profile`,r,`--database-key-file`,l],cwd:n.cwd,env:{...i.env,BRAID_STATE_PATH:u,BRAID_CLI_BRIDGE_ENDPOINT:o.bridgeUrl,BRAID_CLI_BRIDGE_AUTH:o.bridgeBearer},timeoutMs:t.timeout,signal:p,ownProcessGroup:!0},ee,{stdin:[y,...t.dryRun?[]:[b],x].map(e=>JSON.stringify(e)).join(`
 `)+`
 `});if(T)throw T;let D=E.exit;if(!D.success||!S||!w||w.operationId!==h||w.command!==`shutdown`)throw new B(`BRAID_RPC_FAILED`,`Braid graph analysis did not finish`,D.spawnError??D.timeoutDiagnostic??D.stdinError??D.processGroupError??D.captureError??D.terminateError??(E.stderr||`Exit ${D.code}, signal ${D.signal}; complete shutdown acknowledgement: ${!!w}`),`npm install --global @tangle-network/braid`);let O=Tc.parse(S),k=O.view.capabilities[`analysis.recipe`];if(t.dryRun)return{source:a,statePath:u,configuration:O.state.runConfiguration,capability:k};if(!C||C.operationId!==m||C.command!==`analyze`)throw Error(`Braid did not acknowledge this analysis operation`);let A=Ec.parse(C.result);if(!i.schema.safeParse(A.source.runtimeRun).success)throw new B(`BRAID_RPC_FAILED`,`Braid returned analysis of another source`,`Its saved run or immutable checkpoint identity does not match this request`,`tangle graph inspect ${e}`);return{...A,statePath:u}})},`tangle graph analyze ${e}`)}function Ac(t){t.command(`analyze <run>`).description(`Analyze retained graph evidence through Braid`).addHelpText(`after`,`
 Requires the Braid companion CLI: npm install --global @tangle-network/braid.
 BRAID_BIN may select its installed executable. Select an existing canonical AgentProfile with --profile. Analysis uses the owned subscription-only Bridge.
-`).requiredOption(`--profile <name|path>`,`Use a canonical analysis AgentProfile, distinct from the Tangle account profile`).option(`--dry-run`,`Inspect Braid's selected analysis configuration without dispatch`).option(`--timeout <ms>`,`Bound the analysis process in milliseconds`,Number,3e5).action(async(t,n)=>{let r=await kc(t,n);e(r),`status`in r&&r.status!==`completed`&&(process.exitCode=1)})}async function jc(t,n){let r=[],i=[],a=(e,t)=>{if(!t||typeof t!=`object`)return;let n=F.object({status:F.string(),files:F.array(F.object({path:F.string(),artifact:Ce})),missing:F.unknown()}).parse(t);i.push({node:e,status:n.status,missing:n.missing}),r.push(...n.files.map(t=>({node:e,...t})))},o;if(t.startsWith(`wfrun_`)){let e=await X(n),r=await e.workflows.getRun(t);for(let e of r.runtime?.checks??[])a(e.nodeId,e.outputs);o=async({artifact:n})=>{let i=(await e.workflows.listArtifacts(r.workflowId,t)).artifacts.find(e=>e.name===`runtime/${n.sha256}`&&e.byteSize===n.byteLength);if(!i)throw Error(`The workflow owner has no retained bytes for this artifact`);return(await e.workflows.downloadArtifact(r.workflowId,t,i.id)).bytes}}else{if(!F.uuid().safeParse(t).success)throw Error(`Use a recorded graph run ID`);let e=M(await R(M(I(),`.tangle`,`runs`)),t);if(await R(e)!==e)throw Error(`The graph run directory redirects elsewhere`);let{FileSpawnJournal:n,FileResultBlobStore:r,loadSpawnForest:i,createPrivateCasArtifactPort:s}=await import(`@tangle-network/agent-runtime/kernel`),c=new r(M(e,`blobs`)),l=await i(new n(M(e,`spawn-journal.jsonl`)),t);for(let e of l.nodes){if(e.runtime!==`graph-check`||!e.outRef)continue;let t=await c.get(e.outRef);a(e.id,t?.outputs)}let u=s(M(e,`artifacts`),t);o=e=>u.read(e.artifact)}if(!n.artifact)return e({runId:t,capture:i,files:r});if(!n.out)throw new B(`USAGE_INVALID`,`Select an output file`,`Artifact downloads require --out`,`tangle graph inspect ${t} --artifact <node/path> --out <file>`);let s=r.filter(e=>`${e.node}/${e.path}`===n.artifact||e.artifact.sha256===n.artifact);if(s.length!==1)throw Error(`Select one exact node/path from graph inspect --artifacts`);let c=s[0],u=await o(c);if(u.byteLength!==c.artifact.byteLength||`sha256:${Q(Buffer.from(u))}`!==c.artifact.sha256)throw Error(`Retained artifact bytes do not match their recorded identity`);let d=he(n.out);await ft(ue(d),{recursive:!0}),await z(d,u,{mode:384,flag:`wx`});let f={runId:t,node:c.node,path:c.path,artifact:c.artifact,destination:d};n.json?e(f):l(`Saved ${c.path} to ${d}`)}const Mc=1e3;function Nc(e,t){return[...t,e]}function Pc(e,t=`input`,n){if(n===void 0&&!e?.length)return;let r={};if(n!==void 0)try{if(r=JSON.parse(Re(n,`utf8`)),!r||typeof r!=`object`||Array.isArray(r)||Object.entries(r).some(([e,t])=>!e.length||typeof t!=`string`))throw Error(`Invalid input map`)}catch{throw new B(`WORKFLOW_INPUT_FILE_INVALID`,`Could not load --input-file '${n}'`,`Expected a readable JSON object with nonempty keys and string values`,`tangle workflows run --help`)}let i=Object.entries(r);for(let n of e??[]){let e=n.indexOf(`=`);if(e<=0)throw Error(`Invalid --${t} "${n}": expected key=value (e.g. pull_request.number=123)`);i.push([n.slice(0,e),n.slice(e+1)])}return Object.fromEntries(i)}function Fc(e){t(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function Ic(e){if(s({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0){l(`Actions`);let n=e.actionResults.some(e=>e.nodeId!==void 0||e.visit!==void 0);t(e.actionResults.map(e=>({index:e.index,...n?{node:e.nodeId??``,visit:e.visit??``}:{},kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},...n?[{key:`node`,header:`Node`},{key:`visit`,header:`Visit`}]:[],{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}])}e.graph&&(l(`Graph`),s({Nodes:e.graph.nodes.length,Edges:e.graph.edges.length,"Max node visits":e.graph.maxNodeVisits}),t(e.graph.edges.map(e=>({from:e.from,to:e.to,guard:e.when===void 0?``:JSON.stringify(e.when)})),[{key:`from`,header:`From`},{key:`to`,header:`To`},{key:`guard`,header:`Guard`}])),e.edgeVerdicts&&e.edgeVerdicts.length>0&&(l(`Edge verdicts`),t(e.edgeVerdicts.flatMap(e=>Object.entries(e.verdicts).map(([t,n])=>({node:e.nodeId,edge:t,verdict:n?`taken`:`not taken`}))),[{key:`node`,header:`Node`},{key:`edge`,header:`Edge`},{key:`verdict`,header:`Verdict`}]))}function Lc(e){if(e.status===`cancelled`){l(`Cancelled run ${e.runId}.`);return}if(e.signalled){l(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}l(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function Rc(e){switch(e.type){case`snapshot`:l(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function zc(t){t.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input-file <file>`,`Trigger inputs from a flat JSON string map; --input overrides its keys`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,Nc,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(t,n)=>{let r=Pc(n.input,`input`,n.inputFile),i=n.timeout===void 0?void 0:ba(n.timeout,`--timeout`),a=n.pollInterval===void 0?void 0:ba(n.pollInterval,`--poll-interval`),o=await X(n),{runId:s}=await o.workflows.run(t,r);if(!n.wait){if(n.json)return e({runId:s});l(`Started run ${s} for workflow ${t}.`),l(`Inspect it with: tangle workflows run-detail ${t} ${s}`);return}let c=n.json?null:f(`Waiting for run ${s} to finish...`).start(),u;try{u=await o.workflows.waitForRun(t,s,{...i===void 0?{}:{timeoutMs:i},...a===void 0?{}:{pollIntervalMs:a}})}finally{c?.stop()}if(u.status===`failed`&&(process.exitCode=1),n.json)return e(u);Ic(u)}),t.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).action(async(t,n)=>{let r=await X(n),i=n.limit===void 0?void 0:ba(n.limit,`--limit`);if(n.all){let a=[],o=n.cursor,s=0,c=null;for(;;){let e=await r.workflows.listRuns(t,{...i===void 0?{}:{limit:i},...o===void 0?{}:{cursor:o}});if(a.push(...e.runs),s+=1,!e.nextCursor)break;if(s>=Mc){c=e.nextCursor,n.json||l(`Stopped after ${Mc} pages (${a.length} runs); more may exist — resume with --cursor ${e.nextCursor}`);break}o=e.nextCursor}if(n.json)return e({runs:a,nextCursor:c});Fc(a);return}let a=await r.workflows.listRuns(t,{...i===void 0?{}:{limit:i},...n.cursor===void 0?{}:{cursor:n.cursor}});if(n.json)return e(a);Fc(a.runs),a.nextCursor&&l(`More runs available — next page: --cursor ${a.nextCursor}`)}),t.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(t,n,r)=>{let i=await(await X(r)).workflows.getRun(t,n);if(r.json)return e(i);Ic(i)}),t.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(t,n,r)=>{let i=await(await X(r)).workflows.cancel(t,n);if(r.json)return e(i);Lc(i)}),t.command(`retry`).description(`Re-run a failed or cancelled run (a fresh run with the same trigger context)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID of the failed/cancelled run to retry`).option(`--wait`,`Wait for the new run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(t,n,r)=>{let i=r.timeout===void 0?void 0:ba(r.timeout,`--timeout`),a=r.pollInterval===void 0?void 0:ba(r.pollInterval,`--poll-interval`),o=await X(r),s=await o.workflows.retryRun(t,n);if(!r.wait){if(r.json)return e(s);l(`Started run ${s.runId} (retry of ${n}).`),l(`Inspect it with: tangle workflows run-detail ${t} ${s.runId}`);return}let c=r.json?null:f(`Waiting for run ${s.runId} to finish...`).start(),u;try{u=await o.workflows.waitForRun(t,s.runId,{...i===void 0?{}:{timeoutMs:i},...a===void 0?{}:{pollIntervalMs:a}})}finally{c?.stop()}if(u.status===`failed`&&(process.exitCode=1),r.json)return e(u);Ic(u)}),t.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await X(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):Rc(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)})}async function Bc(e,t){let n;try{if(n=t.deploy?(await import(`yaml`)).parse(await L(t.deploy,`utf8`)):{name:le(e).replace(/(\.graph)?\.(yaml|yml|json)$/i,``)},!n||typeof n!=`object`||Array.isArray(n)||typeof n.name!=`string`||!n.name.trim())throw Error(`Invalid deployment`)}catch{throw new B(`GRAPH_DEPLOY_INVALID`,`Cannot read graph deployment settings`,`Use a YAML or JSON object containing name and the platform's graph deployment fields`,`tangle graph apply --help`)}let r=Pc(t.param,`param`),i=t.mcpPolicy??n.mcpPolicy;return{...n,...r?{params:{...n.params,...r}}:{},...t.seat?{seat:t.seat}:{},...i===void 0?{}:{mcpPolicy:Je.parse(i)}}}function Vc(e){if(e.execution?.kind!==`graph`||!e.headRev)throw new B(`GRAPH_DEPLOY_CONFLICT`,`The deployment is not a versioned native graph`,`Choose a graph workflow or a new deployment name`,`tangle workflows list`)}async function Hc(e,t){let n=await e.workflows.list({name:t});if(n.length>1)throw new B(`GRAPH_DEPLOY_CONFLICT`,`More than one workflow has this name`,`Select the intended deployment with --workflow <id>`,`tangle workflows list`);return n[0]?e.workflows.get(n[0].id):void 0}async function Uc(e,t,n,r){let i={on:[],...n,...n.mcpPolicy===void 0?{}:{mcpPolicy:Je.parse(n.mcpPolicy)}},a;a=r?await e.workflows.get(r):await Hc(e,n.name);let o=await e.workflows.validate(t,{format:`graph`,deploy:i});if(!o.valid)throw new B(`GRAPH_DEPLOY_INVALID`,`Graph deployment validation failed`,o.errors.map(e=>`${e.path}: ${e.message}`).join(`
-`),`tangle graph apply --help`);a||=await e.workflows.create(t,{format:`graph`,deploy:{...i,on:[],enabled:!1},dedupeKey:`graph-cli:${n.name}`}),Vc(a);let s=e=>!e.triggers?.some(e=>e.kind===`provider_event`)&&e.enabled===(i.enabled??!0)&&e.execution.sourceSha===Q(t)&&o.graphDigest!==void 0&&e.execution.graphDigest===o.graphDigest&&P(e.execution.deploy)===P(i);if(s(a))return{action:`unchanged`,workflow:a};try{return{action:`applied`,workflow:await e.workflows.update(a.id,t,{format:`graph`,deploy:i,expectedRev:a.headRev})}}catch(t){if(!(t&&typeof t==`object`&&`status`in t&&t.status===409))throw t;let n=await e.workflows.get(a.id);if(Vc(n),!s(n))throw t;return{action:`unchanged`,workflow:n}}}function Wc(t,n){t.command(`webhook <workflow>`).description(`Reveal a new webhook bearer for a deployed graph; retire its previous bearer`).requiredOption(`--rotate`,`Explicitly authorize minting and revealing a new webhook token`).action(async(t,n)=>{let r=await X(n);Vc(await r.workflows.get(t)),e(await r.workflows.rotateHookToken(t))}),t.command(`apply <name-or-file>`).description(`Publish a native graph without running it; update its stable cloud deployment`).option(`--deploy <file>`,`YAML/JSON deployment settings: name, on, params, seat, enabled and maxRunCostUsd`).option(`--workflow <id>`,`Update this workflow instead of matching its name`).option(`--seat <seat>`,`Override the deployment's harness/model@effort`).option(`--param <key=value>`,`Override a deployment parameter; repeatable`,(e,t)=>[...t,e],[]).option(`--dry-run`,`Validate graph and bindings without publishing`).action(async(t,r)=>Cs(void 0,async i=>{let a=n(t,process.cwd()),o=await L(a,`utf8`),s=await Bc(a,r),c=await X({...r,signal:i}),u=r.dryRun?await c.workflows.validate(o,{format:`graph`,deploy:s}):await Uc(c,o,s,r.workflow);`valid`in u&&!u.valid&&(process.exitCode=1),r.json||`valid`in u?e(u):l(`${u.action} · ${u.workflow.id} · revision ${u.workflow.headRev}`)},`tangle graph apply --help`))}async function Gc(e,t,n,r){if(n.mcpSecret?.length)throw new B(`GRAPH_CLOUD_SECRET_BINDING`,`Local MCP credentials cannot be uploaded`,`Cloud secret references must bind through the cloud owner's credential environment`,`tangle graph run --help`);let i=await X({...n,signal:r}),a=Q(t),o=Pc(n.param,`param`),s=await Bc(e,n),c,l;if(n.resume){let e=await i.workflows.getRun(n.resume,{signal:r});e.id!==n.resume&&Y(`The cloud owner returned another run identity`),n.workflow&&e.workflowId!==n.workflow&&Y(`The recorded cloud deployment changed`);let t=e.execution;if((t?.kind!==`graph`||t.sourceSha!==a)&&Y(`The authored cloud graph source changed`),n.deploy&&P(t.deploy)!==P({on:[],...s})&&Y(`The recorded cloud deployment settings changed`),Object.entries(o??{}).some(([e,n])=>!Object.hasOwn(t.params,e)||P(t.params[e])!==P(n))&&Y(`A recorded cloud graph parameter changed`),n.seat!==void 0&&n.seat!==t.deploy.seat&&Y(`The recorded cloud seat override changed`),n.mcpPolicy!==void 0&&P(n.mcpPolicy)!==P(t.deploy.mcpPolicy??{allowLocalMcp:!1,allowedMcpHosts:[]})&&Y(`The recorded cloud MCP policy changed`),n.dryRun)return{run:e};if((e.status===`cancelled`||e.status===`failed`)&&Y(`The cloud run is terminal: ${e.status}`),e.status===`succeeded`)return e.graphResult||Y(`The settled cloud run has no retained Runtime result`),{workflowId:e.workflowId,runId:e.id,sourceDigest:a,result:e.graphResult,replayed:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};if(e.recovery?.state===`running`)return{workflowId:e.workflowId,runId:e.id,sourceDigest:a,run:e,attached:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};e.recovery?.state!==`queued`&&e.recovery?.state!==`recoverable`&&Y(`The owner has not confirmed recovery eligibility`),c=e.workflowId,l=e.revUsed??Y(`The captured cloud revision is unavailable`)}else{let e=n.workflow?await i.workflows.get(n.workflow):!n.deploy&&!n.dryRun?await Hc(i,s.name):void 0;if(e){if((e.execution?.kind!==`graph`||e.execution.sourceSha!==a)&&Y(`The selected deployment does not contain this graph source; use graph apply first`),(n.deploy&&P(e.execution.deploy)!==P({on:[],...s})||Object.entries(o??{}).some(([t,n])=>!Object.hasOwn(e.execution?.kind===`graph`?e.execution.params:{},t)||P(e.execution?.kind===`graph`?e.execution.params[t]:null)!==P(n))||n.seat!==void 0&&n.seat!==e.execution.deploy.seat||n.mcpPolicy!==void 0&&P(n.mcpPolicy)!==P(e.execution.deploy.mcpPolicy??{allowLocalMcp:!1,allowedMcpHosts:[]}))&&Y(`The selected deployment bindings changed; use graph apply first`),n.dryRun)return{workflow:e};c=e.id,l=e.headRev??Y(`The selected deployment has no retained revision`)}else{if(n.dryRun)return i.workflows.validate(t,{format:`graph`,deploy:s});let{workflow:e}=await Uc(i,t,s);c=e.id,l=e.headRev??Y(`The cloud workflow has no retained revision`)}}r.throwIfAborted();let u=await i.workflows.run(c,void 0,{signal:r,sourceSha:a,expectedRev:l,...n.resume?{resumeRunId:n.resume}:{}});return n.resume&&u.runId!==n.resume&&Y(`The cloud owner recovered another run identity`),{...u,workflowId:c,sourceDigest:a,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(c)}/runs/${encodeURIComponent(u.runId)}`}}const Kc=F.strictObject({runId:F.uuid(),identity:F.string(),request:F.string()});function qc(t,n){t.command(`dispatch <name-or-file>`).description(`Admit a local scheduler/webhook delivery once, retaining its event and run for retries`).requiredOption(`--event <file>`,`JSON object supplied as trigger data`).requiredOption(`--delivery <id>`,`Stable provider delivery id or nominal cron occurrence, reused on retries`).option(`--seat <seat>`,`Use harness/model@effort for every node`).addOption(ks()).option(`--mcp-policy <file>`,`Use the same explicit local MCP policy as graph run`).option(`--param <key=value>`,`Graph parameter; repeatable`,(e,t)=>[...t,e],[]).action(async(t,r)=>{let i={...r,mcpPolicy:r.mcpPolicy===void 0?void 0:await js(r.mcpPolicy)},a=e=>{throw new B(`GRAPH_DELIVERY_REFUSED`,`Local graph delivery was not admitted`,e,`tangle graph dispatch --help`)};i.delivery.trim()||a(`A stable nonempty delivery id is required`);let o;try{o=F.record(F.string(),F.unknown()).parse(JSON.parse(await L(i.event,`utf8`)))}catch{return a(`The event file must contain a JSON object`)}let s=await R(n(t,process.cwd())),c=await R(process.cwd()),u=await L(s,`utf8`),d=P({file:s,cwd:c,delivery:i.delivery}),f=P({source:Q(u),trigger:o,mcpPolicy:Ye.parse(i.mcpPolicy??{}),params:Pc(i.param,`param`)??{},...i.seat===void 0?{}:{seat:i.seat}}),p=M(I(),`.tangle`,`deliveries`,Q(d));await ft(p,{recursive:!0,mode:448}),await R(p)!==p&&a(`The delivery store redirects elsewhere`);let m=M(p,`delivery.json`),h;try{let e=await mt(m,Fe.O_WRONLY|Fe.O_CREAT|Fe.O_EXCL|Fe.O_NOFOLLOW,384);try{h={runId:be(),identity:d,request:f},await e.writeFile(JSON.stringify(h)),await e.sync()}finally{await e.close()}}catch(e){if(e.code!==`EEXIST`)throw e;let t=await mt(m,Fe.O_RDONLY|Fe.O_NOFOLLOW);try{h=Kc.parse(JSON.parse(await t.readFile(`utf8`)))}catch{return a(`The durable delivery record is incomplete; inspect it before retrying`)}finally{await t.close()}}(h.identity!==d||h.request!==f)&&a(`This delivery id already belongs to different graph bytes, event data or parameters`);let g;try{let{acquireSingleRunLock:e}=await import(`@tangle-network/agent-eval/campaign`);g=e({lockPath:`${m}.lock`}).release}catch(e){return a(`Delivery ${i.delivery} cannot acquire its owner lock; inspect run ${h.runId}: ${e instanceof Error?e.message:`lock unavailable`}`)}try{let t=M(I(),`.tangle`,`runs`,h.runId,`input.json`),n=!1;try{await L(t),n=!0}catch(e){if(e.code!==`ENOENT`)throw e}let r=await tu(s,{...i,...n?{resume:h.runId}:{}},{cwd:c,source:u,trigger:o,runId:h.runId});i.json?e({delivery:i.delivery,...r}):l(`Delivery ${i.delivery} · run ${h.runId}`)}finally{await g()}})}const Jc=new Map([[`train`,`search`],[`test`,`holdout`]]);async function Yc(e,t,n,r){let i={mcpPolicy:n.mcpPolicy?await js(n.mcpPolicy):void 0,mcpSecret:n.mcpSecret},a=[e,...n.arm],o=n.split===`test`;if(o?a.length!==2||!n.unseal:n.split!==`train`)throw Error(`--split is train, or test with one --arm and --unseal`);let s=o?`holdout`:`search`,c=await L(M(t,`cases.jsonl.gz`)),l=vt(c).toString().trim().split(`
-`).map(e=>JSON.parse(e)),u=new Map(l.map(e=>[e.id,e])),d=e=>u.get(e.split(`:`).pop()??e),f=l.some(e=>e.split!==void 0)&&l.find(e=>!Jc.has(e.split));if(f)throw Error(`Dataset row ${f.id} has split ${JSON.stringify(f.split)??`none`}; when one row names a split, every row names train or test`);let p=e=>`graph-improve-js::${d(e).upstream}`,m=e=>Jc.get(d(e).split)??r.deterministicSplit(p(e),`agent-eval-v1`,[.32,.38]),h=[...u.keys()].filter(e=>m(e)===s).sort();if(!h.length)throw Error(`--split ${n.split} selects no case of this dataset`);let g=(e,t)=>[`issue=https://github.com/${e.upstream}/issues/${e.issue}`,`repo=${e.upstream}`,...[`deliver=branch`,`base=main`,`test=${e.test}`],`verify_image=${t}`,`agent_tools={"websearch":false,"webfetch":false}`],_=g(l[0],`none`),v=[];for(let e of a){let t=await L(e,`utf8`),n=await tu(e,{...i,param:_,dryRun:!0},{source:t});if(!(`graph`in n))throw Error(`${e} did not load locally`);let r=n.graph.nodes.filter(({check:e,profile:{tools:t}})=>!e&&(t?.websearch!==!1||t?.webfetch!==!1));if(r.length)throw Error(`${r.map(e=>e.id)} can use web tools; refusing`);let a=n.graph.budget?.maxTokens;if(!a)throw Error(`${e} sets no budget.maxTokens to book at`);let{maxIterations:o,deadlineMs:s}=n.graph.budget??{};if(!o||!s)throw Error(`${e} needs finite iteration and deadline budgets`);v.push({file:e,source:t,sourceDigest:Q(t),digest:n.graph.digest,cap:a,iterations:o,deadline:s})}return{bindings:i,files:a,sealed:s,manifest:c,tasks:h,at:d,split:m,params:g,arms:v}}const Xc=()=>import(`./graph-dataset-Bs03wlXZ.mjs`),Zc=()=>import(`./graph-operating-evidence-DOCpwKlO.mjs`),Qc=gt(We),$c=async(e,...t)=>(await Qc(`bash`,[`-ec`,e,`gi`,...t],{maxBuffer:3e8})).stdout,el=M(I(),`.tangle`,`graph-improve`,`v5`),tl=M(I(),`.tangle`,`runs`),nl=e=>({inputTokens:0,outputTokens:e,usageUnknown:!0}),rl=e=>!!e&&e.owner!==`work`&&e.code!==`budget-exhausted`;async function il(e){let[t,n]=[M(e,`bin`),M(e,`remotes`)];for(let e of[t,n])await ft(e,{recursive:!0});let r=`#!/bin/sh
+`).requiredOption(`--profile <name|path>`,`Use a canonical analysis AgentProfile, distinct from the Tangle account profile`).option(`--dry-run`,`Inspect Braid's selected analysis configuration without dispatch`).option(`--timeout <ms>`,`Bound the analysis process in milliseconds`,Number,3e5).action(async(t,n)=>{let r=await kc(t,n);e(r),`status`in r&&r.status!==`completed`&&(process.exitCode=1)})}async function jc(t,n){let r=[],i=[],a=(e,t)=>{if(!t||typeof t!=`object`)return;let n=F.object({status:F.string(),files:F.array(F.object({path:F.string(),artifact:we})),missing:F.unknown()}).parse(t);i.push({node:e,status:n.status,missing:n.missing}),r.push(...n.files.map(t=>({node:e,...t})))},o;if(t.startsWith(`wfrun_`)){let e=await X(n),r=await e.workflows.getRun(t);for(let e of r.runtime?.checks??[])a(e.nodeId,e.outputs);o=async({artifact:n})=>{let i=(await e.workflows.listArtifacts(r.workflowId,t)).artifacts.find(e=>e.name===`runtime/${n.sha256}`&&e.byteSize===n.byteLength);if(!i)throw Error(`The workflow owner has no retained bytes for this artifact`);return(await e.workflows.downloadArtifact(r.workflowId,t,i.id)).bytes}}else{if(!F.uuid().safeParse(t).success)throw Error(`Use a recorded graph run ID`);let e=M(await R(M(I(),`.tangle`,`runs`)),t);if(await R(e)!==e)throw Error(`The graph run directory redirects elsewhere`);let{FileSpawnJournal:n,FileResultBlobStore:r,loadSpawnForest:i,createPrivateCasArtifactPort:s}=await import(`@tangle-network/agent-runtime/kernel`),c=new r(M(e,`blobs`)),l=await i(new n(M(e,`spawn-journal.jsonl`)),t);for(let e of l.nodes){if(e.runtime!==`graph-check`||!e.outRef)continue;let t=await c.get(e.outRef);a(e.id,t?.outputs)}let u=s(M(e,`artifacts`),t);o=e=>u.read(e.artifact)}if(!n.artifact)return e({runId:t,capture:i,files:r});if(!n.out)throw new B(`USAGE_INVALID`,`Select an output file`,`Artifact downloads require --out`,`tangle graph inspect ${t} --artifact <node/path> --out <file>`);let s=r.filter(e=>`${e.node}/${e.path}`===n.artifact||e.artifact.sha256===n.artifact);if(s.length!==1)throw Error(`Select one exact node/path from graph inspect --artifacts`);let c=s[0],u=await o(c);if(u.byteLength!==c.artifact.byteLength||`sha256:${Q(Buffer.from(u))}`!==c.artifact.sha256)throw Error(`Retained artifact bytes do not match their recorded identity`);let d=he(n.out);await ft(ue(d),{recursive:!0}),await z(d,u,{mode:384,flag:`wx`});let f={runId:t,node:c.node,path:c.path,artifact:c.artifact,destination:d};n.json?e(f):l(`Saved ${c.path} to ${d}`)}const Mc=1e3;function Nc(e,t){return[...t,e]}function Pc(e,t=`input`,n){if(n===void 0&&!e?.length)return;let r={};if(n!==void 0)try{if(r=JSON.parse(ze(n,`utf8`)),!r||typeof r!=`object`||Array.isArray(r)||Object.entries(r).some(([e,t])=>!e.length||typeof t!=`string`))throw Error(`Invalid input map`)}catch{throw new B(`WORKFLOW_INPUT_FILE_INVALID`,`Could not load --input-file '${n}'`,`Expected a readable JSON object with nonempty keys and string values`,`tangle workflows run --help`)}let i=Object.entries(r);for(let n of e??[]){let e=n.indexOf(`=`);if(e<=0)throw Error(`Invalid --${t} "${n}": expected key=value (e.g. pull_request.number=123)`);i.push([n.slice(0,e),n.slice(e+1)])}return Object.fromEntries(i)}function Fc(e){t(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function Ic(e){if(s({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0){l(`Actions`);let n=e.actionResults.some(e=>e.nodeId!==void 0||e.visit!==void 0);t(e.actionResults.map(e=>({index:e.index,...n?{node:e.nodeId??``,visit:e.visit??``}:{},kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},...n?[{key:`node`,header:`Node`},{key:`visit`,header:`Visit`}]:[],{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}])}e.graph&&(l(`Graph`),s({Nodes:e.graph.nodes.length,Edges:e.graph.edges.length,"Max node visits":e.graph.maxNodeVisits}),t(e.graph.edges.map(e=>({from:e.from,to:e.to,guard:e.when===void 0?``:JSON.stringify(e.when)})),[{key:`from`,header:`From`},{key:`to`,header:`To`},{key:`guard`,header:`Guard`}])),e.edgeVerdicts&&e.edgeVerdicts.length>0&&(l(`Edge verdicts`),t(e.edgeVerdicts.flatMap(e=>Object.entries(e.verdicts).map(([t,n])=>({node:e.nodeId,edge:t,verdict:n?`taken`:`not taken`}))),[{key:`node`,header:`Node`},{key:`edge`,header:`Edge`},{key:`verdict`,header:`Verdict`}]))}function Lc(e){if(e.status===`cancelled`){l(`Cancelled run ${e.runId}.`);return}if(e.signalled){l(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}l(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function Rc(e){switch(e.type){case`snapshot`:l(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function zc(t){t.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input-file <file>`,`Trigger inputs from a flat JSON string map; --input overrides its keys`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,Nc,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(t,n)=>{let r=Pc(n.input,`input`,n.inputFile),i=n.timeout===void 0?void 0:ba(n.timeout,`--timeout`),a=n.pollInterval===void 0?void 0:ba(n.pollInterval,`--poll-interval`),o=await X(n),{runId:s}=await o.workflows.run(t,r);if(!n.wait){if(n.json)return e({runId:s});l(`Started run ${s} for workflow ${t}.`),l(`Inspect it with: tangle workflows run-detail ${t} ${s}`);return}let c=n.json?null:f(`Waiting for run ${s} to finish...`).start(),u;try{u=await o.workflows.waitForRun(t,s,{...i===void 0?{}:{timeoutMs:i},...a===void 0?{}:{pollIntervalMs:a}})}finally{c?.stop()}if(u.status===`failed`&&(process.exitCode=1),n.json)return e(u);Ic(u)}),t.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).action(async(t,n)=>{let r=await X(n),i=n.limit===void 0?void 0:ba(n.limit,`--limit`);if(n.all){let a=[],o=n.cursor,s=0,c=null;for(;;){let e=await r.workflows.listRuns(t,{...i===void 0?{}:{limit:i},...o===void 0?{}:{cursor:o}});if(a.push(...e.runs),s+=1,!e.nextCursor)break;if(s>=Mc){c=e.nextCursor,n.json||l(`Stopped after ${Mc} pages (${a.length} runs); more may exist — resume with --cursor ${e.nextCursor}`);break}o=e.nextCursor}if(n.json)return e({runs:a,nextCursor:c});Fc(a);return}let a=await r.workflows.listRuns(t,{...i===void 0?{}:{limit:i},...n.cursor===void 0?{}:{cursor:n.cursor}});if(n.json)return e(a);Fc(a.runs),a.nextCursor&&l(`More runs available — next page: --cursor ${a.nextCursor}`)}),t.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(t,n,r)=>{let i=await(await X(r)).workflows.getRun(t,n);if(r.json)return e(i);Ic(i)}),t.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(t,n,r)=>{let i=await(await X(r)).workflows.cancel(t,n);if(r.json)return e(i);Lc(i)}),t.command(`retry`).description(`Re-run a failed or cancelled run (a fresh run with the same trigger context)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID of the failed/cancelled run to retry`).option(`--wait`,`Wait for the new run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(t,n,r)=>{let i=r.timeout===void 0?void 0:ba(r.timeout,`--timeout`),a=r.pollInterval===void 0?void 0:ba(r.pollInterval,`--poll-interval`),o=await X(r),s=await o.workflows.retryRun(t,n);if(!r.wait){if(r.json)return e(s);l(`Started run ${s.runId} (retry of ${n}).`),l(`Inspect it with: tangle workflows run-detail ${t} ${s.runId}`);return}let c=r.json?null:f(`Waiting for run ${s.runId} to finish...`).start(),u;try{u=await o.workflows.waitForRun(t,s.runId,{...i===void 0?{}:{timeoutMs:i},...a===void 0?{}:{pollIntervalMs:a}})}finally{c?.stop()}if(u.status===`failed`&&(process.exitCode=1),r.json)return e(u);Ic(u)}),t.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await X(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):Rc(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)})}async function Bc(e,t){let n;try{if(n=t.deploy?(await import(`yaml`)).parse(await L(t.deploy,`utf8`)):{name:le(e).replace(/(\.graph)?\.(yaml|yml|json)$/i,``)},!n||typeof n!=`object`||Array.isArray(n)||typeof n.name!=`string`||!n.name.trim())throw Error(`Invalid deployment`)}catch{throw new B(`GRAPH_DEPLOY_INVALID`,`Cannot read graph deployment settings`,`Use a YAML or JSON object containing name and the platform's graph deployment fields`,`tangle graph apply --help`)}let r=Pc(t.param,`param`),i=t.mcpPolicy??n.mcpPolicy;return{...n,...r?{params:{...n.params,...r}}:{},...t.seat?{seat:t.seat}:{},...i===void 0?{}:{mcpPolicy:Ye.parse(i)}}}function Vc(e){if(e.execution?.kind!==`graph`||!e.headRev)throw new B(`GRAPH_DEPLOY_CONFLICT`,`The deployment is not a versioned native graph`,`Choose a graph workflow or a new deployment name`,`tangle workflows list`)}async function Hc(e,t){let n=await e.workflows.list({name:t});if(n.length>1)throw new B(`GRAPH_DEPLOY_CONFLICT`,`More than one workflow has this name`,`Select the intended deployment with --workflow <id>`,`tangle workflows list`);return n[0]?e.workflows.get(n[0].id):void 0}async function Uc(e,t,n,r){let i={on:[],...n,...n.mcpPolicy===void 0?{}:{mcpPolicy:Ye.parse(n.mcpPolicy)}},a;a=r?await e.workflows.get(r):await Hc(e,n.name);let o=await e.workflows.validate(t,{format:`graph`,deploy:i});if(!o.valid)throw new B(`GRAPH_DEPLOY_INVALID`,`Graph deployment validation failed`,o.errors.map(e=>`${e.path}: ${e.message}`).join(`
+`),`tangle graph apply --help`);a||=await e.workflows.create(t,{format:`graph`,deploy:{...i,on:[],enabled:!1},dedupeKey:`graph-cli:${n.name}`}),Vc(a);let s=e=>!e.triggers?.some(e=>e.kind===`provider_event`)&&e.enabled===(i.enabled??!0)&&e.execution.sourceSha===Q(t)&&o.graphDigest!==void 0&&e.execution.graphDigest===o.graphDigest&&P(e.execution.deploy)===P(i);if(s(a))return{action:`unchanged`,workflow:a};try{return{action:`applied`,workflow:await e.workflows.update(a.id,t,{format:`graph`,deploy:i,expectedRev:a.headRev})}}catch(t){if(!(t&&typeof t==`object`&&`status`in t&&t.status===409))throw t;let n=await e.workflows.get(a.id);if(Vc(n),!s(n))throw t;return{action:`unchanged`,workflow:n}}}function Wc(t,n){t.command(`webhook <workflow>`).description(`Reveal a new webhook bearer for a deployed graph; retire its previous bearer`).requiredOption(`--rotate`,`Explicitly authorize minting and revealing a new webhook token`).action(async(t,n)=>{let r=await X(n);Vc(await r.workflows.get(t)),e(await r.workflows.rotateHookToken(t))}),t.command(`apply <name-or-file>`).description(`Publish a native graph without running it; update its stable cloud deployment`).option(`--deploy <file>`,`YAML/JSON deployment settings: name, on, params, seat, enabled and maxRunCostUsd`).option(`--workflow <id>`,`Update this workflow instead of matching its name`).option(`--seat <seat>`,`Override the deployment's harness/model@effort`).option(`--param <key=value>`,`Override a deployment parameter; repeatable`,(e,t)=>[...t,e],[]).option(`--dry-run`,`Validate graph and bindings without publishing`).action(async(t,r)=>Cs(void 0,async i=>{let a=n(t,process.cwd()),o=await L(a,`utf8`),s=await Bc(a,r),c=await X({...r,signal:i}),u=r.dryRun?await c.workflows.validate(o,{format:`graph`,deploy:s}):await Uc(c,o,s,r.workflow);`valid`in u&&!u.valid&&(process.exitCode=1),r.json||`valid`in u?e(u):l(`${u.action} · ${u.workflow.id} · revision ${u.workflow.headRev}`)},`tangle graph apply --help`))}async function Gc(e,t,n,r){if(n.mcpSecret?.length)throw new B(`GRAPH_CLOUD_SECRET_BINDING`,`Local MCP credentials cannot be uploaded`,`Cloud secret references must bind through the cloud owner's credential environment`,`tangle graph run --help`);let i=await X({...n,signal:r}),a=Q(t),o=Pc(n.param,`param`),s=await Bc(e,n),c,l;if(n.resume){let e=await i.workflows.getRun(n.resume,{signal:r});e.id!==n.resume&&Y(`The cloud owner returned another run identity`),n.workflow&&e.workflowId!==n.workflow&&Y(`The recorded cloud deployment changed`);let t=e.execution;if((t?.kind!==`graph`||t.sourceSha!==a)&&Y(`The authored cloud graph source changed`),n.deploy&&P(t.deploy)!==P({on:[],...s})&&Y(`The recorded cloud deployment settings changed`),Object.entries(o??{}).some(([e,n])=>!Object.hasOwn(t.params,e)||P(t.params[e])!==P(n))&&Y(`A recorded cloud graph parameter changed`),n.seat!==void 0&&n.seat!==t.deploy.seat&&Y(`The recorded cloud seat override changed`),n.mcpPolicy!==void 0&&P(n.mcpPolicy)!==P(t.deploy.mcpPolicy??{allowLocalMcp:!1,allowedMcpHosts:[]})&&Y(`The recorded cloud MCP policy changed`),n.dryRun)return{run:e};if((e.status===`cancelled`||e.status===`failed`)&&Y(`The cloud run is terminal: ${e.status}`),e.status===`succeeded`)return e.graphResult||Y(`The settled cloud run has no retained Runtime result`),{workflowId:e.workflowId,runId:e.id,sourceDigest:a,result:e.graphResult,replayed:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};if(e.recovery?.state===`running`)return{workflowId:e.workflowId,runId:e.id,sourceDigest:a,run:e,attached:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};e.recovery?.state!==`queued`&&e.recovery?.state!==`recoverable`&&Y(`The owner has not confirmed recovery eligibility`),c=e.workflowId,l=e.revUsed??Y(`The captured cloud revision is unavailable`)}else{let e=n.workflow?await i.workflows.get(n.workflow):!n.deploy&&!n.dryRun?await Hc(i,s.name):void 0;if(e){if((e.execution?.kind!==`graph`||e.execution.sourceSha!==a)&&Y(`The selected deployment does not contain this graph source; use graph apply first`),(n.deploy&&P(e.execution.deploy)!==P({on:[],...s})||Object.entries(o??{}).some(([t,n])=>!Object.hasOwn(e.execution?.kind===`graph`?e.execution.params:{},t)||P(e.execution?.kind===`graph`?e.execution.params[t]:null)!==P(n))||n.seat!==void 0&&n.seat!==e.execution.deploy.seat||n.mcpPolicy!==void 0&&P(n.mcpPolicy)!==P(e.execution.deploy.mcpPolicy??{allowLocalMcp:!1,allowedMcpHosts:[]}))&&Y(`The selected deployment bindings changed; use graph apply first`),n.dryRun)return{workflow:e};c=e.id,l=e.headRev??Y(`The selected deployment has no retained revision`)}else{if(n.dryRun)return i.workflows.validate(t,{format:`graph`,deploy:s});let{workflow:e}=await Uc(i,t,s);c=e.id,l=e.headRev??Y(`The cloud workflow has no retained revision`)}}r.throwIfAborted();let u=await i.workflows.run(c,void 0,{signal:r,sourceSha:a,expectedRev:l,...n.resume?{resumeRunId:n.resume}:{}});return n.resume&&u.runId!==n.resume&&Y(`The cloud owner recovered another run identity`),{...u,workflowId:c,sourceDigest:a,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(c)}/runs/${encodeURIComponent(u.runId)}`}}const Kc=F.strictObject({runId:F.uuid(),identity:F.string(),request:F.string()});function qc(t,n){t.command(`dispatch <name-or-file>`).description(`Admit a local scheduler/webhook delivery once, retaining its event and run for retries`).requiredOption(`--event <file>`,`JSON object supplied as trigger data`).requiredOption(`--delivery <id>`,`Stable provider delivery id or nominal cron occurrence, reused on retries`).option(`--seat <seat>`,`Use harness/model@effort for every node`).addOption(ks()).option(`--mcp-policy <file>`,`Use the same explicit local MCP policy as graph run`).option(`--param <key=value>`,`Graph parameter; repeatable`,(e,t)=>[...t,e],[]).action(async(t,r)=>{let i={...r,mcpPolicy:r.mcpPolicy===void 0?void 0:await js(r.mcpPolicy)},a=e=>{throw new B(`GRAPH_DELIVERY_REFUSED`,`Local graph delivery was not admitted`,e,`tangle graph dispatch --help`)};i.delivery.trim()||a(`A stable nonempty delivery id is required`);let o;try{o=F.record(F.string(),F.unknown()).parse(JSON.parse(await L(i.event,`utf8`)))}catch{return a(`The event file must contain a JSON object`)}let s=await R(n(t,process.cwd())),c=await R(process.cwd()),u=await L(s,`utf8`),d=P({file:s,cwd:c,delivery:i.delivery}),f=P({source:Q(u),trigger:o,mcpPolicy:Xe.parse(i.mcpPolicy??{}),params:Pc(i.param,`param`)??{},...i.seat===void 0?{}:{seat:i.seat}}),p=M(I(),`.tangle`,`deliveries`,Q(d));await ft(p,{recursive:!0,mode:448}),await R(p)!==p&&a(`The delivery store redirects elsewhere`);let m=M(p,`delivery.json`),h;try{let e=await mt(m,Ie.O_WRONLY|Ie.O_CREAT|Ie.O_EXCL|Ie.O_NOFOLLOW,384);try{h={runId:be(),identity:d,request:f},await e.writeFile(JSON.stringify(h)),await e.sync()}finally{await e.close()}}catch(e){if(e.code!==`EEXIST`)throw e;let t=await mt(m,Ie.O_RDONLY|Ie.O_NOFOLLOW);try{h=Kc.parse(JSON.parse(await t.readFile(`utf8`)))}catch{return a(`The durable delivery record is incomplete; inspect it before retrying`)}finally{await t.close()}}(h.identity!==d||h.request!==f)&&a(`This delivery id already belongs to different graph bytes, event data or parameters`);let g;try{let{acquireSingleRunLock:e}=await import(`@tangle-network/agent-eval/campaign`);g=e({lockPath:`${m}.lock`}).release}catch(e){return a(`Delivery ${i.delivery} cannot acquire its owner lock; inspect run ${h.runId}: ${e instanceof Error?e.message:`lock unavailable`}`)}try{let t=M(I(),`.tangle`,`runs`,h.runId,`input.json`),n=!1;try{await L(t),n=!0}catch(e){if(e.code!==`ENOENT`)throw e}let r=await tu(s,{...i,...n?{resume:h.runId}:{}},{cwd:c,source:u,trigger:o,runId:h.runId});i.json?e({delivery:i.delivery,...r}):l(`Delivery ${i.delivery} · run ${h.runId}`)}finally{await g()}})}const Jc=new Map([[`train`,`search`],[`test`,`holdout`]]);async function Yc(e,t,n,r){let i={mcpPolicy:n.mcpPolicy?await js(n.mcpPolicy):void 0,mcpSecret:n.mcpSecret},a=[e,...n.arm],o=n.split===`test`;if(o?a.length!==2||!n.unseal:n.split!==`train`)throw Error(`--split is train, or test with one --arm and --unseal`);let s=o?`holdout`:`search`,c=await L(M(t,`cases.jsonl.gz`)),l=vt(c).toString().trim().split(`
+`).map(e=>JSON.parse(e)),u=new Map(l.map(e=>[e.id,e])),d=e=>u.get(e.split(`:`).pop()??e),f=l.some(e=>e.split!==void 0)&&l.find(e=>!Jc.has(e.split));if(f)throw Error(`Dataset row ${f.id} has split ${JSON.stringify(f.split)??`none`}; when one row names a split, every row names train or test`);let p=e=>`graph-improve-js::${d(e).upstream}`,m=e=>Jc.get(d(e).split)??r.deterministicSplit(p(e),`agent-eval-v1`,[.32,.38]),h=[...u.keys()].filter(e=>m(e)===s).sort();if(!h.length)throw Error(`--split ${n.split} selects no case of this dataset`);let g=(e,t)=>[`issue=https://github.com/${e.upstream}/issues/${e.issue}`,`repo=${e.upstream}`,...[`deliver=branch`,`base=main`,`test=${e.test}`],`verify_image=${t}`,`agent_tools={"websearch":false,"webfetch":false}`],_=g(l[0],`none`),v=[];for(let e of a){let t=await L(e,`utf8`),n=await tu(e,{...i,param:_,dryRun:!0},{source:t});if(!(`graph`in n))throw Error(`${e} did not load locally`);let r=n.graph.nodes.filter(({check:e,profile:{tools:t}})=>!e&&(t?.websearch!==!1||t?.webfetch!==!1));if(r.length)throw Error(`${r.map(e=>e.id)} can use web tools; refusing`);let a=n.graph.budget?.maxTokens;if(!a)throw Error(`${e} sets no budget.maxTokens to book at`);let{maxIterations:o,deadlineMs:s}=n.graph.budget??{};if(!o||!s)throw Error(`${e} needs finite iteration and deadline budgets`);v.push({file:e,source:t,sourceDigest:Q(t),digest:n.graph.digest,cap:a,iterations:o,deadline:s})}return{bindings:i,files:a,sealed:s,manifest:c,tasks:h,at:d,split:m,params:g,arms:v}}const Xc=()=>import(`./graph-dataset-Bs03wlXZ.mjs`),Zc=()=>import(`./graph-operating-evidence-DOCpwKlO.mjs`),Qc=gt(Ge),$c=async(e,...t)=>(await Qc(`bash`,[`-ec`,e,`gi`,...t],{maxBuffer:3e8})).stdout,el=M(I(),`.tangle`,`graph-improve`,`v5`),tl=M(I(),`.tangle`,`runs`),nl=e=>({inputTokens:0,outputTokens:e,usageUnknown:!0}),rl=e=>!!e&&e.owner!==`work`&&e.code!==`budget-exhausted`;async function il(e){let[t,n]=[M(e,`bin`),M(e,`remotes`)];for(let e of[t,n])await ft(e,{recursive:!0});let r=`#!/bin/sh
 [ "$1 $2" = "issue view" ] || { echo "gh: offline replay; only 'gh issue view <n>' answers" >&2; exit 1; }
 shift 2; n=; repo=; prev=
 for a; do
@@ -164,13 +164,13 @@ exec cat "${e}/remotes/$repo.git/tangle-issue-$n.json"
 docker run --rm --network none "$1" tar -C "$3/.git" -c . | tar -x -C "$g"
 c=$(git -c user.name=graph-improve -c user.email=gi@local --git-dir "$g" commit-tree 'HEAD^{tree}' -m Base)
 git init -q --bare -b main "$2.partial" && git --git-dir "$g" push -q "$2.partial" "$c:refs/heads/main"
-mv "$2.partial" "$2"`,b,x,S.length?pe.resolve(`/`,...S):`/app`);let C=c(n.id),w=M(i,`remotes`,`${C.upstream}.git`),{issueTitle:T,issueBodyClean:ee}=C,E=`https://github.com/${C.upstream}/issues/${C.issue}`,D=JSON.stringify({title:T,body:ee,url:E,state:`OPEN`}),O=v.runId,k;{y||await $c(`rm -rf "$2" && git clone -q --bare "$1" "$2" && printf %s "$4" > "$2/tangle-issue-$3.json"`,x,w,`${C.issue}`,D);try{let e=l(C,b),n={...s,param:e,json:!0,...f&&{seat:f},...y&&{resume:v.runId}},r=await tu(t.file,{...n,dryRun:!0},{signal:p,source:g.source,...y&&{cwd:y.cwd}});if(!(`graph`in r))throw Error(`Replay did not load locally`);if(!r.graph.budget)throw Error(`Replay has no runtime budget`);try{await d({runId:v.runId,budget:r.graph.budget,sourceDigest:t.sourceDigest,graphDigest:r.graph.digest})}catch(e){throw o.incomplete=e.message,e}let i;try{i=await tu(t.file,n,{signal:p,source:g.source,runId:v.runId,graphDigest:r.graph.digest,...y&&{cwd:y.cwd}})}finally{await d()}O=`runId`in i?i.runId:void 0;let a=JSON.parse(`text`in i?i.text:`{}`);k=Object.values(a).find(e=>e?.json?.branch)?.json?.branch??null}catch(e){let t=e;if(t.code!==`GRAPH_RUN_FAILED`)throw e;O=t.runId;let r=u.readout();if(!r.tokensKnown||r.tokensLeft<0||r.iterationsLeft<0||r.deadlineMs>0&&Date.now()>=r.deadlineMs)throw o.incomplete=`Shared campaign budget exhausted or its accounting is incomplete`,new h(o.incomplete,{cause:e});if(e.runtimeFailures?.some(({failure:e})=>rl(e)))throw new h(n.id,{cause:e})}let r=M(I(),`.tangle`,`runs`,`${O}`),i=(await e.durableRunToolSpans(r)).map(e=>e.toolName).find(e=>/web.?(search|fetch)/i.test(e));if(i&&e.stop.abort(Error(`${O} called ${i}: not offline`)),e.stop.signal.throwIfAborted(),k===null)throw Error(`no node output names a branch`);let a=k?await $c(`b=$(git --git-dir "$1" rev-parse main); git --git-dir "$2" diff --binary "$b" "$3"`,x,w,k):``,c=await e.readSettleRecord(r),m=c&&Rs(c).tokenUsage,_=u.readout();if(!_.tokensKnown||_.tokensLeft<0||_.iterationsLeft<0||_.deadlineMs>0&&Date.now()>=_.deadlineMs)throw o.incomplete=`Shared campaign budget exhausted or its accounting is incomplete`,new h(o.incomplete);return{patch:a,tokens:m?.input!=null&&m.output!=null?{inputTokens:m.input??0,outputTokens:m.output??0}:nl(t.cap),...O&&{runId:O}}}}}function dl(e){let{campaigns:t,files:n,probe:r,reps:i,repList:a,at:o,state:s,wilson:c,decidePairedPromotion:l}=e,u=e=>e.reduce((e,t)=>e+t,0)/e.length,d=t.map((e,t)=>{let r=e.cells.filter(e=>!e.error),i=e=>Object.values(e.judgeScores)[0]?.composite??0,a=r.filter(e=>e.rep===0),o=a.filter(e=>i(e)>=1).length,s=e.cells.filter(e=>e.error),{inputTokens:l,outputTokens:u,usageComplete:d}=e.aggregates.cost;return{graph:n[t],resolved:o,n:a.length,runDir:e.runDir,wilson95:c(o,a.length),unmeasured:s.map(e=>`${e.cellId}: ${e.error}`),tokens:l+u,usageComplete:d,rewards:Object.fromEntries(r.map(e=>[e.cellId,i(e)]))}}),f=({rewards:e},t)=>a.flatMap(n=>e[`${t}:${n}`]??[]),[p,...m]=d;return{reports:d,paired:m.map((e,t)=>{let a=[...r].filter(t=>f(p,t).length&&f(e,t).length),c=[...new Set(a.map(e=>o(e).upstream))],d=c.map(e=>a.filter(t=>o(t).upstream===e)),m=e=>d.map(t=>u(t.map(t=>u(f(e,t))))),[h,g]=[m(p),m(e)];if(!(!s.incomplete&&p.usageComplete&&e.usageComplete&&a.length===r.size&&a.every(t=>f(p,t).length===i&&f(e,t).length===i)))return{arm:n[t+1],cases:a.length,repos:c.length,decision:`hold`,why:s.incomplete??`Campaign evidence is incomplete`,sufficient:!1,rates:[h.length?u(h):null,g.length?u(g):null],delta:null,interval95:null,method:null};let _=l(h,g,{continuous:!0}),{n:v,minimumPairs:y,low:b,threshold:x}=_,S=_.promote?void 0:!_.sufficient&&`insufficient pairs: n ${v} < minimumPairs ${y}`||b<=x&&`interval low ${b} ≤ threshold ${x}`||_.exactTestVetoes&&`McNemar exact test vetoes`||`indeterminate interval`;return{arm:n[t+1],cases:a.length,repos:c.length,rates:[u(h),u(g)],delta:_.delta,method:_.method,interval95:[_.low,_.high],sufficient:_.sufficient,decision:_.promote?`promote`:`hold`,why:S}})}}const fl=1e5;function Z(e){throw new B(`GRAPH_INVALID`,`Graph creation failed`,e,`tangle graph new --help`)}function pl(e){return typeof e==`string`&&/^[a-z0-9][a-z0-9-]{0,62}$/i.test(e)}const ml={maxBarren:2,failures:`verbatim`,panel:`off`,bar:`on`,profile:{id:`graph-new-v1`,opening:`The graph has not passed its outside check.`,plan:`Repair the concrete diagnostics with write_graph, run the saved file and submit the actual evidence.`,rules:`Completion requires a successful host run and unchanged YAML. Retain working graph content when blocked.`,headings:{failures:`Failures`,protected:`Passing checks`,changed:`Changes`,findings:`Findings`,bar:`Acceptance`,plan:`Next`,rules:`Rules`}}};var hl=class{owned;lastFailure;pending=Promise.resolve();revision=0;sealed=!1;constructor(e,t,n){this.directory=e,this.options=t,this.cwd=n}async digest(e=this.owned){e||Z(`No graph file was saved`);let t=await mt(e.file,Fe.O_RDONLY|Fe.O_NOFOLLOW);try{let[n,r]=await Promise.all([t.stat(),e.handle.stat()]);return(!n.isFile()||n.dev!==r.dev||n.ino!==r.ino)&&Z(`The owned graph file was replaced`),Q(await t.readFile())}finally{await t.close()}}enqueue(e){let t=++this.revision,n=this.pending.then(()=>e(t));return this.pending=n.then(()=>void 0,()=>void 0),n}check=()=>this.enqueue(async e=>{let t=this.owned;if(!t?.result)return!1;let{digest:n,result:r}=t,i=await this.digest(t),a=this.revision===e&&this.owned===t&&t.digest===n&&t.result===r&&i===n;return a&&(this.sealed=!0),a});receipt(){this.owned?.result||Z(`No successful graph run was recorded`);let{file:e,digest:t,result:n}=this.owned;return{file:e,digest:t,result:n}}invoke(e,t){return this.sealed&&Z(`The graph is accepted; submit its recorded successful run`),this.enqueue(()=>this.write(e,t)).catch(e=>(this.lastFailure=e,{ok:!1,diagnostic:Ft(e)}))}async write(e,t){t.throwIfAborted(),this.lastFailure=void 0;let n=e;(!n||!pl(n.name)||typeof n.source!=`string`||typeof n.run!=`boolean`||Object.keys(n).some(e=>![`name`,`source`,`run`].includes(e)))&&Z(`Expected only name, source and boolean run`),this.options.name!==void 0&&n.name!==this.options.name&&Z(`The graph name must match --name`),this.owned&&(this.owned.result=void 0);let r=M(this.directory,`${n.name}.yaml`);if(this.owned&&this.owned.file!==r&&Z(`This invocation owns one named graph file`),!this.owned)try{this.owned={file:r,handle:await mt(r,Fe.O_RDWR|Fe.O_CREAT|Fe.O_EXCL|Fe.O_NOFOLLOW,384),digest:Q(``)}}catch(e){throw e.code===`EEXIST`&&Z(`Graph already exists: ${r}; choose another --name`),e}let i=this.owned;await this.digest()!==i.digest&&Z(`The owned graph was changed`);let a=Buffer.from(n.source);for(let e=0;e<a.length;){let{bytesWritten:t}=await i.handle.write(a,e,a.length-e,e);if(!t)throw Error(`Graph file write made no progress`);e+=t}await i.handle.truncate(a.length),await i.handle.sync(),i.digest=Q(a);let o={...this.options,param:[]},s={cwd:this.cwd,signal:t,source:n.source},c=await tu(r,{...o,dryRun:!0},{...s,connectNeeds:!0});`graph`in c||Z(`No canonical graph was returned`),c.graph.deliverable.checkRef===`command`&&Z(`Host command checks need a jailed verifier node`);let{nodes:l,edges:u,budget:d}=c.graph,f=u.reduce((e,t)=>e+(`maxTraversals`in t?(t.maxTraversals??1)-1:0),l.length),p=(f+1)*fl;if(d?.maxTokens!==void 0&&d.maxTokens<p&&Z(`budget.maxTokens ${d.maxTokens} is below ${p}: ${f} agent spawns plus one reservation at ${fl} tokens per native turn`),await this.digest()!==i.digest&&Z(`Graph changed during validation`),!n.run)return{file:r,graphDigest:c.graph.digest,validated:!0};let m=await tu(r,o,{...s,graphDigest:c.graph.digest});return(!(`status`in m)||m.status!==`winner`||m.graphDigest!==c.graph.digest||await this.digest()!==i.digest)&&Z(`The graph must succeed with unchanged YAML`),i.result=m,this.receipt()}async close(){await this.pending,await this.owned?.handle.close()}};async function gl(e,t,n){let{runId:r,runDir:i,cwd:a,bridge:o,signal:s}=e,c=await o(),l=M(await R(M(I(),`.tangle`)),`graphs`);(Us(a,l)||Us(l,a))&&Z(`The graph store must be outside the agent workspace; choose another working directory`);try{await ft(l,{mode:448})}catch(e){if(e.code!==`EEXIST`)throw e}await R(l)!==l&&Z(`The graph store redirects outside its canonical location`);let u=n.seat??rn().seat,d=await hc(a,s)(u,{node:`graph-designer`,cwd:a,signal:s,lastCandidate:!0});d||Z(`No authenticated native subscription is available`);let{graphDesignerProfile:f}=await import(`@tangle-network/agent-runtime/profiles`),{supervisePursuit:p}=await import(`@tangle-network/agent-runtime/durable`),m=f({profile:{name:`graph-designer`,harness:d.harness,model:{provider:d.provider,default:d.model,...d.reasoningEffort===void 0?{}:{reasoningEffort:d.reasoningEffort}},prompt:{instructions:[`You are the sole graph designer. Author a canonical YAML graph for the requested intent, then qualify and run it using write_graph. Its nodes are complete AgentProfiles with a real independent verifier and declarative route/data outside check. Command checks execute on the host and are refused here; put executable verification in the verifier node's normal native tools. Read the supplied skills and preserve the user's task and authority.`,`Call write_graph with name, complete YAML source and run:false to validate; repair its concrete diagnostics, then call it with the identical source and run:true. The graph schema and executor are owned by the installed loader. Supply defaults for parameters needed by the first run. Only a real successful host run of the unchanged saved file passes. Submit that evidence using submit_result; explain concrete blockers using report_blocked.`]},tools:{agent_runtime_coordination_write_graph:!0,agent_runtime_coordination_submit_result:!0,agent_runtime_coordination_read_continuation:!0,agent_runtime_coordination_report_blocked:!0}}}),h=De(m),g=new hl(l,{...n,seat:u},a),_={maxIterations:6,maxTokens:2e6,deadlineMs:9e5};try{let e=await p(m,{intent:t,name:n.name},{pursuitId:r,runId:r,runDir:i,signal:s,backend:{...c,timeoutMs:_.deadlineMs},budget:_,maxDepth:0,coordination:{authentication:!0,requestTimeoutMs:_.deadlineMs},deliverable:{describe:`The saved graph succeeds with unchanged YAML`,check:g.check,checkState:g.check},continuation:ml,resolveSupervisorTools:e=>e.runId!==r||e.nodeId!==r||e.depth!==0||e.identity.profileDigest!==h?[]:[{name:`write_graph`,description:`Save, validate and run this graph.`,inputSchema:{type:`object`,properties:{name:{type:`string`},source:{type:`string`},run:{type:`boolean`}},required:[`name`,`source`,`run`],additionalProperties:!1},handler:(t,n)=>((n.nodeId!==e.nodeId||n.ownerId!==e.ownerId||n.runId!==e.runId)&&Z(`Wrong graph tool owner`),g.invoke(t,n.signal))}]});if(e.result.kind===`no-winner`||!await g.check()){if(g.lastFailure)throw g.lastFailure;let t=e.result.kind===`no-winner`?e.result.error?.message??e.result.reason:`The graph file changed after its successful run`;throw Object.assign(new B(`GRAPH_DESIGN_FAILED`,`Graph design did not finish`,t,`tangle graph new --help`),{runId:r,node:`graph-designer`})}return g.receipt()}finally{await g.close()}}function _l(t){t.command(`new <intent>`).description(`Design, validate and run one portable graph`).option(`--seat <seat>`,`Use harness/model@effort for the designer and graph`).option(`--name <name>`,`Save this graph name`).action(async(t,n)=>{process.env.BRIDGE_JAIL_RW_PATHS?.trim()&&Z(`Remove BRIDGE_JAIL_RW_PATHS before graph new; extra native write roots cannot contain its host store`),n.name!==void 0&&!pl(n.name)&&Z(`Use letters, numbers and hyphens in --name`);let r=await $l({},e=>gl(e,t,n));n.json?e(r):l(`Created ${r.file} · run ${r.result.runId}`)})}const vl={start:[`▶`,j.green],agent:[`●`,j.cyan.bold],check:[`▣`,j.yellow.bold],gate:[`◇`,j.magenta.bold],finish:[`✓`,j.green.bold],stop:[`■`,j.red.bold]};function yl(e){let t=t=>e.nodes.find(e=>e.id===t)?.kind??`agent`,n=e=>{let[n,r]=vl[t(e)];return r(`${n} ${e.replace(/^(finish|stop):/,``)}`)},r=Math.max(...e.nodes.map(e=>e.id.length))+4,i=[`${j.bold(`◆ ${e.name}`)}`,...e.describe?[`  ${e.describe}`]:[],``];for(let[t,n]of e.facts)i.push(`  ${j.dim(t.padEnd(10))} ${n}`);i.push(``,j.bold(`NODES`));for(let t of e.nodes.filter(e=>[`agent`,`check`,`gate`].includes(e.kind))){let[e,...a]=t.detail.split(`
+mv "$2.partial" "$2"`,b,x,S.length?pe.resolve(`/`,...S):`/app`);let C=c(n.id),w=M(i,`remotes`,`${C.upstream}.git`),{issueTitle:T,issueBodyClean:ee}=C,E=`https://github.com/${C.upstream}/issues/${C.issue}`,D=JSON.stringify({title:T,body:ee,url:E,state:`OPEN`}),O=v.runId,k;{y||await $c(`rm -rf "$2" && git clone -q --bare "$1" "$2" && printf %s "$4" > "$2/tangle-issue-$3.json"`,x,w,`${C.issue}`,D);try{let e=l(C,b),n={...s,param:e,json:!0,...f&&{seat:f},...y&&{resume:v.runId}},r=await tu(t.file,{...n,dryRun:!0},{signal:p,source:g.source,...y&&{cwd:y.cwd}});if(!(`graph`in r))throw Error(`Replay did not load locally`);if(!r.graph.budget)throw Error(`Replay has no runtime budget`);try{await d({runId:v.runId,budget:r.graph.budget,sourceDigest:t.sourceDigest,graphDigest:r.graph.digest})}catch(e){throw o.incomplete=e.message,e}let i;try{i=await tu(t.file,n,{signal:p,source:g.source,runId:v.runId,graphDigest:r.graph.digest,...y&&{cwd:y.cwd}})}finally{await d()}O=`runId`in i?i.runId:void 0;let a=JSON.parse(`text`in i?i.text:`{}`);k=Object.values(a).find(e=>e?.json?.branch)?.json?.branch??null}catch(e){let t=e;if(t.code!==`GRAPH_RUN_FAILED`)throw e;O=t.runId;let r=u.readout();if(!r.tokensKnown||r.tokensLeft<0||r.iterationsLeft<0||r.deadlineMs>0&&Date.now()>=r.deadlineMs)throw o.incomplete=`Shared campaign budget exhausted or its accounting is incomplete`,new h(o.incomplete,{cause:e});if(e.runtimeFailures?.some(({failure:e})=>rl(e)))throw new h(n.id,{cause:e})}let r=M(I(),`.tangle`,`runs`,`${O}`),i=(await e.durableRunToolSpans(r)).map(e=>e.toolName).find(e=>/web.?(search|fetch)/i.test(e));if(i&&e.stop.abort(Error(`${O} called ${i}: not offline`)),e.stop.signal.throwIfAborted(),k===null)throw Error(`no node output names a branch`);let a=k?await $c(`b=$(git --git-dir "$1" rev-parse main); git --git-dir "$2" diff --binary "$b" "$3"`,x,w,k):``,c=await e.readSettleRecord(r),m=c&&Rs(c).tokenUsage,_=u.readout();if(!_.tokensKnown||_.tokensLeft<0||_.iterationsLeft<0||_.deadlineMs>0&&Date.now()>=_.deadlineMs)throw o.incomplete=`Shared campaign budget exhausted or its accounting is incomplete`,new h(o.incomplete);return{patch:a,tokens:m?.input!=null&&m.output!=null?{inputTokens:m.input??0,outputTokens:m.output??0}:nl(t.cap),...O&&{runId:O}}}}}function dl(e){let{campaigns:t,files:n,probe:r,reps:i,repList:a,at:o,state:s,wilson:c,decidePairedPromotion:l}=e,u=e=>e.reduce((e,t)=>e+t,0)/e.length,d=t.map((e,t)=>{let r=e.cells.filter(e=>!e.error),i=e=>Object.values(e.judgeScores)[0]?.composite??0,a=r.filter(e=>e.rep===0),o=a.filter(e=>i(e)>=1).length,s=e.cells.filter(e=>e.error),{inputTokens:l,outputTokens:u,usageComplete:d}=e.aggregates.cost;return{graph:n[t],resolved:o,n:a.length,runDir:e.runDir,wilson95:c(o,a.length),unmeasured:s.map(e=>`${e.cellId}: ${e.error}`),tokens:l+u,usageComplete:d,rewards:Object.fromEntries(r.map(e=>[e.cellId,i(e)]))}}),f=({rewards:e},t)=>a.flatMap(n=>e[`${t}:${n}`]??[]),[p,...m]=d;return{reports:d,paired:m.map((e,t)=>{let a=[...r].filter(t=>f(p,t).length&&f(e,t).length),c=[...new Set(a.map(e=>o(e).upstream))],d=c.map(e=>a.filter(t=>o(t).upstream===e)),m=e=>d.map(t=>u(t.map(t=>u(f(e,t))))),[h,g]=[m(p),m(e)];if(!(!s.incomplete&&p.usageComplete&&e.usageComplete&&a.length===r.size&&a.every(t=>f(p,t).length===i&&f(e,t).length===i)))return{arm:n[t+1],cases:a.length,repos:c.length,decision:`hold`,why:s.incomplete??`Campaign evidence is incomplete`,sufficient:!1,rates:[h.length?u(h):null,g.length?u(g):null],delta:null,interval95:null,method:null};let _=l(h,g,{continuous:!0}),{n:v,minimumPairs:y,low:b,threshold:x}=_,S=_.promote?void 0:!_.sufficient&&`insufficient pairs: n ${v} < minimumPairs ${y}`||b<=x&&`interval low ${b} ≤ threshold ${x}`||_.exactTestVetoes&&`McNemar exact test vetoes`||`indeterminate interval`;return{arm:n[t+1],cases:a.length,repos:c.length,rates:[u(h),u(g)],delta:_.delta,method:_.method,interval95:[_.low,_.high],sufficient:_.sufficient,decision:_.promote?`promote`:`hold`,why:S}})}}const fl=1e5;function Z(e){throw new B(`GRAPH_INVALID`,`Graph creation failed`,e,`tangle graph new --help`)}function pl(e){return typeof e==`string`&&/^[a-z0-9][a-z0-9-]{0,62}$/i.test(e)}const ml={maxBarren:2,failures:`verbatim`,panel:`off`,bar:`on`,profile:{id:`graph-new-v1`,opening:`The graph has not passed its outside check.`,plan:`Repair the concrete diagnostics with write_graph, run the saved file and submit the actual evidence.`,rules:`Completion requires a successful host run and unchanged YAML. Retain working graph content when blocked.`,headings:{failures:`Failures`,protected:`Passing checks`,changed:`Changes`,findings:`Findings`,bar:`Acceptance`,plan:`Next`,rules:`Rules`}}};var hl=class{owned;lastFailure;pending=Promise.resolve();revision=0;sealed=!1;constructor(e,t,n){this.directory=e,this.options=t,this.cwd=n}async digest(e=this.owned){e||Z(`No graph file was saved`);let t=await mt(e.file,Ie.O_RDONLY|Ie.O_NOFOLLOW);try{let[n,r]=await Promise.all([t.stat(),e.handle.stat()]);return(!n.isFile()||n.dev!==r.dev||n.ino!==r.ino)&&Z(`The owned graph file was replaced`),Q(await t.readFile())}finally{await t.close()}}enqueue(e){let t=++this.revision,n=this.pending.then(()=>e(t));return this.pending=n.then(()=>void 0,()=>void 0),n}check=()=>this.enqueue(async e=>{let t=this.owned;if(!t?.result)return!1;let{digest:n,result:r}=t,i=await this.digest(t),a=this.revision===e&&this.owned===t&&t.digest===n&&t.result===r&&i===n;return a&&(this.sealed=!0),a});receipt(){this.owned?.result||Z(`No successful graph run was recorded`);let{file:e,digest:t,result:n}=this.owned;return{file:e,digest:t,result:n}}invoke(e,t){return this.sealed&&Z(`The graph is accepted; submit its recorded successful run`),this.enqueue(()=>this.write(e,t)).catch(e=>(this.lastFailure=e,{ok:!1,diagnostic:Ft(e)}))}async write(e,t){t.throwIfAborted(),this.lastFailure=void 0;let n=e;(!n||!pl(n.name)||typeof n.source!=`string`||typeof n.run!=`boolean`||Object.keys(n).some(e=>![`name`,`source`,`run`].includes(e)))&&Z(`Expected only name, source and boolean run`),this.options.name!==void 0&&n.name!==this.options.name&&Z(`The graph name must match --name`),this.owned&&(this.owned.result=void 0);let r=M(this.directory,`${n.name}.yaml`);if(this.owned&&this.owned.file!==r&&Z(`This invocation owns one named graph file`),!this.owned)try{this.owned={file:r,handle:await mt(r,Ie.O_RDWR|Ie.O_CREAT|Ie.O_EXCL|Ie.O_NOFOLLOW,384),digest:Q(``)}}catch(e){throw e.code===`EEXIST`&&Z(`Graph already exists: ${r}; choose another --name`),e}let i=this.owned;await this.digest()!==i.digest&&Z(`The owned graph was changed`);let a=Buffer.from(n.source);for(let e=0;e<a.length;){let{bytesWritten:t}=await i.handle.write(a,e,a.length-e,e);if(!t)throw Error(`Graph file write made no progress`);e+=t}await i.handle.truncate(a.length),await i.handle.sync(),i.digest=Q(a);let o={...this.options,param:[]},s={cwd:this.cwd,signal:t,source:n.source},c=await tu(r,{...o,dryRun:!0},{...s,connectNeeds:!0});`graph`in c||Z(`No canonical graph was returned`),c.graph.deliverable.checkRef===`command`&&Z(`Host command checks need a jailed verifier node`);let{nodes:l,edges:u,budget:d}=c.graph,f=u.reduce((e,t)=>e+(`maxTraversals`in t?(t.maxTraversals??1)-1:0),l.length),p=(f+1)*fl;if(d?.maxTokens!==void 0&&d.maxTokens<p&&Z(`budget.maxTokens ${d.maxTokens} is below ${p}: ${f} agent spawns plus one reservation at ${fl} tokens per native turn`),await this.digest()!==i.digest&&Z(`Graph changed during validation`),!n.run)return{file:r,graphDigest:c.graph.digest,validated:!0};let m=await tu(r,o,{...s,graphDigest:c.graph.digest});return(!(`status`in m)||m.status!==`winner`||m.graphDigest!==c.graph.digest||await this.digest()!==i.digest)&&Z(`The graph must succeed with unchanged YAML`),i.result=m,this.receipt()}async close(){await this.pending,await this.owned?.handle.close()}};async function gl(e,t,n){let{runId:r,runDir:i,cwd:a,bridge:o,signal:s}=e,c=await o(),l=M(await R(M(I(),`.tangle`)),`graphs`);(Us(a,l)||Us(l,a))&&Z(`The graph store must be outside the agent workspace; choose another working directory`);try{await ft(l,{mode:448})}catch(e){if(e.code!==`EEXIST`)throw e}await R(l)!==l&&Z(`The graph store redirects outside its canonical location`);let u=n.seat??rn().seat,d=await hc(a,s)(u,{node:`graph-designer`,cwd:a,signal:s,lastCandidate:!0});d||Z(`No authenticated native subscription is available`);let{graphDesignerProfile:f}=await import(`@tangle-network/agent-runtime/profiles`),{supervisePursuit:p}=await import(`@tangle-network/agent-runtime/durable`),m=f({profile:{name:`graph-designer`,harness:d.harness,model:{provider:d.provider,default:d.model,...d.reasoningEffort===void 0?{}:{reasoningEffort:d.reasoningEffort}},prompt:{instructions:[`You are the sole graph designer. Author a canonical YAML graph for the requested intent, then qualify and run it using write_graph. Its nodes are complete AgentProfiles with a real independent verifier and declarative route/data outside check. Command checks execute on the host and are refused here; put executable verification in the verifier node's normal native tools. Read the supplied skills and preserve the user's task and authority.`,`Call write_graph with name, complete YAML source and run:false to validate; repair its concrete diagnostics, then call it with the identical source and run:true. The graph schema and executor are owned by the installed loader. Supply defaults for parameters needed by the first run. Only a real successful host run of the unchanged saved file passes. Submit that evidence using submit_result; explain concrete blockers using report_blocked.`]},tools:{agent_runtime_coordination_write_graph:!0,agent_runtime_coordination_submit_result:!0,agent_runtime_coordination_read_continuation:!0,agent_runtime_coordination_report_blocked:!0}}}),h=Oe(m),g=new hl(l,{...n,seat:u},a),_={maxIterations:6,maxTokens:2e6,deadlineMs:9e5};try{let e=await p(m,{intent:t,name:n.name},{pursuitId:r,runId:r,runDir:i,signal:s,backend:{...c,timeoutMs:_.deadlineMs},budget:_,maxDepth:0,coordination:{authentication:!0,requestTimeoutMs:_.deadlineMs},deliverable:{describe:`The saved graph succeeds with unchanged YAML`,check:g.check,checkState:g.check},continuation:ml,resolveSupervisorTools:e=>e.runId!==r||e.nodeId!==r||e.depth!==0||e.identity.profileDigest!==h?[]:[{name:`write_graph`,description:`Save, validate and run this graph.`,inputSchema:{type:`object`,properties:{name:{type:`string`},source:{type:`string`},run:{type:`boolean`}},required:[`name`,`source`,`run`],additionalProperties:!1},handler:(t,n)=>((n.nodeId!==e.nodeId||n.ownerId!==e.ownerId||n.runId!==e.runId)&&Z(`Wrong graph tool owner`),g.invoke(t,n.signal))}]});if(e.result.kind===`no-winner`||!await g.check()){if(g.lastFailure)throw g.lastFailure;let t=e.result.kind===`no-winner`?e.result.error?.message??e.result.reason:`The graph file changed after its successful run`;throw Object.assign(new B(`GRAPH_DESIGN_FAILED`,`Graph design did not finish`,t,`tangle graph new --help`),{runId:r,node:`graph-designer`})}return g.receipt()}finally{await g.close()}}function _l(t){t.command(`new <intent>`).description(`Design, validate and run one portable graph`).option(`--seat <seat>`,`Use harness/model@effort for the designer and graph`).option(`--name <name>`,`Save this graph name`).action(async(t,n)=>{process.env.BRIDGE_JAIL_RW_PATHS?.trim()&&Z(`Remove BRIDGE_JAIL_RW_PATHS before graph new; extra native write roots cannot contain its host store`),n.name!==void 0&&!pl(n.name)&&Z(`Use letters, numbers and hyphens in --name`);let r=await $l({},e=>gl(e,t,n));n.json?e(r):l(`Created ${r.file} · run ${r.result.runId}`)})}const vl={start:[`▶`,j.green],agent:[`●`,j.cyan.bold],check:[`▣`,j.yellow.bold],gate:[`◇`,j.magenta.bold],finish:[`✓`,j.green.bold],stop:[`■`,j.red.bold]};function yl(e){let t=t=>e.nodes.find(e=>e.id===t)?.kind??`agent`,n=e=>{let[n,r]=vl[t(e)];return r(`${n} ${e.replace(/^(finish|stop):/,``)}`)},r=Math.max(...e.nodes.map(e=>e.id.length))+4,i=[`${j.bold(`◆ ${e.name}`)}`,...e.describe?[`  ${e.describe}`]:[],``];for(let[t,n]of e.facts)i.push(`  ${j.dim(t.padEnd(10))} ${n}`);i.push(``,j.bold(`NODES`));for(let t of e.nodes.filter(e=>[`agent`,`check`,`gate`].includes(e.kind))){let[e,...a]=t.detail.split(`
 `);i.push(`  ${n(t.id)}${` `.repeat(Math.max(1,r-t.id.length))}${e}`);for(let e of a)i.push(`${` `.repeat(r+4)}${j.dim(e)}`)}i.push(``,j.bold(`FLOW`));for(let t of e.edges){let e=`  ${t.from.map(n).join(j.dim(` + `))} ${j.dim(`─▶`)} ${t.to.map(n).join(j.dim(` ∥ `))}`,r=t.loop?j.magenta(t.label):j.blue(t.label);i.push(...t.label.length+_t(e).length>100?[e,`      ${r}`]:[`${e}  ${r}`])}return i.join(`
 `)}async function bl(e,t){let n=M(t,`dist`,`graph-show`),[r,i]=await Promise.all([`viewer.iife.js`,`styles.css`].map(e=>L(M(n,e),`utf8`))),a=(e=``)=>e.replace(/<\/(script)/gi,`<\\/$1`).replace(/<!--/g,`<\\!--`),o=e.name.replace(/[^\w.-]+/g,`-`),s=`<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${o} · tangle graph</title>
 <meta name="description" content="${(e.describe??o).replace(/[&<>"]/g,``)}">
 <style>${i}html,body,#root{margin:0;height:100%;font-family:ui-sans-serif,system-ui,sans-serif}</style></head>
 <body><div id="root"></div><script id="graph" type="application/json">${JSON.stringify(e).replace(/</g,`\\u003c`)}<\/script>
-<script>${a(r)}<\/script></body></html>`,c=M(await pt(M(Ue(),`tangle-graph-`)),`${o}.html`);return await z(c,s,{mode:384}),c}function xl(t,n,r){t.command(`show <name-or-file>`).description(`Draw a graph file: labelled nodes, routes, loops and stops`).option(`--open`,`Write one offline page and open it in the browser`).action(async(t,i)=>{let a=await R(n(t,process.cwd())),{graphShape:o}=await import(`./graph-view-DOQKwuvP.mjs`),s=o(a,await L(a,`utf8`));if(i.json)return e(s);if(!i.open)return console.log(yl(s));let c=await bl(s,r);l(await Hr(bt(c).href)?`Opened ${c}`:`Open ${c}`)})}async function Sl(e){if(!yn(e.apiKey)){if(e.json||e.dryRun||!process.stdin.isTTY)return;await Zr({baseUrl:e.sandboxBaseUrl,signal:e.signal})}return K(e)}async function Cl(t,n,r){let i=Kl(n.parameter),a=r??await Sl(n);if(!a)throw new B(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let o=await a.connections.start(t,{cli:!0,connectionParameters:i,...n.scope?.length?{requestedScopes:n.scope}:{}});return n.json?(e(Jl(o)),o):(ql(o,n.browser===!1?!1:await Hr(o.redirectUrl),n.wait),o)}async function wl(e,t,n,r){let i=async()=>{n.signal?.throwIfAborted();let{connections:i}=await e.connections.list(),a=i.filter(e=>e.status===`active`&&e.providerId.toLowerCase()===t.trim().toLowerCase());return a.length?Qe(a,r===void 0?t:`${t}:${r}`):void 0},a=await i();if(a||n.json||n.dryRun||!process.stdin.isTTY)return a;let o=await Cl(t,{...n,wait:!0},e);for(;!a&&Date.now()<Date.parse(o.expiresAt);)await nt(1e3,void 0,{signal:n.signal}),a=await i();return a}function Tl(){let e=new N(`hub`).description(`Discover and run Tangle Hub tools`);return El(e),Dl(e),Ol(e),kl(e),Al(e),e}function El(t){t.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--key-env <name>`,`Connect an API-key provider using this environment variable; never prints the key`).option(`--metadata <json>`,`Provider setup metadata for API-key connections`).option(`--scope <scope>`,`Request an OAuth scope; repeatable, must stay within the host's grant`,(e,t)=>[...t,e],[]).option(`--parameter <key=value>`,`Provider-specific OAuth value. Repeatable.`,(e,t)=>[...t,e],[]).action(async(t,n)=>{if(n.keyEnv){if(n.scope?.length)throw Error(`--scope applies to OAuth connections, not --key-env.`);let r=process.env[n.keyEnv];if(!r?.trim())throw Error(`Environment variable '${n.keyEnv}' is empty or unavailable.`);let i=await Sl(n);if(!i)throw new B(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let a;if(n.metadata!==void 0)try{a=JSON.parse(n.metadata)}catch{throw Error(`--metadata must be valid JSON.`)}let o=await i.connections.connectApiKey(t,r,a);n.json?e(o):l(`Connected ${o.connection.providerId} as ${o.connection.id}.`);return}if(n.metadata!==void 0)throw Error(`--metadata requires --key-env.`);await Cl(t,n)});let n=new N(`connections`).description(`List Hub provider connections`).action(async t=>{let n=await(await K(t)).connections.list();t.json?e(n):Gl(n.connections)});n.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let r=await K(n),i=await Rn(r,t);if(!n.force&&!await pr(`Revoke Hub connection ${i}? `,`--force`)){l(`Revoke cancelled.`);return}let a=await r.connections.revoke(i);if(n.json){e(a);return}l(`Revoked Hub connection ${a.connection.id}.`)}),t.addCommand(n)}function Dl(n){n.command(`providers [provider]`).description(`Show provider setup and action catalog; use hub events for trigger readiness`).action(async(n,r)=>{let i=await(await K(r)).connections.providers(),a=i.providers.filter(e=>!n||e.providerId===n.toLowerCase());if(n&&!a.length)throw Error(`Provider '${n}' is absent from this deployment's catalog.`);if(r.json)return e({...i,providers:a});t(a,[{key:`providerId`,header:`Provider`},{key:`authKind`,header:`Auth`},{key:`configured`,header:`Connect configured`},{key:`actionCount`,header:`Catalog actions`}])}),n.command(`events [provider]`).description(`Discover deployed trigger events and ingress readiness separately from callable tools`).action(async(n,r)=>{let i=await K(r),[a,o]=await Promise.all([i.connections.providers(),i.workflows.catalogs()]),s=[...new Set([...a.providers.map(e=>e.providerId),...o.providerEventProviders])];if(n&&!s.includes(n.toLowerCase()))throw Error(`Provider '${n}' is absent from this deployment's catalog.`);let c=s.filter(e=>!n||e===n.toLowerCase()).map(e=>({provider:e,supported:o.providerEventProviders.includes(e),ingressConfigured:a.providers.find(t=>t.providerId===e)?.eventIngressConfigured??null,catalog:o.triggerEvents[e]??null}));if(r.json)return e({providers:c});t(c.map(e=>({...e,ingress:e.ingressConfigured===null?`unknown`:e.ingressConfigured?`ready`:`setup required`,events:e.catalog?.events.map(e=>e.id).join(`, `)??`no published vocabulary`})),[{key:`provider`,header:`Provider`},{key:`supported`,header:`Event source supported`},{key:`ingress`,header:`Ingress`},{key:`events`,header:`Events`}])})}function Ol(t){let n=new N(`permissions`).description(`Manage Hub action permissions`);n.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async t=>{if(!t.connection)throw Error(`--connection is required.`);let n=await K(t),r=await Rn(n,t.connection),i=await n.permissions.list(r);t.json?e(i):Bl(i.policies)}),n.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).action(async t=>{if(!t.connection)throw Error(`--connection is required.`);if(!t.action)throw Error(`--action is required.`);let n=Vl(t.decision),r=await K(t),i=await Rn(r,t.connection),a=await r.permissions.set({connectionId:i,actionPath:t.action,decision:n});t.json?e(a):Bl([a.policy])}),n.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async t=>{if(!t.connection)throw Error(`--connection is required.`);let n=await K(t),r=await Rn(n,t.connection),i=await n.permissions.revertWrites(r);if(t.json){e(i);return}l(`Reverted ${i.reverted} write permission${i.reverted===1?``:`s`} for connection ${i.connectionId}.`)}),t.addCommand(n),t.addCommand(Ml())}function kl(t){let n=new N(`tools`).description(`Discover Hub tools`);n.command(`sources`).description(`List Hub tool sources`).action(async t=>{let n=await(await K(t)).tools.sources();t.json?e(n):Hl(n.sources)}),n.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).action(async(t,n)=>{let r=await(await K(n)).tools.describe(t);n.json?e(r):Ul(r.tool)}),n.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).action(async(t,n)=>{let r=await(await K(n)).tools.search(t.join(` `),{provider:n.provider});n.json?e(r):zl(r.tools)}),t.addCommand(n),t.addCommand(jl(`call`)),t.addCommand(jl(`exec`))}function Al(t){t.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).action(async(e,t)=>{if(Pl(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await K(t);Il(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}),t.command(`status`).description(`Show Hub auth and connection status`).action(async t=>{let n=await(await K(t)).status();t.json?e(n):Yl(n)})}function jl(t){return new N(t).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).action(async(t,n)=>{let{args:r,approve:i}=Nl(t,n),{path:a,input:o}=Rl(r),s=await K(n),c=n.connection?await Rn(s,n.connection):void 0;e((await s.tools.invoke(a,o,{connectionId:c,approve:i})).result)})}function Ml(){let t=new N(`approvals`).description(`List and resolve Hub execution approvals`);t.command(`list`).description(`List pending Hub execution approvals`).action(async t=>{let n=await(await K(t)).approvals.list();t.json?e(n):Fl(n.approvals)});for(let e of[`approve`,`deny`])t.command(e).description(`${e===`approve`?`Approve`:`Deny`} a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).action(async(t,n)=>{Pl(t),Il(await(await K(n)).approvals[e](t),n.json===!0)});return t}function Nl(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function Pl(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function Fl(e){t(e,[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`connectionId`,header:`Connection`},{key:`status`,header:`Status`},{key:`expiresAt`,header:`Expires`}])}function Il(t,n){if(n){e(Ll(t));return}l(`Hub approval ${t.approval.id} ${t.approval.status}.`),t.capabilityToken&&l("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function Ll(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function Rl(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e[e.length-1];try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function zl(e){t(e.map(e=>({...e,provider:e.providerId??e.requiredConnectionProviderId,connection:Wl(e)})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policyState`,header:`Policy`}])}function Bl(e){t(e,[{key:`connectionId`,header:`Connection`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updatedAt`,header:`Updated`}])}function Vl(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function Hl(e){t(e,[{key:`sourceId`,header:`Source`},{key:`displayName`,header:`Provider`},{key:`toolCount`,header:`Tools`},{key:`connectionStatus`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function Ul(e){s({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:Wl(e),Policy:e.policyState}),e.inputSchema!==void 0&&(l(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(l(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function Wl(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function Gl(e){t(e.map(e=>({...e,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `)})),[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsedAt`,header:`Last Used`}])}function Kl(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0||e===n.length-1)throw Error(`Invalid --parameter "${n}": expected key=value (for example subdomain=acme)`);let r=n.slice(0,e);if(Object.hasOwn(t,r))throw Error(`Duplicate --parameter key "${r}".`);t[r]=n.slice(e+1)}return t}function ql(e,t,n=!1){t?l(`Opened browser to connect ${e.provider}.`):(l(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),l(n?`Finish authorization in the browser; this run resumes when connected.`:"Finish authorization in the browser, then rerun `tangle hub status`.")}function Jl(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function Yl(e){let{principal:t,connections:n}=e;l(`Hub status`),s({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&l(`Some providers require reconnect.`)}const Xl=v(import.meta.url);if(!Xl)throw Error(`Tangle CLI package metadata was not found`);const Zl=ue(Xl),Q=e=>ve(`sha256`).update(e).digest(`hex`);function Ql(e,t){if(/[\\/]/.test(e)||/\.(yaml|yml|json)$/.test(e))return he(t,e);let n=t;for(;!Ie(M(n,`.git`))&&ue(n)!==n;)n=ue(n);Ie(M(n,`.git`))||(n=t);let r=[`yaml`,`yml`,`json`].flatMap(e=>[`graph.${e}`,e]),i=[n,I()].flatMap(t=>r.map(n=>M(t,`.tangle/graphs/${e}.${n}`))),a=i.find(Ie);if(a)return a;throw new B(`GRAPH_NOT_FOUND`,`Graph '${e}' was not found`,`Looked in ${i.join(`, `)}`,`tangle graph --help`)}async function $l(e,t){return Cs(e.signal,async n=>{let r=e.runId??be(),i,a=new Set,{graphNativeRedaction:o}=await import(`./graph-native-CmG9wDbX.mjs`),s=o();try{let o=M(I(),`.tangle`,`runs`,r);await ft(o,{recursive:!0,mode:448});let c=await R(M(I(),`.tangle`)),l=await R(e.cwd??process.cwd()),u=[`runs`,`graph-registry`,`graphs`].some(e=>Us(l,M(c,e))||Us(M(c,e),l))?M(I(),`.tangle`,`workspaces`,r):l;await ft(u,{recursive:!0,mode:448});let d;return await t({runId:r,runDir:o,cwd:u,bridge:t=>d??=(async()=>{n.throwIfAborted();let r=ye(32).toString(`hex`),{loadConfig:c,startServer:l}=await import(`cli-bridge`),d=M(Zl,`dist`,`stdio.mjs`),f={...process.env,BRIDGE_HOST:`127.0.0.1`,BRIDGE_BEARER:r,BRIDGE_DATA_DIR:M(o,`bridge`),BRIDGE_BACKENDS:mc,BRIDGE_JAIL_MODE:`fs-jail`,BRIDGE_JAIL_FALLBACK:`deny`,BRIDGE_JAIL_NETWORK:`relay`,BRIDGE_SUBSCRIPTIONS_ONLY:`1`};e.relayAllow?f.BRIDGE_JAIL_RELAY_ALLOW=e.relayAllow:delete f.BRIDGE_JAIL_RELAY_ALLOW;let p=c(f);t&&p.jailReadablePaths.push(d),i=await l({cwd:u,config:{...p,port:0},handleSignals:!1,quiet:!0,onRunRedaction:s.observe,mcpSecrets:{async get(t){let n=e.mcpSecretEnv,r=n&&Object.hasOwn(n,t)?n[t]:void 0,i=r===void 0?void 0:process.env[r];return i&&a.add(i),i}},hub:t?{client:t,hash:Ss,serverForGrant:e=>{if(a.add(e),!i)throw Error(`Hub host is not ready`);return{transport:`stdio`,command:process.execPath,args:[{kind:`public`,value:d}],env:{TANGLE_HUB_MCP_ENDPOINT:{kind:`public`,value:`${i.url}/hub/mcp/grants/${e}`}}}}}:void 0});let{graphNativeCapture:m}=await import(`./graph-native-CmG9wDbX.mjs`);return{harnessTranscript:m({bridgeUrl:i.url,bridgeBearer:r,cwd:u,privateMcpSecrets:()=>[...a],redact:s.redact}),backend:`bridge`,bridgeUrl:i.url,bridgeBearer:r,cwd:u}})(),signal:n})}catch(t){throw t instanceof Error&&Object.assign(t,{runId:e.errorRunId??r}),t}finally{try{await i?.close()}finally{s.close(),a.clear()}}},e.fix??`tangle graph --help`)}function eu(e,t){return[`tangle graph run`,Me(e),...t.dryRun?[`--dry-run`]:[],...t.cloud?[`--cloud`]:[],...t.deploy?[`--deploy`,Me(t.deploy)]:[],...t.workflow?[`--workflow`,Me(t.workflow)]:[],...t.resume?[`--resume`,Me(t.resume)]:[],...t.seat?[`--seat`,Me(t.seat)]:[],...t.seatAccount?[`--seat-account`,Me(t.seatAccount)]:[],...t.seatCommand?[`--seat-command`,Me(t.seatCommand)]:[],...t.param.flatMap(e=>[`--param`,Me(e)])].join(` `)}async function tu(e,t,n={}){let r=n,i=eu(e,t);return await Cs(r.signal,async n=>{n.throwIfAborted();let a=As(t.mcpSecret);if(t.resume&&!t.resume.startsWith(`wfrun_`)&&(t.workflow||t.deploy)&&Y(`A local run cannot move to a cloud deployment`),t.deploy&&!t.cloud&&!t.workflow&&!t.resume?.startsWith(`wfrun_`))throw new B(`GRAPH_DEPLOY_INVALID`,`Deployment settings require cloud placement`,`Use --cloud to bind cloud triggers and settings`,`tangle graph run --help`);let o=await R(Ql(e,r.cwd??process.cwd())),s=r.source??await L(o,`utf8`),c=t.resume&&!t.resume.startsWith(`wfrun_`)?await cc(t.resume):void 0,l=r.taskWorkspace??(t.taskWorkspace?await tc(t.taskWorkspace):void 0)??c?.taskWorkspace;if(c&&(l?Zs(l):null)!==(c.taskWorkspace?Zs(c.taskWorkspace):null)&&Y(`The recorded task workspace snapshot changed`),l&&(t.cloud||t.workflow||t.resume?.startsWith(`wfrun_`)))throw Error(`Local private task workspace artifacts cannot be dispatched to a cloud backend`);let u=c?.runId??r.runId??be(),d=l&&!r.taskWorkspace?await rc(l,{runId:u,resumeCwd:c?.cwd,signal:n,validationOnly:t.dryRun===!0&&!c&&!r.runId}):void 0;d&&(r={...r,runId:u,cwd:d.cwd,taskWorkspace:l});try{if(!t.resume&&(t.cloud||t.workflow)||t.resume?.startsWith(`wfrun_`))return Gc(o,s,t,n);let e=await Bs(),l=Q(s),u=Object.entries(Pc(t.param,`param`)??{}),d=Object.fromEntries(u.filter(([e])=>!e.startsWith(`gate.`))),f=Object.fromEntries(u.filter(([e])=>e.startsWith(`gate.`)).map(([e,t])=>[e.slice(5),t])),p=Ye.parse(t.mcpPolicy??c?.mcpPolicy??{}),m=e.graphRegistry(M(I(),`.tangle`,`graph-registry`)),h;if(c){await R(c.cwd)!==c.cwd&&Y(`The recorded workspace identity changed`),c.file!==o&&Y(`The recorded graph source path changed`);let n=await e.loadGraph(m,c.graphDigest);n||Y(`The recorded executable graph is unavailable`),h=e.validateStoredGraph(n),fc(c,t,l,d,f)}let g={apiKey:t.apiKey,sandboxBaseUrl:t.baseUrl,signal:n,json:t.json,dryRun:t.dryRun&&!r.connectNeeds},_,v=()=>_??=Sl(g),y=new Map,b=(e,{account:t})=>{let n=e.trim().toLowerCase(),r=JSON.stringify([n,t?.toLowerCase()]),i=y.get(r)??(async()=>{let e=await v(),r=e&&await wl(e,n,g,t);return r?{connectionId:r,capabilities:[`*`]}:void 0})();return y.set(r,i),i},x=async i=>{if(n.throwIfAborted(),c&&h)return ws(h,c.gateChoices??{}),{graph:h,params:c.params};let a=await e.loadGraphFile(o,{source:s,seat:t.seat??(r.defaultSeat===void 0?rn().seat:r.defaultSeat??void 0),resolveSeat:hc(i,n),resolveNeed:b,params:d,...r.trigger?{trigger:r.trigger}:{},cwd:i,signal:n});if(n.throwIfAborted(),ws(a.graph,f),r.graphDigest&&a.graph.digest!==r.graphDigest)throw new B(`GRAPH_CHANGED`,`The validated graph changed before execution`,`Its compiled graph digest no longer matches validation`,`tangle graph run --help`);return a},S=r.cwd??process.cwd(),C=await x(c?.cwd??S),w=Xe(p,!0),T=[];for(let e of C.graph.nodes){let t=Ae(e.profile,w);if(!t.ok)throw new B(`GRAPH_MCP_POLICY_REQUIRED`,`A graph profile exceeds its host policy`,`${e.id}: ${t.issues.filter(e=>e.level===`error`).map(e=>`${e.code}: ${e.message}`).join(`; `)}`,`tangle graph run --mcp-policy <policy.json> --help`);for(let t of Object.values(e.profile.mcp??{}))t.enabled!==!1&&t.url&&T.push(new URL(t.url).hostname)}let ee=[vc(C.graph),...T].filter(Boolean).join(`,`)||void 0;if(t.dryRun)return C;let E=yc(C.graph.nodes)?xc(t):void 0,D=c?.runId??r.runId??be(),O=c?.cwd??(r.taskWorkspace?S:await e.graphWorkspace(C.graph,{cwd:S,runId:D}));return await $l({...r,runId:D,cwd:O,signal:n,fix:i,relayAllow:ee,mcpSecretEnv:a},i=>nu(i,{kernel:e,registry:m,loaded:C,gateChoices:f,file:o,source:s,sourceDigest:l,context:r,options:t,prior:c,mcpPolicy:p,getHub:v,seatSource:E,signal:n}))}finally{await d?.release()}},i)}async function nu({runId:e,runDir:t,cwd:n,bridge:r},{kernel:i,registry:a,loaded:o,gateChoices:s,file:c,source:u,sourceDigest:d,context:f,options:p,prior:m,mcpPolicy:h,getHub:g,seatSource:_,signal:v}){let{superviseGraphPursuit:y,readSettleRecord:b}=await import(`@tangle-network/agent-runtime/durable`),x=await i.recordStoredGraphRun(a,o.graph),S=m??{version:1,runId:e,cwd:n,file:c,graphDigest:x.digest,sourceDigest:d,source:u,params:o.params,...f.trigger?{trigger:f.trigger}:{},...Object.keys(s).length?{gateChoices:s}:{},startedAt:new Date().toISOString(),...p.seat===void 0?{}:{seat:p.seat},mcpPolicy:h,...f.taskWorkspace&&{taskWorkspace:f.taskWorkspace}};m||await lc(t,S);let C=m?await b(t):void 0;if(C&&C.tree.root!==e&&Y(`The settlement names another run`),C?.kind===`no-winner`&&Y(`The local run is terminal: ${C.reason}`),C)return{runId:e,graphDigest:x.digest,sourceDigest:d,...Rs(C),replayed:!0};let w=i.graphFromStored(x,{trigger:S.trigger}),T=x.nodes.some(e=>e.profile.connections?.length),ee=T?await g():void 0;if(T&&!ee)throw new B(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured for this local graph`,`tangle auth login`);let E=await r(ee),D=i.createPrivateCasArtifactPort(M(t,`artifacts`),e),O=await Ds(o.params.knowledge,t,D,v),k=_?Cc(E,_,v):void 0,A=S.startedAt;l(`Run ${e} · ${le(c)} · ${n}`);let te=await ru(t);l(`Viewer ${te.url}`);let ne=new AbortController,re=await y(w,{pursuitId:x.digest,runDir:t,runId:e,backend:E,checkArtifacts:D,...O?{resolveSupervisorTools:O}:{},...w.entry===void 0?{driverBackend:E}:{},...x.gates?.length?{decideGate:Ts(S.gateChoices??{},{json:p.json,signal:AbortSignal.any([v,ne.signal])})}:{},resume:!!m,signal:v,...S.trigger?{trigger:S.trigger}:{},...k?{selectSeat:k,coordination:{authentication:!0}}:{},profileSecurity:Xe(S.mcpPolicy,T)}).finally(async()=>{ne.abort(),await te.close()}),ie={runId:e,graphDigest:x.digest,sourceDigest:d,...Rs(re.result.result)},ae=re.result.result,{tokens:oe,tokensKnown:se,iterations:j,ms:ce}=ae.spentTotal;if(await i.recordStoredGraphRun(a,x,{graphDigest:x.digest,evidence:[{kind:`authored-graph`,url:`urn:sha256:${x.digest}`},{kind:`authored-yaml`,url:`urn:sha256:${d}`}],taskDigest:i.taskShapeDigest({graph:le(c),params:o.params,trigger:S.trigger??null,taskWorkspace:S.taskWorkspace?Zs(S.taskWorkspace):null}),startedAt:A,finishedAt:new Date().toISOString(),outcome:ae.kind===`no-winner`?{kind:`no-winner`,reason:ae.reason}:{kind:`delivered`,summary:ie.text},cost:{iterations:j,ms:ce,...se===!1?{}:{tokens:oe.input+oe.output},...ie.costUsd===null?{}:{usd:ie.costUsd}},traversals:re.result.ledger.length,exhaustedEdges:re.result.exhaustedEdges,source:{kind:`tangle-cli-graph`,id:e}}),ae.kind===`no-winner`)throw Object.assign(new B(`GRAPH_RUN_FAILED`,`Graph '${le(c)}' finished without a result`,re.result.stopped?.reason||re.result.ledger.filter(e=>e.outcome===`unpropagated`&&e.reason).pop()?.reason||ae.reason,`tangle graph inspect ${e}`),{runId:e,runtimeFailures:[...ae.tree.nodes.filter(e=>e.failure).map(e=>({node:e.label,failure:e.failure})),...ae.reason===`driver-failed`&&ae.error.failure?[{node:`root`,failure:ae.error.failure}]:[]]});return ie}async function ru(e){let{serveTopWeb:t}=await import(`@tangle-network/agent-runtime/tui`),{readGraphSessions:n}=await import(`./graph-native-CmG9wDbX.mjs`);return t({roots:[e],assets:M(Zl,`dist`,`graph-viewer`),readSessions:n})}async function iu(t,n){if(n.artifacts||n.artifact)return jc(t,n);if(t.startsWith(`wfrun_`)){let r=await X(n),i=await r.workflows.getRun(t);if(n.json)return e(i);for(let e of i.runtime?.checks??[])l(`${e.node} ${e.status} · exit ${e.exitCode??`none`} · pass ${e.pass??`none`}\n${e.reason??e.tail}`);return l(`Run ${t} · ${r.baseUrl}/app/workflows/${encodeURIComponent(i.workflowId)}/runs/${encodeURIComponent(t)}`)}let r=M(I(),`.tangle`,`runs`,t);if(!/^[a-f0-9-]{36}$/i.test(t)||!Ie(r))throw new B(`RUN_NOT_FOUND`,`Run '${t}' was not found`,`Use a run ID printed by tangle graph run`,`tangle graph inspect --help`);let{loadTopSnapshot:i}=await import(`@tangle-network/agent-runtime/tui`);if(n.json)return e(await i(process.cwd(),{runDir:r}));l(`Run ${t} · ${(await ru(r)).url}`)}function au(){let t=new N(`graph`).description(`Build and run portable agent graphs`);return _l(t),ic(t),Wc(t,Ql),qc(t,Ql),Ac(t),ll(t),xl(t,Ql,Zl),t.command(`inspect <run>`).description(`Inspect a live or retained graph run`).option(`--artifacts`,`List complete retained check files and capture gaps`).option(`--artifact <node/path>`,`Download one retained check file by node/path or digest`).option(`--out <file>`,`Save artifact bytes to a new private file`).action(iu),t.command(`run <name-or-file>`).description(`Run a saved graph over native subscriptions`).option(`--cloud`,`Run through Tangle's durable cloud workflow owner`).option(`--deploy <file>`,`Cloud deployment settings, including triggers and parameter defaults`).option(`--workflow <id>`,`Run this existing cloud deployment at its exact source and revision`).option(`--resume <run>`,`Resume this run's saved graph and durable execution`).option(`--seat <seat>`,`Use harness/model@effort for every node`).addOption(ks()).option(`--mcp-policy <file>`,`Host-owned JSON policy: allowLocalMcp and allowedMcpHosts; captured for resume`).option(`--seat-account <account>`,`Account id for an all-eligible authored seat`).option(`--seat-command <program>`,`Executable that prints the account id; the harness is its first argument`).option(`--seat-credential <credential>`,`Credential name passed to the seat command after the harness`).option(`--param <key=value>`,`Graph parameter or gate.<id>=<choice>; repeatable`,(e,t)=>[...t,e],[]).option(`--task-workspace <file>`,`Seed a private run copy from an exact local workspace capture`).option(`--dry-run`,`Validate and print the graph without starting agents`).action(async(t,n)=>{let r={...n,mcpPolicy:n.mcpPolicy===void 0?void 0:await js(n.mcpPolicy)},i=await tu(t,r);r.json||r.dryRun?e(i):`status`in i?(l(`${i.status} · ${i.runId}`),i.text&&console.log(i.text)):`viewerUrl`in i&&l(`Run ${i.runId} · ${i.viewerUrl}`)}),t}function ou(){let n=new N(`intelligence`).description(`Create and inspect trace intelligence reports`);return n.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--endpoint <url>`,`OTLP endpoint base`,xi).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).action(async(t,n)=>{let r=t??`local`;Ei(r);let i=cu(n.apiKey),a=await ji({selection:r,workspace:n.workspace,apiKey:i,endpoint:n.endpoint,serviceName:n.serviceName??Oi(n.workspace),environment:n.environment,smoke:n.smoke,dryRun:!!n.dryRun,hookCommand:n.hookCommand}),o={configPath:a.configPath,agents:a.agents,nativeAgents:a.nativeAgents,manual:a.manual,written:a.written,smokeTraceId:a.smokeTraceId};if(n.json){e(o);return}s({Config:a.configPath,Agents:a.agents.join(`, `),"Native Hooks":a.nativeAgents.join(`, `)||void 0,"Manual Setup":a.manual.length?a.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:a.written.join(`, `),"Smoke Trace":a.smokeTraceId})}),n.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--endpoint <url>`,`OTLP endpoint base`,xi).action(async t=>{let n=Ai(),r=await Ii({endpoint:t.endpoint===`https://intelligence.tangle.tools/v1/otlp`?n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:t.endpoint,apiKey:cu(t.apiKey??n?.apiKey)});t.json?e(r):su(r),r.contentSeen||(process.exitCode=1)}),n.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).action(async t=>{try{let n=lu(t.agent),r=Ai(),i={agent:n,event:t.event,endpoint:t.endpoint??r?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:cu(t.apiKey??r?.apiKey),serviceName:t.serviceName??r?.serviceName??Oi(process.cwd()),environment:t.environment??r?.environment??`local`,sessionId:t.sessionId,payload:t.payload===void 0?await du():uu(t.payload)};if(t.dryRun){let r=Ni(i);if(t.json){e(r);return}s({Trace:r.traceId,Agent:n,Event:t.event});return}let a=await Pi(i);if(t.json){e({traceId:a});return}s({Trace:a,Agent:n,Event:t.event})}catch(n){if(t.nonBlocking){let r=n instanceof Error?n.message:String(n);t.json?e({ok:!1,error:r}):console.error(`Tangle Intelligence hook skipped: ${r}`);return}H(n)}}),n.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await fu({type:`sandbox`,id:e},t)}),n.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await fu({type:`fleet`,id:e},t)}),n.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async e=>{await fu({type:mu(e.subjectType),id:e.subjectId},e)}),n.command(`get <job-id>`).description(`Get an intelligence report`).action(async(t,n)=>{let{client:r}=G(n),i=n.json?null:f(`Fetching intelligence report...`);i?.start();let a=await r.intelligence.getReport(t);if(i?.stop(),n.json){e(a);return}pu(a)}),n.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).action(async n=>{let{client:r}=G(n),i=n.json?null:f(`Fetching intelligence reports...`);i?.start();let a=await r.intelligence.listReports({subjectType:n.subjectType===void 0?void 0:mu(n.subjectType),subjectId:n.subjectId,limit:n.limit===void 0?void 0:_u(n.limit)});if(i?.stop(),n.json){e(a);return}t(a.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}),n}function su(e){s({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let n=Object.entries(e.byAgent);n.length>0&&(console.log(),t(n.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function cu(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function lu(e){if(Di(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function uu(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function du(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function fu(t,n){let r=hu(n.mode),i=vu(n.metadata),a=n.maxUsd===void 0?void 0:gu(n.maxUsd);if(r===`agentic`&&a===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let{client:o}=G(n),s=n.json?null:f(`Creating intelligence report...`);s?.start();let c=await o.intelligence.createReport({subject:t,mode:r,...a===void 0?{}:{budget:{billTo:`customer`,maxUsd:a}},...i===void 0?{}:{metadata:i}});if(s?.stop(),n.json){e(c);return}pu(c)}function pu(t){s({Job:t.jobId,Subject:`${t.subject.type}:${t.subject.id}`,Mode:t.mode,Status:t.status,"Billed To":t.billing.billedTo,Cost:`$${t.billing.costUsd.toFixed(2)}`,Budget:t.billing.budgetMaxUsd===void 0?void 0:`$${t.billing.budgetMaxUsd.toFixed(2)}`,Updated:t.updatedAt}),t.result!==null&&(console.log(),e(t.result))}function mu(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function hu(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function gu(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function _u(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function vu(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const yu=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];async function bu(e,t){let n=await Zn({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.platformUrl===void 0?{}:{baseUrl:e.platformUrl},...e.baseUrl===void 0?{}:{sandboxBaseUrl:e.baseUrl}});if(!t||!n.minted)return n;throw Error("This command needs a key you minted yourself. A browser login is exchanged for a short-lived key the platform will not accept for key management. Set TANGLE_API_KEY, run `tangle auth login --api-key sk-tan-…`, or mint the key in the web console. `tangle keys list` works from the login alone.")}async function xu(e,t,n={}){let r=new Headers(n.headers);n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await Qn(e,t,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected)throw Error(await Su(i,t));return i}async function Su(e,t){let n=await e.text().catch(()=>``),r;try{let e=JSON.parse(n),t=typeof e?.error==`string`?e.error:e?.error?.message;typeof t==`string`&&t.trim()&&(r=t)}catch{}if(r)return`${r} (HTTP ${e.status})`;let i=n?`: ${n.slice(0,400)}`:``;return`Platform request to ${t} returned ${e.status}${i}`}const Cu=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function wu(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function Tu(){let t=new N(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return t.command(`list`).description(`List your active API keys`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async t=>{let n=await bu(t,!1),r=n.baseUrl,a=await(await xu(n,`${r}/v1/keys`,{expected:200})).json();if(t.json){e(a);return}i(Cu,a.data.map(wu))}),t.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${yu.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(t,n)=>{if(n.product!==void 0&&!yu.includes(n.product))throw Error(`Invalid --product. Expected one of ${yu.join(`, `)}`);let i=await bu(n,!0),a=i.baseUrl,o=n.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(n.expiresInDays,10)*24*60*60*1e3).toISOString(),s=f(`Creating API key...`);s.start();let c=await xu(i,`${a}/v1/keys`,{method:`POST`,expected:201,body:JSON.stringify({name:t,product:n.product,budgetUsd:n.budgetUsd?Number.parseFloat(n.budgetUsd):void 0,rpmLimit:n.rpmLimit?Number.parseInt(n.rpmLimit,10):void 0,expiresAt:o})});s.stop();let u=await c.json();if(n.json){e(u);return}r(`API key created: ${u.data.prefix}…`),l(`Copy this key now — it will never be shown again:\n${u.data.key}`)}),t.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(t,n)=>{let i=await bu(n,!0),a=i.baseUrl;if(!n.yes&&!await pr(`Revoke key ${t}? Any service still using it will start to fail.`,`--yes`)){l(`Aborted.`);return}let o=await(await xu(i,`${a}/v1/keys/${encodeURIComponent(t)}`,{method:`DELETE`,expected:200})).json();if(n.json){e(o);return}r(`Revoked ${t}`)}),t}function Eu(e){if(cn().token)throw Error(`A line relay cannot manage numbers or attachments. Use your owner CLI outside the agent box.`);return W(U(e))}function Du(e){if(!e.yes)throw Error(`Review the selected line and use --yes to authorize this change. Attaching enables metered agent work.`)}function Ou(e){if(e===`imessage`||e===`whatsapp`||e===`email`||e===`sms`||e===`voice`||e===`telegram`)return e;throw Error(`--transport must be imessage, whatsapp, email, sms, voice, or telegram`)}function ku(e){return e().catch(H)}async function Au(e){let t=await mt(e,`r`);try{if(!(await t.stat()).isFile())throw Error(`Attachment input must be a regular JSON file`);let e=Buffer.alloc(131073),n=0;for(;n<e.length;){let{bytesRead:r}=await t.read(e,n,e.length-n,null);if(r===0)break;n+=r}if(n===e.length)throw Error(`Attachment JSON exceeds 128 KiB`);let r;try{r=JSON.parse(e.subarray(0,n).toString(`utf8`))}catch{throw Error(`Attachment file is not valid JSON`)}if(!r||typeof r!=`object`||Array.isArray(r))throw Error(`Attachment JSON must be an object`);if(Object.hasOwn(r,`number`))throw Error(`Use the line ID argument, not a number field in the attachment file`);return r}finally{await t.close()}}function ju(t){t.command(`providers`).description(`List provider transports supported by this Hub deployment`).action(t=>ku(async()=>{e(await Eu(t).lines.providers())})),t.command(`list`).description(`List owned lines, optionally for a saved agent profile or sandbox`).option(`--profile-id <id>`,`Stored profile ID`).option(`--sandbox <id>`,`Existing sandbox ID`).action(t=>ku(async()=>{e(await Eu(t).lines.list({profileId:t.profileId,sandboxId:t.sandbox}))})),t.command(`get`).argument(`<line-id>`).description(`Inspect a line and its current attachment`).action((t,n)=>ku(async()=>{e(await Eu(n).lines.get(t))})),t.command(`numbers`).argument(`<connection-id>`).description(`Discover owned provider numbers; this does not purchase or reserve a number`).option(`--transport <transport>`,`imessage, whatsapp, or sms`,`imessage`).action((t,n)=>ku(async()=>{let r=Ou(n.transport);if(r===`email`)throw Error(`Email uses an owned mailbox, not phone inventory`);if(r===`voice`)throw Error(`Voice numbers are listed by ph0ny; provide the owned number ID to lines connect`);if(r===`telegram`)throw Error(`Telegram uses an owned bot, not phone inventory`);e(await Eu(n).lines.numbers(t,r))})),t.command(`connect`).argument(`<connection-id>`).description(`Bind an owned number or identity through Hub; no provider rental is purchased`).option(`--transport <transport>`,`imessage, whatsapp, sms, email, voice, or telegram`,`imessage`).option(`--number-id <id>`,`Exact owned provider number ID; required for voice, SMS, WhatsApp and Linq iMessage`).option(`--address <email>`,`Owned mailbox on a verified email domain`).requiredOption(`--reference <reference>`,`Stable client reference; keep it unchanged on retry`).option(`--label <label>`,`Line display name`).option(`--yes`,`Authorize provider webhook configuration and line binding`).action((t,n)=>ku(async()=>{Du(n);let r=Ou(n.transport);if(r!==`email`&&n.address)throw Error(`--address is email-only`);if((r===`email`||r===`telegram`)&&n.numberId)throw Error(`${r} does not take --number-id`);let i={connectionId:t,label:n.label,clientReference:n.reference},a;if(r===`email`)a={...i,transport:r,address:n.address};else if(r===`telegram`)a={...i,transport:r};else if(r===`imessage`)a={...i,transport:r,phoneNumberId:n.numberId};else{if(!n.numberId)throw Error(`${r} requires --number-id`);a={...i,transport:r,phoneNumberId:n.numberId}}e(await Eu(n).lines.fromConnection(a))})),t.command(`attach`).argument(`<line-id>`).description(`Attach a saved agent to any sandbox, or use an isolated on-demand member instance`).option(`--file <path>`,`Reviewed native attachment JSON (exclusive with quick-setup flags)`).option(`--profile-id <id>`,`Owner-scoped saved profile; each turn pins its source revision`).option(`--member <address>`,`The one allowed sender: E.164 phone or email`).option(`--sandbox <id>`,`Use an existing sandbox instead of an on-demand instance`).option(`--instance-prefix <prefix>`,`Stable instance namespace; defaults to profile:<profile-id>:`).option(`--tools <mode>`,`chat denies tools; act applies the profile's tools and permissions`).option(`--turns-per-day <count>`,`Per-member daily turn ceiling (default 30)`).option(`--yes`,`Authorize agent execution and spend against your key limits`).action((t,n)=>ku(async()=>{Du(n);let r=Eu(n),i;if(n.file){if(n.profileId||n.member||n.sandbox||n.instancePrefix||n.tools||n.turnsPerDay)throw Error(`Choose --file or quick-setup flags, not both`);i=await Au(n.file)}else{if(!n.profileId||!n.member)throw Error(`Provide --profile-id and --member, or --file`);if(n.sandbox&&n.instancePrefix)throw Error(`Choose --sandbox or --instance-prefix`);let e=n.tools??`chat`,t=Number(n.turnsPerDay??`30`);if(e!==`chat`&&e!==`act`)throw Error(`--tools must be chat or act`);if(!Number.isSafeInteger(t)||t<1||t>1e4)throw Error(`--turns-per-day must be 1–10000`);if(e===`act`&&n.sandbox)throw Error(`Acting tools require an isolated on-demand instance; omit --sandbox`);i={mode:`personal`,members:[{address:n.member,role:`owner`}],unknownSenders:`reject`,roles:{owner:{context:`own`,tools:e}},respond:{kind:`agent`,profileId:n.profileId,...e===`act`?{rolePolicy:{version:1,roles:{owner:{kind:`general`}},members:{}}}:{}},limits:{turnsPerMemberPerDay:t},...n.sandbox?{sandboxId:n.sandbox}:{instance:{keyPrefix:n.instancePrefix??`profile:${n.profileId}:`,create:{ownerContext:`isolated`,...e===`act`?{egressPolicy:{mode:`strict`,allowDomains:[new URL(En()).hostname],includeImplicitDomains:!1}}:{}}}}}}if(typeof i.sandboxId==`string`==(i.instance!==void 0))throw Error(`Attachment requires exactly one of sandboxId and instance`);let{sandboxId:a,instance:o,...s}=i,c;if(a){let e=await r.get(a);if(!e)throw Error(`Sandbox not found`);c=await e.lines.attach({...s,number:t})}else{if(!o)throw Error(`Attachment requires an instance`);c=await r.lines.attach({...s,number:t,instance:o})}e(c)}));for(let n of[`detach`,`release`])t.command(n).argument(`<line-id>`).description(n===`detach`?`Stop dispatch; preserve history and provider rental`:`Retire a detached Hub line; does not cancel provider rental`).option(`--yes`,`Authorize this change`).action((t,r)=>ku(async()=>{Du(r),e({[n]:await Eu(r).lines[n](t)})}));t.command(`threads`).argument(`<line-id>`).description(`List this line's separate participant threads`).action((t,n)=>ku(async()=>{e(await Eu(n).lines.threads(t).list())})),t.command(`messages`).argument(`<line-id>`).argument(`<thread-id>`).description(`Read one authorized participant thread`).action((t,n,r)=>ku(async()=>{e(await Eu(r).lines.threads(t).messages(n))}))}async function Mu(e){let{token:t,baseUrl:n}=cn();if(t===void 0)return K(e);if(!t.startsWith(`lrc_`)||!n)throw Error(`The line box needs TANGLE_LINE_TOKEN and TANGLE_HUB_URL`);if(e.apiKey||e.baseUrl&&new URL(e.baseUrl).origin!==new URL(n).origin)throw Error(`A line token cannot be sent to another Hub or combined with an API key`);return new qe({baseUrl:n,authHeaders:()=>({Authorization:`Bearer ${t}`})})}async function Nu(e,t){if(t)return t;if(!cn().token)throw Error(`Provide --line <line-id>`);return(await e.lines.context()).line.id}function Pu(e){return e().catch(H)}function Fu(){return new N(`context`).description(`Show live line identity, members, consent, reminders and quotas`).action(t=>Pu(async()=>{e(await(await Mu(t)).lines.context())}))}function Iu(){let t=new N(`lines`).description(`Connect, manage, message and schedule on a Hub line`);return t.command(`members`).description(`List names, roles and consent on this line`).option(`--line <line-id>`,`Line ID; inferred in a line box`).action(t=>Pu(async()=>{let n=await Mu(t);e(await n.lines.members.list(await Nu(n,t.line)))})),t.command(`send`).description(`Send to a consenting member through Hub`).argument(`<to-member>`,`Exact member ID for an owner; name, ID, or self in a line box`).argument(`<text>`,`Message text`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--on-behalf-of <member>`,`Verified sender for a member relay`).option(`--not-before <iso-time>`,`Delay delivery until this ISO time`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((t,n,r)=>Pu(async()=>{let i=await Mu(r),a=await Nu(i,r.line);if(!cn().token){if(r.onBehalfOf)throw Error(`--on-behalf-of is only available inside a line box`);if(!r.idempotencyKey)throw Error(`Owner sends require --idempotency-key so a retry keeps the same message`);if(!(await i.lines.members.list(a)).some(e=>e.id===t))throw Error(`Owner sends require an exact member ID from tangle lines members`);e(await i.lines.send(a,{memberId:t,text:n,idempotencyKey:r.idempotencyKey,...r.notBefore?{notBefore:r.notBefore}:{}}));return}e(await i.lines.send(a,{toMember:t,text:n,...r.onBehalfOf?{onBehalfOf:r.onBehalfOf}:{},...r.notBefore?{notBefore:r.notBefore}:{},...r.idempotencyKey?{idempotencyKey:r.idempotencyKey}:{}}))})),t.command(`remind`).description(`Wake the agent at a future time to write your reminder`).argument(`<text>`,`What to remember`).requiredOption(`--at <iso-time>`,`Future ISO time`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((t,n)=>Pu(async()=>{if(!n.at)throw Error(`--at is required`);let r=await Mu(n),i=n.idempotencyKey??ve(`sha256`).update(JSON.stringify([t,n.at])).digest(`hex`).slice(0,32);e(await r.lines.remind(await Nu(r,n.line),{text:t,notBefore:n.at,idempotencyKey:i}))})),ju(t),t}function Lu(){let e=new N(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{let n=U({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await q(W(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await(await import(`@tangle-network/sandbox/agent`)).createMcpServer(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}),e}async function Ru(e,t){if(t.self&&e)throw Error(`Use --self or an explicit sandbox, not both`);if(!t.self&&!e)throw Error(`Specify a sandbox id/name or --self`);let n=Qt(),r=t.baseUrl||n.tangleBaseUrl||n.sandboxBaseUrl,i=n.hubUrl;if(t.self&&!r&&i&&new URL(i).origin!==`https://id.tangle.tools`)throw Error(`This deployment must set SANDBOX_BASE_URL or pass --base-url for self preview access`);let a=t.self?t.apiKey??vn():t.apiKey;if(t.self&&!a)throw Error(`Self preview access requires the injected sandbox runtime credential; it never reads saved owner credentials`);let o=U({apiKey:a,baseUrl:r}),s=W(o);return t.self?Ct(s):q(s,o,e)}async function zu(e,t,n){let r=f(e);t||r.start();try{return await n()}finally{r.stop()}}function Bu(e){return e}function Vu(){let t=new N(`preview`).description(`Manage sandbox preview links`);return Bu(t.command(`start`).description(`Start/reuse a managed development server and publish its ready preview`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).option(`--cwd <directory>`,`Project directory in the selected workspace`).option(`--session <session-id>`,`Select the agent's session workspace`).option(`--name <name>`,`App/service label`)).action(async(t,n)=>{let i=await Ru(t,n),a=await zu(`Starting managed preview...`,n.json,()=>xt(i,{cwd:n.cwd,sessionId:n.session,name:n.name}));n.json?e(a):(r(`Preview ready: ${a.url}`),console.log(`Preview ID: ${a.previewId}`))}),Bu(t.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`)).action(async(t,n)=>{let r=await Ru(t,n),a=await zu(`Fetching preview links...`,n.json,()=>r.previewLinks.list());n.json?e(a):a.length===0?console.log(`No preview links found`):i([`App`,`Preview ID`,`Port`,`URL`,`Status`],a.map(e=>[Hu(e.metadata),e.previewId.slice(0,12),String(e.port),e.url,e.status]))}),Bu(t.command(`publish`).description(`Publish one existing HTTP service; never starts or replaces a process`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).requiredOption(`--port <port>`,`Existing service port`).option(`--name <name>`,`App/service label`)).action(async(t,n)=>{if(!n.port||!/^\d+$/.test(n.port))throw Error(`An integer service port is required`);let i=await Ru(t,n),a=await zu(`Publishing service...`,n.json,()=>St(i,{port:Number(n.port),name:n.name}));n.json?e(a):r(`Preview ready: ${a.url}`)}),Bu(t.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`)).action(async(t,n,i)=>{if(!/^\d+$/.test(n)||Number(n)<1||Number(n)>65535)throw Error(`Port must be an integer between 1 and 65535`);let a=await Ru(t,i),o=await zu(`Creating preview for port ${n}...`,i.json,()=>a.previewLinks.create(Number(n)));i.json?e(o):(r(`Preview created: ${o.url}`),console.log(`Preview ID: ${o.previewId}`))}),Bu(t.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`)).action(async(t,n,i)=>{let a=await Ru(t,i);await zu(`Removing preview...`,i.json,()=>a.previewLinks.remove(n)),i.json?e({success:!0,previewId:n}):r(`Preview removed: ${n}`)}),t}function Hu(e){let t=e?.app;if(!t||typeof t!=`object`)return``;let n=`name`in t?t.name:void 0,r=`cwd`in t?t.cwd:void 0;return typeof n==`string`?n:typeof r==`string`?r:``}function Uu(){let t=new N(`process`).description(`Manage processes in a sandbox`);return t.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=yo(r.env??[],`--env`,`env`),s=f(`Spawning: ${n}`);r.json||s.start();let c=await q(a,i,t);if(c=await J(c),r.blocking){let t=await c.exec(n,{cwd:r.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:r.timeout?Number.parseInt(r.timeout,10):void 0});s.stop(),r.json?e(t):(t.stdout&&globalThis.process.stdout.write(t.stdout),t.stderr&&globalThis.process.stderr.write(t.stderr),t.exitCode!==0&&globalThis.process.exit(t.exitCode))}else{let i=await c.process.spawn(n,{cwd:r.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:r.timeout?Number.parseInt(r.timeout,10):void 0});s.stop(),r.json?e({pid:i.pid,command:i.command}):(console.log(`Process started with PID: ${i.pid}`),console.log(`Use 'tangle process logs ${t} ${i.pid}' to view output`))}}),t.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).action(async(t,n)=>{let{context:r,client:a}=G(n),o=f(`Fetching processes...`);n.json||o.start();let s=await q(a,r,t);s=await J(s);let c=await s.process.list();n.running&&(c=c.filter(e=>e.running)),o.stop(),n.json?e(c):c.length===0?console.log(`No processes found`):i([`PID`,`Command`,`Status`,`Exit Code`,`Started`],c.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}),t.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=f(`Fetching process info...`);r.json||o.start();let s=await q(a,i,t);s=await J(s);let c=await s.process.get(Number.parseInt(n,10));if(o.stop(),!c){console.error(`Process ${n} not found`),globalThis.process.exit(1);return}let l=await c.status();r.json?e(l):(console.log(`PID:        ${l.pid}`),console.log(`Command:    ${l.command}`),console.log(`CWD:        ${l.cwd||`(default)`}`),console.log(`Status:     ${l.running?`running`:`exited`}`),console.log(`Exit Code:  ${l.exitCode}`),l.exitSignal&&console.log(`Signal:     ${l.exitSignal}`),console.log(`Started:    ${l.startedAt.toLocaleString()}`),l.exitedAt&&console.log(`Exited:     ${l.exitedAt.toLocaleString()}`))}),t.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=f(`Sending ${r.signal} to PID ${n}...`);r.json||o.start();let s=await q(a,i,t);s=await J(s);let c=await s.process.get(Number.parseInt(n,10));if(!c){o.stop(),console.error(`Process ${n} not found`),globalThis.process.exit(1);return}r.tree?await c.kill(r.signal,{tree:!0}):await c.kill(r.signal),o.stop(),r.json?e({pid:Number.parseInt(n,10),signal:r.signal,...r.tree===!0?{tree:!0}:{},killed:!0}):console.log(r.tree?`Sent ${r.signal} to process tree ${n}`:`Sent ${r.signal} to process ${n}`)}),t.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).action(async(e,t,n)=>{let{context:r,client:i}=G(n),a=await q(i,r,e);a=await J(a);let o=await a.process.get(Number.parseInt(t,10));if(!o){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of o.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}),t}const Wu=[`python`,`node`,`typescript`,`bash`];function Gu(e){switch(de(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function Ku(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await L(he(e),`utf8`)}async function qu(e,t,n=Ku){let r=t?Wu.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${Wu.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=Gu(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function Ju(e){return M(Ue(),`tangle-run-images`,e)}function Yu(){return new N(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${Wu.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).action(async(t,n,r)=>{let{language:i,source:a}=await qu(n,r.lang),{context:o,client:s}=G(r),c=await q(s,o,t);c=await J(c);let l=f(`Running ${i} (${a.length}b)…`);r.json||l.start();let u=await c.runCode(i,a,{sessionId:r.session,timeoutMs:Number.parseInt(r.timeout,10)});if(l.stop(),r.json){e(u),u.exitCode!==0&&process.exit(u.exitCode);return}u.stdout&&process.stdout.write(u.stdout),u.stderr&&process.stderr.write(u.stderr);let d=0;for(let e of u.results)if(e.type===`image`)if(r.saveImages!==!1){let n=typeof r.saveImages==`string`?r.saveImages:Ju(t);Le(n,{recursive:!0});let i=`${n}/${Date.now()}-${d}.${e.format}`;Ve(i,Buffer.from(e.data,`base64`)),process.stderr.write(j.green(`✓ image → ${i}\n`)),d++}else process.stderr.write(j.gray(`[image: ${e.format}, ${e.data.length}b base64]\n`));else if(e.type===`dataframe`){let t=e.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(j.gray(`[dataframe ${e.rows.length}×${e.columns.length}${e.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${t}\n`);for(let t of e.rows.slice(0,20))process.stderr.write(`${t.map(e=>String(e)).join(` | `)}\n`);e.rows.length>20&&process.stderr.write(j.gray(`… ${e.rows.length-20} more rows\n`))}else e.type===`json`?(process.stderr.write(j.gray(`[json] `)),process.stderr.write(`${JSON.stringify(e.value,null,2)}\n`)):e.type===`html`?process.stderr.write(j.gray(`[html ${e.value.length}b]\n`)):e.type===`error`?(process.stderr.write(j.red(`✗ ${e.name}: ${e.message}\n`)),e.traceback&&process.stderr.write(`${e.traceback}\n`)):e.type===`text`&&process.stderr.write(`${e.value}\n`);u.error&&(process.stderr.write(j.red(`\n✗ ${u.error.name}: ${u.error.message}\n`)),u.error.traceback&&process.stderr.write(`${u.error.traceback}\n`)),u.exitCode!==0&&process.exit(u.exitCode)})}function Xu(t){t.command(`network <id-or-name>`).description(`Show runtime network state (exposed ports) for a sandbox. Outbound policy is the sandbox's egress policy.`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Updating network configuration...`);a.start();let o=await q(i,r,t);a.stop();let s=await o.network.getConfig();n.json?e(s):(l(`Network Configuration:`),s.ports&&s.ports.length>0?l(`  Exposed Ports: ${s.ports.join(`, `)}`):l(`  No exposed ports`))}),t.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=Number.parseInt(n.port,10);if(Number.isNaN(o)||o<1||o>65535)throw Error(`Port must be a number between 1 and 65535`);let s=f(`Exposing port ${o}...`);s.start();let c=await(await q(a,i,t)).network.exposePort(o);s.stop(),n.json?e({port:o,url:c}):(r(`Port ${o} exposed.`),l(`  URL: ${c}`))}),t.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching exposed URLs...`);a.start();let o=await(await q(i,r,t)).network.listUrls();if(a.stop(),n.json)e(o);else{let e=Object.entries(o);if(e.length===0)l(`No ports exposed.`);else{l(`Exposed Ports:`);for(let[t,n]of e)l(`  ${t}: ${n}`)}}})}function Zu(){let e=new N(`sandbox`).description(`Manage sandboxes`);return $o(e),Qo(e),Ho(e),Xu(e),e}function Qu(){return new N(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).action(async(e,t,n)=>{let{context:r,client:i}=G(n),a=f(`Searching...`);n.json||a.start();let o=await q(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)})}function $u(){let t=new N(`secret`).description(`Manage secrets`);return t.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).action(async(t,n,i)=>{let a=await G(i).client.secrets.create(t,await ed({value:n,valueStdin:i.valueStdin,prompt:`Enter value for secret '${t}': `}));i.json?e(a):(r(`Secret created: ${a.name}`),l(`Use --secret ${a.name} when creating a sandbox to select it for delivery.`))}),t.command(`list`).description(`List all secrets`).action(async t=>{let n=await G(t).client.secrets.list();t.json?e(n):n.length===0?(l(`No secrets found.`),l(`Use 'tangle secret create <name> [value]' to create one.`)):i([`Name`,`Created At`,`Updated At`],n.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}),t.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let i=G(n).client;if(!n.force&&!await pr(`Are you sure you want to delete secret '${t}'? This cannot be undone. (y/N) `,`--force`)){l(`Cancelled.`);return}await i.secrets.delete(t),n.json?e({success:!0,deleted:t}):r(`Secret deleted: ${t}`)}),t}async function ed(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);let t=e.value??(e.valueStdin?await hr():await fr(e.prompt));if(!t.length)throw Error(e.valueStdin?`Secret value from stdin cannot be empty`:`Secret value cannot be empty`);return t}function td(){let e=new N(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=ce.dirname(yt(import.meta.url)),t=ce.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function nd(){let n=new N(`snapshot`).description(`Manage snapshots`);return n.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--no-wait`,`Return once the snapshot is accepted and print the operation to poll`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=f(`Creating snapshot...`);o.start();let s=await q(a,i,t);if(n.wait===!1){let e=await s.snapshot({tags:n.tags,wait:!1});o.stop(),Uo(e.info,!!n.json);return}let c=await s.snapshot({tags:n.tags});o.stop(),n.json?e(c):(r(`Snapshot created: ${c.snapshotId}`),console.log(`Size: ${rd(c.sizeBytes??0)}`))}),n.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).action(async(n,r)=>{let{context:i,client:a}=G(r),o=f(`Fetching snapshots...`);o.start();let s=await(await q(a,i,n)).listSnapshots();o.stop(),r.json?e(s):t(s.map(e=>({...e,size:rd(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}),n.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--billing-owner <userId>`,`Platform user that pays for the restored sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).action(async(t,n,i)=>{let{client:a}=G(i),o=f(`Restoring from snapshot...`);o.start();let s=await a.create({fromSnapshot:n,fromSandboxId:t,...i.billingOwner?{billingOwnerId:i.billingOwner}:{}});await s.waitFor(`running`,{timeoutMs:12e4}),o.stop(),i.json?e({sandboxId:s.id,restoredFrom:n,status:s.status}):(r(`New sandbox created: ${s.id}`),console.log(`Source snapshot: ${n}`))}),n.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).action(async(t,n,i)=>{let{context:a,client:o}=G(i),s=f(`Reverting sandbox to snapshot...`);s.start();let c=await q(o,a,t),l=await c.revertToSnapshot(n);await c.refresh(),s.stop(),i.json?e({sandboxId:c.id,snapshotId:l.snapshotId,status:c.status}):(r(`Sandbox reverted: ${c.id}`),console.log(`Source snapshot: ${l.snapshotId}`))}),n.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).action(async(t,n,i)=>{let{context:a,client:o}=G(i),s=f(`Deleting snapshot...`);s.start();let c=await(await q(o,a,t)).deleteSnapshot(n);s.stop(),i.json?e({success:!0,sandboxId:t,snapshotId:n,outcome:c.outcome}):c.outcome===`already_absent`?r(`Snapshot already gone: ${n}`):r(`Snapshot deleted: ${n}`)}),n}function rd(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}const id=()=>import(`./device-i0PzYisd.mjs`);function ad(){let e=new N(`solve`).description(`Participate in Tangle Solve competitions`);e.command(`clone <competition>`).description(`Clone the pinned competition repository`).argument(`[directory]`,`Destination directory`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(async(e,t,n)=>(await import(`./clone-CWY8dI5d.mjs`)).cloneCompetition(e,t,n)),e.command(`run [competition]`).description(`Run the competition checker and record its evidence`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).action(async(e,t)=>(await import(`./run-BSXC2ytE.mjs`)).runCompetition(e,t)),e.command(`submit [competition]`).description(`Submit checker evidence through the device account and Tempo`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).option(`--pr-url <url>`,`GitHub pull request containing the submission`).option(`--model <name>`,`Model used to produce the submission`).option(`--note <text>`,`Short note shown with the accepted submission`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(async(e,t)=>(await import(`./submit-D2jvFJtX.mjs`)).submitCompetition(e,t)),e.command(`account`).description(`Show the local Solve signing account`).option(`--create`,`Create the account if it does not exist`).action(async e=>(await import(`./account-BaGFNxyq.mjs`)).showSolveAccount(e));let t=e.command(`device`).description(`List and revoke the Solve devices bound to your account`);return t.command(`list`).description(`List your devices and whether each may submit jobs on Tempo`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(async e=>(await id()).listSolveDevices(e)),t.command(`revoke <address>`).description(`Permanently revoke a device; the local device is revoked with its own key`).option(`--reason <text>`,`Why the device is revoked (shown to the account)`).option(`--yes`,`Confirm the permanent revocation without a prompt`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(async(e,t)=>(await id()).revokeSolveDevice(e,t)),e}function od(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sandboxes/${t}/runtime/ssh`}function sd(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function cd(e){return`'${e.replace(/'/g,`''`)}'`}function ld(e){return e===`win32`?`NUL`:`/dev/null`}function ud(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${cd(`<token>`)}; ssh ${e.map(cd).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${sd(`<token>`)} ssh ${e.map(sd).join(` `)}`}function dd(e){return e.connection!==void 0&&!e.connection.ssh}function fd(){d(`SSH is not enabled for this sandbox.`),l(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function pd(e,t=[],n=process.platform){let r=ld(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function md(){return new N(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).allowUnknownOption(!0).action(async(e,t,n)=>{let{context:r,client:i}=G(n),a=f(`Getting SSH credentials...`);a.start();let o=await q(i,r,e);if(dd(o)){a.stop(),fd();return}o=await J(o);let s=await o.ssh();if(a.stop(),!s){fd();return}let c={...s,proxyCommand:od(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let u=pd(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(ud(u,process.platform));return}l(`Connecting via tunnel...`);let p=Ke(`ssh`,u,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});p.on(`error`,e=>{e.code===`ENOENT`&&(d(`SSH client not found. Please install OpenSSH.`),process.exit(1)),H(e)}),p.on(`exit`,e=>{process.exit(e??0)})})}function hd(){let t=new N(`ssh-keys`).description(`Manage SSH keys`);return t.command(`list`).description(`List SSH keys`).action(async t=>{let n=f(`Fetching SSH keys...`);try{n.start();let r=await W(U(t)).sshKeys.list();n.stop(),t.json?e({sshKeys:r}):r.length===0?l(`No SSH keys found.`):i([`Name`,`Type`,`Fingerprint`,`Created`],r.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){n.stop(),H(e)}}),t.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).action(async(t,n)=>{let i=f(`Adding SSH key...`);try{let a=Re(n.keyFile,`utf8`).trim();i.start();let o=await W(U(n)).sshKeys.create(t,a);i.stop(),n.json?e({sshKey:o}):r(`Added SSH key ${o.name} (${o.fingerprint})`)}catch(e){i.stop(),H(e)}}),t.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=f(`Deleting SSH key...`);try{n.start(),await W(U(t)).sshKeys.delete(e),n.stop(),r(`Deleted SSH key ${e}`)}catch(e){n.stop(),H(e)}}),t}function gd(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function _d(){return new N(`ssh-proxy`).description(`SSH proxy helper that pipes stdin/stdout to WebSocket`).argument(`<runtime-url>`,`Runtime WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||gd(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new URL(e.replace(/^http/,`ws`)),{default:r}=await import(`ws`),i=new r(n,{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),a;function o(){a&&=(clearInterval(a),void 0)}i.on(`open`,()=>{a=setInterval(()=>{i.readyState===r.OPEN&&i.ping()},15e3),a.unref?.(),process.stdin.on(`data`,e=>{i.readyState===r.OPEN&&i.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>i.close(1e3))}),i.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),i.on(`error`,e=>{o(),gd(`WebSocket error: ${e.message}`)}),i.on(`close`,e=>{o(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>i.close())})}function vd(){let n=new N(`team`).description(`Manage teams`);return $(n,`list`).description(`List teams for the current account`).action(async n=>{let r=U(n),i=W(r),a=n.json?null:f(`Fetching teams...`);a?.start();let o=await i.teams.list();if(a?.stop(),n.json){e({teams:o,activeTeamId:r.activeTeamId??null});return}t(o.map(e=>({active:e.id===r.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}),$(n,`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).action(async(t,n)=>{let i=U(n),a=W(i),o=n.json?null:f(`Creating team...`);o?.start();let s=await a.teams.create({name:t,orgId:n.orgId});if(n.switch&&qo(s,i.profile),o?.stop(),n.json){e({team:s,active:!!n.switch});return}r(`Team created: ${Wo(s)}`),n.switch&&r(`Active team set to ${s.name}`)}),$(n,`switch <team>`).description(`Set the active team for the current profile`).action(async(t,n)=>{let i=U(n),a=await Go(W(i),t);if(qo(a,i.profile),n.json){e({team:a,activeTeamId:a.id});return}r(`Active team set to ${Wo(a)}`)}),n.command(`current`).description(`Show the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(t=>{let n=kn(t.profile);if(t.json){e(n.activeTeamId?n:{activeTeamId:null});return}if(!n.activeTeamId){console.log(`No active team.`);return}s({ID:n.activeTeamId,Name:n.activeTeamName})}),n.command(`clear`).description(`Clear the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(t=>{if(Jo(t.profile),t.json){e({activeTeamId:null});return}r(`Active team cleared.`)}),$(n,`members [team]`).description(`List team members`).action(async(n,r)=>{let i=U(r),a=W(i),o=await Ko(a,n,i.profile),s=await a.teams.listMembers(o.id);if(r.json){e({team:o,members:s});return}t(s,[{key:`id`,header:`ID`,width:36},{key:`customerEmail`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}),$(n,`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile),c=yd(n.role),l=await a.teams.updateMember(o.id,t,{role:c});if(n.json){e({team:o,member:l});return}r(`Member updated: ${l.customerEmail}`),s({Team:o.name,Role:l.role,Status:l.status})}),$(n,`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile),c=yd(n.role),l=await a.teams.invite(o.id,{email:t,role:c,ttlHours:n.ttlHours?Number.parseInt(n.ttlHours,10):void 0});if(n.json){e({team:o,invitation:l});return}r(`Invitation created for ${l.email}`),s({Team:o.name,Role:l.role,Expires:l.expiresAt,"Invitation ID":l.id}),r(`Re-run with --json to retrieve the invitation token for sharing.`)}),$(n,`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,t,i.profile);if(!(!n.force&&!n.json&&!await pr(`Leave team '${o.name}'? (y/N) `,`--force`))){if(await a.teams.leave(o.id),i.activeTeamId===o.id&&Jo(i.profile),n.json){e({success:!0,teamId:o.id});return}r(`Left team: ${o.name}`)}}),$(n,`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).action(async(t,n,i)=>{let a=U(i),o=W(a),s=await Ko(o,n,a.profile);if(!(!i.force&&!i.json&&!await pr(`Transfer ownership of '${s.name}' to ${t}? This cannot be undone without the new owner's cooperation. (y/N) `,`--force`))){if(await o.teams.transferOwnership(s.id,t),i.json){e({success:!0,teamId:s.id,newOwnerCustomerId:t});return}r(`Ownership transferred for ${s.name}`)}}),n.addCommand(bd()),n.addCommand(xd()),$(n,`invitations [team]`).description(`List pending and historical team invitations`).action(async(n,r)=>{let i=U(r),a=W(i),o=await Ko(a,n,i.profile),s=await a.teams.listInvitations(o.id);if(r.json){e({team:o,invitations:s});return}t(s,[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}),$(n,`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).action(async(t,n)=>{let i=U(n),a=W(i),o=await a.teams.acceptInvitation(t),s=n.switch===!1?null:await a.teams.get(o.teamId);if(s&&qo(s,i.profile),n.json){e({member:o,activeTeamId:s?.id??null});return}r(`Invitation accepted for team ${o.teamId}`),s&&r(`Active team set to ${s.name}`)}),$(n,`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).action(async(t,n)=>{if(await W(U(n)).teams.revokeInvitation(t),n.json){e({success:!0,invitationId:t});return}r(`Invitation revoked: ${t}`)}),$(n,`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile);if(await a.teams.removeMember(o.id,t),n.json){e({success:!0,teamId:o.id,memberId:t});return}r(`Member removed: ${t}`)}),n}function yd(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function bd(){let n=new N(`secret`).description(`Manage team secrets`);return $(n,`list [team]`).description(`List team secret names`).action(async(n,r)=>{let i=U(r),a=W(i),o=await Ko(a,n,i.profile),s=await a.teams.listSecrets(o.id);if(r.json){e({team:o,secrets:s});return}t(s,[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}),$(n,`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).action(async(t,n,i)=>{let a=U(i),o=W(a),s=await Ko(o,i.team,a.profile),c=await ed({value:n,valueStdin:i.valueStdin,prompt:`Enter value for team secret '${t}': `}),l=await o.teams.upsertSecret(s.id,t,c);if(i.json){e({team:s,secret:l});return}r(`Team secret saved: ${l.name}`)}),$(n,`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile);if(!(!n.force&&!n.json&&!await pr(`Delete team secret '${t}' from '${o.name}'? (y/N) `,`--force`))){if(await a.teams.deleteSecret(o.id,t),n.json){e({success:!0,teamId:o.id,name:t});return}r(`Team secret deleted: ${t}`)}}),$(n,`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(t,n)=>{let r=U(n),i=W(r),a=await Ko(i,n.team,r.profile),o=await i.teams.revealSecret(a.id,t);if(n.json){e({teamId:a.id,...o});return}console.log(o.value)}),n}function xd(){let n=new N(`templates`).description(`Manage team golden-path templates`);return $(n,`list [team]`).description(`List a team's golden-path templates`).action(async(n,r)=>{let i=U(r),a=W(i),o=await Ko(a,n,i.profile),s=await a.teams.listTemplates(o.id);if(r.json){e({team:o,templates:s});return}if(s.length===0){console.log(`No templates yet for ${o.name}.`);return}t(s.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}),$(n,`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).action(async(t,n,i)=>{let a=U(i),o=W(a),s=await Ko(o,i.team,a.profile),c;if(i.config)try{let e=JSON.parse(i.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);c=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let l=await o.teams.createTemplate(s.id,{name:t,snapshotId:n,description:i.description,environment:i.environment,config:c});if(i.json){e({team:s,template:l});return}r(`Team template created: ${l.name} (${l.id})`)}),$(n,`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile);if(!(!n.force&&!n.json&&!await pr(`Delete template '${t}' from '${o.name}'? (y/N) `,`--force`))){if(await a.teams.deleteTemplate(o.id,t),n.json){e({success:!0,teamId:o.id,templateId:t});return}r(`Team template deleted: ${t}`)}}),n}function $(e,t){return e.command(t).option(`--profile <profile>`,`Credential profile`)}async function Sd(t,n,i){let a=new AbortController,o=()=>a.abort();try{let i=W(U({...t,timeout:void 0}));process.once(`SIGINT`,o),process.once(`SIGTERM`,o);let s=await n(i,{...t.timeout===void 0?{}:{timeoutMs:Number(t.timeout)*1e3},resumeJobId:t.resumeJob,signal:a.signal,onProgress:e=>{process.stderr.write(`Publication ${e.id}: ${e.status}\n`)}}).finally(()=>{process.off(`SIGINT`,o),process.off(`SIGTERM`,o)});t.json?e(s):r(`template`in s?`Published template: ${s.template.slug}`:`Published template version: ${s.version.id}`)}catch(e){if(e instanceof w&&e.status!==401&&e.job&&[`pending`,`scanning`,`ready`].includes(e.job.status)){let t=[`tangle`,`template`,...i,`--resume-job`,e.job.id].map(Me).join(` `);Object.assign(e,{fix:{command:t}})}H(e,t.json)}}function Cd(){let n=new N(`template`).description(`Manage published public templates`);return n.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).action(async n=>{let r=W(U(n)),i=n.featured?await r.publicTemplates.featured():await r.publicTemplates.list({query:n.query,tag:n.tag});if(n.json){e({templates:i});return}t(i,[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forkCount`,header:`Forks`,width:8},{key:`sandboxCount`,header:`Sandboxes`,width:12},{key:`updatedAt`,header:`Updated`,width:24}])}),n.command(`get <id-or-slug>`).action(async(t,n)=>{let r=await W(U(n)).publicTemplates.get(t);if(n.json){e({template:r});return}e(r)}),n.command(`versions <id-or-slug>`).action(async(n,r)=>{let i=await W(U(r)).publicTemplates.versions(n);if(r.json){e({versions:i});return}t(i.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`createdAt`,header:`Created`,width:24}])}),n.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).action((e,t,n,r)=>Sd(r,async(i,a)=>({template:await i.publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom},a)}),[`publish`,e,t,n])),n.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).action((e,t,n,r)=>Sd(r,async(i,a)=>({version:await i.publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes},a)}),[`publish-version`,e,t,n])),n}function wd(){let t=new N(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return t.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).action(async t=>{try{let n={from:t.from,to:t.to,model:t.model,runId:t.run,status:t.status===void 0?void 0:Fd(t.status),q:t.query,cursor:t.cursor,limit:t.limit===void 0?void 0:Bd(t.limit)},r=Ed(t),i=t.json?null:f(`Fetching traces...`);i?.start();let a=await r.listTraces(n);if(i?.stop(),t.json)return e(a);kd(a.items),Nd(a.nextCursor)}catch(e){Od(e,t)}}),t.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).action(async(t,n)=>{try{let r=Ed(n);if(n.ndjson){await Dd(r,t);return}let i=n.json?null:f(`Fetching trace spans...`);i?.start();let a=await r.getTraceSpans(t,{cursor:n.cursor,limit:n.limit===void 0?void 0:Bd(n.limit)});if(i?.stop(),!n.cursor&&a.items.length===0)throw new B(`TRACE_NOT_FOUND`,`No spans for trace ${t}`,`A turn's spans arrive about a minute after it ends, and a key reads only its own account's traces`,`tangle traces list --limit 5`);if(n.json)return e(a);Ad(a.items),a.truncated&&s({Spans:`${a.items.length} of ${a.total} (truncated)`}),Nd(a.nextCursor)}catch(e){Od(e,n)}}),t.addCommand(Td()),t}function Td(){let t=new N(`runs`).description(`Read eval-runs pivoted off the trace surface`);return t.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).action(async t=>{try{let n={status:t.status===void 0?void 0:Ld(t.status),gate:t.gate===void 0?void 0:zd(t.gate),label:t.label,from:t.from,to:t.to,q:t.query,cursor:t.cursor,limit:t.limit===void 0?void 0:Bd(t.limit)},r=Ed(t),i=t.json?null:f(`Fetching runs...`);i?.start();let a=await r.listRuns(n);if(i?.stop(),t.json)return e(a);jd(a.items),Nd(a.nextCursor)}catch(e){Od(e,t)}}),t.command(`get <runId>`).description(`Show a single eval-run`).action(async(t,n)=>{try{let r=Ed(n),i=n.json?null:f(`Fetching run...`);i?.start();let a=await r.getRun(t);if(i?.stop(),n.json)return e(a);Md(a)}catch(e){Od(e,n)}}),t}function Ed(e){let t=yn(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return wt({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function Dd(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function Od(e,t){return H(e,t.json===!0)}function kd(e){t(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:Pd(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function Ad(e){t(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function jd(e){t(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function Md(e){s({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function Nd(e){e&&s({"Next page":`--cursor ${e}`})}function Pd(e){return e===null?`-`:`$${e.toFixed(4)}`}function Fd(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const Id=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function Ld(e){let t=Id.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${Id.join(`, `)}`)}const Rd=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function zd(e){let t=Rd.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${Rd.join(`, `)}`)}function Bd(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}const Vd=`@tangle-network/sandbox-cli`,Hd=`curl -fsSL https://sandbox.tangle.tools/install.sh | sh`,Ud=/^\d+\.\d+\.\d+$/;function Wd(e){let t=M(process.env.TANGLE_CLI_HOME||M(I(),`.local/share/tangle-cli`),`node_modules`,Vd);if(Ie(t)&&ze(t)===e)return`tangle update`;if(e.endsWith(M(`lib`,`node_modules`,Vd)))return`npm install -g ${Vd}@latest`;if(e.includes(M(`pnpm`,`global`,``)))return`pnpm add -g ${Vd}@latest`;if(e.includes(`${ge}node_modules${ge}`))return``}const Gd=()=>`${process.env.TANGLE_NPM_REGISTRY??`https://registry.npmjs.org`}/${Vd.replace(`/`,`%2F`)}/latest`,Kd=`const fs = require("node:fs");
+<script>${a(r)}<\/script></body></html>`,c=M(await pt(M(We(),`tangle-graph-`)),`${o}.html`);return await z(c,s,{mode:384}),c}function xl(t,n,r){t.command(`show <name-or-file>`).description(`Draw a graph file: labelled nodes, routes, loops and stops`).option(`--open`,`Write one offline page and open it in the browser`).action(async(t,i)=>{let a=await R(n(t,process.cwd())),{graphShape:o}=await import(`./graph-view-DOQKwuvP.mjs`),s=o(a,await L(a,`utf8`));if(i.json)return e(s);if(!i.open)return console.log(yl(s));let c=await bl(s,r);l(await Hr(bt(c).href)?`Opened ${c}`:`Open ${c}`)})}async function Sl(e){if(!yn(e.apiKey)){if(e.json||e.dryRun||!process.stdin.isTTY)return;await Zr({baseUrl:e.sandboxBaseUrl,signal:e.signal})}return K(e)}async function Cl(t,n,r){let i=Kl(n.parameter),a=r??await Sl(n);if(!a)throw new B(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let o=await a.connections.start(t,{cli:!0,connectionParameters:i,...n.scope?.length?{requestedScopes:n.scope}:{}});return n.json?(e(Jl(o)),o):(ql(o,n.browser===!1?!1:await Hr(o.redirectUrl),n.wait),o)}async function wl(e,t,n,r){let i=async()=>{n.signal?.throwIfAborted();let{connections:i}=await e.connections.list(),a=i.filter(e=>e.status===`active`&&e.providerId.toLowerCase()===t.trim().toLowerCase());return a.length?$e(a,r===void 0?t:`${t}:${r}`):void 0},a=await i();if(a||n.json||n.dryRun||!process.stdin.isTTY)return a;let o=await Cl(t,{...n,wait:!0},e);for(;!a&&Date.now()<Date.parse(o.expiresAt);)await xe(1e3,void 0,{signal:n.signal}),a=await i();return a}function Tl(){let e=new N(`hub`).description(`Discover and run Tangle Hub tools`);return El(e),Dl(e),Ol(e),kl(e),Al(e),e}function El(t){t.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--key-env <name>`,`Connect an API-key provider using this environment variable; never prints the key`).option(`--metadata <json>`,`Provider setup metadata for API-key connections`).option(`--scope <scope>`,`Request an OAuth scope; repeatable, must stay within the host's grant`,(e,t)=>[...t,e],[]).option(`--parameter <key=value>`,`Provider-specific OAuth value. Repeatable.`,(e,t)=>[...t,e],[]).action(async(t,n)=>{if(n.keyEnv){if(n.scope?.length)throw Error(`--scope applies to OAuth connections, not --key-env.`);let r=process.env[n.keyEnv];if(!r?.trim())throw Error(`Environment variable '${n.keyEnv}' is empty or unavailable.`);let i=await Sl(n);if(!i)throw new B(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let a;if(n.metadata!==void 0)try{a=JSON.parse(n.metadata)}catch{throw Error(`--metadata must be valid JSON.`)}let o=await i.connections.connectApiKey(t,r,a);n.json?e(o):l(`Connected ${o.connection.providerId} as ${o.connection.id}.`);return}if(n.metadata!==void 0)throw Error(`--metadata requires --key-env.`);await Cl(t,n)});let n=new N(`connections`).description(`List Hub provider connections`).action(async t=>{let n=await(await K(t)).connections.list();t.json?e(n):Gl(n.connections)});n.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let r=await K(n),i=await Rn(r,t);if(!n.force&&!await pr(`Revoke Hub connection ${i}? `,`--force`)){l(`Revoke cancelled.`);return}let a=await r.connections.revoke(i);if(n.json){e(a);return}l(`Revoked Hub connection ${a.connection.id}.`)}),t.addCommand(n)}function Dl(n){n.command(`providers [provider]`).description(`Show provider setup and action catalog; use hub events for trigger readiness`).action(async(n,r)=>{let i=await(await K(r)).connections.providers(),a=i.providers.filter(e=>!n||e.providerId===n.toLowerCase());if(n&&!a.length)throw Error(`Provider '${n}' is absent from this deployment's catalog.`);if(r.json)return e({...i,providers:a});t(a,[{key:`providerId`,header:`Provider`},{key:`authKind`,header:`Auth`},{key:`configured`,header:`Connect configured`},{key:`actionCount`,header:`Catalog actions`}])}),n.command(`events [provider]`).description(`Discover deployed trigger events and ingress readiness separately from callable tools`).action(async(n,r)=>{let i=await K(r),[a,o]=await Promise.all([i.connections.providers(),i.workflows.catalogs()]),s=[...new Set([...a.providers.map(e=>e.providerId),...o.providerEventProviders])];if(n&&!s.includes(n.toLowerCase()))throw Error(`Provider '${n}' is absent from this deployment's catalog.`);let c=s.filter(e=>!n||e===n.toLowerCase()).map(e=>({provider:e,supported:o.providerEventProviders.includes(e),ingressConfigured:a.providers.find(t=>t.providerId===e)?.eventIngressConfigured??null,catalog:o.triggerEvents[e]??null}));if(r.json)return e({providers:c});t(c.map(e=>({...e,ingress:e.ingressConfigured===null?`unknown`:e.ingressConfigured?`ready`:`setup required`,events:e.catalog?.events.map(e=>e.id).join(`, `)??`no published vocabulary`})),[{key:`provider`,header:`Provider`},{key:`supported`,header:`Event source supported`},{key:`ingress`,header:`Ingress`},{key:`events`,header:`Events`}])})}function Ol(t){let n=new N(`permissions`).description(`Manage Hub action permissions`);n.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async t=>{if(!t.connection)throw Error(`--connection is required.`);let n=await K(t),r=await Rn(n,t.connection),i=await n.permissions.list(r);t.json?e(i):Bl(i.policies)}),n.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).action(async t=>{if(!t.connection)throw Error(`--connection is required.`);if(!t.action)throw Error(`--action is required.`);let n=Vl(t.decision),r=await K(t),i=await Rn(r,t.connection),a=await r.permissions.set({connectionId:i,actionPath:t.action,decision:n});t.json?e(a):Bl([a.policy])}),n.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async t=>{if(!t.connection)throw Error(`--connection is required.`);let n=await K(t),r=await Rn(n,t.connection),i=await n.permissions.revertWrites(r);if(t.json){e(i);return}l(`Reverted ${i.reverted} write permission${i.reverted===1?``:`s`} for connection ${i.connectionId}.`)}),t.addCommand(n),t.addCommand(Ml())}function kl(t){let n=new N(`tools`).description(`Discover Hub tools`);n.command(`sources`).description(`List Hub tool sources`).action(async t=>{let n=await(await K(t)).tools.sources();t.json?e(n):Hl(n.sources)}),n.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).action(async(t,n)=>{let r=await(await K(n)).tools.describe(t);n.json?e(r):Ul(r.tool)}),n.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).action(async(t,n)=>{let r=await(await K(n)).tools.search(t.join(` `),{provider:n.provider});n.json?e(r):zl(r.tools)}),t.addCommand(n),t.addCommand(jl(`call`)),t.addCommand(jl(`exec`))}function Al(t){t.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).action(async(e,t)=>{if(Pl(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await K(t);Il(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}),t.command(`status`).description(`Show Hub auth and connection status`).action(async t=>{let n=await(await K(t)).status();t.json?e(n):Yl(n)})}function jl(t){return new N(t).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).action(async(t,n)=>{let{args:r,approve:i}=Nl(t,n),{path:a,input:o}=Rl(r),s=await K(n),c=n.connection?await Rn(s,n.connection):void 0;e((await s.tools.invoke(a,o,{connectionId:c,approve:i})).result)})}function Ml(){let t=new N(`approvals`).description(`List and resolve Hub execution approvals`);t.command(`list`).description(`List pending Hub execution approvals`).action(async t=>{let n=await(await K(t)).approvals.list();t.json?e(n):Fl(n.approvals)});for(let e of[`approve`,`deny`])t.command(e).description(`${e===`approve`?`Approve`:`Deny`} a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).action(async(t,n)=>{Pl(t),Il(await(await K(n)).approvals[e](t),n.json===!0)});return t}function Nl(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function Pl(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function Fl(e){t(e,[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`connectionId`,header:`Connection`},{key:`status`,header:`Status`},{key:`expiresAt`,header:`Expires`}])}function Il(t,n){if(n){e(Ll(t));return}l(`Hub approval ${t.approval.id} ${t.approval.status}.`),t.capabilityToken&&l("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function Ll(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function Rl(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e[e.length-1];try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function zl(e){t(e.map(e=>({...e,provider:e.providerId??e.requiredConnectionProviderId,connection:Wl(e)})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policyState`,header:`Policy`}])}function Bl(e){t(e,[{key:`connectionId`,header:`Connection`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updatedAt`,header:`Updated`}])}function Vl(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function Hl(e){t(e,[{key:`sourceId`,header:`Source`},{key:`displayName`,header:`Provider`},{key:`toolCount`,header:`Tools`},{key:`connectionStatus`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function Ul(e){s({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:Wl(e),Policy:e.policyState}),e.inputSchema!==void 0&&(l(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(l(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function Wl(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function Gl(e){t(e.map(e=>({...e,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `)})),[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsedAt`,header:`Last Used`}])}function Kl(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0||e===n.length-1)throw Error(`Invalid --parameter "${n}": expected key=value (for example subdomain=acme)`);let r=n.slice(0,e);if(Object.hasOwn(t,r))throw Error(`Duplicate --parameter key "${r}".`);t[r]=n.slice(e+1)}return t}function ql(e,t,n=!1){t?l(`Opened browser to connect ${e.provider}.`):(l(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),l(n?`Finish authorization in the browser; this run resumes when connected.`:"Finish authorization in the browser, then rerun `tangle hub status`.")}function Jl(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function Yl(e){let{principal:t,connections:n}=e;l(`Hub status`),s({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&l(`Some providers require reconnect.`)}const Xl=v(import.meta.url);if(!Xl)throw Error(`Tangle CLI package metadata was not found`);const Zl=ue(Xl),Q=e=>ve(`sha256`).update(e).digest(`hex`);function Ql(e,t){if(/[\\/]/.test(e)||/\.(yaml|yml|json)$/.test(e))return he(t,e);let n=t;for(;!Le(M(n,`.git`))&&ue(n)!==n;)n=ue(n);Le(M(n,`.git`))||(n=t);let r=[`yaml`,`yml`,`json`].flatMap(e=>[`graph.${e}`,e]),i=[n,I()].flatMap(t=>r.map(n=>M(t,`.tangle/graphs/${e}.${n}`))),a=i.find(Le);if(a)return a;throw new B(`GRAPH_NOT_FOUND`,`Graph '${e}' was not found`,`Looked in ${i.join(`, `)}`,`tangle graph --help`)}async function $l(e,t){return Cs(e.signal,async n=>{let r=e.runId??be(),i,a=new Set,{graphNativeRedaction:o}=await import(`./graph-native-CmG9wDbX.mjs`),s=o();try{let o=M(I(),`.tangle`,`runs`,r);await ft(o,{recursive:!0,mode:448});let c=await R(M(I(),`.tangle`)),l=await R(e.cwd??process.cwd()),u=[`runs`,`graph-registry`,`graphs`].some(e=>Us(l,M(c,e))||Us(M(c,e),l))?M(I(),`.tangle`,`workspaces`,r):l;await ft(u,{recursive:!0,mode:448});let d;return await t({runId:r,runDir:o,cwd:u,bridge:t=>d??=(async()=>{n.throwIfAborted();let r=ye(32).toString(`hex`),{loadConfig:c,startServer:l}=await import(`cli-bridge`),d=M(Zl,`dist`,`stdio.mjs`),f={...process.env,BRIDGE_HOST:`127.0.0.1`,BRIDGE_BEARER:r,BRIDGE_DATA_DIR:M(o,`bridge`),BRIDGE_BACKENDS:mc,BRIDGE_JAIL_MODE:`fs-jail`,BRIDGE_JAIL_FALLBACK:`deny`,BRIDGE_JAIL_NETWORK:`relay`,BRIDGE_SUBSCRIPTIONS_ONLY:`1`};e.relayAllow?f.BRIDGE_JAIL_RELAY_ALLOW=e.relayAllow:delete f.BRIDGE_JAIL_RELAY_ALLOW;let p=c(f);t&&p.jailReadablePaths.push(d),i=await l({cwd:u,config:{...p,port:0},handleSignals:!1,quiet:!0,onRunRedaction:s.observe,mcpSecrets:{async get(t){let n=e.mcpSecretEnv,r=n&&Object.hasOwn(n,t)?n[t]:void 0,i=r===void 0?void 0:process.env[r];return i&&a.add(i),i}},hub:t?{client:t,hash:Ss,serverForGrant:e=>{if(a.add(e),!i)throw Error(`Hub host is not ready`);return{transport:`stdio`,command:process.execPath,args:[{kind:`public`,value:d}],env:{TANGLE_HUB_MCP_ENDPOINT:{kind:`public`,value:`${i.url}/hub/mcp/grants/${e}`}}}}}:void 0});let{graphNativeCapture:m}=await import(`./graph-native-CmG9wDbX.mjs`);return{harnessTranscript:m({bridgeUrl:i.url,bridgeBearer:r,cwd:u,privateMcpSecrets:()=>[...a],redact:s.redact}),backend:`bridge`,bridgeUrl:i.url,bridgeBearer:r,cwd:u}})(),signal:n})}catch(t){throw t instanceof Error&&Object.assign(t,{runId:e.errorRunId??r}),t}finally{try{await i?.close()}finally{s.close(),a.clear()}}},e.fix??`tangle graph --help`)}function eu(e,t){return[`tangle graph run`,Ne(e),...t.dryRun?[`--dry-run`]:[],...t.cloud?[`--cloud`]:[],...t.deploy?[`--deploy`,Ne(t.deploy)]:[],...t.workflow?[`--workflow`,Ne(t.workflow)]:[],...t.resume?[`--resume`,Ne(t.resume)]:[],...t.seat?[`--seat`,Ne(t.seat)]:[],...t.seatAccount?[`--seat-account`,Ne(t.seatAccount)]:[],...t.seatCommand?[`--seat-command`,Ne(t.seatCommand)]:[],...t.param.flatMap(e=>[`--param`,Ne(e)])].join(` `)}async function tu(e,t,n={}){let r=n,i=eu(e,t);return await Cs(r.signal,async n=>{n.throwIfAborted();let a=As(t.mcpSecret);if(t.resume&&!t.resume.startsWith(`wfrun_`)&&(t.workflow||t.deploy)&&Y(`A local run cannot move to a cloud deployment`),t.deploy&&!t.cloud&&!t.workflow&&!t.resume?.startsWith(`wfrun_`))throw new B(`GRAPH_DEPLOY_INVALID`,`Deployment settings require cloud placement`,`Use --cloud to bind cloud triggers and settings`,`tangle graph run --help`);let o=await R(Ql(e,r.cwd??process.cwd())),s=r.source??await L(o,`utf8`),c=t.resume&&!t.resume.startsWith(`wfrun_`)?await cc(t.resume):void 0,l=r.taskWorkspace??(t.taskWorkspace?await tc(t.taskWorkspace):void 0)??c?.taskWorkspace;if(c&&(l?Zs(l):null)!==(c.taskWorkspace?Zs(c.taskWorkspace):null)&&Y(`The recorded task workspace snapshot changed`),l&&(t.cloud||t.workflow||t.resume?.startsWith(`wfrun_`)))throw Error(`Local private task workspace artifacts cannot be dispatched to a cloud backend`);let u=c?.runId??r.runId??be(),d=l&&!r.taskWorkspace?await rc(l,{runId:u,resumeCwd:c?.cwd,signal:n,validationOnly:t.dryRun===!0&&!c&&!r.runId}):void 0;d&&(r={...r,runId:u,cwd:d.cwd,taskWorkspace:l});try{if(!t.resume&&(t.cloud||t.workflow)||t.resume?.startsWith(`wfrun_`))return Gc(o,s,t,n);let e=await Bs(),l=Q(s),u=Object.entries(Pc(t.param,`param`)??{}),d=Object.fromEntries(u.filter(([e])=>!e.startsWith(`gate.`))),f=Object.fromEntries(u.filter(([e])=>e.startsWith(`gate.`)).map(([e,t])=>[e.slice(5),t])),p=Xe.parse(t.mcpPolicy??c?.mcpPolicy??{}),m=e.graphRegistry(M(I(),`.tangle`,`graph-registry`)),h;if(c){await R(c.cwd)!==c.cwd&&Y(`The recorded workspace identity changed`),c.file!==o&&Y(`The recorded graph source path changed`);let n=await e.loadGraph(m,c.graphDigest);n||Y(`The recorded executable graph is unavailable`),h=e.validateStoredGraph(n),fc(c,t,l,d,f)}let g={apiKey:t.apiKey,sandboxBaseUrl:t.baseUrl,signal:n,json:t.json,dryRun:t.dryRun&&!r.connectNeeds},_,v=()=>_??=Sl(g),y=new Map,b=(e,{account:t})=>{let n=e.trim().toLowerCase(),r=JSON.stringify([n,t?.toLowerCase()]),i=y.get(r)??(async()=>{let e=await v(),r=e&&await wl(e,n,g,t);return r?{connectionId:r,capabilities:[`*`]}:void 0})();return y.set(r,i),i},x=async i=>{if(n.throwIfAborted(),c&&h)return ws(h,c.gateChoices??{}),{graph:h,params:c.params};let a=await e.loadGraphFile(o,{source:s,seat:t.seat??(r.defaultSeat===void 0?rn().seat:r.defaultSeat??void 0),resolveSeat:hc(i,n),resolveNeed:b,params:d,...r.trigger?{trigger:r.trigger}:{},cwd:i,signal:n});if(n.throwIfAborted(),ws(a.graph,f),r.graphDigest&&a.graph.digest!==r.graphDigest)throw new B(`GRAPH_CHANGED`,`The validated graph changed before execution`,`Its compiled graph digest no longer matches validation`,`tangle graph run --help`);return a},S=r.cwd??process.cwd(),C=await x(c?.cwd??S),w=Ze(p,!0),T=[];for(let e of C.graph.nodes){let t=je(e.profile,w);if(!t.ok)throw new B(`GRAPH_MCP_POLICY_REQUIRED`,`A graph profile exceeds its host policy`,`${e.id}: ${t.issues.filter(e=>e.level===`error`).map(e=>`${e.code}: ${e.message}`).join(`; `)}`,`tangle graph run --mcp-policy <policy.json> --help`);for(let t of Object.values(e.profile.mcp??{}))t.enabled!==!1&&t.url&&T.push(new URL(t.url).hostname)}let ee=[vc(C.graph),...T].filter(Boolean).join(`,`)||void 0;if(t.dryRun)return C;let E=yc(C.graph.nodes)?xc(t):void 0,D=c?.runId??r.runId??be(),O=c?.cwd??(r.taskWorkspace?S:await e.graphWorkspace(C.graph,{cwd:S,runId:D}));return await $l({...r,runId:D,cwd:O,signal:n,fix:i,relayAllow:ee,mcpSecretEnv:a},i=>nu(i,{kernel:e,registry:m,loaded:C,gateChoices:f,file:o,source:s,sourceDigest:l,context:r,options:t,prior:c,mcpPolicy:p,getHub:v,seatSource:E,signal:n}))}finally{await d?.release()}},i)}async function nu({runId:e,runDir:t,cwd:n,bridge:r},{kernel:i,registry:a,loaded:o,gateChoices:s,file:c,source:u,sourceDigest:d,context:f,options:p,prior:m,mcpPolicy:h,getHub:g,seatSource:_,signal:v}){let{superviseGraphPursuit:y,readSettleRecord:b}=await import(`@tangle-network/agent-runtime/durable`),x=await i.recordStoredGraphRun(a,o.graph),S=m??{version:1,runId:e,cwd:n,file:c,graphDigest:x.digest,sourceDigest:d,source:u,params:o.params,...f.trigger?{trigger:f.trigger}:{},...Object.keys(s).length?{gateChoices:s}:{},startedAt:new Date().toISOString(),...p.seat===void 0?{}:{seat:p.seat},mcpPolicy:h,...f.taskWorkspace&&{taskWorkspace:f.taskWorkspace}};m||await lc(t,S);let C=m?await b(t):void 0;if(C&&C.tree.root!==e&&Y(`The settlement names another run`),C?.kind===`no-winner`&&Y(`The local run is terminal: ${C.reason}`),C)return{runId:e,graphDigest:x.digest,sourceDigest:d,...Rs(C),replayed:!0};let w=i.graphFromStored(x,{trigger:S.trigger}),T=x.nodes.some(e=>e.profile.connections?.length),ee=T?await g():void 0;if(T&&!ee)throw new B(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured for this local graph`,`tangle auth login`);let E=await r(ee),D=i.createPrivateCasArtifactPort(M(t,`artifacts`),e),O=await Ds(o.params.knowledge,t,D,v),k=_?Cc(E,_,v):void 0,A=S.startedAt;l(`Run ${e} · ${le(c)} · ${n}`);let te=await ru(t);l(`Viewer ${te.url}`);let ne=new AbortController,re=await y(w,{pursuitId:x.digest,runDir:t,runId:e,backend:E,checkArtifacts:D,...O?{resolveSupervisorTools:O}:{},...w.entry===void 0?{driverBackend:E}:{},...x.gates?.length?{decideGate:Ts(S.gateChoices??{},{json:p.json,signal:AbortSignal.any([v,ne.signal])})}:{},resume:!!m,signal:v,...S.trigger?{trigger:S.trigger}:{},...k?{selectSeat:k,coordination:{authentication:!0}}:{},profileSecurity:Ze(S.mcpPolicy,T)}).finally(async()=>{ne.abort(),await te.close()}),ie={runId:e,graphDigest:x.digest,sourceDigest:d,...Rs(re.result.result)},ae=re.result.result,{tokens:oe,tokensKnown:se,iterations:j,ms:ce}=ae.spentTotal;if(await i.recordStoredGraphRun(a,x,{graphDigest:x.digest,evidence:[{kind:`authored-graph`,url:`urn:sha256:${x.digest}`},{kind:`authored-yaml`,url:`urn:sha256:${d}`}],taskDigest:i.taskShapeDigest({graph:le(c),params:o.params,trigger:S.trigger??null,taskWorkspace:S.taskWorkspace?Zs(S.taskWorkspace):null}),startedAt:A,finishedAt:new Date().toISOString(),outcome:ae.kind===`no-winner`?{kind:`no-winner`,reason:ae.reason}:{kind:`delivered`,summary:ie.text},cost:{iterations:j,ms:ce,...se===!1?{}:{tokens:oe.input+oe.output},...ie.costUsd===null?{}:{usd:ie.costUsd}},traversals:re.result.ledger.length,exhaustedEdges:re.result.exhaustedEdges,source:{kind:`tangle-cli-graph`,id:e}}),ae.kind===`no-winner`)throw Object.assign(new B(`GRAPH_RUN_FAILED`,`Graph '${le(c)}' finished without a result`,re.result.stopped?.reason||re.result.ledger.filter(e=>e.outcome===`unpropagated`&&e.reason).pop()?.reason||ae.reason,`tangle graph inspect ${e}`),{runId:e,runtimeFailures:[...ae.tree.nodes.filter(e=>e.failure).map(e=>({node:e.label,failure:e.failure})),...ae.reason===`driver-failed`&&ae.error.failure?[{node:`root`,failure:ae.error.failure}]:[]]});return ie}async function ru(e){let{serveTopWeb:t}=await import(`@tangle-network/agent-runtime/tui`),{readGraphSessions:n}=await import(`./graph-native-CmG9wDbX.mjs`);return t({roots:[e],assets:M(Zl,`dist`,`graph-viewer`),readSessions:n})}async function iu(t,n){if(n.artifacts||n.artifact)return jc(t,n);if(t.startsWith(`wfrun_`)){let r=await X(n),i=await r.workflows.getRun(t);if(n.json)return e(i);for(let e of i.runtime?.checks??[])l(`${e.node} ${e.status} · exit ${e.exitCode??`none`} · pass ${e.pass??`none`}\n${e.reason??e.tail}`);return l(`Run ${t} · ${r.baseUrl}/app/workflows/${encodeURIComponent(i.workflowId)}/runs/${encodeURIComponent(t)}`)}let r=M(I(),`.tangle`,`runs`,t);if(!/^[a-f0-9-]{36}$/i.test(t)||!Le(r))throw new B(`RUN_NOT_FOUND`,`Run '${t}' was not found`,`Use a run ID printed by tangle graph run`,`tangle graph inspect --help`);let{loadTopSnapshot:i}=await import(`@tangle-network/agent-runtime/tui`);if(n.json)return e(await i(process.cwd(),{runDir:r}));l(`Run ${t} · ${(await ru(r)).url}`)}function au(){let t=new N(`graph`).description(`Build and run portable agent graphs`);return _l(t),ic(t),Wc(t,Ql),qc(t,Ql),Ac(t),ll(t),xl(t,Ql,Zl),t.command(`inspect <run>`).description(`Inspect a live or retained graph run`).option(`--artifacts`,`List complete retained check files and capture gaps`).option(`--artifact <node/path>`,`Download one retained check file by node/path or digest`).option(`--out <file>`,`Save artifact bytes to a new private file`).action(iu),t.command(`run <name-or-file>`).description(`Run a saved graph over native subscriptions`).option(`--cloud`,`Run through Tangle's durable cloud workflow owner`).option(`--deploy <file>`,`Cloud deployment settings, including triggers and parameter defaults`).option(`--workflow <id>`,`Run this existing cloud deployment at its exact source and revision`).option(`--resume <run>`,`Resume this run's saved graph and durable execution`).option(`--seat <seat>`,`Use harness/model@effort for every node`).addOption(ks()).option(`--mcp-policy <file>`,`Host-owned JSON policy: allowLocalMcp and allowedMcpHosts; captured for resume`).option(`--seat-account <account>`,`Account id for an all-eligible authored seat`).option(`--seat-command <program>`,`Executable that prints the account id; the harness is its first argument`).option(`--seat-credential <credential>`,`Credential name passed to the seat command after the harness`).option(`--param <key=value>`,`Graph parameter or gate.<id>=<choice>; repeatable`,(e,t)=>[...t,e],[]).option(`--task-workspace <file>`,`Seed a private run copy from an exact local workspace capture`).option(`--dry-run`,`Validate and print the graph without starting agents`).action(async(t,n)=>{let r={...n,mcpPolicy:n.mcpPolicy===void 0?void 0:await js(n.mcpPolicy)},i=await tu(t,r);r.json||r.dryRun?e(i):`status`in i?(l(`${i.status} · ${i.runId}`),i.text&&console.log(i.text)):`viewerUrl`in i&&l(`Run ${i.runId} · ${i.viewerUrl}`)}),t}function ou(){let n=new N(`intelligence`).description(`Create and inspect trace intelligence reports`);return n.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--endpoint <url>`,`OTLP endpoint base`,xi).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).action(async(t,n)=>{let r=t??`local`;Ei(r);let i=cu(n.apiKey),a=await ji({selection:r,workspace:n.workspace,apiKey:i,endpoint:n.endpoint,serviceName:n.serviceName??Oi(n.workspace),environment:n.environment,smoke:n.smoke,dryRun:!!n.dryRun,hookCommand:n.hookCommand}),o={configPath:a.configPath,agents:a.agents,nativeAgents:a.nativeAgents,manual:a.manual,written:a.written,smokeTraceId:a.smokeTraceId};if(n.json){e(o);return}s({Config:a.configPath,Agents:a.agents.join(`, `),"Native Hooks":a.nativeAgents.join(`, `)||void 0,"Manual Setup":a.manual.length?a.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:a.written.join(`, `),"Smoke Trace":a.smokeTraceId})}),n.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--endpoint <url>`,`OTLP endpoint base`,xi).action(async t=>{let n=Ai(),r=await Ii({endpoint:t.endpoint===`https://intelligence.tangle.tools/v1/otlp`?n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:t.endpoint,apiKey:cu(t.apiKey??n?.apiKey)});t.json?e(r):su(r),r.contentSeen||(process.exitCode=1)}),n.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).action(async t=>{try{let n=lu(t.agent),r=Ai(),i={agent:n,event:t.event,endpoint:t.endpoint??r?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:cu(t.apiKey??r?.apiKey),serviceName:t.serviceName??r?.serviceName??Oi(process.cwd()),environment:t.environment??r?.environment??`local`,sessionId:t.sessionId,payload:t.payload===void 0?await du():uu(t.payload)};if(t.dryRun){let r=Ni(i);if(t.json){e(r);return}s({Trace:r.traceId,Agent:n,Event:t.event});return}let a=await Pi(i);if(t.json){e({traceId:a});return}s({Trace:a,Agent:n,Event:t.event})}catch(n){if(t.nonBlocking){let r=n instanceof Error?n.message:String(n);t.json?e({ok:!1,error:r}):console.error(`Tangle Intelligence hook skipped: ${r}`);return}H(n)}}),n.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await fu({type:`sandbox`,id:e},t)}),n.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await fu({type:`fleet`,id:e},t)}),n.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async e=>{await fu({type:mu(e.subjectType),id:e.subjectId},e)}),n.command(`get <job-id>`).description(`Get an intelligence report`).action(async(t,n)=>{let{client:r}=G(n),i=n.json?null:f(`Fetching intelligence report...`);i?.start();let a=await r.intelligence.getReport(t);if(i?.stop(),n.json){e(a);return}pu(a)}),n.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).action(async n=>{let{client:r}=G(n),i=n.json?null:f(`Fetching intelligence reports...`);i?.start();let a=await r.intelligence.listReports({subjectType:n.subjectType===void 0?void 0:mu(n.subjectType),subjectId:n.subjectId,limit:n.limit===void 0?void 0:_u(n.limit)});if(i?.stop(),n.json){e(a);return}t(a.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}),n}function su(e){s({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let n=Object.entries(e.byAgent);n.length>0&&(console.log(),t(n.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function cu(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function lu(e){if(Di(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function uu(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function du(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function fu(t,n){let r=hu(n.mode),i=vu(n.metadata),a=n.maxUsd===void 0?void 0:gu(n.maxUsd);if(r===`agentic`&&a===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let{client:o}=G(n),s=n.json?null:f(`Creating intelligence report...`);s?.start();let c=await o.intelligence.createReport({subject:t,mode:r,...a===void 0?{}:{budget:{billTo:`customer`,maxUsd:a}},...i===void 0?{}:{metadata:i}});if(s?.stop(),n.json){e(c);return}pu(c)}function pu(t){s({Job:t.jobId,Subject:`${t.subject.type}:${t.subject.id}`,Mode:t.mode,Status:t.status,"Billed To":t.billing.billedTo,Cost:`$${t.billing.costUsd.toFixed(2)}`,Budget:t.billing.budgetMaxUsd===void 0?void 0:`$${t.billing.budgetMaxUsd.toFixed(2)}`,Updated:t.updatedAt}),t.result!==null&&(console.log(),e(t.result))}function mu(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function hu(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function gu(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function _u(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function vu(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const yu=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];async function bu(e,t){let n=await Zn({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.platformUrl===void 0?{}:{baseUrl:e.platformUrl},...e.baseUrl===void 0?{}:{sandboxBaseUrl:e.baseUrl}});if(!t||!n.minted)return n;throw Error("This command needs a key you minted yourself. A browser login is exchanged for a short-lived key the platform will not accept for key management. Set TANGLE_API_KEY, run `tangle auth login --api-key sk-tan-…`, or mint the key in the web console. `tangle keys list` works from the login alone.")}async function xu(e,t,n={}){let r=new Headers(n.headers);n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await Qn(e,t,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected)throw Error(await Su(i,t));return i}async function Su(e,t){let n=await e.text().catch(()=>``),r;try{let e=JSON.parse(n),t=typeof e?.error==`string`?e.error:e?.error?.message;typeof t==`string`&&t.trim()&&(r=t)}catch{}if(r)return`${r} (HTTP ${e.status})`;let i=n?`: ${n.slice(0,400)}`:``;return`Platform request to ${t} returned ${e.status}${i}`}const Cu=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function wu(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function Tu(){let t=new N(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return t.command(`list`).description(`List your active API keys`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async t=>{let n=await bu(t,!1),r=n.baseUrl,a=await(await xu(n,`${r}/v1/keys`,{expected:200})).json();if(t.json){e(a);return}i(Cu,a.data.map(wu))}),t.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${yu.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(t,n)=>{if(n.product!==void 0&&!yu.includes(n.product))throw Error(`Invalid --product. Expected one of ${yu.join(`, `)}`);let i=await bu(n,!0),a=i.baseUrl,o=n.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(n.expiresInDays,10)*24*60*60*1e3).toISOString(),s=f(`Creating API key...`);s.start();let c=await xu(i,`${a}/v1/keys`,{method:`POST`,expected:201,body:JSON.stringify({name:t,product:n.product,budgetUsd:n.budgetUsd?Number.parseFloat(n.budgetUsd):void 0,rpmLimit:n.rpmLimit?Number.parseInt(n.rpmLimit,10):void 0,expiresAt:o})});s.stop();let u=await c.json();if(n.json){e(u);return}r(`API key created: ${u.data.prefix}…`),l(`Copy this key now — it will never be shown again:\n${u.data.key}`)}),t.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(t,n)=>{let i=await bu(n,!0),a=i.baseUrl;if(!n.yes&&!await pr(`Revoke key ${t}? Any service still using it will start to fail.`,`--yes`)){l(`Aborted.`);return}let o=await(await xu(i,`${a}/v1/keys/${encodeURIComponent(t)}`,{method:`DELETE`,expected:200})).json();if(n.json){e(o);return}r(`Revoked ${t}`)}),t}function Eu(e){if(cn().token)throw Error(`A line relay cannot manage numbers or attachments. Use your owner CLI outside the agent box.`);return W(U(e))}function Du(e){if(!e.yes)throw Error(`Review the selected line and use --yes to authorize this change. Attaching enables metered agent work.`)}function Ou(e){if(e===`imessage`||e===`whatsapp`||e===`email`||e===`sms`||e===`voice`||e===`telegram`)return e;throw Error(`--transport must be imessage, whatsapp, email, sms, voice, or telegram`)}function ku(e){return e().catch(H)}async function Au(e){let t=await mt(e,`r`);try{if(!(await t.stat()).isFile())throw Error(`Attachment input must be a regular JSON file`);let e=Buffer.alloc(131073),n=0;for(;n<e.length;){let{bytesRead:r}=await t.read(e,n,e.length-n,null);if(r===0)break;n+=r}if(n===e.length)throw Error(`Attachment JSON exceeds 128 KiB`);let r;try{r=JSON.parse(e.subarray(0,n).toString(`utf8`))}catch{throw Error(`Attachment file is not valid JSON`)}if(!r||typeof r!=`object`||Array.isArray(r))throw Error(`Attachment JSON must be an object`);if(Object.hasOwn(r,`number`))throw Error(`Use the line ID argument, not a number field in the attachment file`);return r}finally{await t.close()}}function ju(t){t.command(`providers`).description(`List provider transports supported by this Hub deployment`).action(t=>ku(async()=>{e(await Eu(t).lines.providers())})),t.command(`list`).description(`List owned lines, optionally for a saved agent profile or sandbox`).option(`--profile-id <id>`,`Stored profile ID`).option(`--sandbox <id>`,`Existing sandbox ID`).action(t=>ku(async()=>{e(await Eu(t).lines.list({profileId:t.profileId,sandboxId:t.sandbox}))})),t.command(`get`).argument(`<line-id>`).description(`Inspect a line and its current attachment`).action((t,n)=>ku(async()=>{e(await Eu(n).lines.get(t))})),t.command(`numbers`).argument(`<connection-id>`).description(`Discover owned provider numbers; this does not purchase or reserve a number`).option(`--transport <transport>`,`imessage, whatsapp, or sms`,`imessage`).action((t,n)=>ku(async()=>{let r=Ou(n.transport);if(r===`email`)throw Error(`Email uses an owned mailbox, not phone inventory`);if(r===`voice`)throw Error(`Voice numbers are listed by ph0ny; provide the owned number ID to lines connect`);if(r===`telegram`)throw Error(`Telegram uses an owned bot, not phone inventory`);e(await Eu(n).lines.numbers(t,r))})),t.command(`connect`).argument(`<connection-id>`).description(`Bind an owned number or identity through Hub; no provider rental is purchased`).option(`--transport <transport>`,`imessage, whatsapp, sms, email, voice, or telegram`,`imessage`).option(`--number-id <id>`,`Exact owned provider number ID; required for voice, SMS, WhatsApp and Linq iMessage`).option(`--address <email>`,`Owned mailbox on a verified email domain`).requiredOption(`--reference <reference>`,`Stable client reference; keep it unchanged on retry`).option(`--label <label>`,`Line display name`).option(`--yes`,`Authorize provider webhook configuration and line binding`).action((t,n)=>ku(async()=>{Du(n);let r=Ou(n.transport);if(r!==`email`&&n.address)throw Error(`--address is email-only`);if((r===`email`||r===`telegram`)&&n.numberId)throw Error(`${r} does not take --number-id`);let i={connectionId:t,label:n.label,clientReference:n.reference},a;if(r===`email`)a={...i,transport:r,address:n.address};else if(r===`telegram`)a={...i,transport:r};else if(r===`imessage`)a={...i,transport:r,phoneNumberId:n.numberId};else{if(!n.numberId)throw Error(`${r} requires --number-id`);a={...i,transport:r,phoneNumberId:n.numberId}}e(await Eu(n).lines.fromConnection(a))})),t.command(`attach`).argument(`<line-id>`).description(`Attach a saved agent to any sandbox, or use an isolated on-demand member instance`).option(`--file <path>`,`Reviewed native attachment JSON (exclusive with quick-setup flags)`).option(`--profile-id <id>`,`Owner-scoped saved profile; each turn pins its source revision`).option(`--member <address>`,`The one allowed sender: E.164 phone or email`).option(`--sandbox <id>`,`Use an existing sandbox instead of an on-demand instance`).option(`--instance-prefix <prefix>`,`Stable instance namespace; defaults to profile:<profile-id>:`).option(`--tools <mode>`,`chat denies tools; act applies the profile's tools and permissions`).option(`--turns-per-day <count>`,`Per-member daily turn ceiling (default 30)`).option(`--yes`,`Authorize agent execution and spend against your key limits`).action((t,n)=>ku(async()=>{Du(n);let r=Eu(n),i;if(n.file){if(n.profileId||n.member||n.sandbox||n.instancePrefix||n.tools||n.turnsPerDay)throw Error(`Choose --file or quick-setup flags, not both`);i=await Au(n.file)}else{if(!n.profileId||!n.member)throw Error(`Provide --profile-id and --member, or --file`);if(n.sandbox&&n.instancePrefix)throw Error(`Choose --sandbox or --instance-prefix`);let e=n.tools??`chat`,t=Number(n.turnsPerDay??`30`);if(e!==`chat`&&e!==`act`)throw Error(`--tools must be chat or act`);if(!Number.isSafeInteger(t)||t<1||t>1e4)throw Error(`--turns-per-day must be 1–10000`);if(e===`act`&&n.sandbox)throw Error(`Acting tools require an isolated on-demand instance; omit --sandbox`);i={mode:`personal`,members:[{address:n.member,role:`owner`}],unknownSenders:`reject`,roles:{owner:{context:`own`,tools:e}},respond:{kind:`agent`,profileId:n.profileId,...e===`act`?{rolePolicy:{version:1,roles:{owner:{kind:`general`}},members:{}}}:{}},limits:{turnsPerMemberPerDay:t},...n.sandbox?{sandboxId:n.sandbox}:{instance:{keyPrefix:n.instancePrefix??`profile:${n.profileId}:`,create:{ownerContext:`isolated`,...e===`act`?{egressPolicy:{mode:`strict`,allowDomains:[new URL(En()).hostname],includeImplicitDomains:!1}}:{}}}}}}if(typeof i.sandboxId==`string`==(i.instance!==void 0))throw Error(`Attachment requires exactly one of sandboxId and instance`);let{sandboxId:a,instance:o,...s}=i,c;if(a){let e=await r.get(a);if(!e)throw Error(`Sandbox not found`);c=await e.lines.attach({...s,number:t})}else{if(!o)throw Error(`Attachment requires an instance`);c=await r.lines.attach({...s,number:t,instance:o})}e(c)}));for(let n of[`detach`,`release`])t.command(n).argument(`<line-id>`).description(n===`detach`?`Stop dispatch; preserve history and provider rental`:`Retire a detached Hub line; does not cancel provider rental`).option(`--yes`,`Authorize this change`).action((t,r)=>ku(async()=>{Du(r),e({[n]:await Eu(r).lines[n](t)})}));t.command(`threads`).argument(`<line-id>`).description(`List this line's separate participant threads`).action((t,n)=>ku(async()=>{e(await Eu(n).lines.threads(t).list())})),t.command(`messages`).argument(`<line-id>`).argument(`<thread-id>`).description(`Read one authorized participant thread`).action((t,n,r)=>ku(async()=>{e(await Eu(r).lines.threads(t).messages(n))}))}async function Mu(e){let{token:t,baseUrl:n}=cn();if(t===void 0)return K(e);if(!t.startsWith(`lrc_`)||!n)throw Error(`The line box needs TANGLE_LINE_TOKEN and TANGLE_HUB_URL`);if(e.apiKey||e.baseUrl&&new URL(e.baseUrl).origin!==new URL(n).origin)throw Error(`A line token cannot be sent to another Hub or combined with an API key`);return new Je({baseUrl:n,authHeaders:()=>({Authorization:`Bearer ${t}`})})}async function Nu(e,t){if(t)return t;if(!cn().token)throw Error(`Provide --line <line-id>`);return(await e.lines.context()).line.id}function Pu(e){return e().catch(H)}function Fu(){return new N(`context`).description(`Show live line identity, members, consent, reminders and quotas`).action(t=>Pu(async()=>{e(await(await Mu(t)).lines.context())}))}function Iu(){let t=new N(`lines`).description(`Connect, manage, message and schedule on a Hub line`);return t.command(`members`).description(`List names, roles and consent on this line`).option(`--line <line-id>`,`Line ID; inferred in a line box`).action(t=>Pu(async()=>{let n=await Mu(t);e(await n.lines.members.list(await Nu(n,t.line)))})),t.command(`send`).description(`Send to a consenting member through Hub`).argument(`<to-member>`,`Exact member ID for an owner; name, ID, or self in a line box`).argument(`<text>`,`Message text`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--on-behalf-of <member>`,`Verified sender for a member relay`).option(`--not-before <iso-time>`,`Delay delivery until this ISO time`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((t,n,r)=>Pu(async()=>{let i=await Mu(r),a=await Nu(i,r.line);if(!cn().token){if(r.onBehalfOf)throw Error(`--on-behalf-of is only available inside a line box`);if(!r.idempotencyKey)throw Error(`Owner sends require --idempotency-key so a retry keeps the same message`);if(!(await i.lines.members.list(a)).some(e=>e.id===t))throw Error(`Owner sends require an exact member ID from tangle lines members`);e(await i.lines.send(a,{memberId:t,text:n,idempotencyKey:r.idempotencyKey,...r.notBefore?{notBefore:r.notBefore}:{}}));return}e(await i.lines.send(a,{toMember:t,text:n,...r.onBehalfOf?{onBehalfOf:r.onBehalfOf}:{},...r.notBefore?{notBefore:r.notBefore}:{},...r.idempotencyKey?{idempotencyKey:r.idempotencyKey}:{}}))})),t.command(`remind`).description(`Wake the agent at a future time to write your reminder`).argument(`<text>`,`What to remember`).requiredOption(`--at <iso-time>`,`Future ISO time`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((t,n)=>Pu(async()=>{if(!n.at)throw Error(`--at is required`);let r=await Mu(n),i=n.idempotencyKey??ve(`sha256`).update(JSON.stringify([t,n.at])).digest(`hex`).slice(0,32);e(await r.lines.remind(await Nu(r,n.line),{text:t,notBefore:n.at,idempotencyKey:i}))})),ju(t),t}function Lu(){let e=new N(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{let n=U({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await q(W(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await(await import(`@tangle-network/sandbox/agent`)).createMcpServer(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}),e}async function Ru(e,t){if(t.self&&e)throw Error(`Use --self or an explicit sandbox, not both`);if(!t.self&&!e)throw Error(`Specify a sandbox id/name or --self`);let n=Qt(),r=t.baseUrl||n.tangleBaseUrl||n.sandboxBaseUrl,i=n.hubUrl;if(t.self&&!r&&i&&new URL(i).origin!==`https://id.tangle.tools`)throw Error(`This deployment must set SANDBOX_BASE_URL or pass --base-url for self preview access`);let a=t.self?t.apiKey??vn():t.apiKey;if(t.self&&!a)throw Error(`Self preview access requires the injected sandbox runtime credential; it never reads saved owner credentials`);let o=U({apiKey:a,baseUrl:r}),s=W(o);return t.self?Ct(s):q(s,o,e)}async function zu(e,t,n){let r=f(e);t||r.start();try{return await n()}finally{r.stop()}}function Bu(e){return e}function Vu(){let t=new N(`preview`).description(`Manage sandbox preview links`);return Bu(t.command(`start`).description(`Start/reuse a managed development server and publish its ready preview`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).option(`--cwd <directory>`,`Project directory in the selected workspace`).option(`--session <session-id>`,`Select the agent's session workspace`).option(`--name <name>`,`App/service label`)).action(async(t,n)=>{let i=await Ru(t,n),a=await zu(`Starting managed preview...`,n.json,()=>xt(i,{cwd:n.cwd,sessionId:n.session,name:n.name}));n.json?e(a):(r(`Preview ready: ${a.url}`),console.log(`Preview ID: ${a.previewId}`))}),Bu(t.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`)).action(async(t,n)=>{let r=await Ru(t,n),a=await zu(`Fetching preview links...`,n.json,()=>r.previewLinks.list());n.json?e(a):a.length===0?console.log(`No preview links found`):i([`App`,`Preview ID`,`Port`,`URL`,`Status`],a.map(e=>[Hu(e.metadata),e.previewId.slice(0,12),String(e.port),e.url,e.status]))}),Bu(t.command(`publish`).description(`Publish one existing HTTP service; never starts or replaces a process`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).requiredOption(`--port <port>`,`Existing service port`).option(`--name <name>`,`App/service label`)).action(async(t,n)=>{if(!n.port||!/^\d+$/.test(n.port))throw Error(`An integer service port is required`);let i=await Ru(t,n),a=await zu(`Publishing service...`,n.json,()=>St(i,{port:Number(n.port),name:n.name}));n.json?e(a):r(`Preview ready: ${a.url}`)}),Bu(t.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`)).action(async(t,n,i)=>{if(!/^\d+$/.test(n)||Number(n)<1||Number(n)>65535)throw Error(`Port must be an integer between 1 and 65535`);let a=await Ru(t,i),o=await zu(`Creating preview for port ${n}...`,i.json,()=>a.previewLinks.create(Number(n)));i.json?e(o):(r(`Preview created: ${o.url}`),console.log(`Preview ID: ${o.previewId}`))}),Bu(t.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`)).action(async(t,n,i)=>{let a=await Ru(t,i);await zu(`Removing preview...`,i.json,()=>a.previewLinks.remove(n)),i.json?e({success:!0,previewId:n}):r(`Preview removed: ${n}`)}),t}function Hu(e){let t=e?.app;if(!t||typeof t!=`object`)return``;let n=`name`in t?t.name:void 0,r=`cwd`in t?t.cwd:void 0;return typeof n==`string`?n:typeof r==`string`?r:``}function Uu(){let t=new N(`process`).description(`Manage processes in a sandbox`);return t.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=yo(r.env??[],`--env`,`env`),s=f(`Spawning: ${n}`);r.json||s.start();let c=await q(a,i,t);if(c=await J(c),r.blocking){let t=await c.exec(n,{cwd:r.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:r.timeout?Number.parseInt(r.timeout,10):void 0});s.stop(),r.json?e(t):(t.stdout&&globalThis.process.stdout.write(t.stdout),t.stderr&&globalThis.process.stderr.write(t.stderr),t.exitCode!==0&&globalThis.process.exit(t.exitCode))}else{let i=await c.process.spawn(n,{cwd:r.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:r.timeout?Number.parseInt(r.timeout,10):void 0});s.stop(),r.json?e({pid:i.pid,command:i.command}):(console.log(`Process started with PID: ${i.pid}`),console.log(`Use 'tangle process logs ${t} ${i.pid}' to view output`))}}),t.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).action(async(t,n)=>{let{context:r,client:a}=G(n),o=f(`Fetching processes...`);n.json||o.start();let s=await q(a,r,t);s=await J(s);let c=await s.process.list();n.running&&(c=c.filter(e=>e.running)),o.stop(),n.json?e(c):c.length===0?console.log(`No processes found`):i([`PID`,`Command`,`Status`,`Exit Code`,`Started`],c.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}),t.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=f(`Fetching process info...`);r.json||o.start();let s=await q(a,i,t);s=await J(s);let c=await s.process.get(Number.parseInt(n,10));if(o.stop(),!c){console.error(`Process ${n} not found`),globalThis.process.exit(1);return}let l=await c.status();r.json?e(l):(console.log(`PID:        ${l.pid}`),console.log(`Command:    ${l.command}`),console.log(`CWD:        ${l.cwd||`(default)`}`),console.log(`Status:     ${l.running?`running`:`exited`}`),console.log(`Exit Code:  ${l.exitCode}`),l.exitSignal&&console.log(`Signal:     ${l.exitSignal}`),console.log(`Started:    ${l.startedAt.toLocaleString()}`),l.exitedAt&&console.log(`Exited:     ${l.exitedAt.toLocaleString()}`))}),t.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).action(async(t,n,r)=>{let{context:i,client:a}=G(r),o=f(`Sending ${r.signal} to PID ${n}...`);r.json||o.start();let s=await q(a,i,t);s=await J(s);let c=await s.process.get(Number.parseInt(n,10));if(!c){o.stop(),console.error(`Process ${n} not found`),globalThis.process.exit(1);return}r.tree?await c.kill(r.signal,{tree:!0}):await c.kill(r.signal),o.stop(),r.json?e({pid:Number.parseInt(n,10),signal:r.signal,...r.tree===!0?{tree:!0}:{},killed:!0}):console.log(r.tree?`Sent ${r.signal} to process tree ${n}`:`Sent ${r.signal} to process ${n}`)}),t.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).action(async(e,t,n)=>{let{context:r,client:i}=G(n),a=await q(i,r,e);a=await J(a);let o=await a.process.get(Number.parseInt(t,10));if(!o){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of o.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}),t}const Wu=[`python`,`node`,`typescript`,`bash`];function Gu(e){switch(de(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function Ku(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await L(he(e),`utf8`)}async function qu(e,t,n=Ku){let r=t?Wu.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${Wu.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=Gu(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function Ju(e){return M(We(),`tangle-run-images`,e)}function Yu(){return new N(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${Wu.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).action(async(t,n,r)=>{let{language:i,source:a}=await qu(n,r.lang),{context:o,client:s}=G(r),c=await q(s,o,t);c=await J(c);let l=f(`Running ${i} (${a.length}b)…`);r.json||l.start();let u=await c.runCode(i,a,{sessionId:r.session,timeoutMs:Number.parseInt(r.timeout,10)});if(l.stop(),r.json){e(u),u.exitCode!==0&&process.exit(u.exitCode);return}u.stdout&&process.stdout.write(u.stdout),u.stderr&&process.stderr.write(u.stderr);let d=0;for(let e of u.results)if(e.type===`image`)if(r.saveImages!==!1){let n=typeof r.saveImages==`string`?r.saveImages:Ju(t);Re(n,{recursive:!0});let i=`${n}/${Date.now()}-${d}.${e.format}`;He(i,Buffer.from(e.data,`base64`)),process.stderr.write(j.green(`✓ image → ${i}\n`)),d++}else process.stderr.write(j.gray(`[image: ${e.format}, ${e.data.length}b base64]\n`));else if(e.type===`dataframe`){let t=e.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(j.gray(`[dataframe ${e.rows.length}×${e.columns.length}${e.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${t}\n`);for(let t of e.rows.slice(0,20))process.stderr.write(`${t.map(e=>String(e)).join(` | `)}\n`);e.rows.length>20&&process.stderr.write(j.gray(`… ${e.rows.length-20} more rows\n`))}else e.type===`json`?(process.stderr.write(j.gray(`[json] `)),process.stderr.write(`${JSON.stringify(e.value,null,2)}\n`)):e.type===`html`?process.stderr.write(j.gray(`[html ${e.value.length}b]\n`)):e.type===`error`?(process.stderr.write(j.red(`✗ ${e.name}: ${e.message}\n`)),e.traceback&&process.stderr.write(`${e.traceback}\n`)):e.type===`text`&&process.stderr.write(`${e.value}\n`);u.error&&(process.stderr.write(j.red(`\n✗ ${u.error.name}: ${u.error.message}\n`)),u.error.traceback&&process.stderr.write(`${u.error.traceback}\n`)),u.exitCode!==0&&process.exit(u.exitCode)})}function Xu(t){t.command(`network <id-or-name>`).description(`Show runtime network state (exposed ports) for a sandbox. Outbound policy is the sandbox's egress policy.`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Updating network configuration...`);a.start();let o=await q(i,r,t);a.stop();let s=await o.network.getConfig();n.json?e(s):(l(`Network Configuration:`),s.ports&&s.ports.length>0?l(`  Exposed Ports: ${s.ports.join(`, `)}`):l(`  No exposed ports`))}),t.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=Number.parseInt(n.port,10);if(Number.isNaN(o)||o<1||o>65535)throw Error(`Port must be a number between 1 and 65535`);let s=f(`Exposing port ${o}...`);s.start();let c=await(await q(a,i,t)).network.exposePort(o);s.stop(),n.json?e({port:o,url:c}):(r(`Port ${o} exposed.`),l(`  URL: ${c}`))}),t.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).action(async(t,n)=>{let{context:r,client:i}=G(n),a=f(`Fetching exposed URLs...`);a.start();let o=await(await q(i,r,t)).network.listUrls();if(a.stop(),n.json)e(o);else{let e=Object.entries(o);if(e.length===0)l(`No ports exposed.`);else{l(`Exposed Ports:`);for(let[t,n]of e)l(`  ${t}: ${n}`)}}})}function Zu(){let e=new N(`sandbox`).description(`Manage sandboxes`);return $o(e),Qo(e),Ho(e),Xu(e),e}function Qu(){return new N(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).action(async(e,t,n)=>{let{context:r,client:i}=G(n),a=f(`Searching...`);n.json||a.start();let o=await q(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)})}function $u(){let t=new N(`secret`).description(`Manage secrets`);return t.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).action(async(t,n,i)=>{let a=await G(i).client.secrets.create(t,await ed({value:n,valueStdin:i.valueStdin,prompt:`Enter value for secret '${t}': `}));i.json?e(a):(r(`Secret created: ${a.name}`),l(`Use --secret ${a.name} when creating a sandbox to select it for delivery.`))}),t.command(`list`).description(`List all secrets`).action(async t=>{let n=await G(t).client.secrets.list();t.json?e(n):n.length===0?(l(`No secrets found.`),l(`Use 'tangle secret create <name> [value]' to create one.`)):i([`Name`,`Created At`,`Updated At`],n.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}),t.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let i=G(n).client;if(!n.force&&!await pr(`Are you sure you want to delete secret '${t}'? This cannot be undone. (y/N) `,`--force`)){l(`Cancelled.`);return}await i.secrets.delete(t),n.json?e({success:!0,deleted:t}):r(`Secret deleted: ${t}`)}),t}async function ed(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);let t=e.value??(e.valueStdin?await hr():await fr(e.prompt));if(!t.length)throw Error(e.valueStdin?`Secret value from stdin cannot be empty`:`Secret value cannot be empty`);return t}function td(){let e=new N(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=ce.dirname(yt(import.meta.url)),t=ce.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function nd(){let n=new N(`snapshot`).description(`Manage snapshots`);return n.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--no-wait`,`Return once the snapshot is accepted and print the operation to poll`).action(async(t,n)=>{let{context:i,client:a}=G(n),o=f(`Creating snapshot...`);o.start();let s=await q(a,i,t);if(n.wait===!1){let e=await s.snapshot({tags:n.tags,wait:!1});o.stop(),Uo(e.info,!!n.json);return}let c=await s.snapshot({tags:n.tags});o.stop(),n.json?e(c):(r(`Snapshot created: ${c.snapshotId}`),console.log(`Size: ${rd(c.sizeBytes??0)}`))}),n.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).action(async(n,r)=>{let{context:i,client:a}=G(r),o=f(`Fetching snapshots...`);o.start();let s=await(await q(a,i,n)).listSnapshots();o.stop(),r.json?e(s):t(s.map(e=>({...e,size:rd(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}),n.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--billing-owner <userId>`,`Platform user that pays for the restored sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).action(async(t,n,i)=>{let{client:a}=G(i),o=f(`Restoring from snapshot...`);o.start();let s=await a.create({fromSnapshot:n,fromSandboxId:t,...i.billingOwner?{billingOwnerId:i.billingOwner}:{}});await s.waitFor(`running`,{timeoutMs:12e4}),o.stop(),i.json?e({sandboxId:s.id,restoredFrom:n,status:s.status}):(r(`New sandbox created: ${s.id}`),console.log(`Source snapshot: ${n}`))}),n.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).action(async(t,n,i)=>{let{context:a,client:o}=G(i),s=f(`Reverting sandbox to snapshot...`);s.start();let c=await q(o,a,t),l=await c.revertToSnapshot(n);await c.refresh(),s.stop(),i.json?e({sandboxId:c.id,snapshotId:l.snapshotId,status:c.status}):(r(`Sandbox reverted: ${c.id}`),console.log(`Source snapshot: ${l.snapshotId}`))}),n.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).action(async(t,n,i)=>{let{context:a,client:o}=G(i),s=f(`Deleting snapshot...`);s.start();let c=await(await q(o,a,t)).deleteSnapshot(n);s.stop(),i.json?e({success:!0,sandboxId:t,snapshotId:n,outcome:c.outcome}):c.outcome===`already_absent`?r(`Snapshot already gone: ${n}`):r(`Snapshot deleted: ${n}`)}),n}function rd(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}const id=()=>import(`./device-i0PzYisd.mjs`);function ad(){let e=new N(`solve`).description(`Participate in Tangle Solve competitions`);e.command(`clone <competition>`).description(`Clone the pinned competition repository`).argument(`[directory]`,`Destination directory`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(async(e,t,n)=>(await import(`./clone-CWY8dI5d.mjs`)).cloneCompetition(e,t,n)),e.command(`run [competition]`).description(`Run the competition checker and record its evidence`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).action(async(e,t)=>(await import(`./run-BSXC2ytE.mjs`)).runCompetition(e,t)),e.command(`submit [competition]`).description(`Submit checker evidence through the device account and Tempo`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).option(`--pr-url <url>`,`GitHub pull request containing the submission`).option(`--model <name>`,`Model used to produce the submission`).option(`--note <text>`,`Short note shown with the accepted submission`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(async(e,t)=>(await import(`./submit-D2jvFJtX.mjs`)).submitCompetition(e,t)),e.command(`account`).description(`Show the local Solve signing account`).option(`--create`,`Create the account if it does not exist`).action(async e=>(await import(`./account-BaGFNxyq.mjs`)).showSolveAccount(e));let t=e.command(`device`).description(`List and revoke the Solve devices bound to your account`);return t.command(`list`).description(`List your devices and whether each may submit jobs on Tempo`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(async e=>(await id()).listSolveDevices(e)),t.command(`revoke <address>`).description(`Permanently revoke a device; the local device is revoked with its own key`).option(`--reason <text>`,`Why the device is revoked (shown to the account)`).option(`--yes`,`Confirm the permanent revocation without a prompt`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(async(e,t)=>(await id()).revokeSolveDevice(e,t)),e}function od(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sandboxes/${t}/runtime/ssh`}function sd(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function cd(e){return`'${e.replace(/'/g,`''`)}'`}function ld(e){return e===`win32`?`NUL`:`/dev/null`}function ud(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${cd(`<token>`)}; ssh ${e.map(cd).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${sd(`<token>`)} ssh ${e.map(sd).join(` `)}`}function dd(e){return e.connection!==void 0&&!e.connection.ssh}function fd(){d(`SSH is not enabled for this sandbox.`),l(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function pd(e,t=[],n=process.platform){let r=ld(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function md(){return new N(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).allowUnknownOption(!0).action(async(e,t,n)=>{let{context:r,client:i}=G(n),a=f(`Getting SSH credentials...`);a.start();let o=await q(i,r,e);if(dd(o)){a.stop(),fd();return}o=await J(o);let s=await o.ssh();if(a.stop(),!s){fd();return}let c={...s,proxyCommand:od(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let u=pd(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(ud(u,process.platform));return}l(`Connecting via tunnel...`);let p=qe(`ssh`,u,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});p.on(`error`,e=>{e.code===`ENOENT`&&(d(`SSH client not found. Please install OpenSSH.`),process.exit(1)),H(e)}),p.on(`exit`,e=>{process.exit(e??0)})})}function hd(){let t=new N(`ssh-keys`).description(`Manage SSH keys`);return t.command(`list`).description(`List SSH keys`).action(async t=>{let n=f(`Fetching SSH keys...`);try{n.start();let r=await W(U(t)).sshKeys.list();n.stop(),t.json?e({sshKeys:r}):r.length===0?l(`No SSH keys found.`):i([`Name`,`Type`,`Fingerprint`,`Created`],r.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){n.stop(),H(e)}}),t.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).action(async(t,n)=>{let i=f(`Adding SSH key...`);try{let a=ze(n.keyFile,`utf8`).trim();i.start();let o=await W(U(n)).sshKeys.create(t,a);i.stop(),n.json?e({sshKey:o}):r(`Added SSH key ${o.name} (${o.fingerprint})`)}catch(e){i.stop(),H(e)}}),t.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=f(`Deleting SSH key...`);try{n.start(),await W(U(t)).sshKeys.delete(e),n.stop(),r(`Deleted SSH key ${e}`)}catch(e){n.stop(),H(e)}}),t}function gd(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function _d(){return new N(`ssh-proxy`).description(`SSH proxy helper that pipes stdin/stdout to WebSocket`).argument(`<runtime-url>`,`Runtime WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||gd(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new URL(e.replace(/^http/,`ws`)),{default:r}=await import(`ws`),i=new r(n,{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),a;function o(){a&&=(clearInterval(a),void 0)}i.on(`open`,()=>{a=setInterval(()=>{i.readyState===r.OPEN&&i.ping()},15e3),a.unref?.(),process.stdin.on(`data`,e=>{i.readyState===r.OPEN&&i.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>i.close(1e3))}),i.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),i.on(`error`,e=>{o(),gd(`WebSocket error: ${e.message}`)}),i.on(`close`,e=>{o(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>i.close())})}function vd(){let n=new N(`team`).description(`Manage teams`);return $(n,`list`).description(`List teams for the current account`).action(async n=>{let r=U(n),i=W(r),a=n.json?null:f(`Fetching teams...`);a?.start();let o=await i.teams.list();if(a?.stop(),n.json){e({teams:o,activeTeamId:r.activeTeamId??null});return}t(o.map(e=>({active:e.id===r.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}),$(n,`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).action(async(t,n)=>{let i=U(n),a=W(i),o=n.json?null:f(`Creating team...`);o?.start();let s=await a.teams.create({name:t,orgId:n.orgId});if(n.switch&&qo(s,i.profile),o?.stop(),n.json){e({team:s,active:!!n.switch});return}r(`Team created: ${Wo(s)}`),n.switch&&r(`Active team set to ${s.name}`)}),$(n,`switch <team>`).description(`Set the active team for the current profile`).action(async(t,n)=>{let i=U(n),a=await Go(W(i),t);if(qo(a,i.profile),n.json){e({team:a,activeTeamId:a.id});return}r(`Active team set to ${Wo(a)}`)}),n.command(`current`).description(`Show the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(t=>{let n=kn(t.profile);if(t.json){e(n.activeTeamId?n:{activeTeamId:null});return}if(!n.activeTeamId){console.log(`No active team.`);return}s({ID:n.activeTeamId,Name:n.activeTeamName})}),n.command(`clear`).description(`Clear the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(t=>{if(Jo(t.profile),t.json){e({activeTeamId:null});return}r(`Active team cleared.`)}),$(n,`members [team]`).description(`List team members`).action(async(n,r)=>{let i=U(r),a=W(i),o=await Ko(a,n,i.profile),s=await a.teams.listMembers(o.id);if(r.json){e({team:o,members:s});return}t(s,[{key:`id`,header:`ID`,width:36},{key:`customerEmail`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}),$(n,`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile),c=yd(n.role),l=await a.teams.updateMember(o.id,t,{role:c});if(n.json){e({team:o,member:l});return}r(`Member updated: ${l.customerEmail}`),s({Team:o.name,Role:l.role,Status:l.status})}),$(n,`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile),c=yd(n.role),l=await a.teams.invite(o.id,{email:t,role:c,ttlHours:n.ttlHours?Number.parseInt(n.ttlHours,10):void 0});if(n.json){e({team:o,invitation:l});return}r(`Invitation created for ${l.email}`),s({Team:o.name,Role:l.role,Expires:l.expiresAt,"Invitation ID":l.id}),r(`Re-run with --json to retrieve the invitation token for sharing.`)}),$(n,`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,t,i.profile);if(!(!n.force&&!n.json&&!await pr(`Leave team '${o.name}'? (y/N) `,`--force`))){if(await a.teams.leave(o.id),i.activeTeamId===o.id&&Jo(i.profile),n.json){e({success:!0,teamId:o.id});return}r(`Left team: ${o.name}`)}}),$(n,`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).action(async(t,n,i)=>{let a=U(i),o=W(a),s=await Ko(o,n,a.profile);if(!(!i.force&&!i.json&&!await pr(`Transfer ownership of '${s.name}' to ${t}? This cannot be undone without the new owner's cooperation. (y/N) `,`--force`))){if(await o.teams.transferOwnership(s.id,t),i.json){e({success:!0,teamId:s.id,newOwnerCustomerId:t});return}r(`Ownership transferred for ${s.name}`)}}),n.addCommand(bd()),n.addCommand(xd()),$(n,`invitations [team]`).description(`List pending and historical team invitations`).action(async(n,r)=>{let i=U(r),a=W(i),o=await Ko(a,n,i.profile),s=await a.teams.listInvitations(o.id);if(r.json){e({team:o,invitations:s});return}t(s,[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}),$(n,`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).action(async(t,n)=>{let i=U(n),a=W(i),o=await a.teams.acceptInvitation(t),s=n.switch===!1?null:await a.teams.get(o.teamId);if(s&&qo(s,i.profile),n.json){e({member:o,activeTeamId:s?.id??null});return}r(`Invitation accepted for team ${o.teamId}`),s&&r(`Active team set to ${s.name}`)}),$(n,`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).action(async(t,n)=>{if(await W(U(n)).teams.revokeInvitation(t),n.json){e({success:!0,invitationId:t});return}r(`Invitation revoked: ${t}`)}),$(n,`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile);if(await a.teams.removeMember(o.id,t),n.json){e({success:!0,teamId:o.id,memberId:t});return}r(`Member removed: ${t}`)}),n}function yd(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function bd(){let n=new N(`secret`).description(`Manage team secrets`);return $(n,`list [team]`).description(`List team secret names`).action(async(n,r)=>{let i=U(r),a=W(i),o=await Ko(a,n,i.profile),s=await a.teams.listSecrets(o.id);if(r.json){e({team:o,secrets:s});return}t(s,[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}),$(n,`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).action(async(t,n,i)=>{let a=U(i),o=W(a),s=await Ko(o,i.team,a.profile),c=await ed({value:n,valueStdin:i.valueStdin,prompt:`Enter value for team secret '${t}': `}),l=await o.teams.upsertSecret(s.id,t,c);if(i.json){e({team:s,secret:l});return}r(`Team secret saved: ${l.name}`)}),$(n,`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile);if(!(!n.force&&!n.json&&!await pr(`Delete team secret '${t}' from '${o.name}'? (y/N) `,`--force`))){if(await a.teams.deleteSecret(o.id,t),n.json){e({success:!0,teamId:o.id,name:t});return}r(`Team secret deleted: ${t}`)}}),$(n,`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(t,n)=>{let r=U(n),i=W(r),a=await Ko(i,n.team,r.profile),o=await i.teams.revealSecret(a.id,t);if(n.json){e({teamId:a.id,...o});return}console.log(o.value)}),n}function xd(){let n=new N(`templates`).description(`Manage team golden-path templates`);return $(n,`list [team]`).description(`List a team's golden-path templates`).action(async(n,r)=>{let i=U(r),a=W(i),o=await Ko(a,n,i.profile),s=await a.teams.listTemplates(o.id);if(r.json){e({team:o,templates:s});return}if(s.length===0){console.log(`No templates yet for ${o.name}.`);return}t(s.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}),$(n,`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).action(async(t,n,i)=>{let a=U(i),o=W(a),s=await Ko(o,i.team,a.profile),c;if(i.config)try{let e=JSON.parse(i.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);c=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let l=await o.teams.createTemplate(s.id,{name:t,snapshotId:n,description:i.description,environment:i.environment,config:c});if(i.json){e({team:s,template:l});return}r(`Team template created: ${l.name} (${l.id})`)}),$(n,`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{let i=U(n),a=W(i),o=await Ko(a,n.team,i.profile);if(!(!n.force&&!n.json&&!await pr(`Delete template '${t}' from '${o.name}'? (y/N) `,`--force`))){if(await a.teams.deleteTemplate(o.id,t),n.json){e({success:!0,teamId:o.id,templateId:t});return}r(`Team template deleted: ${t}`)}}),n}function $(e,t){return e.command(t).option(`--profile <profile>`,`Credential profile`)}async function Sd(t,n,i){let a=new AbortController,o=()=>a.abort();try{let i=W(U({...t,timeout:void 0}));process.once(`SIGINT`,o),process.once(`SIGTERM`,o);let s=await n(i,{...t.timeout===void 0?{}:{timeoutMs:Number(t.timeout)*1e3},resumeJobId:t.resumeJob,signal:a.signal,onProgress:e=>{process.stderr.write(`Publication ${e.id}: ${e.status}\n`)}}).finally(()=>{process.off(`SIGINT`,o),process.off(`SIGTERM`,o)});t.json?e(s):r(`template`in s?`Published template: ${s.template.slug}`:`Published template version: ${s.version.id}`)}catch(e){if(e instanceof w&&e.status!==401&&e.job&&[`pending`,`scanning`,`ready`].includes(e.job.status)){let t=[`tangle`,`template`,...i,`--resume-job`,e.job.id].map(Ne).join(` `);Object.assign(e,{fix:{command:t}})}H(e,t.json)}}function Cd(){let n=new N(`template`).description(`Manage published public templates`);return n.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).action(async n=>{let r=W(U(n)),i=n.featured?await r.publicTemplates.featured():await r.publicTemplates.list({query:n.query,tag:n.tag});if(n.json){e({templates:i});return}t(i,[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forkCount`,header:`Forks`,width:8},{key:`sandboxCount`,header:`Sandboxes`,width:12},{key:`updatedAt`,header:`Updated`,width:24}])}),n.command(`get <id-or-slug>`).action(async(t,n)=>{let r=await W(U(n)).publicTemplates.get(t);if(n.json){e({template:r});return}e(r)}),n.command(`versions <id-or-slug>`).action(async(n,r)=>{let i=await W(U(r)).publicTemplates.versions(n);if(r.json){e({versions:i});return}t(i.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`createdAt`,header:`Created`,width:24}])}),n.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).action((e,t,n,r)=>Sd(r,async(i,a)=>({template:await i.publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom},a)}),[`publish`,e,t,n])),n.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).action((e,t,n,r)=>Sd(r,async(i,a)=>({version:await i.publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes},a)}),[`publish-version`,e,t,n])),n}function wd(){let t=new N(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return t.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).action(async t=>{try{let n={from:t.from,to:t.to,model:t.model,runId:t.run,status:t.status===void 0?void 0:Fd(t.status),q:t.query,cursor:t.cursor,limit:t.limit===void 0?void 0:Bd(t.limit)},r=Ed(t),i=t.json?null:f(`Fetching traces...`);i?.start();let a=await r.listTraces(n);if(i?.stop(),t.json)return e(a);kd(a.items),Nd(a.nextCursor)}catch(e){Od(e,t)}}),t.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).action(async(t,n)=>{try{let r=Ed(n);if(n.ndjson){await Dd(r,t);return}let i=n.json?null:f(`Fetching trace spans...`);i?.start();let a=await r.getTraceSpans(t,{cursor:n.cursor,limit:n.limit===void 0?void 0:Bd(n.limit)});if(i?.stop(),!n.cursor&&a.items.length===0)throw new B(`TRACE_NOT_FOUND`,`No spans for trace ${t}`,`A turn's spans arrive about a minute after it ends, and a key reads only its own account's traces`,`tangle traces list --limit 5`);if(n.json)return e(a);Ad(a.items),a.truncated&&s({Spans:`${a.items.length} of ${a.total} (truncated)`}),Nd(a.nextCursor)}catch(e){Od(e,n)}}),t.addCommand(Td()),t}function Td(){let t=new N(`runs`).description(`Read eval-runs pivoted off the trace surface`);return t.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).action(async t=>{try{let n={status:t.status===void 0?void 0:Ld(t.status),gate:t.gate===void 0?void 0:zd(t.gate),label:t.label,from:t.from,to:t.to,q:t.query,cursor:t.cursor,limit:t.limit===void 0?void 0:Bd(t.limit)},r=Ed(t),i=t.json?null:f(`Fetching runs...`);i?.start();let a=await r.listRuns(n);if(i?.stop(),t.json)return e(a);jd(a.items),Nd(a.nextCursor)}catch(e){Od(e,t)}}),t.command(`get <runId>`).description(`Show a single eval-run`).action(async(t,n)=>{try{let r=Ed(n),i=n.json?null:f(`Fetching run...`);i?.start();let a=await r.getRun(t);if(i?.stop(),n.json)return e(a);Md(a)}catch(e){Od(e,n)}}),t}function Ed(e){let t=yn(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return wt({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function Dd(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function Od(e,t){return H(e,t.json===!0)}function kd(e){t(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:Pd(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function Ad(e){t(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function jd(e){t(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function Md(e){s({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function Nd(e){e&&s({"Next page":`--cursor ${e}`})}function Pd(e){return e===null?`-`:`$${e.toFixed(4)}`}function Fd(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const Id=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function Ld(e){let t=Id.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${Id.join(`, `)}`)}const Rd=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function zd(e){let t=Rd.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${Rd.join(`, `)}`)}function Bd(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}const Vd=`@tangle-network/sandbox-cli`,Hd=`curl -fsSL https://sandbox.tangle.tools/install.sh | sh`,Ud=/^\d+\.\d+\.\d+$/;function Wd(e){let t=M(process.env.TANGLE_CLI_HOME||M(I(),`.local/share/tangle-cli`),`node_modules`,Vd);if(Le(t)&&Be(t)===e)return`tangle update`;if(e.endsWith(M(`lib`,`node_modules`,Vd)))return`npm install -g ${Vd}@latest`;if(e.includes(M(`pnpm`,`global`,``)))return`pnpm add -g ${Vd}@latest`;if(e.includes(`${ge}node_modules${ge}`))return``}const Gd=()=>`${process.env.TANGLE_NPM_REGISTRY??`https://registry.npmjs.org`}/${Vd.replace(`/`,`%2F`)}/latest`,Kd=`const fs = require("node:fs");
 const [file, url] = process.argv.slice(1);
 const record = (latest) => {
   const state = JSON.parse(fs.readFileSync(file, "utf8"));
@@ -178,7 +178,7 @@ const record = (latest) => {
 };
 fetch(url, { signal: AbortSignal.timeout(30000) })
   .then((r) => r.json()).then((b) => b.version, () => null)
-  .then((v) => record(${Ud}.test(v) ? v : null), () => {});`,qd=(e,t)=>e.localeCompare(t,`en`,{numeric:!0})>0;function Jd(e,t){let n=Wd(e);if(n===void 0||!process.stderr.isTTY||process.env.CI)return;let r=M(qt,`update-check.json`),i=Math.floor(Date.now()/864e5);try{let e=Ie(r)?JSON.parse(Re(r,`utf8`)):{},a=e.checked!==i,o=Ud.test(e.latest)&&qd(e.latest,t);if(!a&&(!o||e.shown===i))return;Le(qt,{mode:448,recursive:!0});let s={...e,checked:i,shown:o?i:e.shown};Ve(r,JSON.stringify(s)),a&&Ke(process.execPath,[`-e`,Kd,r,Gd()],{detached:!0,stdio:`ignore`}).unref(),o&&e.shown!==i&&console.error(`tangle ${t} is installed; ${e.latest} is latest.${n&&` Run: ${n}`}`)}catch{}}function Yd(e,t){return new N(`update`).description(`Install the latest published CLI`).action(async()=>{let n=Wd(e);if(n!==`tangle update`)throw new B(`UPDATE_ELSEWHERE`,`install.sh did not install this tangle`,n===void 0?`it runs from source`:`another tool owns it`,n||Hd);let r=(await fetch(Gd(),{signal:AbortSignal.timeout(1e4)}).then(e=>e.json()).catch(()=>({}))).version??``;if(!Ud.test(r))throw new B(`NETWORK_UNAVAILABLE`,`the npm registry gave no version`,`no published version was read`,`tangle update`);if(!qd(r,t))return console.log(`tangle ${t} is already current`);try{Ge(`bash`,[`-c`,`set -o pipefail; ${Hd}`],{stdio:[`ignore`,`ignore`,`inherit`]})}catch{throw new B(`UPDATE_INSTALL_FAILED`,`install.sh failed`,`its error is above`,Hd)}let i=JSON.parse(Re(M(e,`package.json`),`utf8`));console.log(`tangle ${t} -> ${i.version}`)})}function Xd(){return new N(`usage`).description(`Show account usage and billing information`).action(async t=>{let{client:n}=G(t),r=t.json?null:f(`Fetching usage...`);r?.start();let[i,a]=await Promise.all([n.usage(),n.subscription().catch(()=>null)]);r?.stop(),t.json?e({...i,subscription:a}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),s({"Active Sandboxes":i.activeSandboxes,"Total Sandboxes":i.totalSandboxes,"Compute Minutes":Zd(i.computeMinutes),"GPU Seconds":i.gpuSeconds,"GPU Spend":Qd(i.gpuCostUsd)}),a&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),s({Plan:a.plan,Status:a.status,"Credits Available":Qd(a.creditsAvailableUsd),"Credits Used":Qd(a.creditsUsedUsd),"Monthly Balance":Qd(a.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),s({Start:i.periodStart.toLocaleDateString(),End:i.periodEnd.toLocaleDateString()}),console.log())})}function Zd(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function Qd(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function $d(){return new N(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{if(t.clear){dn(),l(`Cleared the active sandbox.`);return}if(e){un(e),l(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=ln();l(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")})}function ef(e){t(e,[{key:`id`,header:`ID`},{key:`nodeId`,header:`Node`},{key:`name`,header:`Name`},{key:`contentType`,header:`Content Type`},{key:`byteSize`,header:`Bytes`},{key:`createdAt`,header:`Created`}])}function tf(t){t.command(`artifacts`).description(`List a run's artifact metadata (never the bytes)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(t,n,r)=>{let i=await(await X(r)).workflows.listArtifacts(t,n);if(r.json)return e(i);ef(i.artifacts)}),t.command(`artifact-download`).description(`Download one run artifact's bytes to a file`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).argument(`<artifactId>`,`Artifact ID`).option(`--out <file>`,`Destination file (defaults to the artifact ID)`).action(async(t,n,r,i)=>{let a=await(await X(i)).workflows.downloadArtifact(t,n,r),o=i.out??r;try{Ve(o,a.bytes)}catch(e){throw Error(`Could not write artifact to "${o}": ${e instanceof Error?e.message:String(e)}`)}if(i.json)return e({file:o,contentType:a.contentType,bytes:a.bytes.length});l(`Wrote ${o} (${a.bytes.length} bytes, ${a.contentType}).`)})}function nf(e){t(e.map(e=>({id:e.id,run:e.runId,title:e.title,options:e.options.join(`, `),requested:e.requestedAt,expires:e.expiresAt??``})),[{key:`id`,header:`ID`},{key:`run`,header:`Run`},{key:`title`,header:`Title`},{key:`options`,header:`Options`},{key:`requested`,header:`Requested`},{key:`expires`,header:`Expires`}])}function rf(t){t.command(`decisions`).description(`List a workflow's pending human decisions`).argument(`<id>`,`Workflow ID`).action(async(t,n)=>{let r=(await(await X(n)).workflows.listPendingDecisions()).decisions.filter(e=>e.workflowId===t);if(n.json)return e({decisions:r});nf(r)}),t.command(`decision-resolve`).description(`Answer the decision a run is parked on and resume it`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).requiredOption(`--choice <choice>`,`The option to resolve with (one of the decision's options)`).action(async(t,n,r)=>{let i=await X(r),a=await i.workflows.getRunDecision(t,n),o=await i.workflows.resolveRunDecision(t,n,{decisionId:a.id,choice:r.choice});if(r.json)return e(o);if(o.resumed){l(`Resolved decision ${o.decisionId} with "${o.choice}" — run ${o.runId} resumed.`);return}l(`Resolved decision ${o.decisionId} with "${o.choice}", but run ${o.runId} had already finished — nothing to resume.`)})}function af(e){try{return Re(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function of(e){t(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function sf(e){let n=e.workflows.filter(e=>e.failed>0).length,r=e.workflows.filter(e=>e.failed===0&&e.waiting>0).length,i=e.workflows.filter(e=>e.failed===0&&e.waiting===0&&e.runsInWindow>0).length;l(`${n} failing · ${r} waiting · ${i} healthy · ${e.workflows.length} total over ${e.window}`),t(e.workflows.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,runs:e.runsInWindow,failed:e.failed,waiting:e.waiting,success:e.successRate===null?`—`:`${Math.round(e.successRate*100)}%`,lastRun:e.lastRunStatus??`—`,lastRunAt:e.lastRunAt??`—`})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`runs`,header:`Runs`},{key:`failed`,header:`Failed`},{key:`waiting`,header:`Waiting`},{key:`success`,header:`Success`},{key:`lastRun`,header:`Last Run`},{key:`lastRunAt`,header:`Last Run At`}])}function cf(e){if(s({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(l(`Triggers`),lf(e.triggers)),e.validationErrors.length>0){l(`Validation issues`);for(let t of e.validationErrors)console.log(`  ${t.path}: ${t.message}`)}}function lf(e){t(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function uf(t){t.command(`list`).description(`List your workflows`).action(async t=>{let n=await(await X(t)).workflows.list();if(t.json)return e(n);of(n)}),t.command(`fleet`).description(`Fleet overview: every workflow's run tallies over a trailing window, failing-first`).option(`--window <window>`,`Trailing window: 24h, 7d, or 30d`,`7d`).action(async t=>{let n=await(await X(t)).workflows.fleetInsights({window:t.window});if(t.json)return e(n);sf(n)}),t.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--yaml`,`Print only the raw definition YAML (the export path — pipe to a file)`).action(async(t,n)=>{let r=await(await X(n)).workflows.get(t);if(n.yaml){if(r.definitionYaml===null)throw Error(`Workflow ${r.id} has no stored definition YAML to export`);process.stdout.write(r.definitionYaml.endsWith(`
-`)?r.definitionYaml:`${r.definitionYaml}\n`);return}if(n.json)return e(r);cf(r)}),t.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).action(async(t,n)=>{let r=af(t),i=await(await X(n)).workflows.create(r);if(n.json)return e(i);l(`Created workflow ${i.id} (${i.name}).`),cf(i)}),t.command(`apply`).description(`Create or update a workflow idempotently, matched by the definition's name`).argument(`<file>`,`Path to the workflow YAML`).action(async(t,n)=>{let r=af(t),i=await X(n),a=await i.workflows.validate(r,{structural:!0});if(!a.valid){if(process.exitCode=1,n.json)return e(a);l(`Invalid workflow:`);for(let e of a.errors)console.log(`  ${e.path}: ${e.message}`);return}let o=(await i.workflows.list()).find(e=>e.name===a.name);if(o){let t=await i.workflows.update(o.id,r);if(n.json)return e({action:`updated`,workflow:t});l(`Updated workflow ${t.id} (${t.name}) — matched by name.`),cf(t);return}let s=await i.workflows.create(r);if(n.json)return e({action:`created`,workflow:s});l(`Created workflow ${s.id} (${s.name}).`),cf(s)}),t.command(`update`).description(`Replace a workflow's definition from a YAML file`).argument(`<id>`,`Workflow ID`).argument(`<file>`,`Path to the workflow YAML`).option(`--note <note>`,`Revision note recorded on the appended revision (why this change)`).action(async(t,n,r)=>{let i=af(n),a=await(await X(r)).workflows.update(t,i,{...r.note===void 0?{}:{note:r.note}});if(r.json)return e(a);l(`Updated workflow ${a.id} (${a.name}).`),cf(a)}),t.command(`delete`).description(`Delete a workflow and its triggers`).argument(`<id>`,`Workflow ID`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{if(!n.force&&!await pr(`Delete workflow ${t}? `,`--force`)){l(`Delete cancelled.`);return}if(await(await X(n)).workflows.delete(t),n.json)return e({deleted:!0,id:t});l(`Deleted workflow ${t}.`)}),t.command(`validate`).description(`Validate a workflow YAML file without saving it`).argument(`<file>`,`Path to the workflow YAML`).option(`--structural`,`CI mode: compile + capability checks only, no connection resolution — the verdict is the same regardless of connected providers`).action(async(t,n)=>{let r=af(t),i=await(await X(n)).workflows.validate(r,{...n.structural?{structural:!0}:{}});if(n.json)return e(i);if(i.valid)l(`Valid: ${i.name} (${i.actionCount} action(s), ${i.triggerCount} trigger(s)).`);else{l(`Invalid workflow:`);for(let e of i.errors)console.log(`  ${e.path}: ${e.message}`);process.exitCode=1}}),t.command(`schema`).description(`Print the JSON Schema for the workflow YAML`).action(async t=>{e(await(await X(t)).workflows.schema())})}async function df(t,n,r){let i=await(await X(r)).workflows.setEnabled(t,n);if(r.json)return e(i);l(`${n?`Enabled`:`Disabled`} workflow ${i.id}.`),cf(i)}function ff(e,t){try{return JSON.parse(e)}catch{throw Error(`Invalid ${t}: not valid JSON`)}}function pf(e,t){try{Ve(e,t,`utf8`)}catch(t){throw Error(`Could not write workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function mf(e){t(e.map(e=>({id:e.id,name:e.name,category:e.category,providers:e.providers.join(`, `),summary:e.summary})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`category`,header:`Category`},{key:`providers`,header:`Providers`},{key:`summary`,header:`Summary`}])}function hf(e,t){let n=e.kind===`github_app`,r=n?`${e.provider} (App installation)`:e.provider,i=e.connectUrl?` — ${n?`install`:`connect`}: ${e.connectUrl}`:``,a=e.prerequisite;return`${r}${i}${a&&t.some(e=>e.provider===a.provider&&e.kind===a.kind&&!e.connected)?` (after connecting ${a.provider})`:``}`}function gf(t){t.command(`enable`).description(`Enable a workflow so its triggers and manual runs fire`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await df(e,!0,t)}),t.command(`disable`).description(`Disable a workflow (pause its triggers and manual runs)`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await df(e,!1,t)}),t.command(`templates`).description(`List the curated starter workflow templates`).action(async t=>{let n=await(await X(t)).workflows.listTemplates();if(t.json)return e(n);mf(n)}),t.command(`init`).description(`Create a workflow from a gallery template and print (or save) its YAML`).argument(`<template-id>`,"Template ID from `workflows templates`").option(`--param <key=value>`,`Template parameter value. Repeatable.`,Nc,[]).option(`--file <out>`,`Write the instantiated workflow YAML to this file instead of stdout`).action(async(t,n)=>{let r=Pc(n.param,`param`)??{},i=await(await X(n)).workflows.instantiateTemplate(t,r);if(n.json)return e(i);if(!i.created){l(`Template ${t} needs provider connections before it can run:`);for(let e of i.connectionRequirements)console.log(`  ${e.connected?`✓`:`✗`} ${hf(e,i.connectionRequirements)}`);process.exitCode=1;return}let{workflow:a}=i;if(a.definitionYaml===null)throw Error(`Workflow ${a.id} was created but the server returned no definition YAML`);if(l(`Created workflow ${a.id} (${a.name}).`),n.file){pf(n.file,a.definitionYaml),l(`Wrote ${n.file}.`);return}process.stdout.write(a.definitionYaml.endsWith(`
+  .then((v) => record(${Ud}.test(v) ? v : null), () => {});`,qd=(e,t)=>e.localeCompare(t,`en`,{numeric:!0})>0;function Jd(e,t){let n=Wd(e);if(n===void 0||!process.stderr.isTTY||process.env.CI)return;let r=M(qt,`update-check.json`),i=Math.floor(Date.now()/864e5);try{let e=Le(r)?JSON.parse(ze(r,`utf8`)):{},a=e.checked!==i,o=Ud.test(e.latest)&&qd(e.latest,t);if(!a&&(!o||e.shown===i))return;Re(qt,{mode:448,recursive:!0});let s={...e,checked:i,shown:o?i:e.shown};He(r,JSON.stringify(s)),a&&qe(process.execPath,[`-e`,Kd,r,Gd()],{detached:!0,stdio:`ignore`}).unref(),o&&e.shown!==i&&console.error(`tangle ${t} is installed; ${e.latest} is latest.${n&&` Run: ${n}`}`)}catch{}}function Yd(e,t){return new N(`update`).description(`Install the latest published CLI`).action(async()=>{let n=Wd(e);if(n!==`tangle update`)throw new B(`UPDATE_ELSEWHERE`,`install.sh did not install this tangle`,n===void 0?`it runs from source`:`another tool owns it`,n||Hd);let r=(await fetch(Gd(),{signal:AbortSignal.timeout(1e4)}).then(e=>e.json()).catch(()=>({}))).version??``;if(!Ud.test(r))throw new B(`NETWORK_UNAVAILABLE`,`the npm registry gave no version`,`no published version was read`,`tangle update`);if(!qd(r,t))return console.log(`tangle ${t} is already current`);try{Ke(`bash`,[`-c`,`set -o pipefail; ${Hd}`],{stdio:[`ignore`,`ignore`,`inherit`]})}catch{throw new B(`UPDATE_INSTALL_FAILED`,`install.sh failed`,`its error is above`,Hd)}let i=JSON.parse(ze(M(e,`package.json`),`utf8`));console.log(`tangle ${t} -> ${i.version}`)})}function Xd(){return new N(`usage`).description(`Show account usage and billing information`).action(async t=>{let{client:n}=G(t),r=t.json?null:f(`Fetching usage...`);r?.start();let[i,a]=await Promise.all([n.usage(),n.subscription().catch(()=>null)]);r?.stop(),t.json?e({...i,subscription:a}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),s({"Active Sandboxes":i.activeSandboxes,"Total Sandboxes":i.totalSandboxes,"Compute Minutes":Zd(i.computeMinutes),"GPU Seconds":i.gpuSeconds,"GPU Spend":Qd(i.gpuCostUsd)}),a&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),s({Plan:a.plan,Status:a.status,"Credits Available":Qd(a.creditsAvailableUsd),"Credits Used":Qd(a.creditsUsedUsd),"Monthly Balance":Qd(a.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),s({Start:i.periodStart.toLocaleDateString(),End:i.periodEnd.toLocaleDateString()}),console.log())})}function Zd(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function Qd(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function $d(){return new N(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{if(t.clear){dn(),l(`Cleared the active sandbox.`);return}if(e){un(e),l(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=ln();l(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")})}function ef(e){t(e,[{key:`id`,header:`ID`},{key:`nodeId`,header:`Node`},{key:`name`,header:`Name`},{key:`contentType`,header:`Content Type`},{key:`byteSize`,header:`Bytes`},{key:`createdAt`,header:`Created`}])}function tf(t){t.command(`artifacts`).description(`List a run's artifact metadata (never the bytes)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(t,n,r)=>{let i=await(await X(r)).workflows.listArtifacts(t,n);if(r.json)return e(i);ef(i.artifacts)}),t.command(`artifact-download`).description(`Download one run artifact's bytes to a file`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).argument(`<artifactId>`,`Artifact ID`).option(`--out <file>`,`Destination file (defaults to the artifact ID)`).action(async(t,n,r,i)=>{let a=await(await X(i)).workflows.downloadArtifact(t,n,r),o=i.out??r;try{He(o,a.bytes)}catch(e){throw Error(`Could not write artifact to "${o}": ${e instanceof Error?e.message:String(e)}`)}if(i.json)return e({file:o,contentType:a.contentType,bytes:a.bytes.length});l(`Wrote ${o} (${a.bytes.length} bytes, ${a.contentType}).`)})}function nf(e){t(e.map(e=>({id:e.id,run:e.runId,title:e.title,options:e.options.join(`, `),requested:e.requestedAt,expires:e.expiresAt??``})),[{key:`id`,header:`ID`},{key:`run`,header:`Run`},{key:`title`,header:`Title`},{key:`options`,header:`Options`},{key:`requested`,header:`Requested`},{key:`expires`,header:`Expires`}])}function rf(t){t.command(`decisions`).description(`List a workflow's pending human decisions`).argument(`<id>`,`Workflow ID`).action(async(t,n)=>{let r=(await(await X(n)).workflows.listPendingDecisions()).decisions.filter(e=>e.workflowId===t);if(n.json)return e({decisions:r});nf(r)}),t.command(`decision-resolve`).description(`Answer the decision a run is parked on and resume it`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).requiredOption(`--choice <choice>`,`The option to resolve with (one of the decision's options)`).action(async(t,n,r)=>{let i=await X(r),a=await i.workflows.getRunDecision(t,n),o=await i.workflows.resolveRunDecision(t,n,{decisionId:a.id,choice:r.choice});if(r.json)return e(o);if(o.resumed){l(`Resolved decision ${o.decisionId} with "${o.choice}" — run ${o.runId} resumed.`);return}l(`Resolved decision ${o.decisionId} with "${o.choice}", but run ${o.runId} had already finished — nothing to resume.`)})}function af(e){try{return ze(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function of(e){t(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function sf(e){let n=e.workflows.filter(e=>e.failed>0).length,r=e.workflows.filter(e=>e.failed===0&&e.waiting>0).length,i=e.workflows.filter(e=>e.failed===0&&e.waiting===0&&e.runsInWindow>0).length;l(`${n} failing · ${r} waiting · ${i} healthy · ${e.workflows.length} total over ${e.window}`),t(e.workflows.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,runs:e.runsInWindow,failed:e.failed,waiting:e.waiting,success:e.successRate===null?`—`:`${Math.round(e.successRate*100)}%`,lastRun:e.lastRunStatus??`—`,lastRunAt:e.lastRunAt??`—`})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`runs`,header:`Runs`},{key:`failed`,header:`Failed`},{key:`waiting`,header:`Waiting`},{key:`success`,header:`Success`},{key:`lastRun`,header:`Last Run`},{key:`lastRunAt`,header:`Last Run At`}])}function cf(e){if(s({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(l(`Triggers`),lf(e.triggers)),e.validationErrors.length>0){l(`Validation issues`);for(let t of e.validationErrors)console.log(`  ${t.path}: ${t.message}`)}}function lf(e){t(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function uf(t){t.command(`list`).description(`List your workflows`).action(async t=>{let n=await(await X(t)).workflows.list();if(t.json)return e(n);of(n)}),t.command(`fleet`).description(`Fleet overview: every workflow's run tallies over a trailing window, failing-first`).option(`--window <window>`,`Trailing window: 24h, 7d, or 30d`,`7d`).action(async t=>{let n=await(await X(t)).workflows.fleetInsights({window:t.window});if(t.json)return e(n);sf(n)}),t.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--yaml`,`Print only the raw definition YAML (the export path — pipe to a file)`).action(async(t,n)=>{let r=await(await X(n)).workflows.get(t);if(n.yaml){if(r.definitionYaml===null)throw Error(`Workflow ${r.id} has no stored definition YAML to export`);process.stdout.write(r.definitionYaml.endsWith(`
+`)?r.definitionYaml:`${r.definitionYaml}\n`);return}if(n.json)return e(r);cf(r)}),t.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).action(async(t,n)=>{let r=af(t),i=await(await X(n)).workflows.create(r);if(n.json)return e(i);l(`Created workflow ${i.id} (${i.name}).`),cf(i)}),t.command(`apply`).description(`Create or update a workflow idempotently, matched by the definition's name`).argument(`<file>`,`Path to the workflow YAML`).action(async(t,n)=>{let r=af(t),i=await X(n),a=await i.workflows.validate(r,{structural:!0});if(!a.valid){if(process.exitCode=1,n.json)return e(a);l(`Invalid workflow:`);for(let e of a.errors)console.log(`  ${e.path}: ${e.message}`);return}let o=(await i.workflows.list()).find(e=>e.name===a.name);if(o){let t=await i.workflows.update(o.id,r);if(n.json)return e({action:`updated`,workflow:t});l(`Updated workflow ${t.id} (${t.name}) — matched by name.`),cf(t);return}let s=await i.workflows.create(r);if(n.json)return e({action:`created`,workflow:s});l(`Created workflow ${s.id} (${s.name}).`),cf(s)}),t.command(`update`).description(`Replace a workflow's definition from a YAML file`).argument(`<id>`,`Workflow ID`).argument(`<file>`,`Path to the workflow YAML`).option(`--note <note>`,`Revision note recorded on the appended revision (why this change)`).action(async(t,n,r)=>{let i=af(n),a=await(await X(r)).workflows.update(t,i,{...r.note===void 0?{}:{note:r.note}});if(r.json)return e(a);l(`Updated workflow ${a.id} (${a.name}).`),cf(a)}),t.command(`delete`).description(`Delete a workflow and its triggers`).argument(`<id>`,`Workflow ID`).option(`--force`,`Skip confirmation prompt`).action(async(t,n)=>{if(!n.force&&!await pr(`Delete workflow ${t}? `,`--force`)){l(`Delete cancelled.`);return}if(await(await X(n)).workflows.delete(t),n.json)return e({deleted:!0,id:t});l(`Deleted workflow ${t}.`)}),t.command(`validate`).description(`Validate a workflow YAML file without saving it`).argument(`<file>`,`Path to the workflow YAML`).option(`--structural`,`CI mode: compile + capability checks only, no connection resolution — the verdict is the same regardless of connected providers`).action(async(t,n)=>{let r=af(t),i=await(await X(n)).workflows.validate(r,{...n.structural?{structural:!0}:{}});if(n.json)return e(i);if(i.valid)l(`Valid: ${i.name} (${i.actionCount} action(s), ${i.triggerCount} trigger(s)).`);else{l(`Invalid workflow:`);for(let e of i.errors)console.log(`  ${e.path}: ${e.message}`);process.exitCode=1}}),t.command(`schema`).description(`Print the JSON Schema for the workflow YAML`).action(async t=>{e(await(await X(t)).workflows.schema())})}async function df(t,n,r){let i=await(await X(r)).workflows.setEnabled(t,n);if(r.json)return e(i);l(`${n?`Enabled`:`Disabled`} workflow ${i.id}.`),cf(i)}function ff(e,t){try{return JSON.parse(e)}catch{throw Error(`Invalid ${t}: not valid JSON`)}}function pf(e,t){try{He(e,t,`utf8`)}catch(t){throw Error(`Could not write workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function mf(e){t(e.map(e=>({id:e.id,name:e.name,category:e.category,providers:e.providers.join(`, `),summary:e.summary})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`category`,header:`Category`},{key:`providers`,header:`Providers`},{key:`summary`,header:`Summary`}])}function hf(e,t){let n=e.kind===`github_app`,r=n?`${e.provider} (App installation)`:e.provider,i=e.connectUrl?` — ${n?`install`:`connect`}: ${e.connectUrl}`:``,a=e.prerequisite;return`${r}${i}${a&&t.some(e=>e.provider===a.provider&&e.kind===a.kind&&!e.connected)?` (after connecting ${a.provider})`:``}`}function gf(t){t.command(`enable`).description(`Enable a workflow so its triggers and manual runs fire`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await df(e,!0,t)}),t.command(`disable`).description(`Disable a workflow (pause its triggers and manual runs)`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await df(e,!1,t)}),t.command(`templates`).description(`List the curated starter workflow templates`).action(async t=>{let n=await(await X(t)).workflows.listTemplates();if(t.json)return e(n);mf(n)}),t.command(`init`).description(`Create a workflow from a gallery template and print (or save) its YAML`).argument(`<template-id>`,"Template ID from `workflows templates`").option(`--param <key=value>`,`Template parameter value. Repeatable.`,Nc,[]).option(`--file <out>`,`Write the instantiated workflow YAML to this file instead of stdout`).action(async(t,n)=>{let r=Pc(n.param,`param`)??{},i=await(await X(n)).workflows.instantiateTemplate(t,r);if(n.json)return e(i);if(!i.created){l(`Template ${t} needs provider connections before it can run:`);for(let e of i.connectionRequirements)console.log(`  ${e.connected?`✓`:`✗`} ${hf(e,i.connectionRequirements)}`);process.exitCode=1;return}let{workflow:a}=i;if(a.definitionYaml===null)throw Error(`Workflow ${a.id} was created but the server returned no definition YAML`);if(l(`Created workflow ${a.id} (${a.name}).`),n.file){pf(n.file,a.definitionYaml),l(`Wrote ${n.file}.`);return}process.stdout.write(a.definitionYaml.endsWith(`
 `)?a.definitionYaml:`${a.definitionYaml}\n`)})}function _f(e){t(e,[{key:`key`,header:`Key`},{key:`version`,header:`Version`},{key:`updatedAt`,header:`Updated`}])}function vf(t){s({Key:t.key,Version:t.version,Updated:t.updatedAt}),l(`Value`),e(t.value)}function yf(t){let n=t.command(`kv`).description(`Read and write a workflow's cross-run KV state`);n.command(`list`).description(`List every KV entry of a workflow`).argument(`<id>`,`Workflow ID`).action(async(t,n)=>{let r=await(await X(n)).workflows.listKv(t);if(n.json)return e(r);_f(r.entries)}),n.command(`get`).description(`Show one KV entry (value and version)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).action(async(t,n,r)=>{let i=await(await X(r)).workflows.getKv(t,n);if(r.json)return e(i);vf(i)}),n.command(`set`).description(`Write a KV entry from a JSON value`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).argument(`<json>`,`Value as JSON (e.g. '{"cursor":123}' or '"abc"')`).option(`--cas <version>`,`Compare-and-swap: write only if the stored version still equals this`).action(async(t,n,r,i)=>{let a=ff(r,`<json>`),o=i.cas===void 0?void 0:ba(i.cas,`--cas`),s=await X(i),c=o===void 0?await s.workflows.putKv(t,n,a):await s.workflows.casKv(t,n,o,a);if(i.json)return e(c);vf(c)}),n.command(`delete`).description(`Delete a KV entry (idempotent)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).action(async(t,n,r)=>{let i=await(await X(r)).workflows.deleteKv(t,n);if(r.json)return e(i);l(i.deleted?`Deleted KV entry "${n}" of workflow ${t}.`:`No KV entry "${n}" on workflow ${t}.`)})}function bf(e){t(e.map(e=>({rev:e.rev,created:e.createdAt,by:e.createdBy,source:e.source,note:e.note??``})),[{key:`rev`,header:`Rev`},{key:`created`,header:`Created`},{key:`by`,header:`Created By`},{key:`source`,header:`Source`},{key:`note`,header:`Note`}])}function xf(t){t.command(`revisions`).description(`List a workflow's definition revision history (newest first)`).argument(`<id>`,`Workflow ID`).action(async(t,n)=>{let r=await(await X(n)).workflows.listRevisions(t);if(n.json)return e(r);bf(r)}),t.command(`revision`).description(`Show one revision's metadata and definition YAML`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number`).action(async(t,n,r)=>{let i=ba(n,`<rev>`),a=await(await X(r)).workflows.getRevision(t,i);if(r.json)return e(a);s({Revision:a.rev,Created:a.createdAt,"Created by":a.createdBy,Source:a.source,Note:a.note??``}),process.stdout.write(a.yaml.endsWith(`
-`)?a.yaml:`${a.yaml}\n`)}),t.command(`rollback`).description(`Restore a prior revision's definition as a NEW head revision (re-validated)`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number to restore`).action(async(t,n,r)=>{let i=ba(n,`<rev>`),a=await(await X(r)).workflows.rollback(t,i);if(r.json)return e(a);l(`Rolled back workflow ${a.id} to rev ${i}.`),cf(a)})}function Sf(){let e=new N(`workflows`).description(`Create and manage Tangle workflows`);return uf(e),zc(e),gf(e),xf(e),yf(e),tf(e),rf(e),e}function Cf(e){for(let[t,n]of Object.entries(e.optsWithGlobals()))e.getOptionValue(t)===void 0&&n!==void 0&&e.setOptionValue(t,n)}const wf=_(import.meta.url),Tf=wf(`../package.json`),Ef=ue(wf.resolve(`../package.json`)),Df=Tf.version??`0.0.0`;function Of(){let e=new N,t=Yd(Ef,Df);e.name(`tangle`).description(`CLI for Tangle Sandbox operations`).version(Df).option(`--json`,`Output JSON where supported, including errors`).option(`--api-key <key>`,`API key (or set TANGLE_API_KEY)`).option(`--base-url <url>`,`API base URL`),e.hook(`preAction`,(e,n)=>{Cf(n);let r=n.opts(),i=r.json===!0||r.ndjson===!0;a(i),n!==t&&!i&&Jd(Ef,Df)}),e.addCommand(Qr()),e.addCommand(Zu()),e.addCommand($d()),e.addCommand($u()),e.addCommand(Tu()),e.addCommand(Fu()),e.addCommand(Iu()),e.addCommand(wo()),e.addCommand(md()),e.addCommand(hd()),e.addCommand(_d()),e.addCommand(Mr()),e.addCommand(nd()),e.addCommand(_s()),e.addCommand(Xd()),e.addCommand(vd()),e.addCommand(Cd()),e.addCommand(si()),e.addCommand(vi()),e.addCommand(Uu()),e.addCommand(vs()),e.addCommand(xs()),e.addCommand(au()),e.addCommand(Tl()),e.addCommand(Sf()),e.addCommand(ao()),e.addCommand(Qu()),e.addCommand(ad()),e.addCommand(td()),e.addCommand(yi()),e.addCommand(Vu()),e.addCommand(ou()),e.addCommand(Qa()),e.addCommand($a()),e.addCommand(Yu()),e.addCommand(Lu()),e.addCommand(wd()),e.addCommand(Hs()),e.addCommand(t);function n(e){e.configureHelp({showGlobalOptions:!0}),e.configureOutput({writeErr:()=>{}}),e.exitOverride(t=>{t.exitCode===0&&process.exit(0),H(t,e.optsWithGlobals().json===!0)});for(let t of e.commands)n(t)}return n(e),e}const kf=Of();kf.parseAsync(process.argv).catch(e=>{H(e,kf.opts().json===!0)});export{Dn as _,sc as a,rc as c,Rs as d,Ye as f,$t as g,rn as h,pc as i,Zs as l,bn as m,tu as n,cc as o,pr as p,X as r,dc as s,Q as t,Xs as u,B as v,H as y};
+`)?a.yaml:`${a.yaml}\n`)}),t.command(`rollback`).description(`Restore a prior revision's definition as a NEW head revision (re-validated)`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number to restore`).action(async(t,n,r)=>{let i=ba(n,`<rev>`),a=await(await X(r)).workflows.rollback(t,i);if(r.json)return e(a);l(`Rolled back workflow ${a.id} to rev ${i}.`),cf(a)})}function Sf(){let e=new N(`workflows`).description(`Create and manage Tangle workflows`);return uf(e),zc(e),gf(e),xf(e),yf(e),tf(e),rf(e),e}function Cf(e){for(let[t,n]of Object.entries(e.optsWithGlobals()))e.getOptionValue(t)===void 0&&n!==void 0&&e.setOptionValue(t,n)}const wf=_(import.meta.url),Tf=wf(`../package.json`),Ef=ue(wf.resolve(`../package.json`)),Df=Tf.version??`0.0.0`;function Of(){let e=new N,t=Yd(Ef,Df);e.name(`tangle`).description(`CLI for Tangle Sandbox operations`).version(Df).option(`--json`,`Output JSON where supported, including errors`).option(`--api-key <key>`,`API key (or set TANGLE_API_KEY)`).option(`--base-url <url>`,`API base URL`),e.hook(`preAction`,(e,n)=>{Cf(n);let r=n.opts(),i=r.json===!0||r.ndjson===!0;a(i),n!==t&&!i&&Jd(Ef,Df)}),e.addCommand(Qr()),e.addCommand(Zu()),e.addCommand($d()),e.addCommand($u()),e.addCommand(Tu()),e.addCommand(Fu()),e.addCommand(Iu()),e.addCommand(wo()),e.addCommand(md()),e.addCommand(hd()),e.addCommand(_d()),e.addCommand(Mr()),e.addCommand(nd()),e.addCommand(_s()),e.addCommand(Xd()),e.addCommand(vd()),e.addCommand(Cd()),e.addCommand(si()),e.addCommand(vi()),e.addCommand(Uu()),e.addCommand(vs()),e.addCommand(xs()),e.addCommand(au()),e.addCommand(Tl()),e.addCommand(Sf()),e.addCommand(ao()),e.addCommand(Qu()),e.addCommand(ad()),e.addCommand(td()),e.addCommand(yi()),e.addCommand(Vu()),e.addCommand(ou()),e.addCommand(Qa()),e.addCommand($a()),e.addCommand(Yu()),e.addCommand(Lu()),e.addCommand(wd()),e.addCommand(Hs()),e.addCommand(t);function n(e){e.configureHelp({showGlobalOptions:!0}),e.configureOutput({writeErr:()=>{}}),e.exitOverride(t=>{t.exitCode===0&&process.exit(0),H(t,e.optsWithGlobals().json===!0)});for(let t of e.commands)n(t)}return n(e),e}const kf=Of();kf.parseAsync(process.argv).catch(e=>{H(e,kf.opts().json===!0)});export{Dn as _,sc as a,rc as c,Rs as d,Xe as f,$t as g,rn as h,pc as i,Zs as l,bn as m,tu as n,cc as o,pr as p,X as r,dc as s,Q as t,Xs as u,B as v,H as y};