@tangle-network/sandbox-cli 0.27.2-develop.20260818091655.8a33197 → 0.27.2-develop.20260818214143.efd4338
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SKILL.md +10 -1
- package/dist/index.mjs +20 -20
- package/package.json +4 -4
package/dist/index.mjs
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
import{createRequire as e}from"node:module";import"dotenv/config";import{Command as t}from"commander";import{createHash as n,randomBytes as r,randomUUID as i}from"node:crypto";import a from"chalk";import*as o from"node:fs";import{chmodSync as s,existsSync as c,mkdirSync as l,readFileSync as u,renameSync as d,writeFileSync as f}from"node:fs";import*as p from"node:path";import{basename as m,dirname as ee,extname as te,join as h,resolve as ne}from"node:path";import{AuthError as re,NetworkError as g,NotFoundError as ie,QuotaError as ae,Sandbox as _,ServerError as oe,StateError as se,TimeoutError as ce,ValidationError as le,createBatchResultAccumulator as ue,createConfidentialSandbox as de,generateAttestationNonce as fe,parseBackendType as pe,parseSSEStream as me,validateBatchRunRequest as he}from"@tangle-network/sandbox";import*as ge from"node:os";import{homedir as _e,tmpdir as ve}from"node:os";import{execFileSync as ye,spawn as be}from"node:child_process";import{HubClient as xe,HubSdkError as Se}from"@tangle-network/hub-sdk";import Ce from"ora";import{CONTENT_COMPLETION_KEY as we,CONTENT_PROMPT_KEY as Te,CONTENT_TOOL_ARGS_KEY as Ee,CONTENT_TOOL_NAME_KEY as De,CONTENT_TOOL_RESULT_KEY as Oe,TANGLE_SUBJECT_KEY as ke,asContentField as v,asContentString as Ae}from"@tangle-network/agent-core/telemetry";import{createMcpServer as je}from"@tangle-network/sandbox/agent";import{readFile as Me}from"node:fs/promises";import{fileURLToPath as Ne}from"node:url";import Pe from"ws";import{modelProvider as Fe}from"@tangle-network/agent-interface";import{supervise as Ie,workerFromBackend as Le}from"@tangle-network/agent-runtime/kernel";import{createIntelligenceClient as Re}from"@tangle-network/sandbox/intelligence";function ze(e){if(e.startsWith(`github:`)){let[t,n]=e.slice(7).split(`@`,2),r=t.split(`/`).filter(Boolean);if(r.length<3)throw Error(`invalid github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let i=`${r[0]}/${r[1]}`,a=r.slice(2).join(`/`);return{kind:`github`,repository:i,path:a,...n?{ref:n}:{},name:m(a)}}let t;try{t=u(e,`utf8`)}catch{throw Error(`cannot read skill/tool "${e}": not a readable file and not a github: ref`)}return{kind:`inline`,name:m(e),content:t}}function Be(e){let t=(e.skills??[]).map(ze),n=(e.tools??[]).map(ze),r=t.length>0||n.length>0;if(!(!e.model&&!e.systemPrompt&&!r))return{...e.model?{model:{default:e.model}}:{},...e.systemPrompt?{prompt:{systemPrompt:e.systemPrompt}}:{},...r?{resources:{...t.length>0?{skills:t}:{},...n.length>0?{tools:n}:{}}}:{}}}async function Ve(e){let t;if(e.startsWith(`github:`)){let[n,r]=e.slice(7).split(`@`,2),i=n.split(`/`).filter(Boolean);if(i.length<3)throw Error(`invalid --profile github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let a=r??`main`;t=await Ye(`https://raw.githubusercontent.com/${i[0]}/${i[1]}/${a}/${i.slice(2).join(`/`)}`)}else t=/^https?:\/\//.test(e)?await Ye(e):u(e,`utf8`);let n;try{n=JSON.parse(t)}catch{throw Error(`profile at "${e}" is not valid JSON`)}return Ge(n,e),n}const He=[`prompt`,`model`,`permissions`,`tools`,`mcp`,`connections`,`subagents`,`resources`,`hooks`,`modes`,`confidential`,`extensions`],Ue=new Set([...He,`name`,`description`,`version`,`tags`,`metadata`]),We=[`files`,`tools`,`skills`,`agents`,`commands`];function Ge(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`profile at "${t}" is not an object`);let n=Object.keys(e),r=n.some(e=>He.includes(e)),i=n.includes(`name`)&&n.every(e=>Ue.has(e));if(!r&&!i)throw Error(`"${t}" does not look like an agent profile: no recognized profile keys (model, prompt, resources, tools, connections, …). Got: ${n.slice(0,6).join(`, `)||`(empty object)`}.`);Ke(e,t)}function Ke(e,t){let n=e.resources;if(!n||typeof n!=`object`)return;for(let e of We){let r=n[e];if(r!==void 0){if(!Array.isArray(r))throw Error(`profile at "${t}" is malformed: resources.${e} must be an array`);for(let n of r)Je(e===`files`?qe(n):n,t)}}let r=n.instructions;r!==void 0&&typeof r!=`string`&&Je(r,t)}function qe(e){return e&&typeof e==`object`?e.resource:e}function Je(e,t){let n=e&&typeof e==`object`?e.kind:void 0;if(n!==`inline`&&n!==`github`)throw Error(`profile at "${t}" has an invalid resource ref kind ${JSON.stringify(n)}: expected "inline" or "github"`)}async function Ye(e){let t=await fetch(e);if(!t.ok)throw Error(`failed to fetch ${e} (${t.status})`);return t.text()}async function Xe(e){let t=e.profileSource?await Ve(e.profileSource):void 0,n=Be(e);return t?n?{...t,...n,...n.resources?{resources:{...t.resources,...n.resources}}:{}}:t:n}const Ze=p.join(ge.homedir(),`.tangle`),y=p.join(Ze,`credentials.json`),Qe=`tangle-sandbox-cli`,$e=`TANGLE_ALLOW_PLAINTEXT_CREDENTIALS`;var et=class extends Error{constructor(e,t){super(`Credentials file at ${e} is corrupted and cannot be parsed. Inspect or remove it manually before retrying — refusing to overwrite it automatically.`),this.filePath=e,this.name=`CredentialsFileCorruptedError`,t&&(this.cause=t)}},tt=class extends Error{constructor(){super(`Could not store credential in the OS keychain, and the plaintext fallback is not enabled. Install a keychain provider (macOS Keychain or libsecret/secret-tool on Linux), or set ${$e}=1 to opt into a plaintext credentials.json with mode 0600.`),this.name=`KeychainUnavailableError`}};function nt(e){let t=ot(e);if(t)return{value:t,source:`keychain`};let n=lt(e);return n?{value:n,source:`file`}:{source:`none`}}function rt(e,t){if(st(e,t))return dt(e),`keychain`;if(!at())throw new tt;return ut(e,t),`file`}function it(e){ct(e),dt(e)}function at(){let e=process.env[$e];if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function ot(e){if(process.platform===`darwin`)try{return ye(`security`,[`find-generic-password`,`-s`,Qe,`-a`,ht(e),`-w`],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`]}).trim()}catch{return}if(process.platform===`linux`)try{return ye(`secret-tool`,[`lookup`,`service`,Qe,`account`,ht(e)],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`]}).trim()}catch{return}}function st(e,t){if(process.platform===`darwin`)try{return ye(`security`,[`add-generic-password`,`-U`,`-s`,Qe,`-a`,ht(e),`-w`,t],{stdio:[`ignore`,`ignore`,`ignore`]}),!0}catch{return!1}if(process.platform===`linux`)try{return ye(`secret-tool`,[`store`,`--label=Tangle Sandbox CLI`,`service`,Qe,`account`,ht(e)],{input:t,stdio:[`pipe`,`ignore`,`ignore`]}),!0}catch{return!1}return!1}function ct(e){if(process.platform===`darwin`){try{ye(`security`,[`delete-generic-password`,`-s`,Qe,`-a`,ht(e)],{stdio:[`ignore`,`ignore`,`ignore`]})}catch{}return}if(process.platform===`linux`)try{ye(`secret-tool`,[`clear`,`service`,Qe,`account`,ht(e)],{stdio:[`ignore`,`ignore`,`ignore`]})}catch{}}function lt(e){return ft()[e]}function ut(e,t){let n=ft();n[e]=t,pt(n)}function dt(e){let t;try{t=ft()}catch(e){if(e instanceof et)return;throw e}e in t&&(delete t[e],pt(t))}function ft(){let e;try{e=o.readFileSync(y,`utf8`)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return{};throw e}try{let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw new et(y);let n={};for(let[e,r]of Object.entries(t))typeof r==`string`&&(n[e]=r);return n}catch(e){throw e instanceof et?e:new et(y,e instanceof Error?e:void 0)}}function pt(e){if(mt(),Object.keys(e).length===0){o.existsSync(y)&&o.unlinkSync(y);return}let t=`${y}.${process.pid}.tmp`;o.writeFileSync(t,`${JSON.stringify(e,null,2)}\n`,{mode:384}),o.renameSync(t,y)}function mt(){if(!o.existsSync(Ze)){o.mkdirSync(Ze,{mode:448,recursive:!0});return}if(process.platform!==`win32`)try{(o.statSync(Ze).mode&511)!=448&&o.chmodSync(Ze,448)}catch{}}function ht(e){return`profile:${e}`}const gt=p.join(ge.homedir(),`.tangle`),_t=p.join(gt,`credentials`),vt=p.join(gt,`config.json`),b=`default`;function yt(){o.existsSync(gt)||o.mkdirSync(gt,{mode:448,recursive:!0})}function bt(e,t){yt();let n=`${e}.${process.pid}.tmp`;o.writeFileSync(n,t,{mode:384}),o.renameSync(n,e)}function xt(){try{if(o.existsSync(_t)){let e=o.readFileSync(_t,`utf-8`).trim();return St(e)?e:e.match(/api_key\s*=\s*(\S+)/)?.[1]}}catch{}}function St(e){return e.startsWith(`sk_`)||e.startsWith(`sk-tan-`)}function Ct(){try{o.existsSync(_t)&&o.unlinkSync(_t)}catch{}}function x(){return Wt(Ut())}function wt(e){let t=Gt(x(),e);bt(vt,`${JSON.stringify(t,null,2)}\n`)}function S(e){return Kt(e||process.env.TANGLE_PROFILE||process.env.SANDBOX_PROFILE||x().activeProfile||b)}function Tt(e){wt({activeProfile:Kt(e)})}function Et(){return process.env.TANGLE_SANDBOX||x().currentSandbox||void 0}function Dt(e){wt({currentSandbox:e})}function Ot(){let e=x();delete e.currentSandbox,bt(vt,`${JSON.stringify(e,null,2)}\n`)}function kt(){let e=x().deviceId;if(e&&/^[A-Za-z0-9_.-]{1,64}$/.test(e))return e;let t=ge.hostname().replace(/[^A-Za-z0-9_.-]/g,`-`).replace(/^-+|-+$/g,``).slice(0,32),n=r(4).toString(`hex`),i=`${t?`${t}-`:`device-`}${n}`;return wt({deviceId:i}),i}function At(e){let t=e||Et();if(!t)throw Error("No sandbox specified. Pass it positionally, set a default with `tangle use <id>`, pass `--box <id>`, or set TANGLE_SANDBOX.");return t}function jt(){let e=x(),t=S(),n=new Set([b,...Object.keys(e.profiles??{})]);return e.activeProfile&&n.add(Kt(e.activeProfile)),[...n].map(e=>{let n=nt(e),r=e===b?xt():void 0,i=n.source===`none`?r?`legacy-file`:`none`:n.source;return{name:e,active:e===t,hasApiKey:n.source!==`none`||!!r,baseUrl:Lt(void 0,e),apiKeySource:i}}).sort((e,t)=>e.name.localeCompare(t.name))}function Mt(e){let t=S(e);return{name:t,active:t===S(),apiKey:Ft(void 0,t),baseUrl:Lt(void 0,t),credentialSource:It(void 0,t)}}function Nt(e,t){let n=Kt(e),r=x(),i=Ht(n,r),a={},o=t.baseUrl??i.baseUrl;o&&(a.baseUrl=o);let s=t.activeTeamId??i.activeTeamId;s&&(a.activeTeamId=s);let c=t.activeTeamName??i.activeTeamName;c&&(a.activeTeamName=c);let l={...r.profiles??{}};a.baseUrl||a.activeTeamId||a.activeTeamName?l[n]=a:delete l[n];let u;return t.apiKey&&(u=rt(n,t.apiKey),n===b&&Ct()),wt({profiles:Object.keys(l).length>0?l:{}}),u}function Pt(e){let t=S(e),n={...x().profiles??{}},r=n[t];if(r){let e={...r,apiKey:void 0};e.baseUrl||e.activeTeamId||e.activeTeamName?n[t]=e:delete n[t]}wt({profiles:n}),it(t),t===b&&Ct()}function Ft(e,t){if(e)return e;let n=process.env.TANGLE_API_KEY;if(n)return n;let r=S(t),i=nt(r);if(i.value)return i.value;if(r===b)return xt()}function It(e,t){if(e)return`flag`;if(process.env.TANGLE_API_KEY)return`env`;let n=S(t),r=nt(n);return r.source===`none`?n===b&&xt()?`legacy-file`:`none`:r.source}function Lt(e,t){if(e)return e;let n=process.env.TANGLE_BASE_URL||process.env.SANDBOX_BASE_URL;if(n)return n;let r=S(t),i=x(),a=Ht(r,i);return a.baseUrl?a.baseUrl:r===b&&i.baseUrl?i.baseUrl:`https://sandbox.tangle.tools`}function Rt(e){if(e)return e.replace(/\/v1\/hub\/?$/,``)}function C(e){let t=S(e.profile),n=Ft(e.apiKey,t);if(!n)throw Error(`No API key found for profile '${t}'. Set TANGLE_API_KEY or run: tangle auth login${t===b?``:` --profile ${t}`}`);return{apiKey:n,baseUrl:Lt(e.baseUrl,t),timeout:e.timeout??3e4,profile:t,...zt(t)}}function zt(e){let t=x(),n=Ht(S(e),t);return{activeTeamId:n.activeTeamId,activeTeamName:n.activeTeamName}}function Bt(e,t){Nt(S(t),{activeTeamId:e.id,activeTeamName:e.name})}function Vt(e){let t=S(e),n=x(),r={...n.profiles??{}},i={baseUrl:Ht(t,n).baseUrl};i.baseUrl?r[t]=i:delete r[t],wt({profiles:r})}function Ht(e,t=x()){let n=Kt(e);return{...n===b?{baseUrl:t.baseUrl,activeTeamId:t.profiles?.[b]?.activeTeamId,activeTeamName:t.profiles?.[b]?.activeTeamName}:{},...t.profiles?.[n]??{}}}function Ut(){try{if(o.existsSync(vt)){let e=o.readFileSync(vt,`utf-8`);return JSON.parse(e)}}catch{}return{}}function Wt(e){let t=!1,n={};e.apiKey&&(rt(b,e.apiKey),Ct(),t=!0);for(let[r,i]of Object.entries(e.profiles??{})){i.apiKey&&(rt(r,i.apiKey),t=!0);let e={};i.baseUrl&&(e.baseUrl=i.baseUrl),i.activeTeamId&&(e.activeTeamId=i.activeTeamId),i.activeTeamName&&(e.activeTeamName=i.activeTeamName),Object.keys(e).length>0&&(n[r]=e)}let r={...e,apiKey:void 0,profiles:Object.keys(n).length>0?n:void 0};return t&&bt(vt,`${JSON.stringify(r,null,2)}\n`),r}function Gt(e,t){let n=t.profiles===void 0?{...e.profiles??{}}:Object.fromEntries(Object.entries(t.profiles).filter(([,e])=>!!(e.apiKey||e.baseUrl||e.activeTeamId||e.activeTeamName)));return{...e,...t,profiles:Object.keys(n).length>0?n:void 0}}function Kt(e){let t=e.trim().toLowerCase();if(!t)throw Error(`Profile name cannot be empty`);if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw Error(`Profile names may only contain lowercase letters, numbers, dots, underscores, and hyphens`);return t}let w=null,qt=null;function T(e){if(e)return w&&qt&&qt.apiKey===e.apiKey&&qt.baseUrl===e.baseUrl&&qt.timeout===e.timeout?w:(w=new _({apiKey:e.apiKey,baseUrl:e.baseUrl,timeoutMs:e.timeout}),qt=e,w);if(w)return w;let t=C({});return w=new _({apiKey:t.apiKey,baseUrl:t.baseUrl,timeoutMs:t.timeout}),qt=t,w}function Jt(){w=null,qt=null}async function Yt(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);if(n.startsWith(`hubconn_`))return n;let{connections:r}=await e.connections.list();return Xt(r,n)}function Xt(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);let r=e.find(e=>e.id===n);if(r)return r.id;let i=n.indexOf(`:`),a=(i===-1?n:n.slice(0,i)).trim().toLowerCase(),o=i===-1?null:n.slice(i+1).trim(),s=e.filter(e=>e.status!==`revoked`&&e.providerId.toLowerCase()===a);if(o&&o.length>0){let e=o.toLowerCase();s=s.filter(t=>(t.accountDisplay??``).toLowerCase()===e||t.displayName.toLowerCase()===e)}if(s.length===1)return s[0].id;throw s.length===0?Error(`No hub connection matches "${t}". List your connections with \`tangle hub connections\`.`):Error(Zt(t,s))}function Zt(e,t){let n=t.map(e=>`- ${e.id} (provider: ${e.providerId}, account: ${e.accountDisplay??e.displayName})`).join(`
|
|
1
|
+
import{createRequire as e}from"node:module";import"dotenv/config";import{Command as t}from"commander";import{createHash as n,randomBytes as r,randomUUID as i}from"node:crypto";import a from"chalk";import*as o from"node:fs";import{chmodSync as s,existsSync as c,mkdirSync as l,readFileSync as u,renameSync as d,writeFileSync as f}from"node:fs";import*as p from"node:path";import{basename as m,dirname as ee,extname as te,join as h,resolve as ne}from"node:path";import{AuthError as g,NetworkError as _,NotFoundError as re,QuotaError as ie,Sandbox as v,ServerError as ae,StateError as oe,TimeoutError as se,ValidationError as ce,createBatchResultAccumulator as le,createConfidentialSandbox as ue,generateAttestationNonce as de,parseBackendType as fe,parseSSEStream as pe,validateBatchRunRequest as me}from"@tangle-network/sandbox";import*as he from"node:os";import{homedir as ge,tmpdir as _e}from"node:os";import{execFileSync as ve,spawn as ye}from"node:child_process";import{HubClient as be,HubSdkError as xe}from"@tangle-network/hub-sdk";import Se from"ora";import{CONTENT_COMPLETION_KEY as Ce,CONTENT_PROMPT_KEY as we,CONTENT_TOOL_ARGS_KEY as Te,CONTENT_TOOL_NAME_KEY as Ee,CONTENT_TOOL_RESULT_KEY as De,TANGLE_SUBJECT_KEY as Oe,asContentField as y,asContentString as ke}from"@tangle-network/agent-core/telemetry";import{createMcpServer as Ae}from"@tangle-network/sandbox/agent";import{readFile as je}from"node:fs/promises";import{fileURLToPath as Me}from"node:url";import Ne from"ws";import{modelProvider as Pe}from"@tangle-network/agent-interface";import{supervise as Fe,workerFromBackend as Ie}from"@tangle-network/agent-runtime/kernel";import{createIntelligenceClient as Le}from"@tangle-network/sandbox/intelligence";function Re(e){if(e.startsWith(`github:`)){let[t,n]=e.slice(7).split(`@`,2),r=t.split(`/`).filter(Boolean);if(r.length<3)throw Error(`invalid github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let i=`${r[0]}/${r[1]}`,a=r.slice(2).join(`/`);return{kind:`github`,repository:i,path:a,...n?{ref:n}:{},name:m(a)}}let t;try{t=u(e,`utf8`)}catch{throw Error(`cannot read skill/tool "${e}": not a readable file and not a github: ref`)}return{kind:`inline`,name:m(e),content:t}}function ze(e){let t=(e.skills??[]).map(Re),n=(e.tools??[]).map(Re),r=t.length>0||n.length>0;if(!(!e.model&&!e.systemPrompt&&!r))return{...e.model?{model:{default:e.model}}:{},...e.systemPrompt?{prompt:{systemPrompt:e.systemPrompt}}:{},...r?{resources:{...t.length>0?{skills:t}:{},...n.length>0?{tools:n}:{}}}:{}}}async function Be(e){let t;if(e.startsWith(`github:`)){let[n,r]=e.slice(7).split(`@`,2),i=n.split(`/`).filter(Boolean);if(i.length<3)throw Error(`invalid --profile github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let a=r??`main`;t=await Je(`https://raw.githubusercontent.com/${i[0]}/${i[1]}/${a}/${i.slice(2).join(`/`)}`)}else t=/^https?:\/\//.test(e)?await Je(e):u(e,`utf8`);let n;try{n=JSON.parse(t)}catch{throw Error(`profile at "${e}" is not valid JSON`)}return We(n,e),n}const Ve=[`prompt`,`model`,`permissions`,`tools`,`mcp`,`connections`,`subagents`,`resources`,`hooks`,`modes`,`confidential`,`extensions`],He=new Set([...Ve,`name`,`description`,`version`,`tags`,`metadata`]),Ue=[`files`,`tools`,`skills`,`agents`,`commands`];function We(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`profile at "${t}" is not an object`);let n=Object.keys(e),r=n.some(e=>Ve.includes(e)),i=n.includes(`name`)&&n.every(e=>He.has(e));if(!r&&!i)throw Error(`"${t}" does not look like an agent profile: no recognized profile keys (model, prompt, resources, tools, connections, …). Got: ${n.slice(0,6).join(`, `)||`(empty object)`}.`);Ge(e,t)}function Ge(e,t){let n=e.resources;if(!n||typeof n!=`object`)return;for(let e of Ue){let r=n[e];if(r!==void 0){if(!Array.isArray(r))throw Error(`profile at "${t}" is malformed: resources.${e} must be an array`);for(let n of r)qe(e===`files`?Ke(n):n,t)}}let r=n.instructions;r!==void 0&&typeof r!=`string`&&qe(r,t)}function Ke(e){return e&&typeof e==`object`?e.resource:e}function qe(e,t){let n=e&&typeof e==`object`?e.kind:void 0;if(n!==`inline`&&n!==`github`)throw Error(`profile at "${t}" has an invalid resource ref kind ${JSON.stringify(n)}: expected "inline" or "github"`)}async function Je(e){let t=await fetch(e);if(!t.ok)throw Error(`failed to fetch ${e} (${t.status})`);return t.text()}async function Ye(e){let t=e.profileSource?await Be(e.profileSource):void 0,n=ze(e);return t?n?{...t,...n,...n.resources?{resources:{...t.resources,...n.resources}}:{}}:t:n}const Xe=p.join(he.homedir(),`.tangle`),Ze=p.join(Xe,`credentials.json`),Qe=`tangle-sandbox-cli`,$e=`TANGLE_ALLOW_PLAINTEXT_CREDENTIALS`;var et=class extends Error{constructor(e,t){super(`Credentials file at ${e} is corrupted and cannot be parsed. Inspect or remove it manually before retrying — refusing to overwrite it automatically.`),this.filePath=e,this.name=`CredentialsFileCorruptedError`,t&&(this.cause=t)}},tt=class extends Error{constructor(){super(`Could not store credential in the OS keychain, and the plaintext fallback is not enabled. Install a keychain provider (macOS Keychain or libsecret/secret-tool on Linux), or set ${$e}=1 to opt into a plaintext credentials.json with mode 0600.`),this.name=`KeychainUnavailableError`}};function nt(e){let t=ot(e);if(t)return{value:t,source:`keychain`};let n=lt(e);return n?{value:n,source:`file`}:{source:`none`}}function rt(e,t){if(st(e,t))return dt(e),`keychain`;if(!at())throw new tt;return ut(e,t),`file`}function it(e){ct(e),dt(e)}function at(){let e=process.env[$e];if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function ot(e){if(process.platform===`darwin`)try{return ve(`security`,[`find-generic-password`,`-s`,Qe,`-a`,ht(e),`-w`],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`]}).trim()}catch{return}if(process.platform===`linux`)try{return ve(`secret-tool`,[`lookup`,`service`,Qe,`account`,ht(e)],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`]}).trim()}catch{return}}function st(e,t){if(process.platform===`darwin`)try{return ve(`security`,[`add-generic-password`,`-U`,`-s`,Qe,`-a`,ht(e),`-w`,t],{stdio:[`ignore`,`ignore`,`ignore`]}),!0}catch{return!1}if(process.platform===`linux`)try{return ve(`secret-tool`,[`store`,`--label=Tangle Sandbox CLI`,`service`,Qe,`account`,ht(e)],{input:t,stdio:[`pipe`,`ignore`,`ignore`]}),!0}catch{return!1}return!1}function ct(e){if(process.platform===`darwin`){try{ve(`security`,[`delete-generic-password`,`-s`,Qe,`-a`,ht(e)],{stdio:[`ignore`,`ignore`,`ignore`]})}catch{}return}if(process.platform===`linux`)try{ve(`secret-tool`,[`clear`,`service`,Qe,`account`,ht(e)],{stdio:[`ignore`,`ignore`,`ignore`]})}catch{}}function lt(e){return ft()[e]}function ut(e,t){let n=ft();n[e]=t,pt(n)}function dt(e){let t;try{t=ft()}catch(e){if(e instanceof et)return;throw e}e in t&&(delete t[e],pt(t))}function ft(){let e;try{e=o.readFileSync(Ze,`utf8`)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return{};throw e}try{let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw new et(Ze);let n={};for(let[e,r]of Object.entries(t))typeof r==`string`&&(n[e]=r);return n}catch(e){throw e instanceof et?e:new et(Ze,e instanceof Error?e:void 0)}}function pt(e){if(mt(),Object.keys(e).length===0){o.existsSync(Ze)&&o.unlinkSync(Ze);return}let t=`${Ze}.${process.pid}.tmp`;o.writeFileSync(t,`${JSON.stringify(e,null,2)}\n`,{mode:384}),o.renameSync(t,Ze)}function mt(){if(!o.existsSync(Xe)){o.mkdirSync(Xe,{mode:448,recursive:!0});return}if(process.platform!==`win32`)try{(o.statSync(Xe).mode&511)!=448&&o.chmodSync(Xe,448)}catch{}}function ht(e){return`profile:${e}`}const gt=p.join(he.homedir(),`.tangle`),_t=p.join(gt,`credentials`),vt=p.join(gt,`config.json`),b=`default`;function yt(){o.existsSync(gt)||o.mkdirSync(gt,{mode:448,recursive:!0})}function bt(e,t){yt();let n=`${e}.${process.pid}.tmp`;o.writeFileSync(n,t,{mode:384}),o.renameSync(n,e)}function xt(){try{if(o.existsSync(_t)){let e=o.readFileSync(_t,`utf-8`).trim();return St(e)?e:e.match(/api_key\s*=\s*(\S+)/)?.[1]}}catch{}}function St(e){return e.startsWith(`sk_`)||e.startsWith(`sk-tan-`)}function Ct(){try{o.existsSync(_t)&&o.unlinkSync(_t)}catch{}}function x(){return Kt(Gt())}function wt(e){let t=qt(x(),e);bt(vt,`${JSON.stringify(t,null,2)}\n`)}function S(e){return Jt(e||process.env.TANGLE_PROFILE||process.env.SANDBOX_PROFILE||x().activeProfile||b)}function Tt(e){wt({activeProfile:Jt(e)})}function Et(){return process.env.TANGLE_SANDBOX||x().currentSandbox||void 0}function Dt(e){wt({currentSandbox:e})}function Ot(){let e=x();delete e.currentSandbox,bt(vt,`${JSON.stringify(e,null,2)}\n`)}function kt(){let e=x().deviceId;if(e&&/^[A-Za-z0-9_.-]{1,64}$/.test(e))return e;let t=he.hostname().replace(/[^A-Za-z0-9_.-]/g,`-`).replace(/^-+|-+$/g,``).slice(0,32),n=r(4).toString(`hex`),i=`${t?`${t}-`:`device-`}${n}`;return wt({deviceId:i}),i}function At(e){let t=e||Et();if(!t)throw Error("No sandbox specified. Pass it positionally, set a default with `tangle use <id>`, pass `--box <id>`, or set TANGLE_SANDBOX.");return t}function jt(){let e=x(),t=S(),n=new Set([b,...Object.keys(e.profiles??{})]);return e.activeProfile&&n.add(Jt(e.activeProfile)),[...n].map(e=>{let n=nt(e),r=e===b?xt():void 0,i=n.source===`none`?r?`legacy-file`:`none`:n.source;return{name:e,active:e===t,hasApiKey:n.source!==`none`||!!r,baseUrl:Lt(void 0,e),apiKeySource:i}}).sort((e,t)=>e.name.localeCompare(t.name))}function Mt(e){let t=S(e);return{name:t,active:t===S(),apiKey:Ft(void 0,t),baseUrl:Lt(void 0,t),credentialSource:It(void 0,t)}}function Nt(e,t){let n=Jt(e),r=x(),i=Wt(n,r),a={},o=t.baseUrl??i.baseUrl;o&&(a.baseUrl=o);let s=t.activeTeamId??i.activeTeamId;s&&(a.activeTeamId=s);let c=t.activeTeamName??i.activeTeamName;c&&(a.activeTeamName=c);let l={...r.profiles??{}};a.baseUrl||a.activeTeamId||a.activeTeamName?l[n]=a:delete l[n];let u;return t.apiKey&&(u=rt(n,t.apiKey),n===b&&Ct()),wt({profiles:Object.keys(l).length>0?l:{}}),u}function Pt(e){let t=S(e),n={...x().profiles??{}},r=n[t];if(r){let e={...r,apiKey:void 0};e.baseUrl||e.activeTeamId||e.activeTeamName?n[t]=e:delete n[t]}wt({profiles:n}),it(t),t===b&&Ct()}function Ft(e,t){if(e)return e;let n=process.env.TANGLE_API_KEY;if(n)return n;let r=S(t),i=nt(r);if(i.value)return i.value;if(r===b)return xt()}function It(e,t){if(e)return`flag`;if(process.env.TANGLE_API_KEY)return`env`;let n=S(t),r=nt(n);return r.source===`none`?n===b&&xt()?`legacy-file`:`none`:r.source}function Lt(e,t){if(e)return e;let n=process.env.TANGLE_BASE_URL||process.env.SANDBOX_BASE_URL;if(n)return n;let r=S(t),i=x(),a=Wt(r,i);return a.baseUrl?a.baseUrl:r===b&&i.baseUrl?i.baseUrl:`https://sandbox.tangle.tools`}function Rt(e){if(e)return e.replace(/\/v1\/hub\/?$/,``)}function zt(e){return e?.trim().replace(/\/+$/,``)||void 0}function Bt(e){return zt(e?.flag)??zt(Rt(zt(process.env.TANGLE_HUB_URL)))??zt(process.env.TANGLE_PLATFORM_URL)??zt(e?.cachedPlatformUrl?.())??`https://id.tangle.tools`}function C(e){let t=S(e.profile),n=Ft(e.apiKey,t);if(!n)throw Error(`No API key found for profile '${t}'. Set TANGLE_API_KEY or run: tangle auth login${t===b?``:` --profile ${t}`}`);return{apiKey:n,baseUrl:Lt(e.baseUrl,t),timeout:e.timeout??3e4,profile:t,...Vt(t)}}function Vt(e){let t=x(),n=Wt(S(e),t);return{activeTeamId:n.activeTeamId,activeTeamName:n.activeTeamName}}function Ht(e,t){Nt(S(t),{activeTeamId:e.id,activeTeamName:e.name})}function Ut(e){let t=S(e),n=x(),r={...n.profiles??{}},i={baseUrl:Wt(t,n).baseUrl};i.baseUrl?r[t]=i:delete r[t],wt({profiles:r})}function Wt(e,t=x()){let n=Jt(e);return{...n===b?{baseUrl:t.baseUrl,activeTeamId:t.profiles?.[b]?.activeTeamId,activeTeamName:t.profiles?.[b]?.activeTeamName}:{},...t.profiles?.[n]??{}}}function Gt(){try{if(o.existsSync(vt)){let e=o.readFileSync(vt,`utf-8`);return JSON.parse(e)}}catch{}return{}}function Kt(e){let t=!1,n={};e.apiKey&&(rt(b,e.apiKey),Ct(),t=!0);for(let[r,i]of Object.entries(e.profiles??{})){i.apiKey&&(rt(r,i.apiKey),t=!0);let e={};i.baseUrl&&(e.baseUrl=i.baseUrl),i.activeTeamId&&(e.activeTeamId=i.activeTeamId),i.activeTeamName&&(e.activeTeamName=i.activeTeamName),Object.keys(e).length>0&&(n[r]=e)}let r={...e,apiKey:void 0,profiles:Object.keys(n).length>0?n:void 0};return t&&bt(vt,`${JSON.stringify(r,null,2)}\n`),r}function qt(e,t){let n=t.profiles===void 0?{...e.profiles??{}}:Object.fromEntries(Object.entries(t.profiles).filter(([,e])=>!!(e.apiKey||e.baseUrl||e.activeTeamId||e.activeTeamName)));return{...e,...t,profiles:Object.keys(n).length>0?n:void 0}}function Jt(e){let t=e.trim().toLowerCase();if(!t)throw Error(`Profile name cannot be empty`);if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw Error(`Profile names may only contain lowercase letters, numbers, dots, underscores, and hyphens`);return t}let w=null,Yt=null;function T(e){if(e)return w&&Yt&&Yt.apiKey===e.apiKey&&Yt.baseUrl===e.baseUrl&&Yt.timeout===e.timeout?w:(w=new v({apiKey:e.apiKey,baseUrl:e.baseUrl,timeoutMs:e.timeout}),Yt=e,w);if(w)return w;let t=C({});return w=new v({apiKey:t.apiKey,baseUrl:t.baseUrl,timeoutMs:t.timeout}),Yt=t,w}function Xt(){w=null,Yt=null}async function Zt(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);if(n.startsWith(`hubconn_`))return n;let{connections:r}=await e.connections.list();return Qt(r,n)}function Qt(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);let r=e.find(e=>e.id===n);if(r)return r.id;let i=n.indexOf(`:`),a=(i===-1?n:n.slice(0,i)).trim().toLowerCase(),o=i===-1?null:n.slice(i+1).trim(),s=e.filter(e=>e.status!==`revoked`&&e.providerId.toLowerCase()===a);if(o&&o.length>0){let e=o.toLowerCase();s=s.filter(t=>(t.accountDisplay??``).toLowerCase()===e||t.displayName.toLowerCase()===e)}if(s.length===1)return s[0].id;throw s.length===0?Error(`No hub connection matches "${t}". List your connections with \`tangle hub connections\`.`):Error($t(t,s))}function $t(e,t){let n=t.map(e=>`- ${e.id} (provider: ${e.providerId}, account: ${e.accountDisplay??e.displayName})`).join(`
|
|
2
2
|
`);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
|
|
3
|
-
`+n}function Qt(e,t){return[...t,e]}async function $t(e,t){let n=e.map(e=>{let t=e.trim(),n=t.indexOf(`:`);return n===-1?{raw:e,ref:null,tail:null}:{raw:e,ref:t.slice(0,n).trim(),tail:t.slice(n+1)}});if(!n.some(e=>e.ref!==null&&e.ref!==`*`&&!e.ref.startsWith(`hubconn_`)))return[...e];let{connections:r}=await(await t()).connections.list();return n.map(e=>e.ref===null||e.ref===`*`||e.ref.startsWith(`hubconn_`)?e.raw:`${Xt(r,e.ref)}:${e.tail}`)}function en(e){let t=new Map,n=[];for(let r of e){let e=r.trim(),i=e.indexOf(`:`);if(i===-1)throw Error(`Invalid --connection "${r}": expected <connectionId>:<capability>[,<capability>]. List connection ids with \`tangle hub connections\` and capability paths with \`tangle hub tools search <keyword>\`.`);let a=e.slice(0,i).trim();if(a.length===0)throw Error(`Invalid --connection "${r}": connection id is empty. Use <connectionId>:<capability> — list ids with \`tangle hub connections\`.`);let o=e.slice(i+1).split(`,`).map(e=>e.trim()).filter(e=>e.length>0);if(o.length===0)throw Error(`Invalid --connection "${r}": grant at least one capability, e.g. ${a}:gmail.messages.list. Discover paths with \`tangle hub tools search <keyword>\`.`);if(o.includes(`*`)&&o.length>1)throw Error(`Invalid --connection "${r}": "*" grants all capabilities and can't be combined with specific paths. Use <connectionId>:* alone, or list explicit paths.`);if(a===`*`&&!(o.length===1&&o[0]===`*`))throw Error(`Invalid --connection "${r}": a "*" connection is only valid as "*:*" (all connections, all capabilities). Name a connection id for specific paths.`);let s=t.get(a);s===void 0&&(s=new Set,t.set(a,s),n.push(a));for(let e of o)s.add(e)}return n.map(e=>{let n=t.get(e),r=n?[...n]:[];if(r.includes(`*`)&&r.length>1)throw Error(`Invalid --connection for "${e}": "*" can't be combined with specific capability paths across repeated --connection flags.`);return{connectionId:e,capabilities:r}})}function tn(e){return e==null?a.dim(`-`):typeof e==`boolean`?e?a.green(`yes`):a.red(`no`):e instanceof Date?rn(e):typeof e==`string`&&nn(e)?rn(new Date(e)):String(e)}function nn(e){return/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/.test(e)}function rn(e){let t=Date.now()-e.getTime();if(t<6e4)return`just now`;if(t<36e5)return`${Math.floor(t/6e4)} min ago`;if(t<864e5){let e=Math.floor(t/36e5);return`${e} hour${e>1?`s`:``} ago`}let n=Math.floor(t/864e5);return`${n} day${n>1?`s`:``} ago`}function an(e){switch(e){case`running`:return a.green(e);case`pending`:case`provisioning`:return a.yellow(e);case`stopped`:return a.gray(e);case`failed`:case`deleted`:return a.red(e);default:return e}}function E(e,t){if(e.length===0){console.log(a.dim(`No items found.`));return}let n=t.map(t=>{let n=t.header.length,r=Math.max(...e.map(e=>tn(e[t.key]).length));return t.width??Math.max(n,r)+2}),r=t.map((e,t)=>a.bold(e.header.padEnd(n[t]))).join(``);console.log(r);for(let r of e){let e=t.map((e,t)=>{let i=tn(r[e.key]);return e.key===`status`&&(i=an(String(r[e.key]))),i.padEnd(n[t])}).join(``);console.log(e)}}function D(e){console.log(JSON.stringify(e,null,2))}function O(e){console.log(a.green(`✓`),e)}function k(e){console.error(a.red(`✗`),e)}function A(e){console.log(a.yellow(`!`),e)}function j(e){console.log(a.blue(`→`),e)}const on=new Set;function M(e){let t=Ce({text:e,color:`cyan`});return on.add(t),t}function sn(){for(let e of on)e.isSpinning&&e.stop();on.clear()}function N(e,t=0){let n=` `.repeat(t);for(let[t,r]of Object.entries(e))r!=null&&console.log(`${n}${a.dim(`${t}:`)} ${tn(r)}`)}function cn(e){if(console.log(),console.log(a.bold(`Sandbox Details`)),console.log(a.dim(`─`.repeat(40))),N({ID:e.id,Name:e.name,Status:an(e.status),Created:e.createdAt,Expires:e.expiresAt}),e.connection){if(console.log(),console.log(a.bold(`Connection`)),console.log(a.dim(`─`.repeat(40))),e.connection.ssh){let{ssh:t}=e.connection,n=process.platform===`win32`?`NUL`:`/dev/null`,r=`ssh -o ProxyCommand="${t.proxyCommand}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=${n} -o GlobalKnownHostsFile=${n} -o LogLevel=ERROR -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -o TCPKeepAlive=yes ${t.username}@localhost -p ${t.port}`;N({SSH:process.platform===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN='<token>'; ${r}`:`TANGLE_SSH_PROXY_AUTH_TOKEN='<token>' ${r}`})}e.connection.webTerminalUrl&&N({"Web Terminal":e.connection.webTerminalUrl}),e.connection.runtimeUrl&&N({"API URL":e.connection.runtimeUrl})}console.log()}function P(e,t){sn(),t?D({error:e.message}):k(e.message),process.exit(1)}function F(e){D(e)}function I(e,t){if(t.length===0){console.log(a.dim(`No items found.`));return}let n=e.map((e,n)=>{let r=Math.max(...t.map(e=>String(e[n]??``).length));return Math.max(e.length,r)+2});console.log(e.map((e,t)=>a.bold(e.padEnd(n[t]))).join(``));for(let e of t)console.log(e.map((e,t)=>String(e??``).padEnd(n[t])).join(``))}function L(e,t=!1){sn(),t&&(D(ln(e)),process.exit(gn(e)));let n=un(e);console.error(a.red(`Error:`),n),process.exit(gn(e))}function ln(e){return e instanceof Se?{error:{code:e.code,message:e.message,...typeof e.status==`number`?{status:e.status}:{},...e.details===void 0?{}:{details:e.details}}}:hn(e)?{error:{code:e.code,message:e.message,status:e.status,...e.details===void 0?{}:{details:e.details}}}:{error:{message:un(e)}}}function un(e){if(e instanceof re)return`Authentication failed. Run 'tangle auth login' to authenticate.`;if(e instanceof ie)return`Resource not found. Check the ID and try again.`;if(e instanceof ae)return`Quota exceeded. Upgrade your plan or wait for quota reset.`;if(e instanceof le)return`Invalid input: ${e.message}`;if(e instanceof se)return`Invalid state: ${e.message}`;if(e instanceof ce)return`Request timed out after ${e.timeoutMs} ms. Retry, or re-run with a longer --timeout <ms> on commands that accept it (e.g. create, resume).`;if(e instanceof g)return`Network error. Check your connection and try again.`;if(e instanceof oe)return`${e.status?`HTTP ${e.status}`:`server error`}: ${e.message}`;if(e instanceof Se){let t=typeof e.status==`number`?` (HTTP ${e.status})`:``;return e.code===`HUB_CONNECTION_MISSING`?dn(e.code,t,e.message,e.details):e.code===`HUB_APPROVAL_REQUIRED`?pn(e.code,t,e.message):e.code===`HUB_UNAUTHENTICATED`?mn(e.code,t,e.message):`${e.code}${t}: ${e.message}`}return hn(e)?e.code===`HUB_CONNECTION_MISSING`?dn(e.code,` (HTTP ${e.status})`,e.message,e.details):e.code===`HUB_APPROVAL_REQUIRED`?pn(e.code,` (HTTP ${e.status})`,e.message):e.code===`HUB_UNAUTHENTICATED`?mn(e.code,` (HTTP ${e.status})`,e.message):`${e.code} (HTTP ${e.status}): ${e.message}`:e instanceof Error?e.message:String(e)}function dn(e,t,n,r){let i=fn(r);return`${e}${t}: ${n}${i?`. Run: tangle hub connect ${i}`:``}`}function fn(e){if(!e||typeof e!=`object`)return;let t=e.provider;return typeof t==`string`&&t.length>0?t:void 0}function pn(e,t,n){return`${e}${t}: ${n}. Run the command again with --auto-approve, or run: tangle hub resume <approval-id> --accept. See: tangle hub resume --help`}function mn(e,t,n){return`${e}${t}: ${n}. The CLI auto-mints a short-lived Hub key from your login session, so this usually means that session has expired — run 'tangle auth login' to re-authenticate. To use a credential directly instead, set TANGLE_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN (and pass --no-hub-key to skip auto-minting).`}function hn(e){if(!(e instanceof Error))return!1;let t=e;return typeof t.code==`string`&&t.code.startsWith(`HUB_`)&&typeof t.status==`number`}function gn(e){return e instanceof le?2:1}function _n(e,t){return n(`sha256`).update(`${e}\0${t}`).digest(`hex`).slice(0,32)}function vn(e){return`${e}:hub`}function yn(e){let{value:t}=nt(vn(e));if(!t)return null;try{let e=JSON.parse(t);if(typeof e.key==`string`&&typeof e.expiresAt==`string`&&typeof e.platformUrl==`string`&&typeof e.sessionFingerprint==`string`)return{key:e.key,expiresAt:e.expiresAt,platformUrl:e.platformUrl,sessionFingerprint:e.sessionFingerprint}}catch{}return null}function bn(e,t){try{rt(vn(e),JSON.stringify(t))}catch{}}async function xn(e,t,n){let r=`${e.replace(/\/+$/,``)}/auth/cli/hub-key`,i;try{i=await fetch(r,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${t}`},body:JSON.stringify({device_id:n})})}catch(e){throw Error(`Could not reach ${r} to mint a Hub key: ${e instanceof Error?e.message:String(e)}`)}let a=await i.text(),o;try{o=JSON.parse(a)}catch{o=null}if(!i.ok||!o?.success){let e=typeof o?.error?.message==`string`?o.error.message:`HTTP ${i.status}`;throw Error(`Hub key minting failed: ${e}. Your sandbox session may have expired — run \`tangle auth login\`.`)}let s=o.data;if(typeof s?.api_key!=`string`||typeof s?.expires_at!=`string`||typeof s?.platform_url!=`string`)throw Error(`Hub key minting returned an unexpected response shape.`);return{key:s.api_key,expiresAt:s.expires_at,platformUrl:s.platform_url}}var Sn=class{cache;fingerprint;constructor(e,t,n,r){this.profile=e,this.sandboxBaseUrl=t,this.sessionToken=n,this.deviceId=r,this.fingerprint=_n(t,n);let i=yn(e);this.cache=i&&i.sessionFingerprint===this.fingerprint?i:null}isFresh(e){return e!==null&&Date.parse(e.expiresAt)-Date.now()>6e4}async ensure(e=!1){if(!e&&this.isFresh(this.cache))return this.cache;let t={...await xn(this.sandboxBaseUrl,this.sessionToken,this.deviceId),sessionFingerprint:this.fingerprint};return this.cache=t,bn(this.profile,t),t}};function Cn(e){if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function wn(e,t){if(e.baseUrl)return e.baseUrl;let n=Rt(process.env.TANGLE_HUB_URL);if(n)return n;let r=yn(t);return r?r.platformUrl:`https://id.tangle.tools`}function Tn(e,t){let n=S(),r=Ft(e.apiKey,n),i=It(e.apiKey,n),a=process.env.TANGLE_HUB_CAPABILITY_TOKEN?.trim()||void 0;if(a&&i===`env`)throw Error(`Set exactly one of TANGLE_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN, not both`);if(i===`flag`&&r)return{kind:`static`,apiKey:r,baseUrl:wn(e,n)};if(i===`env`&&r)return{kind:`static`,apiKey:a??r,baseUrl:wn(e,n)};if(a)return{kind:`static`,apiKey:a,baseUrl:wn(e,n)};if(!r)throw Error(`No API key found for profile '${n}'. Set TANGLE_API_KEY or run: tangle auth login${n===`default`?``:` --profile ${n}`}`);return t?{kind:`static`,apiKey:r,baseUrl:wn(e,n)}:{kind:`managed`,profile:n,sandboxBaseUrl:Lt(void 0,n),sessionToken:r,deviceId:kt(),baseUrlOverride:e.baseUrl}}async function R(e={}){let t=Tn(e,e.hubKey===!1||Cn(process.env.TANGLE_SKIP_HUB_KEY));if(t.kind===`static`)return new xe({baseUrl:t.baseUrl,apiKey:t.apiKey});let n=new Sn(t.profile,t.sandboxBaseUrl,t.sessionToken,t.deviceId),r=await n.ensure();return new xe({baseUrl:t.baseUrlOverride??r.platformUrl,authHeaders:async()=>({Authorization:`Bearer ${(await n.ensure()).key}`}),fetch:async(e,t)=>{let r=await fetch(e,t);if(r.status!==401)return r;let i=await n.ensure(!0),a=new Headers(t?.headers);return a.set(`Authorization`,`Bearer ${i.key}`),fetch(e,{...t,headers:a})}})}function En(e){return e instanceof Date?e.toISOString():String(e)}function Dn(e,t){return`Sandbox name is ambiguous: ${e}. Use a sandbox id instead.\n${t.map(e=>`- ${e.id} (status: ${e.status}, created: ${En(e.createdAt)})`).join(`
|
|
4
|
-
`)}`}function
|
|
3
|
+
`+n}function en(e,t){return[...t,e]}async function tn(e,t){let n=e.map(e=>{let t=e.trim(),n=t.indexOf(`:`);return n===-1?{raw:e,ref:null,tail:null}:{raw:e,ref:t.slice(0,n).trim(),tail:t.slice(n+1)}});if(!n.some(e=>e.ref!==null&&e.ref!==`*`&&!e.ref.startsWith(`hubconn_`)))return[...e];let{connections:r}=await(await t()).connections.list();return n.map(e=>e.ref===null||e.ref===`*`||e.ref.startsWith(`hubconn_`)?e.raw:`${Qt(r,e.ref)}:${e.tail}`)}function nn(e){let t=new Map,n=[];for(let r of e){let e=r.trim(),i=e.indexOf(`:`);if(i===-1)throw Error(`Invalid --connection "${r}": expected <connectionId>:<capability>[,<capability>]. List connection ids with \`tangle hub connections\` and capability paths with \`tangle hub tools search <keyword>\`.`);let a=e.slice(0,i).trim();if(a.length===0)throw Error(`Invalid --connection "${r}": connection id is empty. Use <connectionId>:<capability> — list ids with \`tangle hub connections\`.`);let o=e.slice(i+1).split(`,`).map(e=>e.trim()).filter(e=>e.length>0);if(o.length===0)throw Error(`Invalid --connection "${r}": grant at least one capability, e.g. ${a}:gmail.messages.list. Discover paths with \`tangle hub tools search <keyword>\`.`);if(o.includes(`*`)&&o.length>1)throw Error(`Invalid --connection "${r}": "*" grants all capabilities and can't be combined with specific paths. Use <connectionId>:* alone, or list explicit paths.`);if(a===`*`&&!(o.length===1&&o[0]===`*`))throw Error(`Invalid --connection "${r}": a "*" connection is only valid as "*:*" (all connections, all capabilities). Name a connection id for specific paths.`);let s=t.get(a);s===void 0&&(s=new Set,t.set(a,s),n.push(a));for(let e of o)s.add(e)}return n.map(e=>{let n=t.get(e),r=n?[...n]:[];if(r.includes(`*`)&&r.length>1)throw Error(`Invalid --connection for "${e}": "*" can't be combined with specific capability paths across repeated --connection flags.`);return{connectionId:e,capabilities:r}})}function rn(e){return e==null?a.dim(`-`):typeof e==`boolean`?e?a.green(`yes`):a.red(`no`):e instanceof Date?on(e):typeof e==`string`&&an(e)?on(new Date(e)):String(e)}function an(e){return/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/.test(e)}function on(e){let t=Date.now()-e.getTime();if(t<6e4)return`just now`;if(t<36e5)return`${Math.floor(t/6e4)} min ago`;if(t<864e5){let e=Math.floor(t/36e5);return`${e} hour${e>1?`s`:``} ago`}let n=Math.floor(t/864e5);return`${n} day${n>1?`s`:``} ago`}function sn(e){switch(e){case`running`:return a.green(e);case`pending`:case`provisioning`:return a.yellow(e);case`stopped`:return a.gray(e);case`failed`:case`deleted`:return a.red(e);default:return e}}function E(e,t){if(e.length===0){console.log(a.dim(`No items found.`));return}let n=t.map(t=>{let n=t.header.length,r=Math.max(...e.map(e=>rn(e[t.key]).length));return t.width??Math.max(n,r)+2}),r=t.map((e,t)=>a.bold(e.header.padEnd(n[t]))).join(``);console.log(r);for(let r of e){let e=t.map((e,t)=>{let i=rn(r[e.key]);return e.key===`status`&&(i=sn(String(r[e.key]))),i.padEnd(n[t])}).join(``);console.log(e)}}function D(e){console.log(JSON.stringify(e,null,2))}function O(e){console.log(a.green(`✓`),e)}function k(e){console.error(a.red(`✗`),e)}function A(e){console.log(a.yellow(`!`),e)}function j(e){console.log(a.blue(`→`),e)}const cn=new Set;function M(e){let t=Se({text:e,color:`cyan`});return cn.add(t),t}function ln(){for(let e of cn)e.isSpinning&&e.stop();cn.clear()}function N(e,t=0){let n=` `.repeat(t);for(let[t,r]of Object.entries(e))r!=null&&console.log(`${n}${a.dim(`${t}:`)} ${rn(r)}`)}function un(e){if(console.log(),console.log(a.bold(`Sandbox Details`)),console.log(a.dim(`─`.repeat(40))),N({ID:e.id,Name:e.name,Status:sn(e.status),Created:e.createdAt,Expires:e.expiresAt}),e.connection){if(console.log(),console.log(a.bold(`Connection`)),console.log(a.dim(`─`.repeat(40))),e.connection.ssh){let{ssh:t}=e.connection,n=process.platform===`win32`?`NUL`:`/dev/null`,r=`ssh -o ProxyCommand="${t.proxyCommand}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=${n} -o GlobalKnownHostsFile=${n} -o LogLevel=ERROR -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -o TCPKeepAlive=yes ${t.username}@localhost -p ${t.port}`;N({SSH:process.platform===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN='<token>'; ${r}`:`TANGLE_SSH_PROXY_AUTH_TOKEN='<token>' ${r}`})}e.connection.webTerminalUrl&&N({"Web Terminal":e.connection.webTerminalUrl}),e.connection.runtimeUrl&&N({"API URL":e.connection.runtimeUrl})}console.log()}function P(e,t){ln(),t?D({error:e.message}):k(e.message),process.exit(1)}function F(e){D(e)}function I(e,t){if(t.length===0){console.log(a.dim(`No items found.`));return}let n=e.map((e,n)=>{let r=Math.max(...t.map(e=>String(e[n]??``).length));return Math.max(e.length,r)+2});console.log(e.map((e,t)=>a.bold(e.padEnd(n[t]))).join(``));for(let e of t)console.log(e.map((e,t)=>String(e??``).padEnd(n[t])).join(``))}function L(e,t=!1){ln(),t&&(D(dn(e)),process.exit(vn(e)));let n=fn(e);console.error(a.red(`Error:`),n),process.exit(vn(e))}function dn(e){return e instanceof xe?{error:{code:e.code,message:e.message,...typeof e.status==`number`?{status:e.status}:{},...e.details===void 0?{}:{details:e.details}}}:_n(e)?{error:{code:e.code,message:e.message,status:e.status,...e.details===void 0?{}:{details:e.details}}}:{error:{message:fn(e)}}}function fn(e){if(e instanceof g)return`Authentication failed. Run 'tangle auth login' to authenticate.`;if(e instanceof re)return`Resource not found. Check the ID and try again.`;if(e instanceof ie)return`Quota exceeded. Upgrade your plan or wait for quota reset.`;if(e instanceof ce)return`Invalid input: ${e.message}`;if(e instanceof oe)return`Invalid state: ${e.message}`;if(e instanceof se)return`Request timed out after ${e.timeoutMs} ms. Retry, or re-run with a longer --timeout <ms> on commands that accept it (e.g. create, resume).`;if(e instanceof _)return`Network error. Check your connection and try again.`;if(e instanceof ae)return`${e.status?`HTTP ${e.status}`:`server error`}: ${e.message}`;if(e instanceof xe){let t=typeof e.status==`number`?` (HTTP ${e.status})`:``;return e.code===`HUB_CONNECTION_MISSING`?pn(e.code,t,e.message,e.details):e.code===`HUB_APPROVAL_REQUIRED`?hn(e.code,t,e.message):e.code===`HUB_UNAUTHENTICATED`?gn(e.code,t,e.message):`${e.code}${t}: ${e.message}`}return _n(e)?e.code===`HUB_CONNECTION_MISSING`?pn(e.code,` (HTTP ${e.status})`,e.message,e.details):e.code===`HUB_APPROVAL_REQUIRED`?hn(e.code,` (HTTP ${e.status})`,e.message):e.code===`HUB_UNAUTHENTICATED`?gn(e.code,` (HTTP ${e.status})`,e.message):`${e.code} (HTTP ${e.status}): ${e.message}`:e instanceof Error?e.message:String(e)}function pn(e,t,n,r){let i=mn(r);return`${e}${t}: ${n}${i?`. Run: tangle hub connect ${i}`:``}`}function mn(e){if(!e||typeof e!=`object`)return;let t=e.provider;return typeof t==`string`&&t.length>0?t:void 0}function hn(e,t,n){return`${e}${t}: ${n}. Run the command again with --auto-approve, or run: tangle hub resume <approval-id> --accept. See: tangle hub resume --help`}function gn(e,t,n){return`${e}${t}: ${n}. The CLI auto-mints a short-lived Hub key from your login session, so this usually means that session has expired — run 'tangle auth login' to re-authenticate. To use a credential directly instead, set TANGLE_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN (and pass --no-hub-key to skip auto-minting).`}function _n(e){if(!(e instanceof Error))return!1;let t=e;return typeof t.code==`string`&&t.code.startsWith(`HUB_`)&&typeof t.status==`number`}function vn(e){return e instanceof ce?2:1}function yn(e,t){return n(`sha256`).update(`${e}\0${t}`).digest(`hex`).slice(0,32)}function bn(e){return`${e}:hub`}function xn(e){let{value:t}=nt(bn(e));if(!t)return null;try{let e=JSON.parse(t);if(typeof e.key==`string`&&typeof e.expiresAt==`string`&&typeof e.platformUrl==`string`&&typeof e.sessionFingerprint==`string`)return{key:e.key,expiresAt:e.expiresAt,platformUrl:e.platformUrl,sessionFingerprint:e.sessionFingerprint}}catch{}return null}function Sn(e,t){try{rt(bn(e),JSON.stringify(t))}catch{}}async function Cn(e,t,n){let r=`${e.replace(/\/+$/,``)}/auth/cli/hub-key`,i;try{i=await fetch(r,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${t}`},body:JSON.stringify({device_id:n})})}catch(e){throw Error(`Could not reach ${r} to mint a Hub key: ${e instanceof Error?e.message:String(e)}`)}let a=await i.text(),o;try{o=JSON.parse(a)}catch{o=null}if(!i.ok||!o?.success){let e=typeof o?.error?.message==`string`?o.error.message:`HTTP ${i.status}`;throw Error(`Hub key minting failed: ${e}. Your sandbox session may have expired — run \`tangle auth login\`.`)}let s=o.data;if(typeof s?.api_key!=`string`||typeof s?.expires_at!=`string`||typeof s?.platform_url!=`string`)throw Error(`Hub key minting returned an unexpected response shape.`);return{key:s.api_key,expiresAt:s.expires_at,platformUrl:s.platform_url}}var wn=class{cache;fingerprint;constructor(e,t,n,r){this.profile=e,this.sandboxBaseUrl=t,this.sessionToken=n,this.deviceId=r,this.fingerprint=yn(t,n);let i=xn(e);this.cache=i&&i.sessionFingerprint===this.fingerprint?i:null}isFresh(e){return e!==null&&Date.parse(e.expiresAt)-Date.now()>6e4}async ensure(e=!1){if(!e&&this.isFresh(this.cache))return this.cache;let t={...await Cn(this.sandboxBaseUrl,this.sessionToken,this.deviceId),sessionFingerprint:this.fingerprint};return this.cache=t,Sn(this.profile,t),t}};function Tn(e){if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function En(e,t){return Bt({flag:e.baseUrl,cachedPlatformUrl:()=>xn(t)?.platformUrl})}function Dn(e,t){let n=S(),r=Ft(e.apiKey,n),i=It(e.apiKey,n),a=process.env.TANGLE_HUB_CAPABILITY_TOKEN?.trim()||void 0;if(a&&i===`env`)throw Error(`Set exactly one of TANGLE_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN, not both`);if(i===`flag`&&r)return{kind:`static`,apiKey:r,baseUrl:En(e,n)};if(i===`env`&&r)return{kind:`static`,apiKey:a??r,baseUrl:En(e,n)};if(a)return{kind:`static`,apiKey:a,baseUrl:En(e,n)};if(!r)throw Error(`No API key found for profile '${n}'. Set TANGLE_API_KEY or run: tangle auth login${n===`default`?``:` --profile ${n}`}`);return t?{kind:`static`,apiKey:r,baseUrl:En(e,n)}:{kind:`managed`,profile:n,sandboxBaseUrl:Lt(void 0,n),sessionToken:r,deviceId:kt(),baseUrlOverride:e.baseUrl}}async function R(e={}){let t=Dn(e,e.hubKey===!1||Tn(process.env.TANGLE_SKIP_HUB_KEY));if(t.kind===`static`)return new be({baseUrl:t.baseUrl,apiKey:t.apiKey});let n=new wn(t.profile,t.sandboxBaseUrl,t.sessionToken,t.deviceId),r=await n.ensure();return new be({baseUrl:t.baseUrlOverride??r.platformUrl,authHeaders:async()=>({Authorization:`Bearer ${(await n.ensure()).key}`}),fetch:async(e,t)=>{let r=await fetch(e,t);if(r.status!==401)return r;let i=await n.ensure(!0),a=new Headers(t?.headers);return a.set(`Authorization`,`Bearer ${i.key}`),fetch(e,{...t,headers:a})}})}function On(e){return e instanceof Date?e.toISOString():String(e)}function kn(e,t){return`Sandbox name is ambiguous: ${e}. Use a sandbox id instead.\n${t.map(e=>`- ${e.id} (status: ${e.status}, created: ${On(e.createdAt)})`).join(`
|
|
4
|
+
`)}`}function An(e){return e.activeTeamId?`team:${e.activeTeamId}`:void 0}async function z(e,t,n,r={}){if(!r.nameOnly){let t=await e.get(n);if(t)return t;if(Mn(n))throw Error(`Sandbox not found: ${n}`)}let i=(await e.list({scope:An(t)})).filter(e=>e.name?.toLowerCase()===n.toLowerCase());if(i.length===0)throw Error(`Sandbox not found: ${n}`);if(i.length>1)throw Error(kn(n,i));return i[0]}const jn=/^sandbox-(?:(?:[a-z][a-z0-9-]*)-)?(?:[a-f0-9]{12}|[a-f0-9]{8}-[a-f0-9]{3})(?:-branch-[a-z0-9]+-[0-9]+)*$/;function Mn(e){return jn.test(e)}async function Nn(e,t,n,r={}){try{return(await(await z(e,t,n,{nameOnly:r.name})).delete()).outcome}catch(e){if(!(e instanceof Error&&e.message===`Sandbox not found: ${n}`)||r.name||!r.retryCleanup&&!Mn(n))throw e}let i=await e.fetch(`/v1/sandboxes/${encodeURIComponent(n)}`,{method:`DELETE`});if(i.ok){let e=await i.json().catch(()=>({}));return e.outcome===`destroyed`||e.outcome===`already_absent`?e.outcome:`unknown`}let a=(await i.text()).trim();throw Error(`Sandbox cleanup failed for ${n} (HTTP ${i.status})${a?`: ${a}`:``}`)}async function B(e,t){if(e.status!==`stopped`)return e;let n=t?.resumeTimeoutMs??12e4;j(`Sandbox ${e.id} is stopped. Resuming...`);try{await e.resume({timeoutMs:n}),await e.waitFor(`running`,{timeoutMs:n})}catch(t){let r=t instanceof Error?t.message:String(t);throw Error(`Failed to resume sandbox ${e.id}: ${r}. Run \`tangle sandbox resume ${e.id} --timeout ${n}\` and retry.`)}return e}const Pn=[`anthropic`,`openai`,`vercel-ai`,`mastra`,`mcp-local`,`claude-desktop`,`cursor`,`zed`];function Fn(e,t,n){switch(e){case`anthropic`:return`// pnpm add @anthropic-ai/sdk @tangle-network/sandbox
|
|
5
5
|
import Anthropic from "@anthropic-ai/sdk";
|
|
6
6
|
import { Sandbox } from "@tangle-network/sandbox";
|
|
7
7
|
import { anthropicTools } from "@tangle-network/sandbox/agent";
|
|
@@ -121,29 +121,29 @@ await connect(new StdioServerTransport());`;case`claude-desktop`:return`// Add t
|
|
|
121
121
|
}
|
|
122
122
|
}
|
|
123
123
|
}
|
|
124
|
-
}`}}function
|
|
125
|
-
`),e(t.trim())})})}async function V(e){let t=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout}),n=await new Promise(n=>{t.question(e,e=>{t.close(),n(e.trim().toLowerCase())})});return n===`y`||n===`yes`}async function H(e,t){let n=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout}),r=t?` [${t}]`:``;return await new Promise(t=>{n.question(`${e}${r}: `,e=>{n.close(),t(e.trim())})})||t||``}async function Ln(){if(process.stdin.isTTY)throw Error(`Cannot read secret from stdin when stdin is a TTY`);let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(t));return Buffer.concat(e).toString(`utf8`).replace(/\r?\n$/,``)}function Rn(){let e=new t(`profile`).description(`Create, inspect, and validate portable agent profiles`);return e.command(`create [output]`).description(`Create a profile — interactively (a wizard), or fully via flags`).option(`--name <name>`,`Profile name (when set, skips the wizard)`).option(`--description <text>`,`Profile description`).option(`--model <model>`,`Model (provider/model)`).option(`--system-prompt <text>`,`System prompt`).option(`--skills <ref...>`,`Skill refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--tools <ref...>`,`Tool refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--harness <name>`,`Harness hint shown in the run command`).option(`--json`,`Print the profile as JSON instead of writing a file`).action(async(e,t)=>{try{let n=t.name,r=t.description,i=t.harness,a=t.model,o=t.systemPrompt,s=t.skills??[],c=t.tools??[];if(!n&&process.stdin.isTTY&&(n=await H(`Profile name`,`my-agent`),r=await H(`Description (optional)`)||void 0,i=await H(`Harness`,`claude-code`)||void 0,a=await H(`Model (optional, provider/model)`)||void 0,o=await H(`System prompt (optional)`)||void 0,s=await zn(`Skill ref (local path or github:..., blank to finish)`),c=await zn(`Tool ref (blank to finish)`)),!n)throw Error(process.stdin.isTTY?`Profile name is required.`:"`agent profile create` needs at least --name in a non-interactive shell (no TTY to prompt). Pass --name <name> (and optionally --model/--skills/--tools/--system-prompt).");let l=Be({model:a,systemPrompt:o,skills:s,tools:c}),u={...n?{name:n}:{},...r?{description:r}:{},...l??{}};if(t.json){D(u);return}let d=e??`agent-profile.json`;f(d,`${JSON.stringify(u,null,2)}\n`),j(`Wrote ${d}`),j(`Run it: tangle agent prompt <box> --profile ${d}${i?` --harness ${i}`:``}`)}catch(e){L(e,t.json)}}),e.command(`show <source>`).description(`Load and print a profile (local path, https URL, or github:owner/repo/path[@ref])`).action(async e=>{try{D(await Ve(e))}catch(e){L(e,!0)}}),e.command(`validate <source>`).description(`Check a profile loads and is a well-formed object`).action(async e=>{try{let t=await Ve(e);j(`OK — "${typeof t.name==`string`?t.name:`(unnamed)`}" loaded as a valid profile object`)}catch(e){L(e)}}),e}async function zn(e){let t=[];for(;;){let n=await H(e);if(!n)break;t.push(n)}return t}function Bn(e){return([process.env.SANDBOX_WEB_URL,process.env.TANGLE_SANDBOX_WEB_URL].map(e=>e?.trim()).find(e=>!!e)??e).replace(/\/+$/,``)}function Vn(e,t){if(process.exitCode=1,e.status===`blocked_on_approval`){console.error(a.yellow(`⚠ Blocked on a hub approval.`));let t=e.approval?.approvalId;console.error(t?`Approve it: tangle hub approvals approve ${t}`:"Approve the pending request (`tangle hub approvals`), then re-run.");return}if(e.status===`awaiting_question`){console.error(a.yellow(`⚠ Agent is awaiting an answer to a question.`)),console.error(`Re-run with --interactive to answer it, or answer programmatically via box.session(<id>).answer(<questionId>, { ... }).`);return}console.error(a.red(`✗ ${e.error&&e.error.length>0?e.error:t}`))}function Hn(e,t){return process.exitCode=1,t&&D({status:`awaiting_question`,needsInput:e}),`Agent is awaiting an answer (questionId: ${e.questionId??`unknown`}). Re-run with --interactive to answer, or answer via box.session(<id>).answer(<questionId>, { ... }).`}function Un(e){let t=e.part;if(t?.type===`text`)return t.text??t.content??void 0}function Wn(e){return e.finalText??e.response??e.output??e.content??e.text??void 0}function Gn(e){if(typeof e==`string`)return e;try{return JSON.stringify(e)??``}catch{return String(e)}}function Kn(e,t=0){if(t>6||typeof e!=`object`||!e)return;let n=e,r=n.approval;if(r&&typeof r.id==`string`)return r.id;for(let e of Object.values(n)){let n=Kn(e,t+1);if(n)return n}}function qn(e){let t=e?.toolInvocations;if(!Array.isArray(t))return;let n=t.find(e=>e?.isError===!0);if(n){if(Gn(n.result).includes(`HUB_APPROVAL_REQUIRED`)){let e=Kn(n.result);return e?`Blocked on hub approval — approve with: tangle hub approvals approve ${e}`:"Blocked on hub approval — approve the pending request (`tangle hub approvals`) then re-run."}return`Tool "${n.toolName??`unknown`}" failed`}}function Jn(e){if(e.sawError){console.error(a.red(`✗ ${e.errorMsg??`Agent run failed`}`)),process.exitCode=1;return}let t=Date.now()-e.startedAt,n=e.tokenUsage,r=[`${t}ms`,n?.inputTokens===void 0?void 0:`${n.inputTokens} in`,n?.outputTokens===void 0?void 0:`${n.outputTokens} out`].filter(e=>!!e);console.log(a.green(`✓ Done`),a.dim(`(${r.join(`, `)})`))}async function Yn(e,t){let n=``,r=!1,i,a,o,s=e=>{if(e.startsWith(n)){let t=e.slice(n.length);t&&process.stdout.write(t)}else process.stdout.write(e);n=e};try{for await(let t of e){switch(t.type){case`token`:{let e=t.data?.value;typeof e==`string`&&(process.stdout.write(e),n+=e);break}case`message.part.updated`:{let e=Un(t.data);typeof e==`string`&&e.length>0&&s(e);break}case`raw`:break;case`result`:a=t.data;break;case`question`:{let e=t.data;o={questionId:e.questionId,questions:e.questions};break}case`error`:r=!0,i=t.data.message??JSON.stringify(t.data);break}if(o)break}}catch(e){r=!0,i=e instanceof Error?e.message:String(e)}if(o)return{awaitingQuestion:o,printed:n.length};if(n.length===0&&a){let e=Wn(a);typeof e==`string`&&e.length>0&&(process.stdout.write(e),n=e)}if(!r){let e=qn(a);e&&(r=!0,i=e)}return{outcome:{sawError:r,errorMsg:i,startedAt:t,tokenUsage:a?.tokenUsage},resultData:a,printed:n.length}}function Xn(e){let t=en(e??[]);if(t.length!==0)return{profile:{connections:t}}}async function Zn(e){let t=en(e.connection??[]);if(t.length===0)throw Error(`--allow-writes needs at least one --connection to grant writes for.`);if(t.some(e=>e.connectionId===`*`))throw Error("--allow-writes needs explicit --connection ids; the `*:*` wildcard can't be bulk-granted. Grant per connection, e.g. --connection conn_x:* --allow-writes.");let n=await R({hubKey:e.hubKey});for(let r of t){let t=await n.permissions.allowWrites(r.connectionId);e.json||j(`Allowed ${t.writeActions} write action${t.writeActions===1?``:`s`} for connection ${r.connectionId} (${t.granted} newly granted).`)}e.json||j(`Revert anytime: ${t.map(e=>`tangle hub permissions revert-writes --connection ${e.connectionId}`).join(` · `)}`)}async function Qn(e){!e.connection||e.connection.length===0||(e.connection=await $t(e.connection,()=>R({hubKey:e.hubKey})))}async function $n(e,t){let n=process.stdin,r=process.stdout,i=null,a=!1,o=!1,s,c=new Promise(e=>{s=e}),l=()=>{try{n.setRawMode(!1)}catch{}n.pause()},u=()=>{a||(a=!0,l(),n.off(`data`,p),process.off(`SIGWINCH`,f),process.off(`SIGINT`,d),process.off(`SIGTERM`,d),process.off(`exit`,l),s())},d=e=>{(i?.close()??Promise.resolve()).finally(()=>{u(),process.exit(e===`SIGTERM`?143:130)})},f=()=>{i?.isOpen&&i.resize(r.columns||80,r.rows||24)},p=e=>{if(!i)return;let t=e.indexOf(29);if(t===-1){i.write(e);return}t>0&&i.write(e.subarray(0,t)),i.close().finally(u)};if(i=await e.attach({cols:r.columns||80,rows:r.rows||24,handlers:{onData:e=>{r.write(Buffer.from(e.buffer,e.byteOffset,e.byteLength))},onExit:e=>{o=!0;let t=e.exitCode===void 0?``:` (code ${e.exitCode})`;r.write(`\r\n[interactive session exited${t}]\r\n`),i?.close().finally(u)},onError:e=>{r.write(`\r\n[terminal stream error: ${e.message}]\r\n`)},onClose:()=>u()}}),n.setRawMode(!0),n.resume(),n.on(`data`,p),process.on(`SIGWINCH`,f),process.on(`SIGINT`,d),process.on(`SIGTERM`,d),process.on(`exit`,l),await c,console.log(),o){j(`Interactive session ended.`);return}j(`Detached — the session keeps running.`),N({"Watch & drive":t})}function er(){let e=new t(`agent`).description(`Interact with AI agent`);return e.command(`prompt <idOrMessage> [message]`).description("Send a single prompt to the agent. With one arg it's the prompt and the box comes from `tangle use` / --box / TANGLE_SANDBOX; with two it's <id> <message>.").option(`--box <id>`,`Target sandbox (overrides the active one)`).option(`--session <id>`,`Continue existing session`).option(`--model <model>`,`Model to use`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`300000`).option(`--stream`,`Stream response in real-time`).option(`--interactive`,`Spawn the harness's interactive TUI in the sandbox, inject this prompt, and print a link to watch + drive the live session in the browser (omit for the default headless run)`).option(`--harness <name>`,`Harness that executes this run (claude-code, codex, kimi-code, opencode, pi, amp, hermes). Defaults to the sandbox's configured backend. The box ships all harnesses, so this is a per-run choice.`).option(`--profile <source>`,`Agent profile to run: a local JSON path, an https URL, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--skills <ref...>`,`Attach skills (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>] to pull from a repo`).option(`--tools <ref...>`,`Attach tools (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--system-prompt <text>`,`Override the agent's system prompt for this run`).option(`--connection <spec>`,"Grant a hub connection to the agent as MCP tools (repeatable). The connection is a connection id or a provider name. Modes: <connection>:<cap1>,<cap2> (least privilege, recommended), <connection>:* (all of one connection), or *:* (all connections). List connections with `tangle hub connections`; paths with `tangle hub tools search <keyword>`.",Qt,[]).option(`--allow-writes`,"Pre-approve every WRITE action of each granted --connection so the agent can write unattended (reads are already allowed; destructive actions still prompt). Revert with `tangle hub permissions revert-writes`.").option(`--no-hub-key`,`Do not auto-mint a platform Hub key for --allow-writes; use the stored credential as-is`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=t===void 0?e:t,o=t===void 0?At(n.box):e,s=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),c=T(s);if(n.interactive){let e=[n.profile?`--profile`:null,n.skills?.length?`--skills`:null,n.tools?.length?`--tools`:null,n.systemPrompt?`--system-prompt`:null,n.connection?.length?`--connection`:null,n.allowWrites?`--allow-writes`:null].filter(e=>e!==null);if(e.length>0)throw Error(`${e.join(`, `)} ${e.length===1?`is`:`are`} not supported with --interactive: the interactive harness launches its own TUI and is configured by --harness/--model. Drop --interactive to run with a profile, or bake the agent into the box with \`tangle backend configure\`.`)}let l=await Xe({profileSource:n.profile,systemPrompt:n.systemPrompt,skills:n.skills,tools:n.tools});await Qn(n);let u=Xn(n.connection);n.allowWrites&&await Zn(n);let d=l||u?{...l??{},...u?.profile??{}}:void 0,f=n.harness,p=d||f||n.model?{...f?{type:f}:{},...d?{profile:d}:{},...n.model?{model:{model:n.model}}:{}}:void 0,m=await z(c,s,o);if(m=await B(m),n.interactive){let e=n.session??`int-${i()}`,t=f??(await m.backend.status()).type,a=m.session(e).interactive(),c=M(`Starting interactive ${t} session...`);c.start();let l;try{l=await a.start({harness:t,...n.model?{model:n.model}:{}})}finally{c.stop()}try{await a.sendPrompt(r)}catch(e){throw await a.stop().catch(()=>void 0),e}let u=`${Bn(s.baseUrl)}/dashboard/sandbox/${encodeURIComponent(o)}?interactive=${encodeURIComponent(l.sessionId)}`;if(n.json){D({sessionId:l.sessionId,harness:l.harness,streamUrl:l.streamUrl,webUrl:u});return}j(`Interactive ${l.harness} session started — prompt sent.`),console.log(),N({"Watch & drive":u,Session:l.sessionId}),console.log(),j(`Open the link to watch the agent and type to take over. Send more prompts with --session ${l.sessionId} --interactive.`),process.stdin.isTTY===!0&&process.stdout.isTTY===!0&&(console.log(),j(`Attaching to the live session — press Ctrl-] to detach.`),await $n(a,u));return}if(n.stream){j(`Streaming response...`),console.log();let e=Date.now(),t=await Yn(m.streamPrompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...p?{backend:p}:{}}),e);if(`awaitingQuestion`in t){t.printed>0&&console.log();let e=Hn(t.awaitingQuestion,n.json);n.json||console.error(a.yellow(`⚠ ${e}`));return}t.printed>0&&console.log(),Jn(t.outcome)}else{let e=M(`Processing prompt...`);e.start();let t=await m.prompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...p?{backend:p}:{}});e.stop(),n.json?(D(t),t.success===!1&&(process.exitCode=1)):t.success===!1?Vn(t,`Agent prompt failed`):(console.log(t.response),console.log(),N({Duration:`${t.durationMs}ms`,"Input Tokens":t.usage?.inputTokens,"Output Tokens":t.usage?.outputTokens}))}}catch(e){L(e,n.json)}}),e.addCommand(Fn()),e.addCommand(Rn()),e}async function tr(e){let t=e.timeoutMs??1e4,n=e.baseUrl.replace(/\/$/,``),r=`${n}/v1/account/me`;try{let n=await fetch(r,{headers:{Accept:`application/json`,Authorization:`Bearer ${e.apiKey}`},signal:AbortSignal.timeout(t)});if(!n.ok){let e=await rr(n);throw n.status===401||n.status===403?new re(e||`Invalid API key`):n.status>=500?new oe(e||`Sandbox API returned an unexpected error`,n.status):Error(e||`Credential validation failed with status ${n.status}`)}let i=await n.json();if(!i.success||!i.data)throw Error(`Sandbox API returned an invalid account response`);return{customerId:i.data.customer_id,email:i.data.email,name:i.data.name,tier:i.data.tier,createdAt:i.data.created_at}}catch(e){throw e instanceof re||e instanceof oe||e instanceof ce?e:e instanceof Error&&e.name===`AbortError`?new ce(t,`Timed out validating credentials against ${n}`):e instanceof Error&&!(e instanceof TypeError)?e:new g(`Failed to reach ${n}`,nr(e))}}function nr(e){return e instanceof Error?e:void 0}async function rr(e){let t=await e.text();if(t)try{let e=JSON.parse(t);return e.error?.message??e.message??t}catch{return t}}function ir(e){if(!or(e.hostHeader))return{kind:`host-mismatch`};let t;try{t=new URL(e.requestUrl??`/`,`http://127.0.0.1`)}catch{return{kind:`not-found`}}if(t.pathname!==`/callback`)return{kind:`not-found`};if(t.searchParams.get(`state`)!==e.expectedState)return{kind:`state-mismatch`};let n=t.searchParams.get(`error`);if(n)return{kind:`error`,reason:n};let r=t.searchParams.get(`grant_token`);return r?{kind:`ok`,token:r}:{kind:`missing-token`}}async function ar(e){let t=e.timeoutMs??12e4,n=e.baseUrl.replace(/\/$/,``),i=await import(`node:http`),a=r(32).toString(`hex`),o=null,s=null,c=new Promise((e,t)=>{o=e,s=t}),l=i.createServer((e,t)=>{try{let n=ir({hostHeader:e.headers.host,requestUrl:e.url,expectedState:a});switch(n.kind){case`host-mismatch`:t.writeHead(421,{"content-type":`text/plain; charset=utf-8`}),t.end(`Misdirected request`);return;case`not-found`:t.writeHead(404,{"content-type":`text/plain; charset=utf-8`}),t.end(`Not found`);return;case`state-mismatch`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(dr(`State mismatch — refusing login`)),s?.(Error(`Browser login state mismatch — refusing potentially hijacked callback`));return;case`error`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(dr(n.reason)),s?.(Error(`Browser login failed: ${n.reason}`));return;case`missing-token`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(dr(null)),s?.(Error(`Browser login did not return a grant token`));return;case`ok`:t.writeHead(200,{"content-type":`text/html; charset=utf-8`}),t.end(dr(null)),o?.(n.token);return}}catch(e){s?.(e instanceof Error?e:Error(`Browser login callback failed`))}});await new Promise((e,t)=>{l.once(`error`,t),l.listen(0,`127.0.0.1`,()=>e())});try{let r=l.address();if(!r||typeof r==`string`)throw Error(`Failed to bind local callback server`);let i=new URL(`http://127.0.0.1:${r.port}/callback`);i.searchParams.set(`state`,a);let o=new URL(`${n}/auth/cli/login`);o.searchParams.set(`callback_url`,i.toString()),e.provider&&o.searchParams.set(`provider`,e.provider);let s=await lr(o.toString());e.onLoginUrl?.({loginUrl:o.toString(),browserOpened:s});let u=await cr({baseUrl:n,grantToken:await sr(c,t),timeoutMs:t});return{apiKey:u.apiKey,email:u.email,name:u.name,tier:u.tier}}finally{await new Promise((e,t)=>{l.close(n=>{if(n){t(n);return}e()})}).catch(()=>void 0)}}function or(e){if(!e)return!1;let t=e.toLowerCase().match(/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/);if(!t)return!1;let n=t[1];return n===`127.0.0.1`||n===`localhost`||n===`[::1]`}async function sr(e,t){return await new Promise((n,r)=>{let i=setTimeout(()=>{r(new ce(t,`Timed out waiting for browser login to complete`))},t);e.then(e=>{clearTimeout(i),n(e)},e=>{clearTimeout(i),r(e)})})}async function cr(e){let t=await fetch(`${e.baseUrl}/auth/cli/exchange`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({grant_token:e.grantToken}),signal:AbortSignal.timeout(e.timeoutMs)}).catch(t=>{throw new g(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),n=await t.json().catch(()=>null);if(!t.ok||!n?.success||!n.data?.api_key)throw Error(n?.error?.message||`Failed to exchange browser login grant`);return{apiKey:n.data.api_key,email:n.data.email,name:n.data.name,tier:n.data.tier}}async function lr(e){let{spawn:t}=await import(`node:child_process`),n=process.platform===`darwin`?[`open`,e]:process.platform===`win32`?[`cmd`,`/c`,`start`,``,e]:[`xdg-open`,e];return await new Promise(e=>{let r=t(n[0],n.slice(1),{detached:!0,stdio:`ignore`});r.once(`error`,()=>e(!1)),r.once(`spawn`,()=>{r.unref(),e(!0)})})}function ur(e){return e.replace(/&/g,`&`).replace(/</g,`<`).replace(/>/g,`>`).replace(/"/g,`"`).replace(/'/g,`'`)}function dr(e){return`<!doctype html>
|
|
124
|
+
}`}}function In(e){return{anthropic:`Anthropic Messages API (Claude)`,openai:`OpenAI Chat Completions (function calling)`,"vercel-ai":`Vercel AI SDK (generateText / streamText)`,mastra:`Mastra agent framework`,"mcp-local":`Local MCP server bridge (stdio)`,"claude-desktop":`Claude Desktop config (uses local MCP)`,cursor:`Cursor config (uses local MCP)`,zed:`Zed config (uses local MCP)`}[e]}function Ln(){return new t(`connect`).description(`Print a copy-paste SDK integration snippet for one of: ${Pn.join(`, `)} (to stream a local agent's telemetry to Intelligence, see 'tangle connect')`).argument(`<framework>`,Pn.join(` | `)).option(`-i, --sandbox <id>`,`Sandbox ID to embed in the snippet`,`<SANDBOX_ID>`).option(`-s, --session <id>`,`Session ID to embed in the snippet`,`default`).action((e,t)=>{Pn.includes(e)||(console.error(a.red(`unknown framework: ${e}`),`\nsupported: ${Pn.join(`, `)}`),process.exit(2));let n=e;process.stdout.write(a.cyan(`# ${In(n)}\n\n`)),process.stdout.write(`${Fn(n,t.sandbox,t.session)}\n`)})}async function Rn(e){let{Writable:t}=await import(`node:stream`),n=await import(`node:readline`),r=!1,i=new t({write(e,t,n){r||process.stdout.write(e,t),n()}}),a=n.createInterface({input:process.stdin,output:i,terminal:!0});return process.stdout.write(e),r=!0,await new Promise(e=>{a.question(``,t=>{r=!1,a.close(),process.stdout.write(`
|
|
125
|
+
`),e(t.trim())})})}async function V(e){let t=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout}),n=await new Promise(n=>{t.question(e,e=>{t.close(),n(e.trim().toLowerCase())})});return n===`y`||n===`yes`}async function H(e,t){let n=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout}),r=t?` [${t}]`:``;return await new Promise(t=>{n.question(`${e}${r}: `,e=>{n.close(),t(e.trim())})})||t||``}async function zn(){if(process.stdin.isTTY)throw Error(`Cannot read secret from stdin when stdin is a TTY`);let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(t));return Buffer.concat(e).toString(`utf8`).replace(/\r?\n$/,``)}function Bn(){let e=new t(`profile`).description(`Create, inspect, and validate portable agent profiles`);return e.command(`create [output]`).description(`Create a profile — interactively (a wizard), or fully via flags`).option(`--name <name>`,`Profile name (when set, skips the wizard)`).option(`--description <text>`,`Profile description`).option(`--model <model>`,`Model (provider/model)`).option(`--system-prompt <text>`,`System prompt`).option(`--skills <ref...>`,`Skill refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--tools <ref...>`,`Tool refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--harness <name>`,`Harness hint shown in the run command`).option(`--json`,`Print the profile as JSON instead of writing a file`).action(async(e,t)=>{try{let n=t.name,r=t.description,i=t.harness,a=t.model,o=t.systemPrompt,s=t.skills??[],c=t.tools??[];if(!n&&process.stdin.isTTY&&(n=await H(`Profile name`,`my-agent`),r=await H(`Description (optional)`)||void 0,i=await H(`Harness`,`claude-code`)||void 0,a=await H(`Model (optional, provider/model)`)||void 0,o=await H(`System prompt (optional)`)||void 0,s=await Vn(`Skill ref (local path or github:..., blank to finish)`),c=await Vn(`Tool ref (blank to finish)`)),!n)throw Error(process.stdin.isTTY?`Profile name is required.`:"`agent profile create` needs at least --name in a non-interactive shell (no TTY to prompt). Pass --name <name> (and optionally --model/--skills/--tools/--system-prompt).");let l=ze({model:a,systemPrompt:o,skills:s,tools:c}),u={...n?{name:n}:{},...r?{description:r}:{},...l??{}};if(t.json){D(u);return}let d=e??`agent-profile.json`;f(d,`${JSON.stringify(u,null,2)}\n`),j(`Wrote ${d}`),j(`Run it: tangle agent prompt <box> --profile ${d}${i?` --harness ${i}`:``}`)}catch(e){L(e,t.json)}}),e.command(`show <source>`).description(`Load and print a profile (local path, https URL, or github:owner/repo/path[@ref])`).action(async e=>{try{D(await Be(e))}catch(e){L(e,!0)}}),e.command(`validate <source>`).description(`Check a profile loads and is a well-formed object`).action(async e=>{try{let t=await Be(e);j(`OK — "${typeof t.name==`string`?t.name:`(unnamed)`}" loaded as a valid profile object`)}catch(e){L(e)}}),e}async function Vn(e){let t=[];for(;;){let n=await H(e);if(!n)break;t.push(n)}return t}function Hn(e){return([process.env.SANDBOX_WEB_URL,process.env.TANGLE_SANDBOX_WEB_URL].map(e=>e?.trim()).find(e=>!!e)??e).replace(/\/+$/,``)}function Un(e,t){if(process.exitCode=1,e.status===`blocked_on_approval`){console.error(a.yellow(`⚠ Blocked on a hub approval.`));let t=e.approval?.approvalId;console.error(t?`Approve it: tangle hub approvals approve ${t}`:"Approve the pending request (`tangle hub approvals`), then re-run.");return}if(e.status===`awaiting_question`){console.error(a.yellow(`⚠ Agent is awaiting an answer to a question.`)),console.error(`Re-run with --interactive to answer it, or answer programmatically via box.session(<id>).answer(<questionId>, { ... }).`);return}console.error(a.red(`✗ ${e.error&&e.error.length>0?e.error:t}`))}function Wn(e,t){return process.exitCode=1,t&&D({status:`awaiting_question`,needsInput:e}),`Agent is awaiting an answer (questionId: ${e.questionId??`unknown`}). Re-run with --interactive to answer, or answer via box.session(<id>).answer(<questionId>, { ... }).`}function Gn(e){let t=e.part;if(t?.type===`text`)return t.text??t.content??void 0}function Kn(e){return e.finalText??e.response??e.output??e.content??e.text??void 0}function qn(e){if(typeof e==`string`)return e;try{return JSON.stringify(e)??``}catch{return String(e)}}function Jn(e,t=0){if(t>6||typeof e!=`object`||!e)return;let n=e,r=n.approval;if(r&&typeof r.id==`string`)return r.id;for(let e of Object.values(n)){let n=Jn(e,t+1);if(n)return n}}function Yn(e){let t=e?.toolInvocations;if(!Array.isArray(t))return;let n=t.find(e=>e?.isError===!0);if(n){if(qn(n.result).includes(`HUB_APPROVAL_REQUIRED`)){let e=Jn(n.result);return e?`Blocked on hub approval — approve with: tangle hub approvals approve ${e}`:"Blocked on hub approval — approve the pending request (`tangle hub approvals`) then re-run."}return`Tool "${n.toolName??`unknown`}" failed`}}function Xn(e){if(e.sawError){console.error(a.red(`✗ ${e.errorMsg??`Agent run failed`}`)),process.exitCode=1;return}let t=Date.now()-e.startedAt,n=e.tokenUsage,r=[`${t}ms`,n?.inputTokens===void 0?void 0:`${n.inputTokens} in`,n?.outputTokens===void 0?void 0:`${n.outputTokens} out`].filter(e=>!!e);console.log(a.green(`✓ Done`),a.dim(`(${r.join(`, `)})`))}async function Zn(e,t){let n=``,r=!1,i,a,o,s=e=>{if(e.startsWith(n)){let t=e.slice(n.length);t&&process.stdout.write(t)}else process.stdout.write(e);n=e};try{for await(let t of e){switch(t.type){case`token`:{let e=t.data?.value;typeof e==`string`&&(process.stdout.write(e),n+=e);break}case`message.part.updated`:{let e=Gn(t.data);typeof e==`string`&&e.length>0&&s(e);break}case`raw`:break;case`result`:a=t.data;break;case`question`:{let e=t.data;o={questionId:e.questionId,questions:e.questions};break}case`error`:r=!0,i=t.data.message??JSON.stringify(t.data);break}if(o)break}}catch(e){r=!0,i=e instanceof Error?e.message:String(e)}if(o)return{awaitingQuestion:o,printed:n.length};if(n.length===0&&a){let e=Kn(a);typeof e==`string`&&e.length>0&&(process.stdout.write(e),n=e)}if(!r){let e=Yn(a);e&&(r=!0,i=e)}return{outcome:{sawError:r,errorMsg:i,startedAt:t,tokenUsage:a?.tokenUsage},resultData:a,printed:n.length}}function Qn(e){let t=nn(e??[]);if(t.length!==0)return{profile:{connections:t}}}async function $n(e){let t=nn(e.connection??[]);if(t.length===0)throw Error(`--allow-writes needs at least one --connection to grant writes for.`);if(t.some(e=>e.connectionId===`*`))throw Error("--allow-writes needs explicit --connection ids; the `*:*` wildcard can't be bulk-granted. Grant per connection, e.g. --connection conn_x:* --allow-writes.");let n=await R({hubKey:e.hubKey});for(let r of t){let t=await n.permissions.allowWrites(r.connectionId);e.json||j(`Allowed ${t.writeActions} write action${t.writeActions===1?``:`s`} for connection ${r.connectionId} (${t.granted} newly granted).`)}e.json||j(`Revert anytime: ${t.map(e=>`tangle hub permissions revert-writes --connection ${e.connectionId}`).join(` · `)}`)}async function er(e){!e.connection||e.connection.length===0||(e.connection=await tn(e.connection,()=>R({hubKey:e.hubKey})))}async function tr(e,t){let n=process.stdin,r=process.stdout,i=null,a=!1,o=!1,s,c=new Promise(e=>{s=e}),l=()=>{try{n.setRawMode(!1)}catch{}n.pause()},u=()=>{a||(a=!0,l(),n.off(`data`,p),process.off(`SIGWINCH`,f),process.off(`SIGINT`,d),process.off(`SIGTERM`,d),process.off(`exit`,l),s())},d=e=>{(i?.close()??Promise.resolve()).finally(()=>{u(),process.exit(e===`SIGTERM`?143:130)})},f=()=>{i?.isOpen&&i.resize(r.columns||80,r.rows||24)},p=e=>{if(!i)return;let t=e.indexOf(29);if(t===-1){i.write(e);return}t>0&&i.write(e.subarray(0,t)),i.close().finally(u)};if(i=await e.attach({cols:r.columns||80,rows:r.rows||24,handlers:{onData:e=>{r.write(Buffer.from(e.buffer,e.byteOffset,e.byteLength))},onExit:e=>{o=!0;let t=e.exitCode===void 0?``:` (code ${e.exitCode})`;r.write(`\r\n[interactive session exited${t}]\r\n`),i?.close().finally(u)},onError:e=>{r.write(`\r\n[terminal stream error: ${e.message}]\r\n`)},onClose:()=>u()}}),n.setRawMode(!0),n.resume(),n.on(`data`,p),process.on(`SIGWINCH`,f),process.on(`SIGINT`,d),process.on(`SIGTERM`,d),process.on(`exit`,l),await c,console.log(),o){j(`Interactive session ended.`);return}j(`Detached — the session keeps running.`),N({"Watch & drive":t})}function nr(){let e=new t(`agent`).description(`Interact with AI agent`);return e.command(`prompt <idOrMessage> [message]`).description("Send a single prompt to the agent. With one arg it's the prompt and the box comes from `tangle use` / --box / TANGLE_SANDBOX; with two it's <id> <message>.").option(`--box <id>`,`Target sandbox (overrides the active one)`).option(`--session <id>`,`Continue existing session`).option(`--model <model>`,`Model to use`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`300000`).option(`--stream`,`Stream response in real-time`).option(`--interactive`,`Spawn the harness's interactive TUI in the sandbox, inject this prompt, and print a link to watch + drive the live session in the browser (omit for the default headless run)`).option(`--harness <name>`,`Harness that executes this run (claude-code, codex, kimi-code, opencode, pi, amp, hermes). Defaults to the sandbox's configured backend. The box ships all harnesses, so this is a per-run choice.`).option(`--profile <source>`,`Agent profile to run: a local JSON path, an https URL, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--skills <ref...>`,`Attach skills (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>] to pull from a repo`).option(`--tools <ref...>`,`Attach tools (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--system-prompt <text>`,`Override the agent's system prompt for this run`).option(`--connection <spec>`,"Grant a hub connection to the agent as MCP tools (repeatable). The connection is a connection id or a provider name. Modes: <connection>:<cap1>,<cap2> (least privilege, recommended), <connection>:* (all of one connection), or *:* (all connections). List connections with `tangle hub connections`; paths with `tangle hub tools search <keyword>`.",en,[]).option(`--allow-writes`,"Pre-approve every WRITE action of each granted --connection so the agent can write unattended (reads are already allowed; destructive actions still prompt). Revert with `tangle hub permissions revert-writes`.").option(`--no-hub-key`,`Do not auto-mint a platform Hub key for --allow-writes; use the stored credential as-is`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=t===void 0?e:t,o=t===void 0?At(n.box):e,s=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),c=T(s);if(n.interactive){let e=[n.profile?`--profile`:null,n.skills?.length?`--skills`:null,n.tools?.length?`--tools`:null,n.systemPrompt?`--system-prompt`:null,n.connection?.length?`--connection`:null,n.allowWrites?`--allow-writes`:null].filter(e=>e!==null);if(e.length>0)throw Error(`${e.join(`, `)} ${e.length===1?`is`:`are`} not supported with --interactive: the interactive harness launches its own TUI and is configured by --harness/--model. Drop --interactive to run with a profile, or bake the agent into the box with \`tangle backend configure\`.`)}let l=await Ye({profileSource:n.profile,systemPrompt:n.systemPrompt,skills:n.skills,tools:n.tools});await er(n);let u=Qn(n.connection);n.allowWrites&&await $n(n);let d=l||u?{...l??{},...u?.profile??{}}:void 0,f=n.harness,p=d||f||n.model?{...f?{type:f}:{},...d?{profile:d}:{},...n.model?{model:{model:n.model}}:{}}:void 0,m=await z(c,s,o);if(m=await B(m),n.interactive){let e=n.session??`int-${i()}`,t=f??(await m.backend.status()).type,a=m.session(e).interactive(),c=M(`Starting interactive ${t} session...`);c.start();let l;try{l=await a.start({harness:t,...n.model?{model:n.model}:{}})}finally{c.stop()}try{await a.sendPrompt(r)}catch(e){throw await a.stop().catch(()=>void 0),e}let u=`${Hn(s.baseUrl)}/dashboard/sandbox/${encodeURIComponent(o)}?interactive=${encodeURIComponent(l.sessionId)}`;if(n.json){D({sessionId:l.sessionId,harness:l.harness,streamUrl:l.streamUrl,webUrl:u});return}j(`Interactive ${l.harness} session started — prompt sent.`),console.log(),N({"Watch & drive":u,Session:l.sessionId}),console.log(),j(`Open the link to watch the agent and type to take over. Send more prompts with --session ${l.sessionId} --interactive.`),process.stdin.isTTY===!0&&process.stdout.isTTY===!0&&(console.log(),j(`Attaching to the live session — press Ctrl-] to detach.`),await tr(a,u));return}if(n.stream){j(`Streaming response...`),console.log();let e=Date.now(),t=await Zn(m.streamPrompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...p?{backend:p}:{}}),e);if(`awaitingQuestion`in t){t.printed>0&&console.log();let e=Wn(t.awaitingQuestion,n.json);n.json||console.error(a.yellow(`⚠ ${e}`));return}t.printed>0&&console.log(),Xn(t.outcome)}else{let e=M(`Processing prompt...`);e.start();let t=await m.prompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...p?{backend:p}:{}});e.stop(),n.json?(D(t),t.success===!1&&(process.exitCode=1)):t.success===!1?Un(t,`Agent prompt failed`):(console.log(t.response),console.log(),N({Duration:`${t.durationMs}ms`,"Input Tokens":t.usage?.inputTokens,"Output Tokens":t.usage?.outputTokens}))}}catch(e){L(e,n.json)}}),e.addCommand(Ln()),e.addCommand(Bn()),e}async function rr(e){let t=e.timeoutMs??1e4,n=e.baseUrl.replace(/\/$/,``),r=`${n}/v1/account/me`;try{let n=await fetch(r,{headers:{Accept:`application/json`,Authorization:`Bearer ${e.apiKey}`},signal:AbortSignal.timeout(t)});if(!n.ok){let e=await ar(n);throw n.status===401||n.status===403?new g(e||`Invalid API key`):n.status>=500?new ae(e||`Sandbox API returned an unexpected error`,n.status):Error(e||`Credential validation failed with status ${n.status}`)}let i=await n.json();if(!i.success||!i.data)throw Error(`Sandbox API returned an invalid account response`);return{customerId:i.data.customer_id,email:i.data.email,name:i.data.name,tier:i.data.tier,createdAt:i.data.created_at}}catch(e){throw e instanceof g||e instanceof ae||e instanceof se?e:e instanceof Error&&e.name===`AbortError`?new se(t,`Timed out validating credentials against ${n}`):e instanceof Error&&!(e instanceof TypeError)?e:new _(`Failed to reach ${n}`,ir(e))}}function ir(e){return e instanceof Error?e:void 0}async function ar(e){let t=await e.text();if(t)try{let e=JSON.parse(t);return e.error?.message??e.message??t}catch{return t}}function or(e){if(!cr(e.hostHeader))return{kind:`host-mismatch`};let t;try{t=new URL(e.requestUrl??`/`,`http://127.0.0.1`)}catch{return{kind:`not-found`}}if(t.pathname!==`/callback`)return{kind:`not-found`};if(t.searchParams.get(`state`)!==e.expectedState)return{kind:`state-mismatch`};let n=t.searchParams.get(`error`);if(n)return{kind:`error`,reason:n};let r=t.searchParams.get(`grant_token`);return r?{kind:`ok`,token:r}:{kind:`missing-token`}}async function sr(e){let t=e.timeoutMs??12e4,n=e.baseUrl.replace(/\/$/,``),i=await import(`node:http`),a=r(32).toString(`hex`),o=null,s=null,c=new Promise((e,t)=>{o=e,s=t}),l=i.createServer((e,t)=>{try{let n=or({hostHeader:e.headers.host,requestUrl:e.url,expectedState:a});switch(n.kind){case`host-mismatch`:t.writeHead(421,{"content-type":`text/plain; charset=utf-8`}),t.end(`Misdirected request`);return;case`not-found`:t.writeHead(404,{"content-type":`text/plain; charset=utf-8`}),t.end(`Not found`);return;case`state-mismatch`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(pr(`State mismatch — refusing login`)),s?.(Error(`Browser login state mismatch — refusing potentially hijacked callback`));return;case`error`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(pr(n.reason)),s?.(Error(`Browser login failed: ${n.reason}`));return;case`missing-token`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(pr(null)),s?.(Error(`Browser login did not return a grant token`));return;case`ok`:t.writeHead(200,{"content-type":`text/html; charset=utf-8`}),t.end(pr(null)),o?.(n.token);return}}catch(e){s?.(e instanceof Error?e:Error(`Browser login callback failed`))}});await new Promise((e,t)=>{l.once(`error`,t),l.listen(0,`127.0.0.1`,()=>e())});try{let r=l.address();if(!r||typeof r==`string`)throw Error(`Failed to bind local callback server`);let i=new URL(`http://127.0.0.1:${r.port}/callback`);i.searchParams.set(`state`,a);let o=new URL(`${n}/auth/cli/login`);o.searchParams.set(`callback_url`,i.toString()),e.provider&&o.searchParams.set(`provider`,e.provider);let s=await dr(o.toString());e.onLoginUrl?.({loginUrl:o.toString(),browserOpened:s});let u=await ur({baseUrl:n,grantToken:await lr(c,t),timeoutMs:t});return{apiKey:u.apiKey,email:u.email,name:u.name,tier:u.tier}}finally{await new Promise((e,t)=>{l.close(n=>{if(n){t(n);return}e()})}).catch(()=>void 0)}}function cr(e){if(!e)return!1;let t=e.toLowerCase().match(/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/);if(!t)return!1;let n=t[1];return n===`127.0.0.1`||n===`localhost`||n===`[::1]`}async function lr(e,t){return await new Promise((n,r)=>{let i=setTimeout(()=>{r(new se(t,`Timed out waiting for browser login to complete`))},t);e.then(e=>{clearTimeout(i),n(e)},e=>{clearTimeout(i),r(e)})})}async function ur(e){let t=await fetch(`${e.baseUrl}/auth/cli/exchange`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({grant_token:e.grantToken}),signal:AbortSignal.timeout(e.timeoutMs)}).catch(t=>{throw new _(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),n=await t.json().catch(()=>null);if(!t.ok||!n?.success||!n.data?.api_key)throw Error(n?.error?.message||`Failed to exchange browser login grant`);return{apiKey:n.data.api_key,email:n.data.email,name:n.data.name,tier:n.data.tier}}async function dr(e){let{spawn:t}=await import(`node:child_process`),n=process.platform===`darwin`?[`open`,e]:process.platform===`win32`?[`cmd`,`/c`,`start`,``,e]:[`xdg-open`,e];return await new Promise(e=>{let r=t(n[0],n.slice(1),{detached:!0,stdio:`ignore`});r.once(`error`,()=>e(!1)),r.once(`spawn`,()=>{r.unref(),e(!0)})})}function fr(e){return e.replace(/&/g,`&`).replace(/</g,`<`).replace(/>/g,`>`).replace(/"/g,`"`).replace(/'/g,`'`)}function pr(e){return`<!doctype html>
|
|
126
126
|
<html lang="en">
|
|
127
127
|
<head>
|
|
128
128
|
<meta charset="utf-8" />
|
|
129
129
|
<title>Sandbox CLI Login</title>
|
|
130
130
|
</head>
|
|
131
131
|
<body>
|
|
132
|
-
<p>${e?`Sandbox CLI login failed: ${
|
|
132
|
+
<p>${e?`Sandbox CLI login failed: ${fr(e)}`:`Sandbox CLI login complete. You can close this window.`}</p>
|
|
133
133
|
</body>
|
|
134
|
-
</html>`}const fr=15*6e4;function pr(e){return Number.isFinite(e)&&e>0?e:fr}async function mr(e){let t=e.timeoutMs??fr,n=Date.now(),r=await hr({baseUrl:e.baseUrl,timeoutMs:t,provider:e.provider});for(e.onInstructions?.({userCode:r.user_code,verificationUrl:r.verification_uri,verificationUrlComplete:r.verification_uri_complete,expiresIn:r.expires_in,intervalSeconds:r.interval});;){if(Date.now()-n>t)throw new ce(t,`Timed out waiting for device authorization to complete`);let i=await gr({baseUrl:e.baseUrl,deviceCode:r.device_code,timeoutMs:t});if(i.status===`approved`)return i.data;let a=i.intervalSeconds*1e3;await new Promise(e=>setTimeout(e,a))}}async function hr(e){let t=pr(e.timeoutMs),n=await fetch(`${_r(e.baseUrl)}/auth/cli/device/start`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(e.provider?{provider:e.provider}:{}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new g(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),r=await n.json().catch(()=>null);if(!n.ok||!r?.success||!r.data?.device_code)throw Error(r?.error?.message||`Failed to start device login`);return r.data}async function gr(e){let t=pr(e.timeoutMs),n=await fetch(`${_r(e.baseUrl)}/auth/cli/device/poll`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({device_code:e.deviceCode}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new g(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),r=await n.json().catch(()=>null);if(n.status===428&&r?.error?.code===`AUTHORIZATION_PENDING`)return{status:`pending`,intervalSeconds:typeof r.data?.interval==`number`&&r.data.interval>0?r.data.interval:5};if(!n.ok||!r?.success||!r.data?.api_key||!r.data.email)throw Error(r?.error?.message||`Failed to complete device authorization`);return{status:`approved`,data:{apiKey:r.data.api_key,email:r.data.email,name:r.data.name,tier:r.data.tier}}}function _r(e){return e.replace(/\/$/,``)}function vr(){let e=new t(`auth`).description(`Manage authentication`);e.command(`login`).description(`Authenticate with browser login or an API key`).option(`--api-key <key>`,`API key`).option(`--no-browser`,`Use device-code login instead of opening a browser`).option(`--profile <name>`,`Profile name`).option(`--provider <provider>`,`Identity provider (github, google, microsoft)`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=e.apiKey,n=S(e.profile),r=wr(e.provider),i=Lt(e.baseUrl,n),a=e.browser!==!1;if(!t){if(a){let a=M(`Starting browser login...`);a.start();let o=await ar({baseUrl:i,provider:r,onLoginUrl:({loginUrl:e,browserOpened:t})=>{a.stop(),j(t?`Browser login opened.`:`Open this URL to continue browser login:`),console.log(e)}}).finally(()=>{a.stop()});t=o.apiKey,xr({profile:n,apiKey:t,baseUrl:e.baseUrl?i:void 0}),Jt(),O(`Authenticated`),N({Profile:n,Email:o.email,Tier:o.tier,"Base URL":i}),j(Sr);return}let o=M(`Starting device login...`);o.start();let s=await mr({baseUrl:i,provider:r,onInstructions:({userCode:e,verificationUrl:t,verificationUrlComplete:n})=>{o.stop(),j(`Complete login in a browser on any device:`),N({"Verification URL":t,"Verification URL (prefilled)":n,"Device Code":e})}}).finally(()=>{o.stop()});t=s.apiKey,xr({profile:n,apiKey:t,baseUrl:e.baseUrl?i:void 0}),Jt(),O(`Authenticated`),N({Profile:n,Email:s.email,Tier:s.tier,"Base URL":i}),j(Sr);return}t||(k(`No API key provided.`),process.exit(1)),St(t)||(k(`Invalid API key format. Keys should start with 'sk_' or 'sk-tan-'.`),process.exit(1));let o=M(`Validating credentials...`);o.start();let s=await tr({apiKey:t,baseUrl:i});o.stop(),xr({profile:n,apiKey:t,baseUrl:e.baseUrl?i:void 0}),Jt(),O(`Authenticated`),N({Profile:n,Email:s.email,Tier:s.tier,"Base URL":i}),j(Sr)}catch(e){L(e)}}),e.command(`logout`).description(`Remove stored credentials`).option(`--profile <name>`,`Profile name`).action(e=>{try{let t=S(e.profile);Pt(t),Jt(),O(`Logged out successfully.`),j(`Credentials removed for profile '${t}'.`)}catch(e){L(e)}}),e.command(`status`).description(`Show current authentication status`).option(`--json`,`Output as JSON`).option(`--profile <name>`,`Profile name`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=S(e.profile),n=Ft(e.apiKey,t),r=Lt(e.baseUrl,t),i=It(e.apiKey,t);if(!n){if(e.json){D({authenticated:!1,reason:`missing_credentials`,profile:t,baseUrl:r,credentialSource:null});return}k(`Not authenticated`),j(`Run 'tangle auth login --profile ${t}' to authenticate.`),process.exit(1)}let a=e.json?null:M(`Checking credentials...`);a?.start();try{let o=await tr({apiKey:n,baseUrl:r});if(a?.stop(),e.json){D({authenticated:!0,profile:t,baseUrl:r,credentialSource:i,account:o});return}O(`Authenticated`),N({Profile:t,"API Key":yr(n),"Base URL":r,Source:br(i),Email:o.email,Tier:o.tier})}catch(o){a?.stop(),e.json&&(D({authenticated:!1,profile:t,baseUrl:r,credentialSource:i,error:o instanceof Error?o.message:String(o)}),process.exit(1)),o instanceof re?k(`Stored credentials are invalid.`):A(`Stored credentials found, but validation could not complete.`),N({Profile:t,"API Key":yr(n),"Base URL":r,Source:br(i),Error:o instanceof Error?o.message:String(o)}),process.exit(1)}}catch(e){L(e)}});let n=new t(`profiles`).description(`Manage CLI profiles`);return n.command(`list`).description(`List configured profiles`).option(`--json`,`Output as JSON`).action(e=>{try{let t=jt();if(e.json){D(t);return}if(t.length===0){j(`No profiles found.`);return}I([`Profile`,`Active`,`Base URL`,`Credentials`,`Source`],t.map(e=>[e.name,e.active?`yes`:`no`,e.baseUrl,e.hasApiKey?`configured`:`none`,e.apiKeySource]))}catch(e){L(e)}}),n.command(`use <name>`).description(`Set the active profile`).action(e=>{try{Tt(e);let t=Mt(e);O(`Active profile set to '${t.name}'.`),N({"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`})}catch(e){L(e)}}),n.command(`current`).description(`Show the active profile`).option(`--json`,`Output as JSON`).action(e=>{try{let t=Mt();if(e.json){D(t);return}N({Profile:t.name,"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`,Source:br(t.credentialSource)})}catch(e){L(e)}}),e.addCommand(n),e}function yr(e){return e.length<=14?e:`${e.slice(0,10)}...${e.slice(-4)}`}function br(e){switch(e){case`flag`:return`command flag`;case`env`:return`environment`;case`keychain`:return`OS keychain`;case`file`:return`credentials file`;case`legacy-file`:return`legacy credentials file`;default:return`unknown`}}function xr(e){let t=Nt(e.profile,{apiKey:e.apiKey,...e.baseUrl?{baseUrl:e.baseUrl}:{}});Tt(e.profile),wt({...e.baseUrl&&e.profile===`default`?{baseUrl:e.baseUrl}:{}}),Sr=Cr(e.profile,t)}let Sr=`Credentials updated.`;function Cr(e,t){return t===`keychain`?e===`default`?`API key saved to the OS keychain for the default profile`:`API key saved to the OS keychain for profile '${e}'`:t===`file`?e===`default`?`API key saved to ~/.tangle/credentials.json for the default profile`:`API key saved to ~/.tangle/credentials.json for profile '${e}'`:`Profile '${e}' updated.`}function wr(e){if(e===void 0||e===`github`||e===`google`||e===`microsoft`)return e;throw Error(`--provider must be one of: github, google, microsoft`)}function Tr(){let e=new t(`backend`).description(`Manage sandbox AI agent backend`);return e.command(`status <sandboxId-or-name>`).description(`Get backend agent status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching backend status...`);i.start();let a=await(await z(r,n,e)).backend.status();i.stop(),t.json?D(a):(j(`Backend Type: ${a.type}`),j(`Status: ${a.status}`),a.version&&j(`Version: ${a.version}`),a.error&&j(`Error: ${a.error}`),a.metadata&&j(`Metadata: ${JSON.stringify(a.metadata,null,2)}`))}catch(e){L(e)}}),e.command(`capabilities <sandboxId-or-name>`).description(`Get backend capabilities`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching capabilities...`);i.start();let a=await(await z(r,n,e)).backend.capabilities();i.stop(),t.json?D(a):(j(`Backend Capabilities:`),j(` Streaming: ${a.streaming?`✓`:`✗`}`),j(` Tool Use: ${a.toolUse?`✓`:`✗`}`),j(` Reasoning: ${a.reasoning?`✓`:`✗`}`),j(` Multimodal: ${a.multimodal?`✓`:`✗`}`),j(` Context Window: ${a.contextWindow.toLocaleString()} tokens`))}catch(e){L(e)}}),e.command(`configure <sandboxId-or-name>`).description(`Update backend configuration`).option(`--model <model>`,`Model string (format: provider/model)`).option(`--max-thinking-tokens <n>`,`Maximum thinking tokens`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Updating backend config...`);i.start();let a=await z(r,n,e),o={};if(t.model||t.maxThinkingTokens){if(o.model={},t.model){let e=t.model.split(`/`);e.length>=2?(o.model.provider=e[0],o.model.model=e.slice(1).join(`/`)):o.model.model=t.model}t.maxThinkingTokens&&(o.model.maxThinkingTokens=Number.parseInt(t.maxThinkingTokens,10))}await a.backend.updateConfig(o),i.stop(),O(`Backend configuration updated`),t.json&&D(o)}catch(e){L(e)}}),e.command(`add-mcp <sandboxId-or-name>`).description(`Add an MCP server to the backend`).requiredOption(`--name <name>`,`MCP server name`).requiredOption(`--command <cmd>`,`Command to run (e.g., npx)`).option(`--args <args...>`,`Command arguments`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--cwd <dir>`,`Working directory`).option(`--url <url>`,`Remote MCP server URL (for SSE)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Adding MCP server...`);i.start();let a=await z(r,n,e),o={};if(t.env)for(let e of t.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(o[t]=n.join(`=`))}await a.backend.addMcp(t.name,{command:t.command,args:t.args,env:Object.keys(o).length>0?o:void 0,cwd:t.cwd,url:t.url}),i.stop(),O(`MCP server "${t.name}" added`),t.json&&D({name:t.name,command:t.command,args:t.args,env:Object.keys(o).length>0?o:void 0,cwd:t.cwd,url:t.url})}catch(e){L(e)}}),e.command(`mcp-status <sandboxId-or-name>`).description(`Get status of MCP servers`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching MCP status...`);i.start();let a=await(await z(r,n,e)).backend.getMcpStatus();if(i.stop(),t.json)D(a);else{let e=Object.entries(a);e.length===0?j(`No MCP servers configured`):E(e.map(([e,t])=>{let n=t;return{name:e,status:n.status,error:n.error??``}}),[{key:`name`,header:`Name`,width:24},{key:`status`,header:`Status`,width:12},{key:`error`,header:`Error`,width:40}])}}catch(e){L(e)}}),e.command(`restart <sandboxId-or-name>`).description(`Restart the backend agent`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Restarting backend...`);i.start(),await(await z(r,n,e)).backend.restart(),i.stop(),O(`Backend restarted`)}catch(e){L(e)}}),e}function Er(e){let t=e.indexOf(`=`);if(t<=0)throw Error(`Invalid --task "${e}": expected format id=message (e.g. t1=summarize README)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!n||!r)throw Error(`Invalid --task "${e}": id and message must be non-empty`);return{id:n,message:r}}function Dr(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--tasks file is not valid JSON: ${e.message}`)}let n=Array.isArray(t)?t:t?.tasks;if(!Array.isArray(n))throw Error(`--tasks file must contain an array or an object with a "tasks" array`);return n.map((e,t)=>{if(!e||typeof e!=`object`)throw Error(`--tasks[${t}] must be an object`);let n=e,r=typeof n.id==`string`?n.id.trim():``,i=typeof n.message==`string`?n.message:``;if(!r)throw Error(`--tasks[${t}].id must be a non-empty string`);if(!i.trim())throw Error(`--tasks[${t}].message must be a non-empty string`);let a={id:r,message:i};if(n.context!==void 0&&(typeof n.context!=`object`||n.context===null||Array.isArray(n.context)))throw Error(`--tasks[${t}].context must be a JSON object`);if(n.context!==void 0&&(a.context=n.context),n.timeoutMs!==void 0&&(!Number.isInteger(n.timeoutMs)||n.timeoutMs<=0))throw Error(`--tasks[${t}].timeoutMs must be a positive integer`);return n.timeoutMs!==void 0&&(a.timeoutMs=n.timeoutMs),a})}function Or(e){let t=e.readFile??(e=>u(e,`utf8`)),n=[];e.file&&n.push(...Dr(t(e.file)));for(let t of e.inline??[])n.push(Er(t));if(n.length===0)throw Error(`No tasks provided. Use --tasks <file> and/or --task id=message.`);let r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate task id: ${e.id}`);r.add(e.id)}return n}const kr=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function Ar(e){let t=e.trim(),n=t.indexOf(`/`);if(n<=0||n===t.length-1)throw Error(`--model must be in the form provider/model (got "${e}")`);return{provider:t.slice(0,n),model:t.slice(n+1)}}function jr(e){let t=e.indexOf(`=`);if(t<=0||t===e.length-1)throw Error(`Invalid --backend "${e}": expected format id=type (e.g. primary=opencode)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!kr.test(n))throw Error(`Invalid backend id "${n}": use 1-128 letters, numbers, dots, underscores, or hyphens, starting with a letter or number`);if(!r||r.includes(`=`))throw Error(`Invalid --backend "${e}": type must be a non-empty backend name`);return{id:n,type:r}}function Mr(e,t){if(!e||e.length===0)throw Error(`No backends provided. Use --backend id=type or --request <file>.`);let n=e.map(jr),r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate backend id: ${e.id}`);r.add(e.id)}if(t&&n.length!==1)throw Error(`--model requires exactly one backend; use a profile to configure models for multiple backends`);return t&&(n[0]={...n[0],model:Ar(t)}),n}function Nr(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--request file is not valid JSON: ${e.message}`)}try{return he(t)}catch(e){throw Error(`--request file is not a valid batch request: ${e.message}`)}}function Pr(e,t,n){return n?`${e} [${t}]`:e}function Fr(e){let t=new Map;for(let n of e)t.set(n.taskId,(t.get(n.taskId)??0)+1);return new Set([...t.entries()].filter(([,e])=>e>1).map(([e])=>e))}function Ir(){let e=new t(`batch`).description(`Run multiple agent tasks in parallel across sandboxes`);return e.command(`run`).description(`Execute a batch of tasks. Provide tasks via --tasks <file.json> and/or repeated --task id=message flags.`).option(`--tasks <file>`,`Path to a JSON file with an array of tasks (or {tasks: [...]})`).option(`--request <file>`,`Path to a complete batch request JSON file`).option(`--task <id=message>`,`Inline task, id=message. Repeatable.`,(e,t=[])=>[...t,e],[]).option(`--stream`,`Stream per-task events as they arrive`).option(`-t, --timeout <ms>`,`Per-task timeout in milliseconds`,`300000`).option(`--persistent`,`Keep sandboxes alive after completion`,!1).option(`--reuse-key <key>`,`Stable workspace identity required by --persistent`).option(`--idempotency-key <key>`,`Retry identity; keyed runs continue after disconnect`).option(`--backend <id=type>`,`Backend identity and type. Required and repeatable without --request.`,(e,t=[])=>[...t,e],[]).option(`--model <provider/model>`,`Model override when exactly one backend is selected`).option(`--json`,`Output the final result as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{let n=new AbortController,r=!1,i=()=>{r||(r=!0,j(`Cancel requested — stopping stream...`),n.abort())};process.on(`SIGINT`,i),process.on(`SIGTERM`,i);try{let r;if(e.request){let n=[`tasks`,`task`,`backend`,`model`,`timeout`,`persistent`,`reuseKey`].filter(e=>t.getOptionValueSource(e)===`cli`);if(n.length>0){let e={reuseKey:`reuse-key`};throw Error(`--request cannot be combined with ${n.map(t=>`--${e[t]??t}`).join(`, `)}`)}r=Nr(u(e.request,`utf8`))}else{let t=Or({file:e.tasks,inline:e.task}),n=Mr(e.backend,e.model),i=Number(e.timeout);if(!Number.isInteger(i)||i<=0)throw Error(`--timeout must be a positive integer number of milliseconds`);let a=!!e.persistent;if(a&&!e.reuseKey)throw Error(`--persistent requires --reuse-key`);if(!a&&e.reuseKey)throw Error(`--reuse-key requires --persistent`);r=he({tasks:t,timeoutMs:i,backends:n,...a?{persistent:!0,reuseKey:e.reuseKey}:{persistent:!1}})}let{tasks:i,backends:o}=r,s=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),c={signal:n.signal,...e.idempotencyKey?{idempotencyKey:e.idempotencyKey}:{}};if(e.stream){j(`Streaming batch of ${i.length} task(s)...`),console.log();let t=ue(r),n=o.length>1;for await(let e of s.streamBatch(r,c))switch(t.add(e),e.type){case`batch.started`:{let t=e.data;j(`Batch started (${t.taskCount} tasks, ${t.backendCount} backends)`);break}case`task.started`:{let t=e.data;console.log(a.dim(`→ ${Pr(t.taskId,t.backendId,n)} started`));break}case`task.retry`:{let t=e.data;console.log(a.yellow(`↻ ${Pr(t.taskId,t.backendId,n)} retry ${t.attempt}: ${t.error}`));break}case`task.completed`:{let t=e.data;console.log(a.green(`✓ ${Pr(t.taskId,t.backendId,n)} completed in ${t.durationMs}ms`+(t.retries?` (${t.retries} retries)`:``)));break}case`task.failed`:{let t=e.data;console.log(a.red(`✗ ${Pr(t.taskId,t.backendId,n)} failed: ${t.error}`));break}case`batch.completed`:break}let l=t.finish();console.log(),e.json?D(l):N({"Total tasks":l.totalTasks,"Total backends":l.totalBackends,"Total executions":l.totalExecutions,Succeeded:l.totalSuccess,Failed:l.totalFailure,"Total retries":l.totalRetries,"Success rate":`${l.successRate.toFixed(1)}%`}),l.totalFailure>0&&(process.exitCode=1)}else{j(`Running batch of ${i.length} task(s)...`);let t=await s.runBatch(r,c);if(e.json)D(t);else if(console.log(),N({"Total tasks":t.totalTasks,"Total backends":t.totalBackends,"Total executions":t.totalExecutions,Succeeded:t.totalSuccess,Failed:t.totalFailure,"Total retries":t.totalRetries,"Success rate":`${t.successRate.toFixed(1)}%`}),t.results.length>0){let e=Fr(t.results);console.log(),console.log(a.bold(`Task Results`)),console.log(a.dim(`─`.repeat(40)));for(let n of t.results){let t=n.success?a.green(`✓`):a.red(`✗`),r=n.success?n.usage.inputTokens+n.usage.outputTokens:0,i=r>0?` • ${r} tokens`:``;console.log(`${t} ${Pr(n.taskId,n.backendId,e.has(n.taskId))} ${a.dim(`(${n.durationMs}ms, ${n.retries} retries${i})`)}`),n.success||console.log(a.red(` ${n.error}`))}}t.totalFailure>0&&(process.exitCode=1)}}catch(e){if(r){console.log(),j(`Batch cancelled.`),process.exitCode=130;return}L(e)}finally{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)}}),e}function Lr(){let e=new t(`branch`).description(`Branch a running sandbox into copy-on-write children`);return e.command(`create <sandbox-id-or-name>`).description(`Branch a running sandbox into N copy-on-write children`).option(`--count <n>`,`Number of children to create`,`1`).option(`--idempotency-key <key>`,`Retry identity: the same key and count replays the first fan-out and creates no second one`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Number.parseInt(t.count,10);if(!Number.isInteger(n)||n<1)throw Error(`--count must be an integer >= 1 (got ${t.count})`);let r=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),i=T(r),a=M(`Branching into ${n} child(ren)...`);a.start();let o=await z(i,r,e),s=await o.fork(n,{...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}}),c=s.children;a.stop(),t.json?D({children:c.map(e=>({sandboxId:e.id})),requestedCount:s.requestedCount,materializedCount:s.materializedCount,complete:s.complete,...s.idempotency?{idempotency:s.idempotency}:{}}):(s.complete?O(`Branched ${c.length} child(ren) from ${o.id}`):A(`Branched ${s.materializedCount} of ${s.requestedCount} requested child(ren) from ${o.id}`),s.idempotency?.outcome===`replayed`&&j(`Replayed an earlier fan-out under this key; created none.`),E(c.map(e=>({sandboxId:e.id})),[{key:`sandboxId`,header:`Child Sandbox`,width:28}]))}catch(e){L(e)}}),e}const Rr=[`codex`,`claude-code`,`nanoclaw`,`kimi-code`,`opencode`,`pi`,`openclaw`,`hermes`],zr=`https://intelligence.tangle.tools/v1/otlp`,Br=[`codex`,`claude-code`],Vr=[`codex`,`claude-code`,`nanoclaw`],Hr=[`SessionStart`,`UserPromptSubmit`,`PreToolUse`,`PostToolUse`,`Stop`],Ur={codex:{kind:`native`,surface:`codex`,label:`Codex`,buildFiles:ni},"claude-code":{kind:`native`,surface:`claude-code`,label:`Claude Code`,buildFiles:ri},nanoclaw:{kind:`native`,surface:`nanoclaw`,label:`NanoClaw`,buildFiles:ri},"kimi-code":{kind:`manual`,surface:`kimi-code`,label:`Kimi Code`,reason:`Kimi Code loads hooks through an explicit config file, so use standard OTLP env wiring until the native config adapter is verified.`},opencode:{kind:`manual`,surface:`opencode`,label:`OpenCode`,reason:`OpenCode hooks run as plugins; use standard OTLP env wiring until the native plugin adapter is verified.`},pi:{kind:`manual`,surface:`pi`,label:`Pi`,reason:`Pi hooks run through TypeScript extensions; use standard OTLP env wiring until the native extension adapter is verified.`},openclaw:{kind:`manual`,surface:`openclaw`,label:`OpenClaw`,reason:`OpenClaw project hooks require user opt-in; use standard OTLP env wiring until the hook toggle and adapter are verified.`},hermes:{kind:`manual`,surface:`hermes`,label:`Hermes`,reason:`Hermes project plugins require explicit enablement; use standard OTLP env wiring until the plugin adapter is verified.`}};function Wr(e){let t=e.split(`,`).map(e=>e.trim()).filter(Boolean).flatMap(e=>ti(e));return t.length===0?[...Br]:gi(t)}function Gr(e){return Object.hasOwn(Ur,e)}function Kr(e=process.cwd()){return m(ne(e))||`agent-workspace`}function qr(){return h(_e(),`.tangle`,`intelligence.json`)}function Jr(e=qr()){if(!c(e))return null;let t=pi(e),n=_i(t,`apiKey`),r=_i(t,`endpoint`),i=_i(t,`serviceName`),a=_i(t,`environment`);if(!n||!r||!i||!a)throw Error(`${e} is missing apiKey, endpoint, serviceName, or environment`);return{apiKey:n,endpoint:r,serviceName:i,environment:a}}async function Yr(e){let t=ne(e.workspace),n=qr(),r=Wr(e.selection),i=[],a=[],o=[],s={apiKey:e.apiKey,endpoint:U(e.endpoint),serviceName:e.serviceName,environment:e.environment};e.dryRun||ui(n,s),o.push(n);for(let n of r){let r=Ur[n];if(r.kind===`manual`){a.push({agent:r.surface,label:r.label,reason:r.reason});continue}i.push(r.surface);let s=t=>Xr(e.hookCommand,r.surface,t);for(let n of r.buildFiles(s)){let r=h(t,n.relPath);if(e.dryRun){o.push(r);continue}fi(r,JSON.parse(n.content),n.mode),o.push(r)}}return!e.smoke||e.dryRun?{configPath:n,written:o,agents:r,nativeAgents:i,manual:a}:{configPath:n,written:o,agents:r,nativeAgents:i,manual:a,smokeTraceId:await Qr({agent:i[0]??r[0]??`codex`,event:`install.smoke`,endpoint:s.endpoint,apiKey:s.apiKey,serviceName:s.serviceName,environment:s.environment,sessionId:`install-smoke-${Date.now()}`,payload:{source:`tangle intelligence connect`}})}}function Xr(e,t,n){return`${e.trim()} --agent ${t} --event ${n} --non-blocking`}function Zr(e){let t=BigInt(Date.now())*1000000n,n=yi(16),r=yi(8),i=e.sessionId??ii(e.payload),a={"service.name":e.serviceName,"deployment.environment":e.environment,"tangle.agent.surface":e.agent,"tangle.agent.hook.event":e.event,"tangle.agent.hook.source":`local-hook`,...ai(e.payload)};return i&&(a[`session.id`]=i,a[`gen_ai.conversation.id`]=i,a[`tangle.sessionId`]=i),{body:{resourceSpans:[{resource:{attributes:[bi(`service.name`,e.serviceName),bi(`deployment.environment`,e.environment),bi(`tangle.agent.surface`,e.agent)]},scopeSpans:[{scope:{name:`tangle.intelligence.agent-hook`,version:`1.0.0`},spans:[{traceId:n,spanId:r,name:`agent.${e.agent}.${e.event}`,kind:1,startTimeUnixNano:t.toString(),endTimeUnixNano:(t+1000000n).toString(),attributes:Object.entries(a).map(([e,t])=>bi(e,t)),status:{code:1}}]}]}]},traceId:n}}async function Qr(e){let{body:t,traceId:n}=Zr(e),r=await fetch(`${U(e.endpoint)}/v1/traces`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(t)});if(!r.ok){let e=await r.text().catch(()=>``);throw Error(`OTLP smoke ingest failed: ${r.status}${e?` ${e}`:``}`)}return n}function $r(e){return U(e).replace(/\/v1\/otlp$/,``).replace(/\/+$/,``)}async function ei(e){let t=`${$r(e.endpoint)}/v1/onboarding/status`,n=await fetch(t,{headers:{Authorization:`Bearer ${e.apiKey}`},signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`onboarding status request failed: ${n.status}${e?` ${e}`:``}`)}let r=await n.json();return{tracesSeen:!!r.tracesSeen,contentSeen:!!r.contentSeen,lastSeenAt:typeof r.lastSeenAt==`string`?r.lastSeenAt:null,windowDays:typeof r.windowDays==`number`?r.windowDays:7,byAgent:r.byAgent&&typeof r.byAgent==`object`?r.byAgent:{}}}function U(e){let t=e.trim().replace(/\/+$/,``);return t.endsWith(`/v1/traces`)?t.slice(0,-10):t.endsWith(`/v1/logs`)?t.slice(0,-8):t}function ti(e){switch(e){case`local`:case`both`:return[...Br];case`all`:return[...Vr];case`claude`:return[`claude-code`];case`kimi`:return[`kimi-code`];default:if(Gr(e))return[e];throw Error(`agent must be one of: local, all, both, ${Rr.join(`, `)}`)}}function ni(e){let t=Object.fromEntries(Hr.map(t=>[t,[{command:e(t),timeoutMs:3e3,blocking:!1,matcher:`*`}]]));return[{relPath:`.codex/hooks.json`,content:JSON.stringify({hooks:t},null,2)}]}function ri(e){let t=Object.fromEntries(Hr.map(t=>[t,[{matcher:`*`,hooks:[{type:`command`,command:e(t),timeout:3}]}]]));return[{relPath:`.claude/settings.json`,content:JSON.stringify({hooks:t},null,2)}]}function ii(e){return si(e,[`session.id`,`sessionId`,`session_id`,`conversationId`,`conversation_id`,`threadId`,`thread_id`,`transcriptId`,`transcript_id`])||process.env.TANGLE_SESSION_ID||process.env.CODEX_THREAD_ID||process.env.CLAUDE_SESSION_ID||process.env.OPENCODE_SESSION_ID}function ai(e){let t={},n=oi(e,[`tool.name`,`toolName`,`tool_name`,`tool`]),r=oi(e,[`command`,`cmd`,`shell_command`,`shellCommand`]),i=oi(e,[`tool.input`,`toolInput`,`tool_input`,`input`,`arguments`,`args`]),a=oi(e,[`tool.output`,`toolOutput`,`tool_output`,`output`,`result`]),o=oi(e,[`tool.exit_code`,`exitCode`,`exit_code`,`status`]),s=oi(e,[`tool.error.message`,`errorMessage`,`error_message`,`error`]);return n&&(t[`tool.name`]=n),r&&(t[`process.command`]=r),i&&(t[`tool.input.summary`]=i),a&&(t[`tool.output.summary`]=a),o&&(t[`tool.exit_code`]=o),s&&(t[`tool.error.message`]=s),t}function oi(e,t){let n=ci(e,t);if(n===void 0)return null;if(typeof n==`string`)return li(n);if(typeof n==`number`||typeof n==`boolean`||typeof n==`bigint`)return String(n);try{return li(JSON.stringify(n))}catch{return null}}function si(e,t){let n=ci(e,t);return typeof n==`string`&&n.length>0?n:void 0}function ci(e,t){if(typeof e!=`object`||!e)return;let n=[e],r=new Set;for(;n.length;){let e=n.pop();if(typeof e!=`object`||!e||r.has(e))continue;r.add(e);let i=e;for(let e of t){let t=i[e];if(t!=null&&t!==``)return t}for(let e of Object.values(i))typeof e==`object`&&e&&n.push(e)}}function li(e){return e.length>4096?`${e.slice(0,4093)}...`:e}function ui(e,t){di(e,`${JSON.stringify(t,null,2)}\n`)}function di(e,t){l(ee(e),{mode:448,recursive:!0});let n=`${e}.${process.pid}.tmp`;f(n,t,{mode:384}),d(n,e)}function fi(e,t,n){l(ee(e),{recursive:!0});let r=mi(pi(e),t);f(e,`${JSON.stringify(r,null,2)}\n`,{mode:n??420})}function pi(e){if(!c(e))return{};let t=JSON.parse(u(e,`utf8`));if(!vi(t))throw Error(`${e} must contain a JSON object`);return t}function mi(e,t){let n={...e};for(let[e,r]of Object.entries(t)){let t=n[e];vi(t)&&vi(r)?n[e]=mi(t,r):Array.isArray(t)&&Array.isArray(r)?n[e]=hi([...t,...r]):n[e]=r}return n}function hi(e){let t=new Set,n=[];for(let r of e){let e=JSON.stringify(r);t.has(e)||(t.add(e),n.push(r))}return n}function gi(e){return[...new Set(e)]}function _i(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function vi(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null)}function yi(e){return r(e).toString(`hex`)}function bi(e,t){return{key:e,value:{stringValue:t}}}const xi=`tangle.opencode-exporter`,Si=16384;function Ci(e){return e.length<=Si?e:`${e.slice(0,Si-1)}…`}function W(e,t){return{key:e,value:{stringValue:t}}}function wi(e){if(!e||typeof e!=`object`)return null;let t=e,n=v(t.type);return n?{type:n,properties:t.properties&&typeof t.properties==`object`?t.properties:void 0}:null}function Ti(e,t){let n=[W(`event.name`,e),W(`gen_ai.system`,`opencode`),W(`service.name`,`opencode`)];return t&&(n.push(W(`session.id`,t)),n.push(W(`gen_ai.conversation.id`,t))),n}function Ei(e){if(!e)return null;let t=e.part,n=e.info;return v(t?.sessionID)??v(n?.sessionID)??v(e.sessionID)??null}function Di(e,t){let n=v(e.role)??v(e.info?.role);if(n)return n.toLowerCase();let r=v(e.messageID),i=t?.(r)??null;return i?i.toLowerCase():null}function Oi(e,t,n){let r=[],i=Ei(e.properties),a=(n,r)=>({timeUnixNano:t,severityNumber:9,severityText:`INFO`,...n===null?{}:{body:{stringValue:Ci(n)}},attributes:[...Ti(e.type,i),...r]});if(e.type===`message.part.updated`){let t=e.properties?.part;if(!t)return r;let i=v(t.type);if(i===`text`||i===`reasoning`){let e=v(t.text);if(e){let i=Di(t,n)===`user`?Te:we;r.push(a(e,[W(i,Ci(e))]))}return r}if(i===`tool`){let e=v(t.tool),n=t.state,i=Ae(n?.input),o=Ae(n?.output),s=v(n?.error)??(typeof n?.error==`object`&&n?.error!==null?Ae(n.error):null);if(e||i){let t=[];e&&t.push(W(De,e)),i&&t.push(W(Ee,Ci(i))),r.push(a(null,t))}let c=o??s;if(c){let t=[W(Oe,Ci(c))];e&&t.push(W(De,e)),r.push(a(c,t))}return r}return r}if(e.type===`session.next.text.delta`||e.type===`session.next.text.ended`){let t=e.properties??{},n=v(t.text)??(e.type===`session.next.text.delta`?v(t.delta):null);return n&&r.push(a(n,[W(we,Ci(n))])),r}return r}function ki(e=process.env.OTEL_RESOURCE_ATTRIBUTES){if(!e)return null;for(let t of e.split(`,`)){let e=t.indexOf(`=`);if(e===-1||t.slice(0,e).trim()!==ke)continue;let n=t.slice(e+1).trim();if(n.length>0)return n}return null}function Ai(e,t){if(e.length===0)return null;let n=[W(`service.name`,`opencode`),W(`gen_ai.system`,`opencode`),W(`telemetry.sdk.name`,xi)];return t&&t.trim().length>0&&n.push(W(ke,t.trim())),{resourceLogs:[{resource:{attributes:n},scopeLogs:[{scope:{name:xi,version:`1.0.0`},logRecords:e}]}]}}function ji(e){return(e??process.env.OPENCODE_BASE_URL??`http://127.0.0.1:4096`).replace(/\/+$/,``)}async function Mi(e){let t=U(e.endpoint),n=await(e.fetchImpl??fetch)(`${t}/v1/logs`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(e.request),signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`OpenCode OTLP logs ingest failed: ${n.status}${e?` ${e}`:``}`)}}var Ni=class extends Error{partial;constructor(e,t){let n=e instanceof Error?e.message:String(e);super(n),this.name=`OpencodeExporterError`,this.partial=t,e instanceof Error&&(this.cause=e)}};function Pi(){return(BigInt(Date.now())*1000000n).toString()}async function Fi(e){let t=ji(e.opencodeBaseUrl),n=e.nowUnixNano??Pi,r=e.fetchImpl??fetch,i=e.subjectKey===void 0?ki():e.subjectKey,a=await r(`${t}/event`,{headers:{Accept:`text/event-stream`},signal:e.signal});if(!a.ok){let e=await a.text().catch(()=>``);throw Error(`OpenCode event subscribe failed: ${a.status} at ${t}/event${e?` ${e}`:``}. Is OpenCode running with 'opencode serve'?`)}if(!a.body)throw Error(`OpenCode event stream at ${t}/event returned no body — cannot subscribe`);let o={eventsSeen:0,contentEventsExported:0,recordsExported:0},s=new Map,c=e=>e?s.get(e)??null:null;try{for await(let t of me(a.body,{signal:e.signal})){o.eventsSeen++;let a=wi(t.data);if(!a)continue;if(a.type===`message.updated`){let e=a.properties?.info,t=v(e?.id),n=v(e?.role);t&&n&&s.set(t,n);continue}let l=Oi(a,n(),c),u=Ai(l,i);u&&(await Mi({endpoint:e.endpoint,apiKey:e.apiKey,request:u,timeoutMs:e.postTimeoutMs,fetchImpl:r}),o.contentEventsExported++,o.recordsExported+=l.length,e.onExport?.({eventType:a.type,records:l.length}))}}catch(e){if(e instanceof Error&&(e.name===`AbortError`||e.message.toLowerCase().includes(`abort`)))return o;throw new Ni(e,o)}return o}function G(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}const Ii=[`claude-code`,`codex`,`opencode`,`openclaw`,`hermes`,`nanoclaw`],Li={"claude-code":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,openclaw:`OpenClaw`,hermes:`Hermes`,nanoclaw:`NanoClaw`},Ri=`# >>> tangle intelligence (claude-code) >>>`,zi=`# <<< tangle intelligence (claude-code) <<<`;function Bi(e){return Ii.includes(e)}function Vi(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??Ft(void 0);if(!t)throw Error(`No Tangle API key found. Pass --api-key, set TANGLE_API_KEY, or run: tangle auth login`);return t}const Hi={full:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`},{key:`OTEL_LOG_TOOL_CONTENT`,comment:`full tool input+output bodies`},{key:`OTEL_LOG_RAW_API_BODIES`,comment:`full prompt+completion JSON (richest)`}],prompts:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`}],metadata:[]};function Ui(e,t){return t===`env`?e:/\s/.test(e)?`"${e}"`:e}function Wi(e,t){let n=t===`shell`?`export `:t===`dockerfile`?`ENV `:``,r=[];for(let i of e){if(i.kind===`blank`){t===`shell`&&r.push(``);continue}if(i.kind===`comment`){t===`shell`&&r.push(`# ${i.text}`);continue}let e=t===`shell`&&i.comment?` # ${i.comment}`:``;r.push(`${n}${i.key}=${Ui(i.value,t)}${e}`)}return r.join(`
|
|
135
|
-
`)}function
|
|
136
|
-
`)}function
|
|
134
|
+
</html>`}const mr=15*6e4;function hr(e){return Number.isFinite(e)&&e>0?e:mr}async function gr(e){let t=e.timeoutMs??mr,n=Date.now(),r=await _r({baseUrl:e.baseUrl,timeoutMs:t,provider:e.provider});for(e.onInstructions?.({userCode:r.user_code,verificationUrl:r.verification_uri,verificationUrlComplete:r.verification_uri_complete,expiresIn:r.expires_in,intervalSeconds:r.interval});;){if(Date.now()-n>t)throw new se(t,`Timed out waiting for device authorization to complete`);let i=await vr({baseUrl:e.baseUrl,deviceCode:r.device_code,timeoutMs:t});if(i.status===`approved`)return i.data;let a=i.intervalSeconds*1e3;await new Promise(e=>setTimeout(e,a))}}async function _r(e){let t=hr(e.timeoutMs),n=await fetch(`${yr(e.baseUrl)}/auth/cli/device/start`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(e.provider?{provider:e.provider}:{}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new _(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),r=await n.json().catch(()=>null);if(!n.ok||!r?.success||!r.data?.device_code)throw Error(r?.error?.message||`Failed to start device login`);return r.data}async function vr(e){let t=hr(e.timeoutMs),n=await fetch(`${yr(e.baseUrl)}/auth/cli/device/poll`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({device_code:e.deviceCode}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new _(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),r=await n.json().catch(()=>null);if(n.status===428&&r?.error?.code===`AUTHORIZATION_PENDING`)return{status:`pending`,intervalSeconds:typeof r.data?.interval==`number`&&r.data.interval>0?r.data.interval:5};if(!n.ok||!r?.success||!r.data?.api_key||!r.data.email)throw Error(r?.error?.message||`Failed to complete device authorization`);return{status:`approved`,data:{apiKey:r.data.api_key,email:r.data.email,name:r.data.name,tier:r.data.tier}}}function yr(e){return e.replace(/\/$/,``)}function br(){let e=new t(`auth`).description(`Manage authentication`);e.command(`login`).description(`Authenticate with browser login or an API key`).option(`--api-key <key>`,`API key`).option(`--no-browser`,`Use device-code login instead of opening a browser`).option(`--profile <name>`,`Profile name`).option(`--provider <provider>`,`Identity provider (github, google, microsoft)`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=e.apiKey,n=S(e.profile),r=Er(e.provider),i=Lt(e.baseUrl,n),a=e.browser!==!1;if(!t){if(a){let a=M(`Starting browser login...`);a.start();let o=await sr({baseUrl:i,provider:r,onLoginUrl:({loginUrl:e,browserOpened:t})=>{a.stop(),j(t?`Browser login opened.`:`Open this URL to continue browser login:`),console.log(e)}}).finally(()=>{a.stop()});t=o.apiKey,Cr({profile:n,apiKey:t,baseUrl:e.baseUrl?i:void 0}),Xt(),O(`Authenticated`),N({Profile:n,Email:o.email,Tier:o.tier,"Base URL":i}),j(wr);return}let o=M(`Starting device login...`);o.start();let s=await gr({baseUrl:i,provider:r,onInstructions:({userCode:e,verificationUrl:t,verificationUrlComplete:n})=>{o.stop(),j(`Complete login in a browser on any device:`),N({"Verification URL":t,"Verification URL (prefilled)":n,"Device Code":e})}}).finally(()=>{o.stop()});t=s.apiKey,Cr({profile:n,apiKey:t,baseUrl:e.baseUrl?i:void 0}),Xt(),O(`Authenticated`),N({Profile:n,Email:s.email,Tier:s.tier,"Base URL":i}),j(wr);return}t||(k(`No API key provided.`),process.exit(1)),St(t)||(k(`Invalid API key format. Keys should start with 'sk_' or 'sk-tan-'.`),process.exit(1));let o=M(`Validating credentials...`);o.start();let s=await rr({apiKey:t,baseUrl:i});o.stop(),Cr({profile:n,apiKey:t,baseUrl:e.baseUrl?i:void 0}),Xt(),O(`Authenticated`),N({Profile:n,Email:s.email,Tier:s.tier,"Base URL":i}),j(wr)}catch(e){L(e)}}),e.command(`logout`).description(`Remove stored credentials`).option(`--profile <name>`,`Profile name`).action(e=>{try{let t=S(e.profile);Pt(t),Xt(),O(`Logged out successfully.`),j(`Credentials removed for profile '${t}'.`)}catch(e){L(e)}}),e.command(`status`).description(`Show current authentication status`).option(`--json`,`Output as JSON`).option(`--profile <name>`,`Profile name`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=S(e.profile),n=Ft(e.apiKey,t),r=Lt(e.baseUrl,t),i=It(e.apiKey,t);if(!n){if(e.json){D({authenticated:!1,reason:`missing_credentials`,profile:t,baseUrl:r,credentialSource:null});return}k(`Not authenticated`),j(`Run 'tangle auth login --profile ${t}' to authenticate.`),process.exit(1)}let a=e.json?null:M(`Checking credentials...`);a?.start();try{let o=await rr({apiKey:n,baseUrl:r});if(a?.stop(),e.json){D({authenticated:!0,profile:t,baseUrl:r,credentialSource:i,account:o});return}O(`Authenticated`),N({Profile:t,"API Key":xr(n),"Base URL":r,Source:Sr(i),Email:o.email,Tier:o.tier})}catch(o){a?.stop(),e.json&&(D({authenticated:!1,profile:t,baseUrl:r,credentialSource:i,error:o instanceof Error?o.message:String(o)}),process.exit(1)),o instanceof g?k(`Stored credentials are invalid.`):A(`Stored credentials found, but validation could not complete.`),N({Profile:t,"API Key":xr(n),"Base URL":r,Source:Sr(i),Error:o instanceof Error?o.message:String(o)}),process.exit(1)}}catch(e){L(e)}});let n=new t(`profiles`).description(`Manage CLI profiles`);return n.command(`list`).description(`List configured profiles`).option(`--json`,`Output as JSON`).action(e=>{try{let t=jt();if(e.json){D(t);return}if(t.length===0){j(`No profiles found.`);return}I([`Profile`,`Active`,`Base URL`,`Credentials`,`Source`],t.map(e=>[e.name,e.active?`yes`:`no`,e.baseUrl,e.hasApiKey?`configured`:`none`,e.apiKeySource]))}catch(e){L(e)}}),n.command(`use <name>`).description(`Set the active profile`).action(e=>{try{Tt(e);let t=Mt(e);O(`Active profile set to '${t.name}'.`),N({"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`})}catch(e){L(e)}}),n.command(`current`).description(`Show the active profile`).option(`--json`,`Output as JSON`).action(e=>{try{let t=Mt();if(e.json){D(t);return}N({Profile:t.name,"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`,Source:Sr(t.credentialSource)})}catch(e){L(e)}}),e.addCommand(n),e}function xr(e){return e.length<=14?e:`${e.slice(0,10)}...${e.slice(-4)}`}function Sr(e){switch(e){case`flag`:return`command flag`;case`env`:return`environment`;case`keychain`:return`OS keychain`;case`file`:return`credentials file`;case`legacy-file`:return`legacy credentials file`;default:return`unknown`}}function Cr(e){let t=Nt(e.profile,{apiKey:e.apiKey,...e.baseUrl?{baseUrl:e.baseUrl}:{}});Tt(e.profile),wt({...e.baseUrl&&e.profile===`default`?{baseUrl:e.baseUrl}:{}}),wr=Tr(e.profile,t)}let wr=`Credentials updated.`;function Tr(e,t){return t===`keychain`?e===`default`?`API key saved to the OS keychain for the default profile`:`API key saved to the OS keychain for profile '${e}'`:t===`file`?e===`default`?`API key saved to ~/.tangle/credentials.json for the default profile`:`API key saved to ~/.tangle/credentials.json for profile '${e}'`:`Profile '${e}' updated.`}function Er(e){if(e===void 0||e===`github`||e===`google`||e===`microsoft`)return e;throw Error(`--provider must be one of: github, google, microsoft`)}function Dr(){let e=new t(`backend`).description(`Manage sandbox AI agent backend`);return e.command(`status <sandboxId-or-name>`).description(`Get backend agent status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching backend status...`);i.start();let a=await(await z(r,n,e)).backend.status();i.stop(),t.json?D(a):(j(`Backend Type: ${a.type}`),j(`Status: ${a.status}`),a.version&&j(`Version: ${a.version}`),a.error&&j(`Error: ${a.error}`),a.metadata&&j(`Metadata: ${JSON.stringify(a.metadata,null,2)}`))}catch(e){L(e)}}),e.command(`capabilities <sandboxId-or-name>`).description(`Get backend capabilities`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching capabilities...`);i.start();let a=await(await z(r,n,e)).backend.capabilities();i.stop(),t.json?D(a):(j(`Backend Capabilities:`),j(` Streaming: ${a.streaming?`✓`:`✗`}`),j(` Tool Use: ${a.toolUse?`✓`:`✗`}`),j(` Reasoning: ${a.reasoning?`✓`:`✗`}`),j(` Multimodal: ${a.multimodal?`✓`:`✗`}`),j(` Context Window: ${a.contextWindow.toLocaleString()} tokens`))}catch(e){L(e)}}),e.command(`configure <sandboxId-or-name>`).description(`Update backend configuration`).option(`--model <model>`,`Model string (format: provider/model)`).option(`--max-thinking-tokens <n>`,`Maximum thinking tokens`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Updating backend config...`);i.start();let a=await z(r,n,e),o={};if(t.model||t.maxThinkingTokens){if(o.model={},t.model){let e=t.model.split(`/`);e.length>=2?(o.model.provider=e[0],o.model.model=e.slice(1).join(`/`)):o.model.model=t.model}t.maxThinkingTokens&&(o.model.maxThinkingTokens=Number.parseInt(t.maxThinkingTokens,10))}await a.backend.updateConfig(o),i.stop(),O(`Backend configuration updated`),t.json&&D(o)}catch(e){L(e)}}),e.command(`add-mcp <sandboxId-or-name>`).description(`Add an MCP server to the backend`).requiredOption(`--name <name>`,`MCP server name`).requiredOption(`--command <cmd>`,`Command to run (e.g., npx)`).option(`--args <args...>`,`Command arguments`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--cwd <dir>`,`Working directory`).option(`--url <url>`,`Remote MCP server URL (for SSE)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Adding MCP server...`);i.start();let a=await z(r,n,e),o={};if(t.env)for(let e of t.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(o[t]=n.join(`=`))}await a.backend.addMcp(t.name,{command:t.command,args:t.args,env:Object.keys(o).length>0?o:void 0,cwd:t.cwd,url:t.url}),i.stop(),O(`MCP server "${t.name}" added`),t.json&&D({name:t.name,command:t.command,args:t.args,env:Object.keys(o).length>0?o:void 0,cwd:t.cwd,url:t.url})}catch(e){L(e)}}),e.command(`mcp-status <sandboxId-or-name>`).description(`Get status of MCP servers`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching MCP status...`);i.start();let a=await(await z(r,n,e)).backend.getMcpStatus();if(i.stop(),t.json)D(a);else{let e=Object.entries(a);e.length===0?j(`No MCP servers configured`):E(e.map(([e,t])=>{let n=t;return{name:e,status:n.status,error:n.error??``}}),[{key:`name`,header:`Name`,width:24},{key:`status`,header:`Status`,width:12},{key:`error`,header:`Error`,width:40}])}}catch(e){L(e)}}),e.command(`restart <sandboxId-or-name>`).description(`Restart the backend agent`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Restarting backend...`);i.start(),await(await z(r,n,e)).backend.restart(),i.stop(),O(`Backend restarted`)}catch(e){L(e)}}),e}function Or(e){let t=e.indexOf(`=`);if(t<=0)throw Error(`Invalid --task "${e}": expected format id=message (e.g. t1=summarize README)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!n||!r)throw Error(`Invalid --task "${e}": id and message must be non-empty`);return{id:n,message:r}}function kr(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--tasks file is not valid JSON: ${e.message}`)}let n=Array.isArray(t)?t:t?.tasks;if(!Array.isArray(n))throw Error(`--tasks file must contain an array or an object with a "tasks" array`);return n.map((e,t)=>{if(!e||typeof e!=`object`)throw Error(`--tasks[${t}] must be an object`);let n=e,r=typeof n.id==`string`?n.id.trim():``,i=typeof n.message==`string`?n.message:``;if(!r)throw Error(`--tasks[${t}].id must be a non-empty string`);if(!i.trim())throw Error(`--tasks[${t}].message must be a non-empty string`);let a={id:r,message:i};if(n.context!==void 0&&(typeof n.context!=`object`||n.context===null||Array.isArray(n.context)))throw Error(`--tasks[${t}].context must be a JSON object`);if(n.context!==void 0&&(a.context=n.context),n.timeoutMs!==void 0&&(!Number.isInteger(n.timeoutMs)||n.timeoutMs<=0))throw Error(`--tasks[${t}].timeoutMs must be a positive integer`);return n.timeoutMs!==void 0&&(a.timeoutMs=n.timeoutMs),a})}function Ar(e){let t=e.readFile??(e=>u(e,`utf8`)),n=[];e.file&&n.push(...kr(t(e.file)));for(let t of e.inline??[])n.push(Or(t));if(n.length===0)throw Error(`No tasks provided. Use --tasks <file> and/or --task id=message.`);let r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate task id: ${e.id}`);r.add(e.id)}return n}const jr=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function Mr(e){let t=e.trim(),n=t.indexOf(`/`);if(n<=0||n===t.length-1)throw Error(`--model must be in the form provider/model (got "${e}")`);return{provider:t.slice(0,n),model:t.slice(n+1)}}function Nr(e){let t=e.indexOf(`=`);if(t<=0||t===e.length-1)throw Error(`Invalid --backend "${e}": expected format id=type (e.g. primary=opencode)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!jr.test(n))throw Error(`Invalid backend id "${n}": use 1-128 letters, numbers, dots, underscores, or hyphens, starting with a letter or number`);if(!r||r.includes(`=`))throw Error(`Invalid --backend "${e}": type must be a non-empty backend name`);return{id:n,type:r}}function Pr(e,t){if(!e||e.length===0)throw Error(`No backends provided. Use --backend id=type or --request <file>.`);let n=e.map(Nr),r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate backend id: ${e.id}`);r.add(e.id)}if(t&&n.length!==1)throw Error(`--model requires exactly one backend; use a profile to configure models for multiple backends`);return t&&(n[0]={...n[0],model:Mr(t)}),n}function Fr(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--request file is not valid JSON: ${e.message}`)}try{return me(t)}catch(e){throw Error(`--request file is not a valid batch request: ${e.message}`)}}function Ir(e,t,n){return n?`${e} [${t}]`:e}function Lr(e){let t=new Map;for(let n of e)t.set(n.taskId,(t.get(n.taskId)??0)+1);return new Set([...t.entries()].filter(([,e])=>e>1).map(([e])=>e))}function Rr(){let e=new t(`batch`).description(`Run multiple agent tasks in parallel across sandboxes`);return e.command(`run`).description(`Execute a batch of tasks. Provide tasks via --tasks <file.json> and/or repeated --task id=message flags.`).option(`--tasks <file>`,`Path to a JSON file with an array of tasks (or {tasks: [...]})`).option(`--request <file>`,`Path to a complete batch request JSON file`).option(`--task <id=message>`,`Inline task, id=message. Repeatable.`,(e,t=[])=>[...t,e],[]).option(`--stream`,`Stream per-task events as they arrive`).option(`-t, --timeout <ms>`,`Per-task timeout in milliseconds`,`300000`).option(`--persistent`,`Keep sandboxes alive after completion`,!1).option(`--reuse-key <key>`,`Stable workspace identity required by --persistent`).option(`--idempotency-key <key>`,`Retry identity; keyed runs continue after disconnect`).option(`--backend <id=type>`,`Backend identity and type. Required and repeatable without --request.`,(e,t=[])=>[...t,e],[]).option(`--model <provider/model>`,`Model override when exactly one backend is selected`).option(`--json`,`Output the final result as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{let n=new AbortController,r=!1,i=()=>{r||(r=!0,j(`Cancel requested — stopping stream...`),n.abort())};process.on(`SIGINT`,i),process.on(`SIGTERM`,i);try{let r;if(e.request){let n=[`tasks`,`task`,`backend`,`model`,`timeout`,`persistent`,`reuseKey`].filter(e=>t.getOptionValueSource(e)===`cli`);if(n.length>0){let e={reuseKey:`reuse-key`};throw Error(`--request cannot be combined with ${n.map(t=>`--${e[t]??t}`).join(`, `)}`)}r=Fr(u(e.request,`utf8`))}else{let t=Ar({file:e.tasks,inline:e.task}),n=Pr(e.backend,e.model),i=Number(e.timeout);if(!Number.isInteger(i)||i<=0)throw Error(`--timeout must be a positive integer number of milliseconds`);let a=!!e.persistent;if(a&&!e.reuseKey)throw Error(`--persistent requires --reuse-key`);if(!a&&e.reuseKey)throw Error(`--reuse-key requires --persistent`);r=me({tasks:t,timeoutMs:i,backends:n,...a?{persistent:!0,reuseKey:e.reuseKey}:{persistent:!1}})}let{tasks:i,backends:o}=r,s=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),c={signal:n.signal,...e.idempotencyKey?{idempotencyKey:e.idempotencyKey}:{}};if(e.stream){j(`Streaming batch of ${i.length} task(s)...`),console.log();let t=le(r),n=o.length>1;for await(let e of s.streamBatch(r,c))switch(t.add(e),e.type){case`batch.started`:{let t=e.data;j(`Batch started (${t.taskCount} tasks, ${t.backendCount} backends)`);break}case`task.started`:{let t=e.data;console.log(a.dim(`→ ${Ir(t.taskId,t.backendId,n)} started`));break}case`task.retry`:{let t=e.data;console.log(a.yellow(`↻ ${Ir(t.taskId,t.backendId,n)} retry ${t.attempt}: ${t.error}`));break}case`task.completed`:{let t=e.data;console.log(a.green(`✓ ${Ir(t.taskId,t.backendId,n)} completed in ${t.durationMs}ms`+(t.retries?` (${t.retries} retries)`:``)));break}case`task.failed`:{let t=e.data;console.log(a.red(`✗ ${Ir(t.taskId,t.backendId,n)} failed: ${t.error}`));break}case`batch.completed`:break}let l=t.finish();console.log(),e.json?D(l):N({"Total tasks":l.totalTasks,"Total backends":l.totalBackends,"Total executions":l.totalExecutions,Succeeded:l.totalSuccess,Failed:l.totalFailure,"Total retries":l.totalRetries,"Success rate":`${l.successRate.toFixed(1)}%`}),l.totalFailure>0&&(process.exitCode=1)}else{j(`Running batch of ${i.length} task(s)...`);let t=await s.runBatch(r,c);if(e.json)D(t);else if(console.log(),N({"Total tasks":t.totalTasks,"Total backends":t.totalBackends,"Total executions":t.totalExecutions,Succeeded:t.totalSuccess,Failed:t.totalFailure,"Total retries":t.totalRetries,"Success rate":`${t.successRate.toFixed(1)}%`}),t.results.length>0){let e=Lr(t.results);console.log(),console.log(a.bold(`Task Results`)),console.log(a.dim(`─`.repeat(40)));for(let n of t.results){let t=n.success?a.green(`✓`):a.red(`✗`),r=n.success?n.usage.inputTokens+n.usage.outputTokens:0,i=r>0?` • ${r} tokens`:``;console.log(`${t} ${Ir(n.taskId,n.backendId,e.has(n.taskId))} ${a.dim(`(${n.durationMs}ms, ${n.retries} retries${i})`)}`),n.success||console.log(a.red(` ${n.error}`))}}t.totalFailure>0&&(process.exitCode=1)}}catch(e){if(r){console.log(),j(`Batch cancelled.`),process.exitCode=130;return}L(e)}finally{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)}}),e}function zr(){let e=new t(`branch`).description(`Branch a running sandbox into copy-on-write children`);return e.command(`create <sandbox-id-or-name>`).description(`Branch a running sandbox into N copy-on-write children`).option(`--count <n>`,`Number of children to create`,`1`).option(`--idempotency-key <key>`,`Retry identity: the same key and count replays the first fan-out and creates no second one`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Number.parseInt(t.count,10);if(!Number.isInteger(n)||n<1)throw Error(`--count must be an integer >= 1 (got ${t.count})`);let r=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),i=T(r),a=M(`Branching into ${n} child(ren)...`);a.start();let o=await z(i,r,e),s=await o.fork(n,{...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}}),c=s.children;a.stop(),t.json?D({children:c.map(e=>({sandboxId:e.id})),requestedCount:s.requestedCount,materializedCount:s.materializedCount,complete:s.complete,...s.idempotency?{idempotency:s.idempotency}:{}}):(s.complete?O(`Branched ${c.length} child(ren) from ${o.id}`):A(`Branched ${s.materializedCount} of ${s.requestedCount} requested child(ren) from ${o.id}`),s.idempotency?.outcome===`replayed`&&j(`Replayed an earlier fan-out under this key; created none.`),E(c.map(e=>({sandboxId:e.id})),[{key:`sandboxId`,header:`Child Sandbox`,width:28}]))}catch(e){L(e)}}),e}const Br=[`codex`,`claude-code`,`nanoclaw`,`kimi-code`,`opencode`,`pi`,`openclaw`,`hermes`],Vr=`https://intelligence.tangle.tools/v1/otlp`,Hr=[`codex`,`claude-code`],Ur=[`codex`,`claude-code`,`nanoclaw`],Wr=[`SessionStart`,`UserPromptSubmit`,`PreToolUse`,`PostToolUse`,`Stop`],Gr={codex:{kind:`native`,surface:`codex`,label:`Codex`,buildFiles:ii},"claude-code":{kind:`native`,surface:`claude-code`,label:`Claude Code`,buildFiles:ai},nanoclaw:{kind:`native`,surface:`nanoclaw`,label:`NanoClaw`,buildFiles:ai},"kimi-code":{kind:`manual`,surface:`kimi-code`,label:`Kimi Code`,reason:`Kimi Code loads hooks through an explicit config file, so use standard OTLP env wiring until the native config adapter is verified.`},opencode:{kind:`manual`,surface:`opencode`,label:`OpenCode`,reason:`OpenCode hooks run as plugins; use standard OTLP env wiring until the native plugin adapter is verified.`},pi:{kind:`manual`,surface:`pi`,label:`Pi`,reason:`Pi hooks run through TypeScript extensions; use standard OTLP env wiring until the native extension adapter is verified.`},openclaw:{kind:`manual`,surface:`openclaw`,label:`OpenClaw`,reason:`OpenClaw project hooks require user opt-in; use standard OTLP env wiring until the hook toggle and adapter are verified.`},hermes:{kind:`manual`,surface:`hermes`,label:`Hermes`,reason:`Hermes project plugins require explicit enablement; use standard OTLP env wiring until the plugin adapter is verified.`}};function Kr(e){let t=e.split(`,`).map(e=>e.trim()).filter(Boolean).flatMap(e=>ri(e));return t.length===0?[...Hr]:vi(t)}function qr(e){return Object.hasOwn(Gr,e)}function Jr(e=process.cwd()){return m(ne(e))||`agent-workspace`}function Yr(){return h(ge(),`.tangle`,`intelligence.json`)}function Xr(e=Yr()){if(!c(e))return null;let t=hi(e),n=yi(t,`apiKey`),r=yi(t,`endpoint`),i=yi(t,`serviceName`),a=yi(t,`environment`);if(!n||!r||!i||!a)throw Error(`${e} is missing apiKey, endpoint, serviceName, or environment`);return{apiKey:n,endpoint:r,serviceName:i,environment:a}}async function Zr(e){let t=ne(e.workspace),n=Yr(),r=Kr(e.selection),i=[],a=[],o=[],s={apiKey:e.apiKey,endpoint:U(e.endpoint),serviceName:e.serviceName,environment:e.environment};e.dryRun||fi(n,s),o.push(n);for(let n of r){let r=Gr[n];if(r.kind===`manual`){a.push({agent:r.surface,label:r.label,reason:r.reason});continue}i.push(r.surface);let s=t=>Qr(e.hookCommand,r.surface,t);for(let n of r.buildFiles(s)){let r=h(t,n.relPath);if(e.dryRun){o.push(r);continue}mi(r,JSON.parse(n.content),n.mode),o.push(r)}}return!e.smoke||e.dryRun?{configPath:n,written:o,agents:r,nativeAgents:i,manual:a}:{configPath:n,written:o,agents:r,nativeAgents:i,manual:a,smokeTraceId:await ei({agent:i[0]??r[0]??`codex`,event:`install.smoke`,endpoint:s.endpoint,apiKey:s.apiKey,serviceName:s.serviceName,environment:s.environment,sessionId:`install-smoke-${Date.now()}`,payload:{source:`tangle intelligence connect`}})}}function Qr(e,t,n){return`${e.trim()} --agent ${t} --event ${n} --non-blocking`}function $r(e){let t=BigInt(Date.now())*1000000n,n=xi(16),r=xi(8),i=e.sessionId??oi(e.payload),a={"service.name":e.serviceName,"deployment.environment":e.environment,"tangle.agent.surface":e.agent,"tangle.agent.hook.event":e.event,"tangle.agent.hook.source":`local-hook`,...si(e.payload)};return i&&(a[`session.id`]=i,a[`gen_ai.conversation.id`]=i,a[`tangle.sessionId`]=i),{body:{resourceSpans:[{resource:{attributes:[Si(`service.name`,e.serviceName),Si(`deployment.environment`,e.environment),Si(`tangle.agent.surface`,e.agent)]},scopeSpans:[{scope:{name:`tangle.intelligence.agent-hook`,version:`1.0.0`},spans:[{traceId:n,spanId:r,name:`agent.${e.agent}.${e.event}`,kind:1,startTimeUnixNano:t.toString(),endTimeUnixNano:(t+1000000n).toString(),attributes:Object.entries(a).map(([e,t])=>Si(e,t)),status:{code:1}}]}]}]},traceId:n}}async function ei(e){let{body:t,traceId:n}=$r(e),r=await fetch(`${U(e.endpoint)}/v1/traces`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(t)});if(!r.ok){let e=await r.text().catch(()=>``);throw Error(`OTLP smoke ingest failed: ${r.status}${e?` ${e}`:``}`)}return n}function ti(e){return U(e).replace(/\/v1\/otlp$/,``).replace(/\/+$/,``)}async function ni(e){let t=`${ti(e.endpoint)}/v1/onboarding/status`,n=await fetch(t,{headers:{Authorization:`Bearer ${e.apiKey}`},signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`onboarding status request failed: ${n.status}${e?` ${e}`:``}`)}let r=await n.json();return{tracesSeen:!!r.tracesSeen,contentSeen:!!r.contentSeen,lastSeenAt:typeof r.lastSeenAt==`string`?r.lastSeenAt:null,windowDays:typeof r.windowDays==`number`?r.windowDays:7,byAgent:r.byAgent&&typeof r.byAgent==`object`?r.byAgent:{}}}function U(e){let t=e.trim().replace(/\/+$/,``);return t.endsWith(`/v1/traces`)?t.slice(0,-10):t.endsWith(`/v1/logs`)?t.slice(0,-8):t}function ri(e){switch(e){case`local`:case`both`:return[...Hr];case`all`:return[...Ur];case`claude`:return[`claude-code`];case`kimi`:return[`kimi-code`];default:if(qr(e))return[e];throw Error(`agent must be one of: local, all, both, ${Br.join(`, `)}`)}}function ii(e){let t=Object.fromEntries(Wr.map(t=>[t,[{command:e(t),timeoutMs:3e3,blocking:!1,matcher:`*`}]]));return[{relPath:`.codex/hooks.json`,content:JSON.stringify({hooks:t},null,2)}]}function ai(e){let t=Object.fromEntries(Wr.map(t=>[t,[{matcher:`*`,hooks:[{type:`command`,command:e(t),timeout:3}]}]]));return[{relPath:`.claude/settings.json`,content:JSON.stringify({hooks:t},null,2)}]}function oi(e){return li(e,[`session.id`,`sessionId`,`session_id`,`conversationId`,`conversation_id`,`threadId`,`thread_id`,`transcriptId`,`transcript_id`])||process.env.TANGLE_SESSION_ID||process.env.CODEX_THREAD_ID||process.env.CLAUDE_SESSION_ID||process.env.OPENCODE_SESSION_ID}function si(e){let t={},n=ci(e,[`tool.name`,`toolName`,`tool_name`,`tool`]),r=ci(e,[`command`,`cmd`,`shell_command`,`shellCommand`]),i=ci(e,[`tool.input`,`toolInput`,`tool_input`,`input`,`arguments`,`args`]),a=ci(e,[`tool.output`,`toolOutput`,`tool_output`,`output`,`result`]),o=ci(e,[`tool.exit_code`,`exitCode`,`exit_code`,`status`]),s=ci(e,[`tool.error.message`,`errorMessage`,`error_message`,`error`]);return n&&(t[`tool.name`]=n),r&&(t[`process.command`]=r),i&&(t[`tool.input.summary`]=i),a&&(t[`tool.output.summary`]=a),o&&(t[`tool.exit_code`]=o),s&&(t[`tool.error.message`]=s),t}function ci(e,t){let n=ui(e,t);if(n===void 0)return null;if(typeof n==`string`)return di(n);if(typeof n==`number`||typeof n==`boolean`||typeof n==`bigint`)return String(n);try{return di(JSON.stringify(n))}catch{return null}}function li(e,t){let n=ui(e,t);return typeof n==`string`&&n.length>0?n:void 0}function ui(e,t){if(typeof e!=`object`||!e)return;let n=[e],r=new Set;for(;n.length;){let e=n.pop();if(typeof e!=`object`||!e||r.has(e))continue;r.add(e);let i=e;for(let e of t){let t=i[e];if(t!=null&&t!==``)return t}for(let e of Object.values(i))typeof e==`object`&&e&&n.push(e)}}function di(e){return e.length>4096?`${e.slice(0,4093)}...`:e}function fi(e,t){pi(e,`${JSON.stringify(t,null,2)}\n`)}function pi(e,t){l(ee(e),{mode:448,recursive:!0});let n=`${e}.${process.pid}.tmp`;f(n,t,{mode:384}),d(n,e)}function mi(e,t,n){l(ee(e),{recursive:!0});let r=gi(hi(e),t);f(e,`${JSON.stringify(r,null,2)}\n`,{mode:n??420})}function hi(e){if(!c(e))return{};let t=JSON.parse(u(e,`utf8`));if(!bi(t))throw Error(`${e} must contain a JSON object`);return t}function gi(e,t){let n={...e};for(let[e,r]of Object.entries(t)){let t=n[e];bi(t)&&bi(r)?n[e]=gi(t,r):Array.isArray(t)&&Array.isArray(r)?n[e]=_i([...t,...r]):n[e]=r}return n}function _i(e){let t=new Set,n=[];for(let r of e){let e=JSON.stringify(r);t.has(e)||(t.add(e),n.push(r))}return n}function vi(e){return[...new Set(e)]}function yi(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function bi(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null)}function xi(e){return r(e).toString(`hex`)}function Si(e,t){return{key:e,value:{stringValue:t}}}const Ci=`tangle.opencode-exporter`,wi=16384;function Ti(e){return e.length<=wi?e:`${e.slice(0,wi-1)}…`}function W(e,t){return{key:e,value:{stringValue:t}}}function Ei(e){if(!e||typeof e!=`object`)return null;let t=e,n=y(t.type);return n?{type:n,properties:t.properties&&typeof t.properties==`object`?t.properties:void 0}:null}function Di(e,t){let n=[W(`event.name`,e),W(`gen_ai.system`,`opencode`),W(`service.name`,`opencode`)];return t&&(n.push(W(`session.id`,t)),n.push(W(`gen_ai.conversation.id`,t))),n}function Oi(e){if(!e)return null;let t=e.part,n=e.info;return y(t?.sessionID)??y(n?.sessionID)??y(e.sessionID)??null}function ki(e,t){let n=y(e.role)??y(e.info?.role);if(n)return n.toLowerCase();let r=y(e.messageID),i=t?.(r)??null;return i?i.toLowerCase():null}function Ai(e,t,n){let r=[],i=Oi(e.properties),a=(n,r)=>({timeUnixNano:t,severityNumber:9,severityText:`INFO`,...n===null?{}:{body:{stringValue:Ti(n)}},attributes:[...Di(e.type,i),...r]});if(e.type===`message.part.updated`){let t=e.properties?.part;if(!t)return r;let i=y(t.type);if(i===`text`||i===`reasoning`){let e=y(t.text);if(e){let i=ki(t,n)===`user`?we:Ce;r.push(a(e,[W(i,Ti(e))]))}return r}if(i===`tool`){let e=y(t.tool),n=t.state,i=ke(n?.input),o=ke(n?.output),s=y(n?.error)??(typeof n?.error==`object`&&n?.error!==null?ke(n.error):null);if(e||i){let t=[];e&&t.push(W(Ee,e)),i&&t.push(W(Te,Ti(i))),r.push(a(null,t))}let c=o??s;if(c){let t=[W(De,Ti(c))];e&&t.push(W(Ee,e)),r.push(a(c,t))}return r}return r}if(e.type===`session.next.text.delta`||e.type===`session.next.text.ended`){let t=e.properties??{},n=y(t.text)??(e.type===`session.next.text.delta`?y(t.delta):null);return n&&r.push(a(n,[W(Ce,Ti(n))])),r}return r}function ji(e=process.env.OTEL_RESOURCE_ATTRIBUTES){if(!e)return null;for(let t of e.split(`,`)){let e=t.indexOf(`=`);if(e===-1||t.slice(0,e).trim()!==Oe)continue;let n=t.slice(e+1).trim();if(n.length>0)return n}return null}function Mi(e,t){if(e.length===0)return null;let n=[W(`service.name`,`opencode`),W(`gen_ai.system`,`opencode`),W(`telemetry.sdk.name`,Ci)];return t&&t.trim().length>0&&n.push(W(Oe,t.trim())),{resourceLogs:[{resource:{attributes:n},scopeLogs:[{scope:{name:Ci,version:`1.0.0`},logRecords:e}]}]}}function Ni(e){return(e??process.env.OPENCODE_BASE_URL??`http://127.0.0.1:4096`).replace(/\/+$/,``)}async function Pi(e){let t=U(e.endpoint),n=await(e.fetchImpl??fetch)(`${t}/v1/logs`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(e.request),signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`OpenCode OTLP logs ingest failed: ${n.status}${e?` ${e}`:``}`)}}var Fi=class extends Error{partial;constructor(e,t){let n=e instanceof Error?e.message:String(e);super(n),this.name=`OpencodeExporterError`,this.partial=t,e instanceof Error&&(this.cause=e)}};function Ii(){return(BigInt(Date.now())*1000000n).toString()}async function Li(e){let t=Ni(e.opencodeBaseUrl),n=e.nowUnixNano??Ii,r=e.fetchImpl??fetch,i=e.subjectKey===void 0?ji():e.subjectKey,a=await r(`${t}/event`,{headers:{Accept:`text/event-stream`},signal:e.signal});if(!a.ok){let e=await a.text().catch(()=>``);throw Error(`OpenCode event subscribe failed: ${a.status} at ${t}/event${e?` ${e}`:``}. Is OpenCode running with 'opencode serve'?`)}if(!a.body)throw Error(`OpenCode event stream at ${t}/event returned no body — cannot subscribe`);let o={eventsSeen:0,contentEventsExported:0,recordsExported:0},s=new Map,c=e=>e?s.get(e)??null:null;try{for await(let t of pe(a.body,{signal:e.signal})){o.eventsSeen++;let a=Ei(t.data);if(!a)continue;if(a.type===`message.updated`){let e=a.properties?.info,t=y(e?.id),n=y(e?.role);t&&n&&s.set(t,n);continue}let l=Ai(a,n(),c),u=Mi(l,i);u&&(await Pi({endpoint:e.endpoint,apiKey:e.apiKey,request:u,timeoutMs:e.postTimeoutMs,fetchImpl:r}),o.contentEventsExported++,o.recordsExported+=l.length,e.onExport?.({eventType:a.type,records:l.length}))}}catch(e){if(e instanceof Error&&(e.name===`AbortError`||e.message.toLowerCase().includes(`abort`)))return o;throw new Fi(e,o)}return o}function G(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}const Ri=[`claude-code`,`codex`,`opencode`,`openclaw`,`hermes`,`nanoclaw`],zi={"claude-code":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,openclaw:`OpenClaw`,hermes:`Hermes`,nanoclaw:`NanoClaw`},Bi=`# >>> tangle intelligence (claude-code) >>>`,Vi=`# <<< tangle intelligence (claude-code) <<<`;function Hi(e){return Ri.includes(e)}function Ui(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??Ft(void 0);if(!t)throw Error(`No Tangle API key found. Pass --api-key, set TANGLE_API_KEY, or run: tangle auth login`);return t}const Wi={full:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`},{key:`OTEL_LOG_TOOL_CONTENT`,comment:`full tool input+output bodies`},{key:`OTEL_LOG_RAW_API_BODIES`,comment:`full prompt+completion JSON (richest)`}],prompts:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`}],metadata:[]};function Gi(e,t){return t===`env`?e:/\s/.test(e)?`"${e}"`:e}function Ki(e,t){let n=t===`shell`?`export `:t===`dockerfile`?`ENV `:``,r=[];for(let i of e){if(i.kind===`blank`){t===`shell`&&r.push(``);continue}if(i.kind===`comment`){t===`shell`&&r.push(`# ${i.text}`);continue}let e=t===`shell`&&i.comment?` # ${i.comment}`:``;r.push(`${n}${i.key}=${Gi(i.value,t)}${e}`)}return r.join(`
|
|
135
|
+
`)}function qi(e){let t=U(e.endpoint),n=e.apiKey??"${TANGLE_API_KEY}",r=e.content??`full`,i=e.format??`shell`,a=[{kind:`comment`,text:`Enable + point Claude Code at Tangle (JSON protocol — matches our adapter)`},{kind:`set`,key:`CLAUDE_CODE_ENABLE_TELEMETRY`,value:`1`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_PROTOCOL`,value:`http/json`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_ENDPOINT`,value:t},{kind:`set`,key:`OTEL_EXPORTER_OTLP_HEADERS`,value:`Authorization=Bearer ${n}`}];e.projectKey?a.push({kind:`blank`},{kind:`comment`,text:`Groups your runs into a project so Tangle can roll up + automate per-project:`},{kind:`set`,key:`OTEL_RESOURCE_ATTRIBUTES`,value:`tangle.subject.key=${e.projectKey}`}):a.push({kind:`blank`},{kind:`comment`,text:`Label this project so Tangle rolls up + automates per-project (pick your own):`},{kind:`comment`,text:` export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=<your project>`}),a.push({kind:`blank`},{kind:`comment`,text:`CONTENT rides LOG EVENTS, so the logs exporter is MANDATORY.`},{kind:`set`,key:`OTEL_LOGS_EXPORTER`,value:`otlp`,comment:`required for prompt/completion/tool content`},{kind:`set`,key:`OTEL_METRICS_EXPORTER`,value:`otlp`,comment:`tokens / cost`},{kind:`set`,key:`OTEL_TRACES_EXPORTER`,value:`otlp`,comment:`spans (beta)`},{kind:`blank`});let o=Wi[r];if(o.length===0)a.push({kind:`comment`,text:`Content gates intentionally OFF (metadata-only: tokens, durations, tool names — no prompt/completion/tool bodies).`});else{a.push({kind:`comment`,text:`THE CONTENT GATES (all default OFF):`});for(let e of o)a.push({kind:`set`,key:e.key,value:`1`,comment:e.comment})}return Ki(a,i)}function Ji(e){return[Bi,qi(e),Vi].join(`
|
|
136
|
+
`)}function Yi(e,t){let n=e.indexOf(Bi);if(n!==-1){let r=e.indexOf(Vi,n);if(r===-1)throw Error(`shell rc has a '${Bi}' marker without its closing '${Vi}' — fix it by hand and re-run`);let i=r+43,a=`${e.slice(0,n)}${t}${e.slice(i)}`;return{contents:a,changed:a!==e}}return{contents:`${e.length===0?``:Xi(e)}${t}\n`,changed:!0}}function Xi(e){return e.endsWith(`
|
|
137
137
|
|
|
138
138
|
`)?e:e.endsWith(`
|
|
139
|
-
`)?`${e}\n`:`${e}\n\n`}function
|
|
140
|
-
`))
|
|
141
|
-
`)}function
|
|
142
|
-
`)}\n`,changed:!0};let i=
|
|
143
|
-
`)?e:`${e}\n`}function ra(e){switch(e){case`claude-code`:return`Claude Code: set OTEL_LOGS_EXPORTER=otlp and the four OTEL_LOG_* gates (OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_TOOL_CONTENT, OTEL_LOG_RAW_API_BODIES).`;case`codex`:return`Codex: set log_user_prompt = true in [otel] (default false redacts content).`;case`opencode`:return`OpenCode: a standalone install emits nothing without the tangle-opencode-exporter shim; inside a Tangle sandbox it is already instrumented.`;case`openclaw`:case`hermes`:case`nanoclaw`:return`${Li[e]}: no native OTLP exporter and no standalone server to subscribe to — run it inside a Tangle sandbox, where the sidecar adapter exports its content with gen_ai.system=${e}. A bare standalone install emits metadata only.`}}function ia(){let e=process.env.SHELL??``;return e.includes(`zsh`)?h(_e(),`.zshrc`):e.includes(`bash`)?h(_e(),`.bashrc`):h(_e(),`.zshrc`)}function aa(e){return c(e)?u(e,`utf8`):``}function oa(e,t){l(ee(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;f(n,t,{mode:384}),s(n,384),d(n,e)}function sa(){return new t(`connect`).description(`Connect a local coding agent's telemetry to Tangle Intelligence, content on (for SDK integration snippets, see 'tangle agent connect')`).argument(`[agent]`,`claude-code | codex | opencode | openclaw | hermes | nanoclaw`).option(`--api-key <key>`,`Tangle API key (or set TANGLE_API_KEY)`).option(`--endpoint <url>`,`OTLP endpoint base`,zr).option(`-p, --project <key>`,`Project label (tangle.subject.key) to group runs; omit to set it yourself`).option(`--rc <path>`,`Shell rc file to append the Claude Code env block to`).option(`--no-write`,`Print the config instead of writing files (Claude Code / Codex)`).option(`--inline-key`,"Embed the resolved API key literally in the config (default: keep ${TANGLE_API_KEY})").option(`--verify`,`Poll onboarding status and report whether CONTENT is flowing`).option(`--timeout <seconds>`,`Verify poll timeout in seconds`,`120`).option(`--run`,`OpenCode only: run the content exporter against a live OpenCode server until interrupted`).option(`--opencode-url <url>`,`OpenCode server base URL for --run (or set OPENCODE_BASE_URL)`).option(`--format <kind>`,`Claude Code output: shell (export block) | env (.env / docker --env-file) | dockerfile (ENV lines). env/dockerfile are the cron/container path — printed to stdout, no shell-rc edit, no TTY`,`shell`).option(`--content <tier>`,`Claude Code content tier: full (everything) | prompts (task+prompts+tool-args) | metadata (telemetry on, content off)`,`full`).action(async(e,t)=>{try{let n=U(t.endpoint);if(t.run){if((e?la(e):`opencode`)!==`opencode`)throw Error(`--run is OpenCode-only: it runs the content exporter against a live OpenCode server. Other agents export natively once configured.`);await _a({endpoint:n,apiKey:Vi(t.apiKey),opencodeUrl:t.opencodeUrl});return}if(t.verify){await va({endpoint:n,apiKey:Vi(t.apiKey),agent:e?la(e):void 0,timeoutSeconds:G(t.timeout,`--timeout`)});return}let r=e?la(e):await fa(),i=t.inlineKey?Vi(t.apiKey):void 0;r===`claude-code`?await pa({endpoint:n,apiKey:i,projectKey:t.project,rcPath:t.rc,write:t.write!==!1,content:da(t.content),format:ua(t.format)}):r===`codex`?ma({endpoint:n,apiKey:i,projectKey:t.project,write:t.write!==!1}):r===`opencode`?ha({endpoint:n}):ga(r,{endpoint:n}),console.log(),j(`Run your agent on a real task, then verify content is flowing: tangle connect ${r} --verify`)}catch(e){L(e)}})}function ca(){return new t(`opencode-exporter`).description(`Export a running OpenCode's content to Tangle Intelligence (standalone shim)`).option(`--api-key <key>`,`Tangle API key (or set TANGLE_API_KEY)`).option(`--endpoint <url>`,`OTLP endpoint base`,zr).option(`--opencode-url <url>`,`OpenCode server base URL (or set OPENCODE_BASE_URL)`).action(async e=>{try{await _a({endpoint:U(e.endpoint),apiKey:Vi(e.apiKey),opencodeUrl:e.opencodeUrl})}catch(e){L(e)}})}function la(e){if(Bi(e))return e;throw Error(`Unknown agent '${e}'. Choose one of: ${Ii.join(`, `)}`)}function ua(e){if(e===`shell`||e===`env`||e===`dockerfile`)return e;throw Error(`--format must be one of: shell, env, dockerfile (got '${e}')`)}function da(e){if(e===`full`||e===`prompts`||e===`metadata`)return e;throw Error(`--content must be one of: full, prompts, metadata (got '${e}')`)}async function fa(){if(!process.stdin.isTTY)throw Error(`Specify an agent: tangle connect <${Ii.join(`|`)}>`);console.log(`Which coding agent are you connecting?`),Ii.forEach((e,t)=>{console.log(` ${t+1}) ${Li[e]} (${e})`)});let e=await H(`Enter a number or name`,`1`);return Ii[Number.parseInt(e,10)-1]||la(e.trim())}async function pa(e){let t=Gi({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format});if(console.log(t),e.format!==`shell`){console.log(),j(e.format===`env`?"Cron/container path: feed these to your service env (.env, `docker run --env-file`, k8s envFrom). No shell-rc edit, no TTY needed.":`Dockerfile path: paste these ENV lines into your image. No shell-rc edit, no TTY needed.`);return}if(console.log(),j(`Privacy tiers: --content full ships the whole conversation; --content prompts keeps task, prompts, and tool args only; --content metadata turns content off (telemetry still flows). Secrets are scrubbed server-side regardless.`),!e.write)return;let n=e.rcPath??ia(),r=process.stdin.isTTY?await H(`Append this idempotent block to ${n}? (y/N)`,`n`):`n`;if(r.toLowerCase()!==`y`&&r.toLowerCase()!==`yes`){console.log(),j(`Not writing. To append later: tangle connect claude-code --rc ${n}`);return}let i=Ki({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format}),{contents:a,changed:o}=qi(aa(n),i);if(!o){console.log(),O(`Already present in ${n} — nothing to change.`);return}oa(n,a),console.log(),O(`Wrote Tangle Intelligence env block to ${n}.`),j(`Reload your shell (e.g. 'source ${n}') before running the agent.`)}function ma(e){let t=h(_e(),`.codex`,`config.toml`),{contents:n,changed:r}=ea(aa(t),{endpoint:e.endpoint,apiKey:e.apiKey});if(!e.write){console.log(n.trimEnd());return}if(!r){O(`${t} already has the Tangle [otel] block — nothing to change.`);return}oa(t,n),O(`Merged the Tangle [otel] block into ${t}.`),j("Codex emits content on the logs signal (codex.* events). Set TANGLE_API_KEY in your env before running if you kept the ${TANGLE_API_KEY} reference."),j(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=${e.projectKey??`<your project>`} before running codex.`)}function ha(e){let t=U(e.endpoint);A(`OpenCode has no native OTel exporter, so a standalone install emits nothing without a shim.`),console.log(),N({"Inside a Tangle sandbox":`already instrumented — our adapter exports OpenCode's event-stream content. Nothing to do.`,Standalone:`run 'tangle connect opencode --run' alongside a running OpenCode, exporting to ${t}.`}),console.log(),j(`Start OpenCode in server mode ('opencode serve'), then in another terminal run: tangle connect opencode --run`),j(`The exporter subscribes to OpenCode's SSE event bus and exports content-bearing OTLP (prompt/completion/tool content) to Tangle. Verify with: tangle connect opencode --verify`),j(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting the exporter.`)}function ga(e,t){let n=U(t.endpoint),r=Li[e];A(`${r} has no native OTel exporter, so a standalone install emits nothing without instrumentation.`),console.log(),N({"Inside a Tangle sandbox":`already instrumented — the sidecar adapter exports ${r}'s prompt/completion/tool content (gen_ai.system=${e}) to ${n}. Nothing to do.`,Standalone:`${r} exposes no OTLP and no event-bus server; run it inside a Tangle sandbox to capture content.`}),console.log(),j(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting ${r}.`),j(`Verify content is flowing: tangle connect ${e} --verify`)}async function _a(e){let t=ji(e.opencodeUrl),n=new AbortController,r=()=>n.abort();process.on(`SIGINT`,r),process.on(`SIGTERM`,r),j(`Subscribing to OpenCode at ${t} — exporting content to Tangle.`),j(`Run OpenCode tasks now. Press Ctrl-C to stop.`),console.log();let i=0,a;try{a=await Fi({endpoint:e.endpoint,apiKey:e.apiKey,opencodeBaseUrl:t,signal:n.signal,onExport:({eventType:e,records:t})=>{i+=t,j(`exported ${t} record(s) from ${e} (total ${i})`)}})}catch(e){if(e instanceof Ni){let{recordsExported:t,contentEventsExported:n}=e.partial;console.log(),A(`Exporter failed after exporting ${t} content record(s) from ${n} event(s): ${e.message}`)}throw e}finally{process.off(`SIGINT`,r),process.off(`SIGTERM`,r)}if(console.log(),a.contentEventsExported===0){A(`Saw ${a.eventsSeen} event(s) but none carried content. Run a real OpenCode task (a prompt that produces text or a tool call), then re-run.`);return}O(`Exported ${a.recordsExported} content record(s) from ${a.contentEventsExported} event(s).`),j(`Verify it landed: tangle connect opencode --verify`)}async function va(e){let t=Date.now()+e.timeoutSeconds*1e3,n=3e3,r=Math.min(e.timeoutSeconds*1e3,1e4),i=M(`Checking whether content is flowing…`);i.start();let a;try{for(;;){try{a=await ei({endpoint:e.endpoint,apiKey:e.apiKey,timeoutMs:r})}catch(e){if(Date.now()>=t)throw e;await ba(n);continue}if(a.contentSeen||Date.now()>=t)break;await ba(n)}}finally{i.stop()}if(!a)throw Error(`onboarding status check returned no result`);ya(a,e.agent),a.contentSeen||(process.exitCode=1)}function ya(e,t){if(e.contentSeen){O(`Content flowing — Tangle Intelligence can analyze this feed.`),N({"Last seen":e.lastSeenAt??`just now`,Window:`${e.windowDays}d`});return}if(e.tracesSeen){A(`Metadata-only — traces are arriving but carry no content. You missed a content gate.`);let n=t?[t]:Object.keys(e.byAgent).filter(Bi),r=n.length>0?n:Ii;for(let n of r){let r=e.byAgent[n];(t||!r||r.tracesSeen&&!r.contentSeen)&&j(ra(n))}return}A(`No traces yet for your tenant. Run your agent once on a real task, then re-run --verify.`),t&&j(ra(t))}function ba(e){return new Promise(t=>setTimeout(t,e))}function xa(){let e=new t(`environments`).alias(`env`).description(`Manage sandbox environments`);return e.command(`list`).alias(`ls`).description(`List available environments`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Fetching environments...`);e.json||n.start();let r=await t.environments.list();n.stop(),e.json?D(r):r.length===0?console.log(`No environments found`):I([`ID`,`Description`,`Version`],r.map(e=>[e.id,e.description??``,e.version]))}catch(e){L(e)}}),e.command(`get`).description(`Get environment details`).argument(`<id>`,`Environment ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Fetching environment...`);t.json||r.start();let i=await n.environments.get(e);if(r.stop(),!i){console.error(`Environment not found: ${e}`),process.exit(1);return}t.json?D(i):(console.log(`ID: ${i.id}`),console.log(`Description: ${i.description??`-`}`),console.log(`Version: ${i.version}`),i.base&&console.log(`Base: ${i.base}`))}catch(e){L(e)}}),e}function Sa(){return new t(`exec`).description(`Execute a command in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command...>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`60000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=t.join(` `),o={};if(n.env)for(let e of n.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(o[t]=n.join(`=`))}let s=M(`Executing: ${a}`);n.json||s.start();let c=await z(i,r,e);c=await B(c);let l=await c.exec(a,{cwd:n.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:Number.parseInt(n.timeout,10)});s.stop(),n.json?D(l):(l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr),l.exitCode!==0&&process.exit(l.exitCode))}catch(e){if(e instanceof g){let t=`Exec transport lost before command status was confirmed. Remote command status is unknown. Original error: ${e.message}. For long-running commands, use \`tangle process spawn\`, \`tangle process logs\`, and \`tangle process kill --tree\`.`;return L(Error(t,{cause:e}))}L(e)}})}const Ca=[`runpod`,`vast-ai`,`lambda-labs`,`tensordock`,`paperspace`,`aws`,`gcp`,`azure`,`crusoe`,`fluidstack`];function wa(e){let t=e.memory?K(e.memory,`--accelerator-memory`):void 0;return{kind:ka(e.kind),count:e.count?K(e.count,`--accelerator-count`):1,...t===void 0?{}:{memoryMB:t}}}function Ta(e,t,n){let r=!!(e.provider||e.image||e.env||e.maxSpendUsd||e.maxLifetime||e.idleTimeout);if(!t&&r)throw Error(n);if(t){if(!e.maxSpendUsd||!e.maxLifetime)throw Error(`--accelerator-kind requires --gpu-max-spend-usd and --gpu-max-lifetime`);return{...e.provider?{provider:Oa(e.provider,`--gpu-provider`)}:{},...e.image?{image:e.image}:{},...e.env?{env:Da(e.env,`--gpu-env`,`GPU env`)}:{},maxSpendUsd:Aa(e.maxSpendUsd,`--gpu-max-spend-usd`),maxLifetimeSeconds:K(e.maxLifetime,`--gpu-max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:K(e.idleTimeout,`--gpu-idle-timeout`)}:{}}}}function Ea(e){return{...e.provider?{provider:Oa(e.provider,`GPU provider`)}:{},accelerator:wa({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory}),...e.image?{image:e.image}:{},...e.env?{env:Da(e.env,`--env`,`env`)}:{},maxSpendUsd:Aa(e.maxSpendUsd,`--max-spend-usd`),maxLifetimeSeconds:K(e.maxLifetime,`--max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:K(e.idleTimeout,`--idle-timeout`)}:{}}}function Da(e,t,n){let r={};for(let i of e){let[e,...a]=i.split(`=`);if(!e||a.length===0)throw Error(`${t} expects ${n} values in KEY=VALUE format`);r[e]=a.join(`=`)}return r}function K(e,t){if(!/^\d+$/.test(e))throw Error(`${t} must be a positive integer`);let n=Number.parseInt(e,10);if(Number.isNaN(n)||n<1)throw Error(`${t} must be a positive integer`);return n}function Oa(e,t){if(Ca.includes(e))return e;throw Error(`${t} must be one of ${Ca.join(`, `)}`)}function ka(e){let t=e.trim().toLowerCase();if(/^[a-z0-9][a-z0-9._-]*$/.test(t))return t;throw Error(`--accelerator-kind must contain only letters, numbers, dots, underscores, or hyphens`)}function Aa(e,t){if(!/^(?:\d+|\d+\.\d+|\.\d+)$/.test(e))throw Error(`${t} must be a positive number`);let n=Number.parseFloat(e);if(!Number.isFinite(n)||n<=0)throw Error(`${t} must be a positive number`);return n}const ja=[`list`,`create`,`delete`,`exec`,`prompt`,`read`,`write`];function Ma(){let e=new t(`fleet`).description(`Manage sandbox fleets`);return e.command(`create`).description(`Create a sandbox fleet`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--count <n>`,`Number of worker machines`,`1`).option(`--environment <environment>`,`Named environment, container image, or built image ID for each machine`).option(`--cpu <cores>`,`CPU cores per machine`).option(`--memory <mb>`,`Memory in MB per machine`).option(`--disk <gb>`,`Disk in GB per machine`).option(`--accelerator-kind <kind>`,`Accelerator kind per machine, for example nvidia-l4 or nvidia-h100`).option(`--accelerator-count <count>`,`Accelerator devices per machine`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB per machine`).option(`--gpu-provider <provider>`,`GPU cloud provider per machine; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for each GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum spend per machine GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum GPU lease lifetime per machine in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy each GPU lease after this many idle seconds`).option(`--driver <type>`,`Infrastructure driver type`).option(`--backend <id>`,`Agent backend type`).option(`--workspace <mode>`,`Workspace mode: isolated | shared`,`isolated`).option(`--max-spend-usd <n>`,`Fleet spend cap in USD (policy)`).option(`--max-lifetime <s>`,`Max machine lifetime in seconds (policy)`).option(`--spec <file.json>`,`Path to a JSON file describing the fleet (overrides synthesized machines)`).option(`--coordinator`,`Create a coordinator + workers fleet (routes to createWithCoordinator)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Creating fleet...`);n.start();let r=e.coordinator?await t.fleets.createWithCoordinator(Ia(e)):await t.fleets.create(Fa(e));n.stop();let i=Ba(r.machines);e.json?D({fleetId:r.fleetId,machines:i}):(O(`Fleet created: ${r.fleetId}`),E(i,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}]))}catch(e){L(e)}}),e.command(`list <fleet-id>`).description(`List the machines of one fleet (fleet id is required)`).option(`--status <status>`,`Filter machines by status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Fetching fleet...`);r.start();let i=await n.fleets.list({fleetId:e,status:t.status});r.stop();let a=Ba(i.machines);t.json?D({fleetId:i.fleetId,machines:a}):E(a,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}])}catch(e){L(e)}}),e.command(`get <fleet-id>`).description(`Show one fleet's manifest (server record)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Fetching manifest...`);r.start();let i=await n.fleets.manifest(e);r.stop(),t.json?D(i):(N({"Fleet ID":i.fleetId??i.id,Machines:i.machines.length,"Workspace mode":i.workspace?.mode,"Workspace status":i.workspace?.status,"Max lifetime (s)":i.policy?.maxLifetimeSeconds,"Max spend (USD)":i.policy?.maxSpendUsd,Created:i.createdAt,Updated:i.updatedAt}),E(i.machines.map(e=>({machineId:e.machineId,sandboxId:e.sandboxId,role:e.role,status:e.status})),[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`role`,header:`Role`,width:14},{key:`status`,header:`Status`,width:14}]))}catch(e){L(e)}}),e.command(`delete <fleet-id>`).description(`Delete a fleet's machine sandboxes and its record`).option(`--continue-on-error`,`Keep deleting remaining machines if one delete fails`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Deleting fleet...`);r.start(),await n.fleets.delete(e,{continueOnError:t.continueOnError}),r.stop(),t.json?D({success:!0,fleetId:e}):O(`Fleet deleted: ${e}`)}catch(e){L(e)}}),e.command(`reap`).description(`TTL cleanup of all expired fleets (fleet-wide)`).option(`--dry-run`,`Report what would be reaped without deleting`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Reaping expired fleets...`);n.start();let r=await t.fleets.reapExpired({dryRun:e.dryRun});n.stop(),e.json?D(r):(N({"Dry run":r.dryRun,Expired:r.expired,Deleted:r.deleted}),E(r.fleets.map(e=>({fleetId:e.fleetId,expiredAt:e.expiredAt,deleted:e.deleted})),[{key:`fleetId`,header:`Fleet`,width:24},{key:`expiredAt`,header:`Expired`,width:18},{key:`deleted`,header:`Deleted`,width:10}]))}catch(e){L(e)}}),e.command(`reconcile`).description(`Drop fleet records whose underlying sandboxes vanished`).option(`--dry-run`,`Report orphans without removing them`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Reconciling fleets...`);n.start();let r=await t.fleets.reconcile({dryRun:e.dryRun});n.stop(),e.json?D(r):(N({"Dry run":r.dryRun,Checked:r.checked,Orphaned:r.orphaned,Removed:r.removed}),E(r.machines.map(e=>({fleetId:e.fleetId,machineId:e.machineId,sandboxId:e.sandboxId,removed:e.removed})),[{key:`fleetId`,header:`Fleet`,width:24},{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`removed`,header:`Removed`,width:10}]))}catch(e){L(e)}}),e.addCommand(Na()),e.command(`exec <fleet-id> <command>`).description(`Run a shell command across the fleet's machines`).option(`--machine <id...>`,`Restrict to a subset of machine ids (default: all)`).option(`--cwd <dir>`,`Working directory for the command`).option(`--timeout <ms>`,`Per-machine timeout in milliseconds`).option(`--max-concurrent <n>`,`Max concurrent dispatches`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=T(C({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=M(`Dispatching command...`);i.start();let a=await(await r.fleets.list({fleetId:e})).dispatchExecDetailed(t,{machines:n.machine,cwd:n.cwd,timeoutMs:n.timeout?Number(n.timeout):void 0,maxConcurrent:n.maxConcurrent?Number(n.maxConcurrent):void 0});if(i.stop(),n.json)D(a);else{E(a.results.map(e=>({machineId:e.machineId,ok:e.ok,exitCode:e.result?.exitCode,durationMs:e.durationMs})),[{key:`machineId`,header:`Machine`,width:20},{key:`ok`,header:`OK`,width:6},{key:`exitCode`,header:`Exit`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14}]);for(let e of a.results){let t=e.result?.stdout,n=e.result?.stderr;t&&(console.log(`\n[${e.machineId}] stdout:`),console.log(t)),n&&(console.log(`\n[${e.machineId}] stderr:`),console.log(n)),e.error&&console.log(`\n[${e.machineId}] error: ${e.error.message}`)}}a.results.some(e=>e.ok===!1)&&(process.exitCode=1)}catch(e){L(e)}}),e.command(`capabilities`).description(`List fleet drivers and their supported features`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Fetching capabilities...`);n.start();let r=await t.fleets.capabilities();n.stop(),e.json?D(r):E(r.drivers.map(e=>({driverType:e.driverType,sharedWorkspace:e.sharedWorkspace,accelerators:e.accelerators,queueTimings:e.queueTimings})),[{key:`driverType`,header:`Driver`,width:16},{key:`sharedWorkspace`,header:`Shared WS`,width:12},{key:`accelerators`,header:`Accel`,width:8},{key:`queueTimings`,header:`Queue`,width:8}])}catch(e){L(e)}}),e.command(`usage <fleet-id>`).description(`Show fleet usage and reliability insights`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Fetching usage...`);r.start();let i=await n.fleets.usage(e);if(r.stop(),t.json)D(i);else if(N({"Fleet ID":i.usage.fleetId,Status:i.usage.status,Machines:i.usage.machineCount,Running:i.usage.runningMachines,Failed:i.usage.failedMachines,"Runtime (ms)":i.usage.meteredUsage?.runtimeMs,"Reliability score":i.insights.reliabilityScore,"Failure rate":i.insights.failureRate}),i.insights.recommendedActions.length>0){console.log(`
|
|
144
|
-
Recommended actions:`);for(let e of i.insights.recommendedActions)console.log(` - ${e}`)}}catch(e){L(e)}}),e.command(`cost <fleet-id>`).description(`Show the fleet's cost estimate`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Estimating cost...`);r.start();let i=await n.fleets.cost(e);r.stop(),t.json?D(i):N({Plan:i.plan,Currency:i.currency,"Hourly (USD)":i.hourlyUsd,"Max lifetime (s)":i.maxLifetimeSeconds,"Estimated max lifetime (USD)":i.estimatedMaxLifetimeUsd,Machines:i.requestedResources.machines,"Total CPU":i.requestedResources.totalCpu,"Total memory (MB)":i.requestedResources.totalMemoryMb})}catch(e){L(e)}}),e.command(`token <fleet-id>`).description(`Mint a scoped fleet bearer token (treated as a secret)`).option(`--action <a...>`,`Allowed actions: list create delete exec prompt read write`).option(`--ttl-minutes <n>`,`Token lifetime in minutes`).option(`--json`,`Output as JSON (only path that prints the full token)`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Minting fleet token...`);r.start();let i=await n.fleets.createToken(e,{actions:
|
|
145
|
-
Re-run with --json to print the full token value.`))}catch(e){L(e)}}),e}function Na(){let e=new t(`workspace`).description(`Manage a fleet's shared workspace`);return e.command(`snapshot <fleet-id>`).description(`Snapshot the fleet's shared workspace`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Creating workspace snapshot...`);r.start();let i=await n.fleets.createWorkspaceSnapshot(e);r.stop(),t.json?D(i):O(`Workspace snapshot created: ${i.snapshotId??i.id}`)}catch(e){L(e)}}),e.command(`restore <fleet-id> <snapshot-id>`).description(`Restore the fleet's shared workspace from a snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=T(C({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=M(`Restoring workspace...`);i.start();let a=await r.fleets.restoreWorkspaceSnapshot(e,t);i.stop(),n.json?D(a):O(`Workspace restored from ${a.snapshotId??t}`)}catch(e){L(e)}}),e.command(`reconcile <fleet-id>`).description(`Re-mount the shared workspace on all fleet machines`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Reconciling workspace...`);r.start();let i=await n.fleets.reconcileWorkspace(e);r.stop(),t.json?D(i):(N({"Fleet ID":i.fleetId,Checked:i.checked,"Orphaned mounts":i.orphanedMounts}),E(i.machines.map(e=>({machineId:e.machineId,sandboxId:e.sandboxId,mounted:e.mounted})),[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`mounted`,header:`Mounted`,width:10}]))}catch(e){L(e)}}),e}function Pa(e){if(e.spec){let t=JSON.parse(u(e.spec,`utf8`));return{base:{fleetId:e.fleetId,defaults:t.defaults,policy:t.policy,workspace:t.workspace,metadata:t.metadata},machines:t.machines??[]}}let t=La(e),n=Ra(e,!!t?.accelerator),r={...e.environment?{environment:e.environment}:{},...t?{resources:t}:{},...e.driver?{driver:{type:e.driver}}:{},...n?{gpuLease:n}:{},...e.backend?{backend:{type:e.backend}}:{}},i=za(e),a=Math.max(1,Number(e.count)||1),o=Array.from({length:a},(e,t)=>({machineId:`worker-${t+1}`}));return{base:{fleetId:e.fleetId,defaults:Object.keys(r).length>0?r:void 0,policy:i,workspace:{mode:e.workspace}},machines:o}}function Fa(e){let{base:t,machines:n}=Pa(e);return{...t,machines:n}}function Ia(e){let{base:t,machines:n}=Pa(e);return{...t,workers:n}}function La(e){let t={};if(e.cpu&&(t.cpuCores=Number(e.cpu)),e.memory&&(t.memoryMB=Number(e.memory)),e.disk&&(t.diskGB=Number(e.disk)),e.acceleratorKind)t.accelerator=wa({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory});else if(e.acceleratorCount||e.acceleratorMemory)throw Error(`--accelerator-count and --accelerator-memory require --accelerator-kind`);return Object.keys(t).length>0?t:void 0}function Ra(e,t){return Ta({provider:e.gpuProvider,image:e.gpuWorkerImage,env:e.gpuEnv,maxSpendUsd:e.gpuMaxSpendUsd,maxLifetime:e.gpuMaxLifetime,idleTimeout:e.gpuIdleTimeout},t,`Fleet GPU lease flags require --accelerator-kind`)}function za(e){let t={};return e.maxSpendUsd&&(t.maxSpendUsd=Number(e.maxSpendUsd)),e.maxLifetime&&(t.maxLifetimeSeconds=Number(e.maxLifetime)),Object.keys(t).length>0?t:void 0}function Ba(e){return[...e.entries()].map(([e,t])=>({machineId:e,sandboxId:t.id,status:t.status}))}function Va(e){if(!(!e||e.length===0)){for(let t of e)if(!ja.includes(t))throw Error(`Invalid token action '${t}'. Allowed: ${ja.join(`, `)}`);return e}}function Ha(e){return e.length<=12?`****`:`${e.slice(0,6)}...${e.slice(-4)} (masked — use --json for full value)`}function Ua(){let e=new t(`fs`).description(`File system operations on sandboxes`);return q(e.command(`upload`).description(`Upload a file to a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<local-path>`,`Local file path`).argument(`<remote-path>`,`Remote destination path`).option(`--json`,`Output as JSON`)).action(async(e,t,n,r)=>{try{let{context:i,client:a}=J(r),s=await z(a,i,e);if(s=await B(s),!o.existsSync(t))throw Error(`Local file not found: ${t}`);let c=o.statSync(t),l=Date.now();console.log(`Uploading ${t} to ${n}...`),await s.fs.upload(t,n,{onProgress:e=>{let t=e.percentage.toFixed(1);process.stdout.write(`\rProgress: ${t}% (${e.bytesUploaded}/${e.totalBytes} bytes)`)}});let u=Date.now()-l;console.log(``),r.json?F({success:!0,localPath:t,remotePath:n,size:c.size,durationMs:u}):console.log(`✓ Uploaded ${c.size} bytes in ${u}ms`)}catch(e){P(e,r.json)}}),q(e.command(`download`).description(`Download a file from a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<remote-path>`,`Remote file path`).argument(`<local-path>`,`Local destination path`).option(`--json`,`Output as JSON`)).action(async(e,t,n,r)=>{try{let{context:i,client:a}=J(r),s=await z(a,i,e);s=await B(s);let c=Date.now();console.log(`Downloading ${t} to ${n}...`),await s.fs.download(t,n,{onProgress:e=>{let t=e.percentage.toFixed(1);process.stdout.write(`\rProgress: ${t}% (${e.bytesDownloaded}/${e.totalBytes} bytes)`)}});let l=Date.now()-c,u=o.statSync(n);console.log(``),r.json?F({success:!0,remotePath:t,localPath:n,size:u.size,durationMs:l}):console.log(`✓ Downloaded ${u.size} bytes in ${l}ms`)}catch(e){P(e,r.json)}}),q(e.command(`ls`).description(`List directory contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`[path]`,`Directory path`,`.`).option(`-l, --long`,`Show detailed information`).option(`-a, --all`,`Include hidden files`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a);let o=await a.fs.list(t,{all:n.all,long:n.long});if(n.json)F(o);else if(n.long)I([`Mode`,`Owner`,`Group`,`Size`,`Modified`,`Name`],o.map(e=>{let t=e.isDir?`d`:e.isSymlink?`l`:`-`,n=Wa(e.permissions),r=e.isDir?`<DIR>`:Ga(e.size),i=e.modTime.toLocaleDateString();return[t+n,e.owner,e.group,r,i,e.name]}));else{let e=o.map(e=>e.isDir?`${e.name}/`:e.name);console.log(e.join(` `))}}catch(e){P(e,n.json)}}),q(e.command(`stat`).description(`Get file or directory information`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file or directory`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a);let o=await a.fs.stat(t);n.json?F(o):(console.log(` File: ${o.name}`),console.log(` Path: ${o.path}`),console.log(` Size: ${Ga(o.size)} (${o.size} bytes)`),console.log(` Type: ${o.isDir?`directory`:o.isSymlink?`symlink`:`file`}`),console.log(` Mode: ${Wa(o.permissions)} (${o.permissions.toString(8)})`),console.log(` Owner: ${o.owner}`),console.log(` Group: ${o.group}`),console.log(` Modified: ${o.modTime.toISOString()}`),console.log(` Accessed: ${o.accessTime.toISOString()}`))}catch(e){P(e,n.json)}}),q(e.command(`cat`).description(`Print file contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a);let o=await a.read(t);n.json?F({path:t,content:o}):console.log(o)}catch(e){P(e,n.json)}}),q(e.command(`rm`).description(`Delete a file or directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to delete`).option(`-r, --recursive`,`Delete directories recursively`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a),await a.fs.delete(t,{recursive:n.recursive}),n.json?F({success:!0,path:t,deleted:!0}):console.log(`✓ Deleted: ${t}`)}catch(e){P(e,n.json)}}),q(e.command(`mkdir`).description(`Create a directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Directory path to create`).option(`-p, --parents`,`Create parent directories as needed`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a),await a.fs.mkdir(t,{recursive:n.parents}),n.json?F({success:!0,path:t,created:!0}):console.log(`✓ Created: ${t}`)}catch(e){P(e,n.json)}}),q(e.command(`exists`).description(`Check if a path exists`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to check`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a);let o=await a.fs.exists(t);n.json?F({path:t,exists:o}):(console.log(o?`exists`:`not found`),process.exit(+!o))}catch(e){P(e,n.json)}}),e}function Wa(e){let t=[`r`,`w`,`x`],n=``;for(let r=2;r>=0;r--){let i=r*3;for(let r=0;r<3;r++)n+=e>>i+(2-r)&1?t[r]:`-`}return n}function Ga(e){let t=[`B`,`KB`,`MB`,`GB`,`TB`],n=e,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r++;return r===0?`${n}${t[r]}`:`${n.toFixed(1)}${t[r]}`}function q(e){return e.option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`)}function J(e){let t=C({apiKey:e.apiKey,baseUrl:e.baseUrl});return{context:t,client:T(t)}}function Ka(){let e=new t(`git`).description(`Git operations in a sandbox workspace`);return e.command(`status`).description(`Show git repository status`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching status...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.status();if(i.stop(),t.json)D(o);else if(!o.isRepo)console.log(`No git repository in the sandbox workspace.`);else{if(console.log(`Branch: ${o.branch??`unknown`}`),console.log(`HEAD: ${o.head.slice(0,7)||`(no commits)`}`),console.log(`Dirty: ${o.isDirty?`yes`:`no`}`),o.ahead&&console.log(`Ahead: ${o.ahead}`),o.behind&&console.log(`Behind: ${o.behind}`),o.staged.length>0){console.log(`\nStaged (${o.staged.length}):`);for(let e of o.staged)console.log(` + ${e}`)}if(o.modified.length>0){console.log(`\nModified (${o.modified.length}):`);for(let e of o.modified)console.log(` M ${e}`)}if(o.untracked.length>0){console.log(`\nUntracked (${o.untracked.length}):`);for(let e of o.untracked)console.log(` ? ${e}`)}}}catch(e){L(e)}}),e.command(`log`).description(`Show commit log`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`-n, --limit <count>`,`Max commits to show`,`10`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching log...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.log(Number.parseInt(t.limit,10));if(i.stop(),t.json)D(o);else if(o.length===0)console.log(`No commits found`);else for(let e of o)console.log(`${e.shortSha} ${e.message.split(`
|
|
146
|
-
`)[0]} (${e.author}, ${e.date.toLocaleDateString()})`)}catch(e){L(e)}}),e.command(`diff`).description(`Show diff`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--ref <ref>`,`Ref to diff against`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching diff...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.diff(t.ref);i.stop(),t.json?D(o):o.raw?console.log(o.raw):console.log(`${o.additions} additions, ${o.deletions} deletions across ${o.files.length} files`)}catch(e){L(e)}}),e.command(`add`).description(`Stage files`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<paths...>`,`Paths to stage`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await z(T(r),r,e);i=await B(i),await i.git.add(t),O(`Staged: ${t.join(`, `)}`)}catch(e){L(e)}}),e.command(`commit`).description(`Create a commit`).argument(`<id-or-name>`,`Sandbox ID or name`).requiredOption(`-m, --message <msg>`,`Commit message`).option(`--amend`,`Amend the previous commit`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await z(T(n),n,e);r=await B(r);let i=await r.git.commit(t.message,{amend:t.amend});t.json?D(i):O(`Committed: ${i.shortSha} ${i.message}`)}catch(e){L(e)}}),e.command(`push`).description(`Push to remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--force`,`Force push`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Pushing...`);i.start();let a=await z(r,n,e);a=await B(a),await a.git.push({force:t.force}),i.stop(),O(`Pushed to remote`)}catch(e){L(e)}}),e.command(`pull`).description(`Pull from remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--rebase`,`Rebase instead of merge`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Pulling...`);i.start();let a=await z(r,n,e);a=await B(a),await a.git.pull({rebase:t.rebase}),i.stop(),O(`Pulled from remote`)}catch(e){L(e)}}),e.command(`branches`).description(`List branches`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching branches...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.branches();i.stop(),t.json?D(o):o.length===0?console.log(`No branches found`):I([`Name`,`Current`,`Remote`],o.map(e=>[e.name,e.current?`* `:` `,e.upstream??`-`]))}catch(e){L(e)}}),e.command(`checkout`).description(`Checkout a branch or ref`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<ref>`,`Branch name or ref`).option(`-b, --create`,`Create a new branch`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await z(T(r),r,e);i=await B(i),await i.git.checkout(t,{create:n.create}),O(`Checked out: ${t}${n.create?` (new)`:``}`)}catch(e){L(e)}}),e}function qa(){let e=new t(`hub`).description(`Discover and run Tangle Hub tools`);e.option(`--json`,`Output as JSON`),e.hook(`preAction`,(e,t)=>{Ya(t)}),e.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--parameter <key=value>`,`Provider-specific OAuth value. Repeatable.`,fo,[]).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=po(t.parameter),r=await(await R(t)).connections.start(e,{cli:!0,connectionParameters:n});if(t.json){D(ho(r));return}mo(r,t.browser===!1?!1:await lr(r.redirectUrl))}catch(e){Y(e,t)}});let n=new t(`connections`).description(`List Hub provider connections`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).connections.list();if(e.json){D(t);return}uo(t.connections)}catch(t){Y(t,e)}});n.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await R(t),r=await Yt(n,e);if(!t.force&&!await V(`Revoke Hub connection ${r}? `)){j(`Revoke cancelled.`);return}let i=await n.connections.revoke(r);if(t.json){D(i);return}j(`Revoked Hub connection ${i.connection.id}.`)}catch(e){Y(e,t)}}),e.addCommand(n);let r=new t(`permissions`).description(`Manage Hub action permissions`);r.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);let t=await R(e),n=await Yt(t,e.connection),r=await t.permissions.list(n);if(e.json){D(r);return}ao(r.policies)}catch(t){Y(t,e)}}),r.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);if(!e.action)throw Error(`--action is required.`);let t=oo(e.decision),n=await R(e),r=await Yt(n,e.connection),i=await n.permissions.set({connectionId:r,actionPath:e.action,decision:t});if(e.json){D(i);return}ao([i.policy])}catch(t){Y(t,e)}}),r.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);let t=await R(e),n=await Yt(t,e.connection),r=await t.permissions.revertWrites(n);if(e.json){D(r);return}j(`Reverted ${r.reverted} write permission${r.reverted===1?``:`s`} for connection ${r.connectionId}.`)}catch(t){Y(t,e)}}),e.addCommand(r);let i=new t(`approvals`).description(`List and resolve Hub execution approvals`);i.command(`list`).description(`List pending Hub execution approvals`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).approvals.list();if(e.json){D(t);return}eo(t.approvals)}catch(t){Y(t,e)}}),i.command(`approve`).description(`Approve a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{$a(e),to(await(await R(t)).approvals.approve(e),t.json===!0)}catch(e){Y(e,t)}}),i.command(`deny`).description(`Deny a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{$a(e),to(await(await R(t)).approvals.deny(e),t.json===!0)}catch(e){Y(e,t)}}),e.addCommand(i);let a=new t(`tools`).description(`Discover Hub tools`);return a.command(`sources`).description(`List Hub tool sources`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).tools.sources();if(e.json){D(t);return}so(t.sources)}catch(t){Y(t,e)}}),a.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await(await R(t)).tools.describe(e);if(t.json){D(n);return}co(n.tool)}catch(e){Y(e,t)}}),a.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await(await R(t)).tools.search(e.join(` `),{provider:t.provider});if(t.json){D(n);return}io(n.tools)}catch(e){Y(e,t)}}),e.addCommand(a),e.addCommand(Ja(`call`)),e.addCommand(Ja(`exec`)),e.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if($a(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await R(t);to(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}catch(e){Y(e,t)}}),e.command(`status`).description(`Show Hub auth and connection status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).status();if(e.json){D(t);return}go(t)}catch(t){Y(t,e)}}),e}function Ja(e){return new t(e).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let{args:n,approve:r}=Qa(e,t),{path:i,input:a}=ro(n),o=await R(t),s=t.connection?await Yt(o,t.connection):void 0;D((await o.tools.invoke(i,a,{connectionId:s,approve:r})).result)}catch(e){Y(e,t)}})}function Ya(e){if(!Xa(e,`json`)||e.getOptionValue(`json`)!==void 0)return;let t=e.parent;for(;t;){let n=t.getOptionValue(`json`);if(n!==void 0){e.setOptionValue(`json`,n);return}t=t.parent}}function Xa(e,t){return e.options.some(e=>e.attributeName()===t)}function Za(e){return e.json===!0}function Y(e,t){return Za(t)?L(e,!0):L(e)}function Qa(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function $a(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function eo(e){E(e.map(e=>({id:e.id,provider:e.providerId,action:e.actionPath,connection:e.connectionId,status:e.status,expires:e.expiresAt})),[{key:`id`,header:`ID`},{key:`provider`,header:`Provider`},{key:`action`,header:`Action`},{key:`connection`,header:`Connection`},{key:`status`,header:`Status`},{key:`expires`,header:`Expires`}])}function to(e,t){if(t){D(no(e));return}j(`Hub approval ${e.approval.id} ${e.approval.status}.`),e.capabilityToken&&j("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function no(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function ro(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e.at(-1);if(t===void 0)throw Error(`Usage: tangle hub call <path> <json-input>`);try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function io(e){E(e.map(e=>({path:e.path,provider:e.providerId??e.requiredConnectionProviderId,title:e.title,description:e.description,connection:lo(e),policy:e.policyState})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policy`,header:`Policy`}])}function ao(e){E(e.map(e=>({connection:e.connectionId,provider:e.providerId,action:e.actionPath,decision:e.decision,updated:e.updatedAt})),[{key:`connection`,header:`Connection`},{key:`provider`,header:`Provider`},{key:`action`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updated`,header:`Updated`}])}function oo(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function so(e){E(e.map(e=>({source:e.sourceId,provider:e.displayName,tools:e.toolCount,connection:e.connectionStatus,health:e.health,configured:e.configured})),[{key:`source`,header:`Source`},{key:`provider`,header:`Provider`},{key:`tools`,header:`Tools`},{key:`connection`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function co(e){N({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:lo(e),Policy:e.policyState}),e.inputSchema!==void 0&&(j(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(j(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function lo(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function uo(e){E(e.map(e=>({id:e.id,provider:e.providerId,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `),status:e.status,health:e.health,lastUsed:e.lastUsedAt})),[{key:`id`,header:`ID`},{key:`provider`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsed`,header:`Last Used`}])}function fo(e,t){return[...t,e]}function po(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0||e===n.length-1)throw Error(`Invalid --parameter "${n}": expected key=value (for example subdomain=acme)`);let r=n.slice(0,e);if(Object.hasOwn(t,r))throw Error(`Duplicate --parameter key "${r}".`);t[r]=n.slice(e+1)}return t}function mo(e,t){t?j(`Opened browser to connect ${e.provider}.`):(j(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),j("Finish authorization in the browser, then rerun `tangle hub status`.")}function ho(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function go(e){let{principal:t,connections:n}=e;j(`Hub status`),N({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&j(`Some providers require reconnect.`)}function _o(){let e=new t(`intelligence`).description(`Create and inspect trace intelligence reports`);return e.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`,zr).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).option(`--json`,`Output as JSON`).action(async(e,t)=>{try{let n=e??`local`;Wr(n);let r=yo(t.apiKey),i=await Yr({selection:n,workspace:t.workspace,apiKey:r,endpoint:t.endpoint,serviceName:t.serviceName??Kr(t.workspace),environment:t.environment,smoke:t.smoke,dryRun:!!t.dryRun,hookCommand:t.hookCommand}),a={configPath:i.configPath,agents:i.agents,nativeAgents:i.nativeAgents,manual:i.manual,written:i.written,smokeTraceId:i.smokeTraceId};if(t.json){D(a);return}N({Config:i.configPath,Agents:i.agents.join(`, `),"Native Hooks":i.nativeAgents.join(`, `)||void 0,"Manual Setup":i.manual.length?i.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:i.written.join(`, `),"Smoke Trace":i.smokeTraceId})}catch(e){L(e)}}),e.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`,zr).option(`--json`,`Output as JSON`).action(async e=>{try{let t=Jr(),n=await ei({endpoint:e.endpoint===`https://intelligence.tangle.tools/v1/otlp`?t?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:e.endpoint,apiKey:yo(e.apiKey??t?.apiKey)});e.json?D(n):vo(n),n.contentSeen||(process.exitCode=1)}catch(e){L(e)}}),e.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).option(`--json`,`Output as JSON`).action(async e=>{try{let t=bo(e.agent),n=Jr(),r={agent:t,event:e.event,endpoint:e.endpoint??n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:yo(e.apiKey??n?.apiKey),serviceName:e.serviceName??n?.serviceName??Kr(process.cwd()),environment:e.environment??n?.environment??`local`,sessionId:e.sessionId,payload:e.payload===void 0?await So():xo(e.payload)};if(e.dryRun){let n=Zr(r);if(e.json){D(n);return}N({Trace:n.traceId,Agent:t,Event:e.event});return}let i=await Qr(r);if(e.json){D({traceId:i});return}N({Trace:i,Agent:t,Event:e.event})}catch(t){if(e.nonBlocking){let n=t instanceof Error?t.message:String(t);e.json?D({ok:!1,error:n}):console.error(`Tangle Intelligence hook skipped: ${n}`);return}L(t)}}),e.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await Co({type:`sandbox`,id:e},t)}),e.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await Co({type:`fleet`,id:e},t)}),e.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{await Co({type:To(e.subjectType),id:e.subjectId},e)}),e.command(`get <job-id>`).description(`Get an intelligence report`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=t.json?null:M(`Fetching intelligence report...`);r?.start();let i=await n.intelligence.getReport(e);if(r?.stop(),t.json){D(i);return}wo(i)}catch(e){L(e)}}),e.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=e.json?null:M(`Fetching intelligence reports...`);n?.start();let r=await t.intelligence.listReports({subjectType:e.subjectType===void 0?void 0:To(e.subjectType),subjectId:e.subjectId,limit:e.limit===void 0?void 0:Oo(e.limit)});if(n?.stop(),e.json){D(r);return}E(r.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}catch(e){L(e)}}),e}function vo(e){N({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let t=Object.entries(e.byAgent);t.length>0&&(console.log(),E(t.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function yo(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function bo(e){if(Gr(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function xo(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function So(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function Co(e,t){try{let n=Eo(t.mode),r=ko(t.metadata),i=t.maxUsd===void 0?void 0:Do(t.maxUsd);if(n===`agentic`&&i===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let a=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),o=t.json?null:M(`Creating intelligence report...`);o?.start();let s=await a.intelligence.createReport({subject:e,mode:n,...i===void 0?{}:{budget:{billTo:`customer`,maxUsd:i}},...r===void 0?{}:{metadata:r}});if(o?.stop(),t.json){D(s);return}wo(s)}catch(e){L(e)}}function wo(e){N({Job:e.jobId,Subject:`${e.subject.type}:${e.subject.id}`,Mode:e.mode,Status:e.status,"Billed To":e.billing.billedTo,Cost:`$${e.billing.costUsd.toFixed(2)}`,Budget:e.billing.budgetMaxUsd===void 0?void 0:`$${e.billing.budgetMaxUsd.toFixed(2)}`,Updated:e.updatedAt}),e.result!==null&&(console.log(),D(e.result))}function To(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function Eo(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function Do(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function Oo(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function ko(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const Ao=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];function jo(e){return(e?.trim()||process.env.TANGLE_PLATFORM_URL?.trim()||`https://id.tangle.tools`).replace(/\/+$/,``)}async function Mo(e,t,n={}){let r=new Headers(n.headers);r.set(`Authorization`,`Bearer ${t}`),n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await fetch(e,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected){let t=await i.text().catch(()=>``),n=t?`: ${t.slice(0,400)}`:``;throw Error(`Platform request to ${e} returned ${i.status}${n}`)}return i}const No=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function Po(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function Fo(){let e=new t(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return e.command(`list`).description(`List your active API keys`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async e=>{try{let t=C({apiKey:e.apiKey,baseUrl:e.baseUrl}),n=await(await Mo(`${jo(e.platformUrl)}/v1/keys`,t.apiKey,{expected:200})).json();if(e.json){D(n);return}I(No,n.data.map(Po))}catch(e){L(e)}}),e.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${Ao.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{try{if(t.product!==void 0&&!Ao.includes(t.product))throw Error(`Invalid --product. Expected one of ${Ao.join(`, `)}`);let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=jo(t.platformUrl),i=t.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(t.expiresInDays,10)*24*60*60*1e3).toISOString(),a=M(`Creating API key...`);a.start();let o=await Mo(`${r}/v1/keys`,n.apiKey,{method:`POST`,expected:201,body:JSON.stringify({name:e,product:t.product,budgetUsd:t.budgetUsd?Number.parseFloat(t.budgetUsd):void 0,rpmLimit:t.rpmLimit?Number.parseInt(t.rpmLimit,10):void 0,expiresAt:i})});a.stop();let s=await o.json();if(t.json){D(s);return}O(`API key created: ${s.data.prefix}…`),j(`Copy this key now — it will never be shown again:\n${s.data.key}`)}catch(e){L(e)}}),e.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=jo(t.platformUrl);if(!t.yes&&!await V(`Revoke key ${e}? Any service still using it will start to fail.`)){j(`Aborted.`);return}let i=await(await Mo(`${r}/v1/keys/${encodeURIComponent(e)}`,n.apiKey,{method:`DELETE`,expected:200})).json();if(t.json){D(i);return}O(`Revoked ${e}`)}catch(e){L(e)}}),e}function Io(){let e=new t(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await z(T(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await je(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}catch(e){L(e)}}),e}function Lo(){let e=new t(`permissions`).description(`Manage sandbox user permissions`);return e.command(`list <sandboxId-or-name>`).description(`List all users in a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching users...`);i.start();let a=await(await z(r,n,e)).permissions.list();i.stop(),t.json?D(a):E(a.map(e=>({userId:e.userId,username:e.username,role:e.role,homeDir:e.homeDir,createdAt:e.createdAt.toISOString().split(`T`)[0]})),[{key:`userId`,header:`User ID`,width:20},{key:`username`,header:`Username`,width:16},{key:`role`,header:`Role`,width:12},{key:`homeDir`,header:`Home Directory`,width:24},{key:`createdAt`,header:`Created`,width:16}])}catch(e){L(e)}}),e.command(`get <sandboxId-or-name> <userId>`).description(`Get details for a specific user`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Fetching user...`);a.start();let o=await(await z(i,r,e)).permissions.get(t);if(a.stop(),!o)throw Error(`User ${t} not found in sandbox ${e}`);n.json?D(o):(j(`User: ${o.userId}`),j(` Username: ${o.username}`),j(` Role: ${o.role}`),j(` Home: ${o.homeDir}`),j(` SSH Keys: ${o.sshKeys.length}`),j(` Created: ${o.createdAt.toISOString()}`))}catch(e){L(e)}}),e.command(`add <sandboxId-or-name>`).description(`Add a user to a sandbox`).requiredOption(`--user-id <id>`,`User ID (from your auth system)`).option(`--username <name>`,`Preferred username`).option(`--role <role>`,`Permission level (owner, admin, developer, viewer)`,`developer`).option(`--ssh-key <key>`,`SSH public key for access`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Adding user...`);i.start();let a=await(await z(r,n,e)).permissions.add({userId:t.userId,username:t.username,role:t.role,sshKeys:t.sshKey?[t.sshKey]:void 0});i.stop(),t.json?D(a):(O(`User ${a.userId} added as ${a.role}`),j(` Username: ${a.username}`),j(` Home: ${a.homeDir}`))}catch(e){L(e)}}),e.command(`update <sandboxId-or-name> <userId>`).description(`Update a user's permissions`).option(`--role <role>`,`New permission level (owner, admin, developer, viewer)`).option(`--add-ssh-key <key>`,`Add SSH public key`).option(`--remove-ssh-key <key>`,`Remove SSH public key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Updating user...`);a.start();let o=await(await z(i,r,e)).permissions.update(t,{role:n.role,addSshKeys:n.addSshKey?[n.addSshKey]:void 0,removeSshKeys:n.removeSshKey?[n.removeSshKey]:void 0});a.stop(),n.json?D(o):(O(`User ${t} updated`),j(` Role: ${o.role}`),j(` SSH Keys: ${o.sshKeys.length}`))}catch(e){L(e)}}),e.command(`remove <sandboxId-or-name> <userId>`).description(`Remove a user from a sandbox`).option(`--preserve-home`,`Keep user's home directory`).option(`-f, --force`,`Skip confirmation`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{if(!n.force){let e=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(n=>{e.question(`Remove user ${t} from sandbox? [y/N] `,t=>{e.close(),n(t.toLowerCase()===`y`)})})){j(`Cancelled.`);return}}let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Removing user...`);a.start(),await(await z(i,r,e)).permissions.remove(t,{preserveHomeDir:n.preserveHome}),a.stop(),O(`User ${t} removed from sandbox ${e}`)}catch(e){L(e)}}),e.command(`policies <sandboxId-or-name> <userId>`).description(`Get access policies for a user`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Fetching policies...`);a.start();let o=await(await z(i,r,e)).permissions.getAccessPolicies(t);a.stop(),n.json?D(o):o.length===0?j(`No access policies configured`):E(o.map(e=>({pattern:e.pattern,permission:e.permission,priority:e.priority??0})),[{key:`pattern`,header:`Pattern`,width:30},{key:`permission`,header:`Permission`,width:12},{key:`priority`,header:`Priority`,width:10}])}catch(e){L(e)}}),e.command(`check <sandboxId-or-name> <userId> <path> <action>`).description(`Check if a user can perform an action on a path`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r,i)=>{try{if(![`read`,`write`,`execute`].includes(r))throw Error(`Action must be: read, write, or execute`);let a=C({apiKey:i.apiKey,baseUrl:i.baseUrl}),o=T(a),s=M(`Checking access...`);s.start();let c=await(await z(o,a,e)).permissions.checkAccess(t,n,r);s.stop(),c?O(`✓ User ${t} CAN ${r} ${n}`):j(`✗ User ${t} CANNOT ${r} ${n}`)}catch(e){L(e)}}),e}function Ro(){let e=new t(`preview`).description(`Manage sandbox preview links`);return e.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching preview links...`);t.json||i.start();let a=await(await z(r,n,e)).previewLinks.list();i.stop(),t.json?D(a):a.length===0?console.log(`No preview links found`):I([`Preview ID`,`Port`,`URL`,`Status`],a.map(e=>[e.previewId.slice(0,12),String(e.port),e.url,e.status]))}catch(e){L(e)}}),e.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Creating preview for port ${t}...`);n.json||a.start();let o=await(await z(i,r,e)).previewLinks.create(Number.parseInt(t,10));a.stop(),n.json?D(o):(O(`Preview created: ${o.url}`),console.log(`Preview ID: ${o.previewId}`))}catch(e){L(e)}}),e.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Removing preview...`);n.json||a.start(),await(await z(i,r,e)).previewLinks.remove(t),a.stop(),n.json?D({success:!0,previewId:t}):O(`Preview removed: ${t}`)}catch(e){L(e)}}),e}function zo(){let e=new t(`process`).description(`Manage processes in a sandbox`);return e.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a={};if(n.env)for(let e of n.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(a[t]=n.join(`=`))}let o=M(`Spawning: ${t}`);n.json||o.start();let s=await z(i,r,e);if(s=await B(s),n.blocking){let e=await s.exec(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?D(e):(e.stdout&&globalThis.process.stdout.write(e.stdout),e.stderr&&globalThis.process.stderr.write(e.stderr),e.exitCode!==0&&globalThis.process.exit(e.exitCode))}else{let r=await s.process.spawn(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?D({pid:r.pid,command:r.command}):(console.log(`Process started with PID: ${r.pid}`),console.log(`Use 'tangle process logs ${e} ${r.pid}' to view output`))}}catch(e){L(e)}}),e.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching processes...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.process.list();t.running&&(o=o.filter(e=>e.running)),i.stop(),t.json?D(o):o.length===0?console.log(`No processes found`):I([`PID`,`Command`,`Status`,`Exit Code`,`Started`],o.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}catch(e){L(e)}}),e.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Fetching process info...`);n.json||a.start();let o=await z(i,r,e);o=await B(o);let s=await o.process.get(Number.parseInt(t,10));if(a.stop(),!s){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}let c=await s.status();n.json?D(c):(console.log(`PID: ${c.pid}`),console.log(`Command: ${c.command}`),console.log(`CWD: ${c.cwd||`(default)`}`),console.log(`Status: ${c.running?`running`:`exited`}`),console.log(`Exit Code: ${c.exitCode}`),c.exitSignal&&console.log(`Signal: ${c.exitSignal}`),console.log(`Started: ${c.startedAt.toLocaleString()}`),c.exitedAt&&console.log(`Exited: ${c.exitedAt.toLocaleString()}`))}catch(e){L(e)}}),e.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Sending ${n.signal} to PID ${t}...`);n.json||a.start();let o=await z(i,r,e);o=await B(o);let s=await o.process.get(Number.parseInt(t,10));if(!s){a.stop(),console.error(`Process ${t} not found`),globalThis.process.exit(1);return}n.tree?await s.kill(n.signal,{tree:!0}):await s.kill(n.signal),a.stop(),n.json?D({pid:Number.parseInt(t,10),signal:n.signal,...n.tree===!0?{tree:!0}:{},killed:!0}):console.log(n.tree?`Sent ${n.signal} to process tree ${t}`:`Sent ${n.signal} to process ${t}`)}catch(e){L(e)}}),e.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).option(`--json`,`Output as JSON lines`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await z(T(r),r,e);i=await B(i);let a=await i.process.get(Number.parseInt(t,10));if(!a){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of a.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}catch(e){L(e)}}),e}const Bo=[`python`,`node`,`typescript`,`bash`];function Vo(e){switch(te(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function Ho(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await Me(ne(e),`utf8`)}async function Uo(e,t,n=Ho){let r=t?Bo.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${Bo.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=Vo(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function Wo(e){return h(ve(),`tangle-run-images`,e)}function Go(){return new t(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${Bo.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).option(`--json`,`Output the full CodeExecutionResult as JSON`).action(async(e,t,n)=>{try{let{language:r,source:i}=await Uo(t,n.lang),o=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),s=await z(T(o),o,e);s=await B(s);let c=M(`Running ${r} (${i.length}b)…`);n.json||c.start();let u=await s.runCode(r,i,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10)});if(c.stop(),n.json){D(u),u.exitCode!==0&&process.exit(u.exitCode);return}u.stdout&&process.stdout.write(u.stdout),u.stderr&&process.stderr.write(u.stderr);let d=0;for(let t of u.results)if(t.type===`image`)if(n.saveImages!==!1){let r=typeof n.saveImages==`string`?n.saveImages:Wo(e);l(r,{recursive:!0});let i=`${r}/${Date.now()}-${d}.${t.format}`;f(i,Buffer.from(t.data,`base64`)),process.stderr.write(a.green(`✓ image → ${i}\n`)),d++}else process.stderr.write(a.gray(`[image: ${t.format}, ${t.data.length}b base64]\n`));else if(t.type===`dataframe`){let e=t.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(a.gray(`[dataframe ${t.rows.length}×${t.columns.length}${t.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${e}\n`);for(let e of t.rows.slice(0,20))process.stderr.write(`${e.map(e=>String(e)).join(` | `)}\n`);t.rows.length>20&&process.stderr.write(a.gray(`… ${t.rows.length-20} more rows\n`))}else t.type===`json`?(process.stderr.write(a.gray(`[json] `)),process.stderr.write(`${JSON.stringify(t.value,null,2)}\n`)):t.type===`html`?process.stderr.write(a.gray(`[html ${t.value.length}b]\n`)):t.type===`error`?(process.stderr.write(a.red(`✗ ${t.name}: ${t.message}\n`)),t.traceback&&process.stderr.write(`${t.traceback}\n`)):t.type===`text`&&process.stderr.write(`${t.value}\n`);u.error&&(process.stderr.write(a.red(`\n✗ ${u.error.name}: ${u.error.message}\n`)),u.error.traceback&&process.stderr.write(`${u.error.traceback}\n`)),u.exitCode!==0&&process.exit(u.exitCode)}catch(e){L(e)}})}function Ko(e){return`${e.name} (${e.id})`}async function qo(e,t){if(t.startsWith(`team_`))return e.teams.get(t);let n=(await e.teams.list()).filter(e=>e.name.toLowerCase()===t.toLowerCase());if(n.length===0)throw Error(`Team not found: ${t}`);if(n.length>1)throw Error(`Team name is ambiguous: ${t}. Use a team id instead.`);return n[0]}async function X(e,t,n){if(t)return qo(e,t);let r=zt(n);if(!r.activeTeamId)throw Error("No active team. Run `tangle team switch <team>` or pass `--team <team>`.");return e.teams.get(r.activeTeamId)}function Jo(e,t){Bt({id:e.id,name:e.name},t)}function Yo(e){Vt(e)}async function Xo(e){let t=typeof e.envVarName==`string`&&e.envVarName.length>0?e.envVarName:null,n=!!e.fromStdin;if(t&&n)throw Error(`Pass either ${e.flagPrefix}-env or ${e.flagPrefix}-stdin, not both`);if(t){let n=process.env[t];if(!n||n.length===0)throw Error(`${e.flagPrefix}-env points at ${t}, but that environment variable is empty or unset`);return n}if(n){let t=await Ln();if(t.length===0)throw Error(`${e.flagPrefix}-stdin received empty input on stdin`);return t}}function Zo(e){let t=e.split(`/`);return t.length>=2?{provider:t[0],model:t.slice(1).join(`/`)}:{model:e}}function Qo(){let e=new t(`sandbox`).description(`Manage sandboxes`);e.command(`create`).description(`Create a new sandbox`).option(`-n, --name <name>`,`Sandbox name`).option(`-e, --environment <environment>`,`Named environment, container image, or built image ID`).option(`--bare`,`Create a bare sandbox without the agent runtime`).option(`--ssh`,`Enable SSH access`).option(`--ssh-key <key>`,`SSH public key for authentication`).option(`--ssh-keys <names...>`,`Stored SSH key names or IDs for authentication`).option(`--ssh-key-file <paths...>`,`SSH public key file paths for authentication`).option(`--web-terminal`,`Enable web terminal`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--secret <names...>`,`Secrets to inject as environment variables`).option(`--metadata <entries...>`,`Metadata entries (KEY=VALUE or KEY=JSON)`).option(`--cpu <cores>`,`CPU cores`,`2`).option(`--memory <mb>`,`Memory in MB`,`4096`).option(`--disk <gb>`,`Disk size in GB`,`20`).option(`--accelerator-kind <kind>`,`Accelerator kind, for example nvidia-h100 or amd-mi300x`).option(`--accelerator-count <count>`,`Accelerator device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB`).option(`--gpu-provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum customer spend for the create-time GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum create-time GPU lease lifetime in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy the create-time GPU lease after this many idle seconds`).option(`--lifetime <seconds>`,`Max wall-clock lifetime before the sandbox is suspended — stopped, not deleted; resume it within the cold window (default 3600 = 1h). Raise it for long sessions, e.g. --lifetime 7200`,`3600`).option(`--idle-timeout <seconds>`,"Idle time before the sandbox is stopped — not deleted (default 900 = 15m). Resume it later with `tangle sandbox resume <id-or-name>`, or it auto-resumes on next use. Raise it for demos, e.g. --idle-timeout 3600",`900`).option(`--from-snapshot <id>`,`Create the sandbox from a snapshot`).option(`--public-template <id-or-slug>`,`Create the sandbox from a published public template`).option(`--public-template-version <id>`,`Pin creation to a specific published public-template version`).option(`--billing-owner <userId>`,`Platform user that pays for the sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--team <team>`,`Create in a team by id or name`).option(`--personal`,`Create a personal sandbox even when a team is active`).option(`--git-url <url>`,`Git repository URL to clone during provisioning`).option(`--git-ref <ref>`,`Git branch, tag, or commit to checkout`).option(`--git-depth <depth>`,`Git clone depth`).option(`--git-sparse <paths...>`,`Sparse checkout paths`).option(`--git-token-env <name>`,`Name of an environment variable containing the Git HTTPS auth token`).option(`--git-token-stdin`,`Read the Git HTTPS auth token from stdin`).option(`--storage-type <type>`,`BYOS3 storage type (s3, gcs, r2)`).option(`--storage-bucket <name>`,`BYOS3 bucket name`).option(`--storage-endpoint <url>`,`BYOS3 endpoint URL`).option(`--storage-region <region>`,`BYOS3 region`).option(`--storage-prefix <prefix>`,`BYOS3 path prefix`).option(`--storage-access-key-id <id>`,`BYOS3 access key ID`).option(`--storage-secret-access-key-env <name>`,`Name of an environment variable containing the BYOS3 secret access key`).option(`--storage-secret-access-key-stdin`,`Read the BYOS3 secret access key from stdin`).option(`--driver <type>`,`Infrastructure driver (docker, firecracker, host-agent, tangle)`).option(`--driver-criu`,`Enable CRIU checkpointing (firecracker only)`).option(`--driver-region <region>`,`Preferred region for host-agent driver`).option(`--backend <type>`,`Backend agent type (opencode, claude-code, kimi-code, codex, amp)`).option(`--backend-model <model>`,`Model override (format: provider/model)`).option(`--backend-api-key-env <name>`,`Name of an environment variable containing the BYOK backend API key`).option(`--backend-api-key-stdin`,`Read the BYOK backend API key from stdin`).option(`--tee <type>`,`Require a TEE backend (any, tdx, nitro, sev-snp, phala-dstack)`).option(`--sealed`,`Request TEE sealed-secret support`).option(`--attestation-nonce <hex|auto>`,`Deploy-time attestation nonce; use auto to generate one`).option(`--attestation-refresh`,`Generate a fresh deploy-time attestation nonce when --tee is set`).option(`--require-attestation`,`Fail unless TEE attestation evidence is returned`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`--timeout <ms>`,`HTTP timeout in milliseconds`,`30000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=[[`cpu`,`cpuCores`],[`memory`,`memoryMB`],[`disk`,`diskGB`]].filter(([e])=>t.getOptionValueSource(e)===`default`).map(([,e])=>e),r=await Xo({envVarName:e.gitTokenEnv,fromStdin:e.gitTokenStdin,flagPrefix:`--git-token`}),i=await Xo({envVarName:e.storageSecretAccessKeyEnv,fromStdin:e.storageSecretAccessKeyStdin,flagPrefix:`--storage-secret-access-key`}),a=await Xo({envVarName:e.backendApiKeyEnv,fromStdin:e.backendApiKeyStdin,flagPrefix:`--backend-api-key`}),o=C({apiKey:e.apiKey,baseUrl:e.baseUrl,timeout:e.timeout?Number.parseInt(e.timeout,10):void 0}),s=T(o),c=M(`Creating sandbox...`);c.start();let l=await is({client:s,explicitTeam:e.team,personal:e.personal,activeTeamId:o.activeTeamId}),d={};if(e.env)for(let t of e.env){let[e,...n]=t.split(`=`);e&&n.length>0&&(d[e]=n.join(`=`))}let f=e.metadata?es(e.metadata):void 0,p=ns(e,r),m=rs(e,i),ee=e.acceleratorKind?wa({kind:String(e.acceleratorKind),count:String(e.acceleratorCount),memory:typeof e.acceleratorMemory==`string`?e.acceleratorMemory:void 0}):void 0,te=Ta({provider:typeof e.gpuProvider==`string`?e.gpuProvider:void 0,image:typeof e.gpuWorkerImage==`string`?e.gpuWorkerImage:void 0,env:Array.isArray(e.gpuEnv)?e.gpuEnv:void 0,maxSpendUsd:typeof e.gpuMaxSpendUsd==`string`?e.gpuMaxSpendUsd:void 0,maxLifetime:typeof e.gpuMaxLifetime==`string`?e.gpuMaxLifetime:void 0,idleTimeout:typeof e.gpuIdleTimeout==`string`?e.gpuIdleTimeout:void 0},!!ee,`Create-time GPU lease flags require --accelerator-kind`),h=e.driver?{type:e.driver,enableCriu:e.driverCriu||void 0,preferredRegion:e.driverRegion}:void 0,ne=e.backend||e.backendModel?{...e.backend?{type:pe(e.backend)}:{},model:e.backendModel||a?{...e.backendModel?Zo(e.backendModel):{},apiKey:a}:void 0}:void 0,re=[...e.sshKey?[e.sshKey]:[],...(e.sshKeyFile??[]).map(e=>u(e,`utf8`).trim())],g={name:e.name,environment:e.environment,bare:e.bare||void 0,sshEnabled:e.ssh||!!e.sshKey||re.length>0||!!e.sshKeys?.length,sshPublicKeys:re.length>0?re:void 0,sshKeyIds:e.sshKeys,webTerminalEnabled:e.webTerminal,env:Object.keys(d).length>0?d:void 0,git:p,resources:{cpuCores:Number.parseInt(e.cpu,10),memoryMB:Number.parseInt(e.memory,10),diskGB:Number.parseInt(e.disk,10),accelerator:ee,...n.length>0?{advisoryFields:n}:{}},gpuLease:te,maxLifetimeSeconds:Number.parseInt(e.lifetime,10),idleTimeoutSeconds:Number.parseInt(e.idleTimeout,10),storage:m,fromSnapshot:e.fromSnapshot,publicTemplateId:e.publicTemplate,publicTemplateVersionId:e.publicTemplateVersion,teamId:l,...e.billingOwner?{billingOwnerId:e.billingOwner}:{},secrets:e.secret,metadata:f,driver:h,backend:ne},ie=e.tee?{tee:e.tee,sealed:e.sealed||void 0,attestationRefresh:e.attestationRefresh||e.attestationNonce===`auto`||void 0}:void 0,ae=ie?await de(s,{...g,confidential:ie,attestationNonce:e.attestationNonce??(e.attestationRefresh?`auto`:void 0),requireAttestation:e.requireAttestation??!0}):void 0,_=ae?.sandbox??await s.create(g);e.wait&&(c.text=`Waiting for sandbox to start...`,await _.waitFor(`running`,{timeoutMs:12e4}),await _.refresh()),c.stop(),e.json?D({id:_.id,name:_.name,status:_.status,createdAt:_.createdAt,expiresAt:_.expiresAt,connection:$o(_.connection),teamId:l,gpuLease:_.gpuLease,confidential:ie,attestation:ae?.attestation,attestationNonce:ae?.attestationNonce}):(O(`Sandbox created: ${_.id}`),cn({id:_.id,name:_.name,status:_.status,createdAt:_.createdAt?.toISOString(),expiresAt:_.expiresAt?.toISOString(),connection:_.connection}),l&&console.log(`Team: ${l}`),_.gpuLease&&(console.log(`GPU lease: ${_.gpuLease.id}`),ss(_.gpuLease)),ie&&(console.log(`TEE: ${ie.tee}`),console.log(`Attestation: ${ae?.attestation?`present`:`not returned`}`),ae?.attestationNonce&&console.log(`Attestation nonce: ${ae.attestationNonce}`)))}catch(e){L(e)}}),e.command(`attestation <id-or-name>`).description(`Fetch TEE attestation evidence for a sandbox`).option(`--nonce <hex|auto>`,`Nonce to bind into a fresh attestation report; use auto to generate one`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=t.nonce===`auto`?fe():t.nonce,a=M(`Fetching TEE attestation...`);a.start();let o=await(await z(r,n,e)).getTeeAttestation(i?{attestationNonce:i}:void 0);a.stop(),t.json?D(o):(O(`Attestation fetched for ${e}`),console.log(`TEE type: ${o.attestation.tee_type}`),console.log(`Evidence bytes: ${o.attestation.evidence.length}`),console.log(`Measurement bytes: ${o.attestation.measurement.length}`),console.log(`Timestamp: ${o.attestation.timestamp}`),o.attestationNonce&&console.log(`Nonce: ${o.attestationNonce}`))}catch(e){L(e)}}),e.command(`list`).description(`List all sandboxes`).option(`-s, --status <status>`,`Filter by status (running, stopped, all)`).option(`-l, --limit <n>`,`Limit results`,`50`).option(`--team <team>`,`List sandboxes for a team by id or name`).option(`--personal`,`List personal sandboxes`).option(`--all-scopes`,`List personal and team sandboxes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=C({apiKey:e.apiKey,baseUrl:e.baseUrl}),n=T(t),r=M(`Fetching sandboxes...`);r.start();let i=await as({client:n,explicitTeam:e.team,personal:e.personal,allScopes:e.allScopes,activeTeamId:t.activeTeamId}),a=await n.list({status:e.status===`all`?void 0:e.status,limit:Number.parseInt(e.limit,10),scope:i});r.stop(),e.json?D(a):E(a.map(e=>({id:e.id,status:e.status,createdAt:e.createdAt,name:e.name??``})),[{key:`id`,header:`ID`,width:24},{key:`status`,header:`Status`,width:14},{key:`createdAt`,header:`Created`,width:16},{key:`name`,header:`Name`,width:20}])}catch(e){L(e)}}),e.command(`get <id-or-name>`).description(`Get sandbox details`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching sandbox...`);i.start();let a=await z(r,n,e);i.stop(),t.json?D(a):cn({id:a.id,name:a.name,status:a.status,createdAt:a.createdAt?.toISOString(),expiresAt:a.expiresAt?.toISOString(),connection:a.connection})}catch(e){L(e)}}),e.command(`delete <id-or-name>`).description(`Delete a sandbox`).option(`-f, --force`,`Skip confirmation`).option(`--name`,`Treat the reference as a sandbox name`).option(`--retry-cleanup`,`Retry server-side cleanup after the sandbox disappeared from get/list`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(!t.force){let t=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(n=>{t.question(`Delete sandbox ${e}? [y/N] `,e=>{t.close(),n(e.toLowerCase()===`y`)})})){j(`Cancelled.`);return}}let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Deleting sandbox...`);i.start();let a=await jn(r,n,e,{retryCleanup:t.retryCleanup,name:t.name});i.stop(),O(a===`already_absent`?`Sandbox ${e} was already gone.`:`Sandbox ${e} deleted.`)}catch(e){L(e)}}),e.command(`stop <id-or-name>`).description(`Stop a running sandbox`).option(`--name`,`Treat the reference as a sandbox name`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Stopping sandbox...`);i.start(),await(await z(r,n,e,{nameOnly:t.name})).stop(),i.stop(),O(`Sandbox ${e} stopped.`)}catch(e){L(e)}}),e.command(`resume <id-or-name>`).description(`Resume a stopped sandbox`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`-t, --timeout <ms>`,`Resume timeout in milliseconds; a cold resume re-provisions the sandbox, so this defaults higher than other commands (default 120000)`,`120000`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Number.parseInt(t.timeout,10);if(!Number.isFinite(n)||n<=0)throw Error(`--timeout must be a positive number of milliseconds`);let r=C({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:n}),i=T(r),a=M(`Resuming sandbox...`);a.start();let o=await z(i,r,e);await o.resume({timeoutMs:n}),t.wait&&(a.text=`Waiting for sandbox to start...`,await o.waitFor(`running`,{timeoutMs:n})),a.stop(),O(`Sandbox ${o.id} resumed.`)}catch(e){L(e)}});let n=e.command(`gpu`).description(`Manage on-demand GPU leases for a sandbox`);return n.command(`attach <id-or-name>`).description(`Attach a temporary GPU worker to a sandbox`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Attaching GPU lease...`);i.start();let a=await(await z(r,n,e)).gpu.attach(Ea(t));i.stop(),t.json?D(a):(O(`GPU lease attached: ${a.id}`),ss(a))}catch(e){L(e)}}),n.command(`run <id-or-name> <command...>`).description(`Attach a temporary GPU, run a command, then destroy it`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker and command (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{let r,i,a,o;try{let a=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),o=await z(T(a),a,e),s=M(`Attaching GPU lease...`);s.start(),r=await o.gpu.attach(Ea(n)),s.stop();let c=M(`Running GPU command...`);c.start(),i=await o.gpu.exec(r.id,{command:t.join(` `),timeoutMs:n.timeout?K(String(n.timeout),`--timeout`):void 0,cwd:n.cwd,env:n.env?Da(n.env,`--env`,`env`):void 0}),c.stop(),n.json||cs(i)}catch(e){a=e}finally{if(r)try{let t=C({apiKey:n.apiKey,baseUrl:n.baseUrl});r=await(await z(T(t),t,e)).gpu.detach(r.id)}catch(e){o=e}}if(a){L(a),o&&L(o);return}if(o){L(o);return}n.json?D({lease:r,result:i}):r&&O(`GPU lease detached: ${r.id}`);let s=i?.result.exitCode;s&&s!==0&&(process.exitCode=s)}),n.command(`list <id-or-name>`).description(`List GPU leases attached to a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching GPU leases...`);i.start();let a=await(await z(r,n,e)).gpu.list();i.stop(),t.json?D(a):a.length===0?j(`No GPU leases attached.`):E(a.map(e=>({id:e.id,status:e.status,provider:e.provider,accelerator:`${e.accelerator.kind}x${e.accelerator.count}`,customerUsdHr:e.customerPricePerHourUsd??``})),[{key:`id`,header:`ID`,width:28},{key:`status`,header:`Status`,width:12},{key:`provider`,header:`Provider`,width:12},{key:`accelerator`,header:`GPU`,width:24},{key:`customerUsdHr`,header:`$/hr`,width:10}])}catch(e){L(e)}}),n.command(`exec <id-or-name> <lease-id> <command...>`).description(`Run a command on an attached GPU lease`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=C({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=T(i),o=M(`Running GPU command...`);o.start();let s=await(await z(a,i,e)).gpu.exec(t,{command:n.join(` `),timeoutMs:r.timeout?K(String(r.timeout),`--timeout`):void 0,cwd:r.cwd,env:r.env?Da(r.env,`--env`,`env`):void 0});o.stop(),r.json?D(s):cs(s)}catch(e){L(e)}}),n.command(`detach <id-or-name> <lease-id>`).description(`Detach and destroy a GPU lease`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Detaching GPU lease...`);a.start();let o=await(await z(i,r,e)).gpu.detach(t);a.stop(),n.json?D(o):(O(`GPU lease detached: ${o.id}`),ss(o))}catch(e){L(e)}}),e.command(`network <id-or-name>`).description(`Show runtime network state (exposed ports) for a sandbox. Outbound policy is not settable here — see the outbound flags.`).option(`--block-outbound`,`Unenforceable; the server rejects it. Block outbound traffic with an egress policy of mode "blocked"`).option(`--allow-list <cidrs>`,`Unenforceable; the server rejects it. Egress policy allowlists domains, not CIDRs`).option(`--clear`,`Unenforceable; the server rejects it. There is no per-sandbox outbound restriction here to clear`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Updating network configuration...`);i.start();let a=await z(r,n,e);if(t.clear)await a.network.update({blockOutbound:!1,allowList:[]});else if(t.blockOutbound)await a.network.update({blockOutbound:!0});else if(t.allowList){let e=t.allowList.split(`,`).map(e=>e.trim());await a.network.update({allowList:e})}else{i.stop();let e=await a.network.getConfig();t.json?D(e):(j(`Network Configuration:`),e.ports&&e.ports.length>0?j(` Exposed Ports: ${e.ports.join(`, `)}`):j(` No exposed ports`));return}i.stop();let o=await a.network.getConfig();t.json?D(o):(O(`Network configuration updated.`),o.ports&&o.ports.length>0&&j(` Exposed Ports: ${o.ports.join(`, `)}`))}catch(e){L(e)}}),e.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=Number.parseInt(t.port,10);if(Number.isNaN(i)||i<1||i>65535)throw Error(`Port must be a number between 1 and 65535`);let a=M(`Exposing port ${i}...`);a.start();let o=await(await z(r,n,e)).network.exposePort(i);a.stop(),t.json?D({port:i,url:o}):(O(`Port ${i} exposed.`),j(` URL: ${o}`))}catch(e){L(e)}}),e.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching exposed URLs...`);i.start();let a=await(await z(r,n,e)).network.listUrls();if(i.stop(),t.json)D(a);else{let e=Object.entries(a);if(e.length===0)j(`No ports exposed.`);else{j(`Exposed Ports:`);for(let[t,n]of e)j(` ${t}: ${n}`)}}}catch(e){L(e)}}),e}function $o(e){return!e||e.authToken===void 0?e:{...e,authToken:`[REDACTED]`}}function es(e){let t={};for(let n of e){let[e,...r]=n.split(`=`);if(!e||r.length===0)throw Error(`--metadata expects values in KEY=VALUE or KEY=JSON format`);t[e]=ts(r.join(`=`))}return t}function ts(e){try{return JSON.parse(e)}catch{return e}}function ns(e,t){if(!(!e.gitUrl&&!e.gitRef&&!e.gitDepth&&!e.gitSparse&&!t)){if(!e.gitUrl||typeof e.gitUrl!=`string`)throw Error(`--git-url is required when using git provisioning options`);return{url:e.gitUrl,ref:typeof e.gitRef==`string`?e.gitRef:void 0,depth:typeof e.gitDepth==`string`?K(e.gitDepth,`--git-depth`):void 0,sparse:Array.isArray(e.gitSparse)?e.gitSparse:void 0,auth:t?{token:t}:void 0}}}function rs(e,t){if(!(!e.storageType&&!e.storageBucket&&!e.storageEndpoint&&!e.storageRegion&&!e.storagePrefix&&!e.storageAccessKeyId&&!t)){if(typeof e.storageType!=`string`||typeof e.storageBucket!=`string`||typeof e.storageAccessKeyId!=`string`||!t)throw Error(`Storage config requires --storage-type, --storage-bucket, --storage-access-key-id, and one of --storage-secret-access-key-env / --storage-secret-access-key-stdin`);return{type:os(e.storageType),bucket:e.storageBucket,endpoint:typeof e.storageEndpoint==`string`?e.storageEndpoint:void 0,region:typeof e.storageRegion==`string`?e.storageRegion:void 0,prefix:typeof e.storagePrefix==`string`?e.storagePrefix:void 0,credentials:{accessKeyId:e.storageAccessKeyId,secretAccessKey:t}}}}async function is(e){if(e.explicitTeam&&e.personal)throw Error(`--team and --personal cannot be used together`);if(!e.personal)return e.explicitTeam?(await qo(e.client,e.explicitTeam)).id:e.activeTeamId}async function as(e){if([!!e.explicitTeam,!!e.personal,!!e.allScopes].filter(Boolean).length>1)throw Error(`--team, --personal, and --all-scopes are mutually exclusive`);if(e.allScopes)return`all`;if(e.personal)return`personal`;if(e.explicitTeam)return`team:${(await qo(e.client,e.explicitTeam)).id}`;if(e.activeTeamId)return`team:${e.activeTeamId}`}function os(e){if(e===`s3`||e===`gcs`||e===`r2`)return e;throw Error(`--storage-type must be one of s3, gcs, or r2`)}function ss(e){j(` Status: ${e.status}`),j(` Provider: ${e.provider}`),j(` GPU: ${e.accelerator.kind} x ${e.accelerator.count}`),e.customerPricePerHourUsd!==void 0&&j(` Customer price: $${e.customerPricePerHourUsd}/hr`),e.estimatedCustomerCostUsd!==void 0&&j(` Max estimate: $${e.estimatedCustomerCostUsd}`),e.billing&&(j(` Billed seconds: ${e.billing.seconds}`),j(` Customer cost: $${e.billing.customerCostUsd}`))}function cs(e){e.result.stdout&&process.stdout.write(e.result.stdout),e.result.stderr&&process.stderr.write(e.result.stderr),j(`Exit code: ${e.result.exitCode}`)}function ls(){return new t(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).option(`--json`,`Output as JSON lines`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Searching...`);n.json||a.start();let o=await z(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)}catch(e){L(e)}})}function us(){let e=new t(`secret`).description(`Manage secrets`);return e.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=T(C({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=await ds({value:t,valueStdin:n.valueStdin,prompt:`Enter value for secret '${e}': `}),a=M(`Creating secret...`);a.start();let o=await r.secrets.create(e,i);a.stop(),n.json?D({name:o.name,createdAt:o.createdAt.toISOString(),updatedAt:o.updatedAt.toISOString()}):(O(`Secret created: ${o.name}`),j(`Use --secrets ${o.name} when creating a sandbox to inject it as an environment variable.`))}catch(e){L(e)}}),e.command(`list`).description(`List all secrets`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Fetching secrets...`);n.start();let r=await t.secrets.list();n.stop(),e.json?D(r.map(e=>({name:e.name,createdAt:e.createdAt.toISOString(),updatedAt:e.updatedAt.toISOString()}))):r.length===0?(j(`No secrets found.`),j(`Use 'tangle secret create <name> [value]' to create one.`)):I([`Name`,`Created At`,`Updated At`],r.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}catch(e){L(e)}}),e.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl}));if(!t.force&&!await V(`Are you sure you want to delete secret '${e}'? This cannot be undone. (y/N) `)){j(`Cancelled.`);return}let r=M(`Deleting secret...`);r.start(),await n.secrets.delete(e),r.stop(),t.json?D({success:!0,deleted:e}):O(`Secret deleted: ${e}`)}catch(e){L(e)}}),e}async function ds(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);if(e.value!==void 0){if(e.value.length===0)throw Error(`Secret value cannot be empty`);return e.value}if(e.valueStdin){let e=await Ln();if(e.length===0)throw Error(`Secret value from stdin cannot be empty`);return e}let t=await In(e.prompt);if(t.length===0)throw Error(`Secret value cannot be empty`);return t}function fs(){let e=new t(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=p.dirname(Ne(import.meta.url)),t=p.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function ps(){let e=new t(`snapshot`).description(`Manage snapshots`);return e.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Creating snapshot...`);i.start();let a=await(await z(r,n,e)).snapshot({tags:t.tags});i.stop(),t.json?D(a):(O(`Snapshot created: ${a.snapshotId}`),console.log(`Size: ${ms(a.sizeBytes??0)}`))}catch(e){L(e)}}),e.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching snapshots...`);i.start();let a=await(await z(r,n,e)).listSnapshots();i.stop(),t.json?D(a):E(a.map(e=>({...e,size:ms(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}catch(e){L(e)}}),e.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--billing-owner <userId>`,`Platform user that pays for the restored sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=T(C({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=M(`Restoring from snapshot...`);i.start();let a=await r.create({fromSnapshot:t,fromSandboxId:e,...n.billingOwner?{billingOwnerId:n.billingOwner}:{}});await a.waitFor(`running`,{timeoutMs:12e4}),i.stop(),n.json?D({sandboxId:a.id,restoredFrom:t,status:a.status}):(O(`New sandbox created: ${a.id}`),console.log(`Source snapshot: ${t}`))}catch(e){L(e)}}),e.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Reverting sandbox to snapshot...`);a.start();let o=await z(i,r,e),s=await o.revertToSnapshot(t);await o.refresh(),a.stop(),n.json?D({sandboxId:o.id,snapshotId:s.snapshotId,status:o.status}):(O(`Sandbox reverted: ${o.id}`),console.log(`Source snapshot: ${s.snapshotId}`))}catch(e){L(e)}}),e.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Deleting snapshot...`);a.start();let o=await(await z(i,r,e)).deleteSnapshot(t);a.stop(),n.json?D({success:!0,sandboxId:e,snapshotId:t,outcome:o.outcome}):o.outcome===`already_absent`?O(`Snapshot already gone: ${t}`):O(`Snapshot deleted: ${t}`)}catch(e){L(e)}}),e}function ms(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}function hs(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sidecar-proxy/${t}/ssh`}function gs(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function _s(e){return`'${e.replace(/'/g,`''`)}'`}function vs(e){return e===`win32`?`NUL`:`/dev/null`}function ys(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${_s(`<token>`)}; ssh ${e.map(_s).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${gs(`<token>`)} ssh ${e.map(gs).join(` `)}`}function bs(e){return e.connection!==void 0&&!e.connection.ssh}function xs(){k(`SSH is not enabled for this sandbox.`),j(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function Ss(e,t=[],n=process.platform){let r=vs(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function Cs(){return new t(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).allowUnknownOption(!0).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Getting SSH credentials...`);a.start();let o=await z(i,r,e);if(bs(o)){a.stop(),xs();return}o=await B(o);let s=await o.ssh();if(a.stop(),!s){xs();return}let c={...s,proxyCommand:hs(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let l=Ss(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(ys(l,process.platform));return}j(`Connecting via tunnel...`);let u=be(`ssh`,l,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});u.on(`error`,e=>{e.code===`ENOENT`&&(k(`SSH client not found. Please install OpenSSH.`),process.exit(1)),L(e)}),u.on(`exit`,e=>{process.exit(e??0)})}catch(e){L(e)}})}function ws(){let e=new t(`ssh-keys`).description(`Manage SSH keys`);return e.command(`list`).description(`List SSH keys`).option(`--json`,`Output as JSON`).action(async e=>{let t=M(`Fetching SSH keys...`);try{t.start();let n=await T(C(e)).sshKeys.list();t.stop(),e.json?D({sshKeys:n}):n.length===0?j(`No SSH keys found.`):I([`Name`,`Type`,`Fingerprint`,`Created`],n.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){t.stop(),L(e)}}),e.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).option(`--json`,`Output as JSON`).action(async(e,t)=>{let n=M(`Adding SSH key...`);try{let r=u(t.keyFile,`utf8`).trim();n.start();let i=await T(C(t)).sshKeys.create(e,r);n.stop(),t.json?D({sshKey:i}):O(`Added SSH key ${i.name} (${i.fingerprint})`)}catch(e){n.stop(),L(e)}}),e.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=M(`Deleting SSH key...`);try{n.start(),await T(C(t)).sshKeys.delete(e),n.stop(),O(`Deleted SSH key ${e}`)}catch(e){n.stop(),L(e)}}),e}function Ts(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function Es(){return new t(`ssh-proxy`).description(`SSH proxy helper that pipes stdin/stdout to WebSocket`).argument(`<runtime-url>`,`Runtime WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||Ts(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new Pe(new URL(e.replace(/^http/,`ws`)),{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),r;function i(){r&&=(clearInterval(r),void 0)}n.on(`open`,()=>{r=setInterval(()=>{n.readyState===Pe.OPEN&&n.ping()},15e3),r.unref?.(),process.stdin.on(`data`,e=>{n.readyState===Pe.OPEN&&n.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>n.close(1e3))}),n.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),n.on(`error`,e=>{i(),Ts(`WebSocket error: ${e.message}`)}),n.on(`close`,e=>{i(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>n.close())})}const Ds=[`claude-code`,`opencode`,`codex`,`kimi-code`,`prime`],Os=[`project`,`read-only`],ks={min:1,max:15},As=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function js(e){let t=Fe(e);if(t)return t;throw Error(`--model '${e}' has no provider. Pass a canonical id, for example 'deepseek/${e}'.`)}function Ms(e,t){return{...e,harness:t}}function Ns(e){let t=e.harness??`claude-code`;if(!Ds.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${Ds.join(`, `)}.`);let n=e.tokenScope??`project`;if(!Os.includes(n))throw Error(`Unknown --token-scope '${n}'. Supported: ${Os.join(`, `)}.`);let r=Ps(e.maxTokens,2e5,`--max-tokens`),i=Ps(e.maxIterations,50,`--max-iterations`),a=Ps(e.tokenTtl,10,`--token-ttl`);if(a<ks.min||a>ks.max)throw Error(`--token-ttl ${a} out of range; the SDK clamps to [${ks.min}, ${ks.max}] minutes.`);let o=e.maxWorkers===void 0?void 0:Ps(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:r,maxIterations:i,tokenScope:n,tokenTtl:a,...o===void 0?{}:{maxWorkers:o}}}function Ps(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function Fs(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function Is(e){let{client:t,scope:n,ttlMinutes:r,onScope:i}=e,a={async create(e){let a=await t.create(Ls(e)),o={scope:n,ttlMinutes:r},s=await a.mintScopedToken(o);return i({id:a.id,scope:s.scope,expiresAt:s.expiresAt,status:`spawned`}),a}};return typeof t.criuStatus==`function`&&(a.criuStatus=t.criuStatus.bind(t)),a}function Ls(e){if(!e?.env)return e;let{TANGLE_API_KEY:t,...n}=e.env;return{...e,env:n}}function Rs(e){if(e.kind===`no-winner`)return{text:``,tokenUsage:{input:0,output:0},costUsd:0,status:`no-winner (${e.reason})`};let t=e.out;return{text:typeof t==`string`?t:zs(t)?t.content:JSON.stringify(t),tokenUsage:{input:e.spentTotal.tokens.input,output:e.spentTotal.tokens.output},costUsd:e.spentTotal.usd,status:`winner`}}function zs(e){return typeof e==`object`&&!!e&&typeof e.content==`string`}const Bs={makeClient:e=>T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),resolveRouter:e=>({routerBaseUrl:As,routerKey:C({apiKey:e.apiKey}).apiKey}),supervise:Ie};async function Vs(e,t,n,r=Bs){let a=r.makeClient({apiKey:n.apiKey,baseUrl:n.baseUrl}),{budget:o,perWorker:s}=Fs(t),c=[],l=Le({backend:`sandbox`,sandboxClient:Is({client:a,scope:t.tokenScope,ttlMinutes:t.tokenTtl,onScope:e=>{if(c.push(e),!n.json){let n=`ttl ${t.tokenTtl}m`;j(`worker ${e.id} [${e.scope} token ${n}] spawned`)}}}),maxIterations:1}),u=(e,n)=>l(Ms(e,t.harness),n),d={name:`supervisor`,harness:`cli-base`,model:{default:t.model??`deepseek-v4-flash`,provider:t.model?js(t.model):`deepseek`}},f=r.resolveRouter({apiKey:n.apiKey}),p=Rs(await r.supervise(d,{goal:e},{budget:o,makeWorkerAgent:u,router:f,...s?{perWorker:s}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${i()}`})),m=p.status===`winner`?`settled`:`failed`;for(let e of c)e.status=m,n.json||j(`worker ${e.id} [${e.scope} token ttl ${t.tokenTtl}m] settled (${e.status})`);return{task:e,result:p.text,workers:c,tokenUsage:p.tokenUsage,costUsd:p.costUsd,status:p.status}}function Hs(){let e=new t(`supervise`);return e.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task. Each worker box mints a short-lived scoped token instead of receiving the root API key.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${Ds.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--token-scope <scope>`,`Per-worker token scope (${Os.join(` | `)})`,`project`).option(`--token-ttl <min>`,`Per-worker token TTL in minutes (SDK clamps to [1, 15])`,`10`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Ns({harness:t.harness,model:t.model,maxTokens:t.maxTokens,maxIterations:t.maxIterations,tokenScope:t.tokenScope,tokenTtl:t.tokenTtl,maxWorkers:t.maxWorkers});t.json||(j(`Supervising: ${e}`),j(`harness=${n.harness} budget=${n.maxTokens}tok/${n.maxIterations}it scope=${n.tokenScope} ttl=${n.tokenTtl}m`),console.log());let r=await Vs(e,n,{apiKey:t.apiKey,baseUrl:t.baseUrl,json:t.json});if(t.json){D(r),r.status!==`winner`&&(process.exitCode=1);return}if(console.log(),r.status!==`winner`)throw Error(`Supervisor finished without a winner: ${r.status}`);console.log(r.result),console.log(),N({"Input Tokens":r.tokenUsage.input,"Output Tokens":r.tokenUsage.output,Cost:`$${r.costUsd.toFixed(4)}`})}catch(e){L(e,t.json)}}),e}function Us(){let e=new t(`team`).description(`Manage teams`);return e.command(`list`).description(`List teams for the current account`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async e=>{try{let t=C(e),n=T(t),r=e.json?null:M(`Fetching teams...`);r?.start();let i=await n.teams.list();if(r?.stop(),e.json){D({teams:i,activeTeamId:t.activeTeamId??null});return}E(i.map(e=>({active:e.id===t.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}catch(e){L(e)}}),e.command(`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=t.json?null:M(`Creating team...`);i?.start();let a=await r.teams.create({name:e,orgId:t.orgId});if(t.switch&&Jo(a,n.profile),i?.stop(),t.json){D({team:a,active:!!t.switch});return}O(`Team created: ${Ko(a)}`),t.switch&&O(`Active team set to ${a.name}`)}catch(e){L(e)}}),e.command(`switch <team>`).description(`Set the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=await qo(T(n),e);if(Jo(r,n.profile),t.json){D({team:r,activeTeamId:r.id});return}O(`Active team set to ${Ko(r)}`)}catch(e){L(e)}}),e.command(`current`).description(`Show the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--profile <profile>`,`Credential profile`).action(e=>{try{let t=zt(e.profile);if(e.json){D(t.activeTeamId?t:{activeTeamId:null});return}if(!t.activeTeamId){console.log(`No active team.`);return}N({ID:t.activeTeamId,Name:t.activeTeamName})}catch(e){L(e)}}),e.command(`clear`).description(`Clear the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--profile <profile>`,`Credential profile`).action(e=>{try{if(Yo(e.profile),e.json){D({activeTeamId:null});return}O(`Active team cleared.`)}catch(e){L(e)}}),e.command(`members [team]`).description(`List team members`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile),a=await r.teams.listMembers(i.id);if(t.json){D({team:i,members:a});return}E(a.map(e=>({id:e.id,email:e.customerEmail,role:e.role,status:e.status,joinedAt:e.joinedAt})),[{key:`id`,header:`ID`,width:36},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}catch(e){L(e)}}),e.command(`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile),a=Ws(t.role),o=await r.teams.updateMember(i.id,e,{role:a});if(t.json){D({team:i,member:o});return}O(`Member updated: ${o.customerEmail}`),N({Team:i.name,Role:o.role,Status:o.status})}catch(e){L(e)}}),e.command(`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile),a=Ws(t.role),o=await r.teams.invite(i.id,{email:e,role:a,ttlHours:t.ttlHours?Number.parseInt(t.ttlHours,10):void 0});if(t.json){D({team:i,invitation:o});return}O(`Invitation created for ${o.email}`),N({Team:i.name,Role:o.role,Expires:o.expiresAt,"Invitation ID":o.id}),O(`Re-run with --json to retrieve the invitation token for sharing.`)}catch(e){L(e)}}),e.command(`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile);if(!t.force&&!t.json&&!await V(`Leave team '${i.name}'? (y/N) `))return;if(await r.teams.leave(i.id),n.activeTeamId===i.id&&Yo(n.profile),t.json){D({success:!0,teamId:i.id});return}O(`Left team: ${i.name}`)}catch(e){L(e)}}),e.command(`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=C(n),i=T(r),a=await X(i,t,r.profile);if(!n.force&&!n.json&&!await V(`Transfer ownership of '${a.name}' to ${e}? This cannot be undone without the new owner's cooperation. (y/N) `))return;if(await i.teams.transferOwnership(a.id,e),n.json){D({success:!0,teamId:a.id,newOwnerCustomerId:e});return}O(`Ownership transferred for ${a.name}`)}catch(e){L(e)}}),e.addCommand(Gs()),e.addCommand(Ks()),e.command(`invitations [team]`).description(`List pending and historical team invitations`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile),a=await r.teams.listInvitations(i.id);if(t.json){D({team:i,invitations:a});return}E(a.map(e=>({id:e.id,email:e.email,role:e.role,status:e.status,expiresAt:e.expiresAt})),[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}catch(e){L(e)}}),e.command(`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await r.teams.acceptInvitation(e),a=t.switch===!1?null:await r.teams.get(i.teamId);if(a&&Jo(a,n.profile),t.json){D({member:i,activeTeamId:a?.id??null});return}O(`Invitation accepted for team ${i.teamId}`),a&&O(`Active team set to ${a.name}`)}catch(e){L(e)}}),e.command(`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{if(await T(C(t)).teams.revokeInvitation(e),t.json){D({success:!0,invitationId:e});return}O(`Invitation revoked: ${e}`)}catch(e){L(e)}}),e.command(`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile);if(await r.teams.removeMember(i.id,e),t.json){D({success:!0,teamId:i.id,memberId:e});return}O(`Member removed: ${e}`)}catch(e){L(e)}}),e}function Ws(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function Gs(){let e=new t(`secret`).description(`Manage team secrets`);return e.command(`list [team]`).description(`List team secret names`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile),a=await r.teams.listSecrets(i.id);if(t.json){D({team:i,secrets:a});return}E(a.map(e=>({name:e.name,updatedAt:e.updatedAt,updatedBy:e.updatedBy})),[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}catch(e){L(e)}}),e.command(`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=C(n),i=T(r),a=await X(i,n.team,r.profile),o=await qs({value:t,valueStdin:n.valueStdin,prompt:`Enter value for team secret '${e}': `}),s=await i.teams.upsertSecret(a.id,e,o);if(n.json){D({team:a,secret:s});return}O(`Team secret saved: ${s.name}`)}catch(e){L(e)}}),e.command(`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile);if(!t.force&&!t.json&&!await V(`Delete team secret '${e}' from '${i.name}'? (y/N) `))return;if(await r.teams.deleteSecret(i.id,e),t.json){D({success:!0,teamId:i.id,name:e});return}O(`Team secret deleted: ${e}`)}catch(e){L(e)}}),e.command(`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile),a=await r.teams.revealSecret(i.id,e);if(t.json){D({teamId:i.id,...a});return}console.log(a.value)}catch(e){L(e)}}),e}function Ks(){let e=new t(`templates`).description(`Manage team golden-path templates`);return e.command(`list [team]`).description(`List a team's golden-path templates`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile),a=await r.teams.listTemplates(i.id);if(t.json){D({team:i,templates:a});return}if(a.length===0){console.log(`No templates yet for ${i.name}.`);return}E(a.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}catch(e){L(e)}}),e.command(`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=C(n),i=T(r),a=await X(i,n.team,r.profile),o;if(n.config)try{let e=JSON.parse(n.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);o=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let s=await i.teams.createTemplate(a.id,{name:e,snapshotId:t,description:n.description,environment:n.environment,config:o});if(n.json){D({team:a,template:s});return}O(`Team template created: ${s.name} (${s.id})`)}catch(e){L(e)}}),e.command(`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile);if(!t.force&&!t.json&&!await V(`Delete template '${e}' from '${i.name}'? (y/N) `))return;if(await r.teams.deleteTemplate(i.id,e),t.json){D({success:!0,teamId:i.id,templateId:e});return}O(`Team template deleted: ${e}`)}catch(e){L(e)}}),e}async function qs(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);if(e.value!==void 0){if(e.value.length===0)throw Error(`Secret value cannot be empty`);return e.value}if(e.valueStdin){let e=await Ln();if(e.length===0)throw Error(`Secret value from stdin cannot be empty`);return e}let t=await In(e.prompt);if(t.length===0)throw Error(`Secret value cannot be empty`);return t}function Js(){let e=new t(`template`).description(`Manage published public templates`);return e.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C(e)),n=e.featured?await t.publicTemplates.featured():await t.publicTemplates.list({query:e.query,tag:e.tag});if(e.json){D({templates:n});return}E(n.map(e=>({slug:e.slug,name:e.name,forks:e.forkCount,sandboxes:e.sandboxCount,updated:e.updatedAt})),[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forks`,header:`Forks`,width:8},{key:`sandboxes`,header:`Sandboxes`,width:12},{key:`updated`,header:`Updated`,width:24}])}catch(e){L(e)}}),e.command(`get <id-or-slug>`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await T(C(t)).publicTemplates.get(e);if(t.json){D({template:n});return}D(n)}catch(e){L(e)}}),e.command(`versions <id-or-slug>`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await T(C(t)).publicTemplates.versions(e);if(t.json){D({versions:n});return}E(n.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`snapshotId`,header:`Snapshot`,width:20},{key:`createdAt`,header:`Created`,width:24}])}catch(e){L(e)}}),e.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=await T(C(r)).publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom});if(r.json){D({template:i});return}O(`Published template: ${i.slug}`)}catch(e){L(e)}}),e.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=await T(C(r)).publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes});if(r.json){D({version:i});return}O(`Published template version: ${i.id}`)}catch(e){L(e)}}),e}function Ys(){let e=new t(`tools`).description(`Manage language runtimes and tools in a sandbox (via mise)`);return e.command(`list`).alias(`ls`).description(`List installed tools in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching tools...`);t.json||i.start();let a=await(await z(r,n,e)).tools.list();i.stop(),t.json?D(a):a.length===0?console.log(`No tools installed`):I([`Tool`,`Version`,`Active`],a.map(e=>[e.name,e.version,e.active?`yes`:`no`]))}catch(e){L(e)}}),e.command(`install`).description(`Install a tool version`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name (e.g. node, python, go)`).argument(`<version>`,`Version to install (e.g. 20, 3.12, latest)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=C({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=T(i),o=M(`Installing ${t}@${n}...`);r.json||o.start(),await(await z(a,i,e)).tools.install(t,n),o.stop(),r.json?D({tool:t,version:n,installed:!0}):O(`Installed ${t}@${n}`)}catch(e){L(e)}}),e.command(`use`).description(`Activate a tool version for the current session`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name`).argument(`<version>`,`Version to activate`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=C({apiKey:r.apiKey,baseUrl:r.baseUrl});await(await z(T(i),i,e)).tools.use(t,n),O(`Activated ${t}@${n}`)}catch(e){L(e)}}),e.command(`run`).description(`Run a command with a specific tool`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name`).argument(`<args...>`,`Command arguments`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=C({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=T(i),o=M(`Running ${t} ${n.join(` `)}...`);r.json||o.start();let s=await(await z(a,i,e)).tools.run(t,n);o.stop(),r.json?D(s):(s.stdout&&process.stdout.write(s.stdout),s.stderr&&process.stderr.write(s.stderr),s.exitCode!==0&&process.exit(s.exitCode))}catch(e){L(e)}}),e}function Xs(){let e=new t(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return e.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async e=>{try{let t={from:e.from,to:e.to,model:e.model,runId:e.run,status:e.status===void 0?void 0:sc(e.status),q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:fc(e.limit)},n=Qs(e),r=e.json?null:M(`Fetching traces...`);r?.start();let i=await n.listTraces(t);if(r?.stop(),e.json)return D(i);tc(i.items),ac(i.nextCursor)}catch(t){ec(t,e)}}),e.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async(e,t)=>{try{let n=Qs(t);if(t.ndjson){await $s(n,e);return}let r=t.json?null:M(`Fetching trace spans...`);r?.start();let i=await n.getTraceSpans(e,{cursor:t.cursor,limit:t.limit===void 0?void 0:fc(t.limit)});if(r?.stop(),t.json)return D(i);nc(i.items),i.truncated&&N({Spans:`${i.items.length} of ${i.total} (truncated)`}),ac(i.nextCursor)}catch(e){ec(e,t)}}),e.addCommand(Zs()),e}function Zs(){let e=new t(`runs`).description(`Read eval-runs pivoted off the trace surface`);return e.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async e=>{try{let t={status:e.status===void 0?void 0:lc(e.status),gate:e.gate===void 0?void 0:dc(e.gate),label:e.label,from:e.from,to:e.to,q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:fc(e.limit)},n=Qs(e),r=e.json?null:M(`Fetching runs...`);r?.start();let i=await n.listRuns(t);if(r?.stop(),e.json)return D(i);rc(i.items),ac(i.nextCursor)}catch(t){ec(t,e)}}),e.command(`get <runId>`).description(`Show a single eval-run`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async(e,t)=>{try{let n=Qs(t),r=t.json?null:M(`Fetching run...`);r?.start();let i=await n.getRun(e);if(r?.stop(),t.json)return D(i);ic(i)}catch(e){ec(e,t)}}),e}function Qs(e){let t=Ft(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return Re({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function $s(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function ec(e,t){return L(e,t.json===!0)}function tc(e){E(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:oc(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function nc(e){E(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function rc(e){E(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function ic(e){N({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function ac(e){e&&N({"Next page":`--cursor ${e}`})}function oc(e){return e===null?`-`:`$${e.toFixed(4)}`}function sc(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const cc=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function lc(e){let t=cc.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${cc.join(`, `)}`)}const uc=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function dc(e){let t=uc.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${uc.join(`, `)}`)}function fc(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function pc(){return new t(`usage`).description(`Show account usage and billing information`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=e.json?null:M(`Fetching usage...`);n?.start();let[r,i]=await Promise.all([t.usage(),t.subscription().catch(()=>null)]);n?.stop(),e.json?D({...r,subscription:i}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),N({"Active Sandboxes":r.activeSandboxes,"Total Sandboxes":r.totalSandboxes,"Compute Minutes":mc(r.computeMinutes),"GPU Seconds":r.gpuSeconds,"GPU Spend":hc(r.gpuCostUsd)}),i&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),N({Plan:i.plan,Status:i.status,"Credits Available":hc(i.creditsAvailableUsd),"Credits Used":hc(i.creditsUsedUsd),"Monthly Balance":hc(i.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),N({Start:r.periodStart.toLocaleDateString(),End:r.periodEnd.toLocaleDateString()}),console.log())}catch(e){L(e)}})}function mc(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function hc(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function gc(){return new t(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{try{if(t.clear){Ot(),j(`Cleared the active sandbox.`);return}if(e){Dt(e),j(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=Et();j(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")}catch(e){L(e)}})}const _c=1e3;function vc(){let e=new t(`workflows`).description(`Create and manage Tangle workflows`);e.option(`--json`,`Output as JSON`),e.hook(`preAction`,(e,t)=>{xc(t)}),e.command(`list`).description(`List your workflows`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await Z(e).workflows.list();if(e.json)return D(t);Cc(t)}catch(t){Q(t,e)}}),e.command(`fleet`).description(`Fleet overview: every workflow's run tallies over a trailing window, failing-first`).option(`--window <window>`,`Trailing window: 24h, 7d, or 30d`,`7d`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await Z(e).workflows.fleetInsights({window:e.window});if(e.json)return D(t);wc(t)}catch(t){Q(t,e)}}),e.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--yaml`,`Print only the raw definition YAML (the export path — pipe to a file)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await Z(t).workflows.get(e);if(t.yaml){if(n.definitionYaml===null)throw Error(`Workflow ${n.id} has no stored definition YAML to export`);process.stdout.write(n.definitionYaml.endsWith(`
|
|
147
|
-
`)?n.definitionYaml:`${n.definitionYaml}\n`);return}if(t.json)return D(n);Tc(n)}catch(e){Q(e,t)}}),e.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=bc(e),r=await Z(t).workflows.create(n);if(t.json)return D(r);j(`Created workflow ${r.id} (${r.name}).`),Tc(r)}catch(e){Q(e,t)}}),e.command(`apply`).description(`Create or update a workflow idempotently, matched by the definition's name`).argument(`<file>`,`Path to the workflow YAML`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=bc(e),r=Z(t),i=await r.workflows.validate(n,{structural:!0});if(!i.valid){if(process.exitCode=1,t.json)return D(i);j(`Invalid workflow:`);for(let e of i.errors)console.log(` ${e.path}: ${e.message}`);return}let a=(await r.workflows.list()).find(e=>e.name===i.name);if(a){let e=await r.workflows.update(a.id,n);if(t.json)return D({action:`updated`,workflow:e});j(`Updated workflow ${e.id} (${e.name}) — matched by name.`),Tc(e);return}let o=await r.workflows.create(n);if(t.json)return D({action:`created`,workflow:o});j(`Created workflow ${o.id} (${o.name}).`),Tc(o)}catch(e){Q(e,t)}}),e.command(`update`).description(`Replace a workflow's definition from a YAML file`).argument(`<id>`,`Workflow ID`).argument(`<file>`,`Path to the workflow YAML`).option(`--note <note>`,`Revision note recorded on the appended revision (why this change)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=bc(t),i=await Z(n).workflows.update(e,r,{...n.note===void 0?{}:{note:n.note}});if(n.json)return D(i);j(`Updated workflow ${i.id} (${i.name}).`),Tc(i)}catch(e){Q(e,n)}}),e.command(`delete`).description(`Delete a workflow and its triggers`).argument(`<id>`,`Workflow ID`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(!t.force&&!await V(`Delete workflow ${e}? `)){j(`Delete cancelled.`);return}if(await Z(t).workflows.delete(e),t.json)return D({deleted:!0,id:e});j(`Deleted workflow ${e}.`)}catch(e){Q(e,t)}}),e.command(`validate`).description(`Validate a workflow YAML file without saving it`).argument(`<file>`,`Path to the workflow YAML`).option(`--structural`,`CI mode: compile + capability checks only, no connection resolution — the verdict is the same regardless of connected providers`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=bc(e),r=await Z(t).workflows.validate(n,{...t.structural?{structural:!0}:{}});if(t.json)return D(r);if(r.valid)j(`Valid: ${r.name} (${r.actionCount} action(s), ${r.triggerCount} trigger(s)).`);else{j(`Invalid workflow:`);for(let e of r.errors)console.log(` ${e.path}: ${e.message}`);process.exitCode=1}}catch(e){Q(e,t)}}),e.command(`schema`).description(`Print the JSON Schema for the workflow YAML`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{D(await Z(e).workflows.schema())}catch(t){Q(t,e)}}),e.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,Ec,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Dc(t.input),r=t.timeout===void 0?void 0:G(t.timeout,`--timeout`),i=t.pollInterval===void 0?void 0:G(t.pollInterval,`--poll-interval`),a=Z(t),{runId:o}=await a.workflows.run(e,n);if(!t.wait){if(t.json)return D({runId:o});j(`Started run ${o} for workflow ${e}.`),j(`Inspect it with: tangle workflows run-detail ${e} ${o}`);return}let s=t.json?null:M(`Waiting for run ${o} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),t.json)return D(c);kc(c)}catch(e){Q(e,t)}}),e.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Z(t),r=t.limit===void 0?void 0:G(t.limit,`--limit`);if(t.all){let i=[],a=t.cursor,o=0,s=null;for(;;){let c=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...a===void 0?{}:{cursor:a}});if(i.push(...c.runs),o+=1,!c.nextCursor)break;if(o>=_c){s=c.nextCursor,t.json||j(`Stopped after ${_c} pages (${i.length} runs); more may exist — resume with --cursor ${c.nextCursor}`);break}a=c.nextCursor}if(t.json)return D({runs:i,nextCursor:s});Oc(i);return}let i=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...t.cursor===void 0?{}:{cursor:t.cursor}});if(t.json)return D(i);Oc(i.runs),i.nextCursor&&j(`More runs available — next page: --cursor ${i.nextCursor}`)}catch(e){Q(e,t)}}),e.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.getRun(e,t);if(n.json)return D(r);kc(r)}catch(e){Q(e,n)}}),e.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.cancel(e,t);if(n.json)return D(r);Ac(r)}catch(e){Q(e,n)}}),e.command(`retry`).description(`Re-run a failed or cancelled run (a fresh run with the same trigger context)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID of the failed/cancelled run to retry`).option(`--wait`,`Wait for the new run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=n.timeout===void 0?void 0:G(n.timeout,`--timeout`),i=n.pollInterval===void 0?void 0:G(n.pollInterval,`--poll-interval`),a=Z(n),o=await a.workflows.retryRun(e,t);if(!n.wait){if(n.json)return D(o);j(`Started run ${o.runId} (retry of ${t}).`),j(`Inspect it with: tangle workflows run-detail ${e} ${o.runId}`);return}let s=n.json?null:M(`Waiting for run ${o.runId} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o.runId,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),n.json)return D(c);kc(c)}catch(e){Q(e,n)}}),e.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Emit each event as a JSON line`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=Z(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):jc(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)}catch(e){Q(e,n)}}),e.command(`enable`).description(`Enable a workflow so its triggers and manual runs fire`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await yc(e,!0,t)}),e.command(`disable`).description(`Disable a workflow (pause its triggers and manual runs)`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await yc(e,!1,t)}),e.command(`templates`).description(`List the curated starter workflow templates`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await Z(e).workflows.listTemplates();if(e.json)return D(t);Fc(t)}catch(t){Q(t,e)}}),e.command(`init`).description(`Create a workflow from a gallery template and print (or save) its YAML`).argument(`<template-id>`,"Template ID from `workflows templates`").option(`--param <key=value>`,`Template parameter value. Repeatable.`,Ec,[]).option(`--file <out>`,`Write the instantiated workflow YAML to this file instead of stdout`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Dc(t.param,`param`)??{},r=await Z(t).workflows.instantiateTemplate(e,n);if(t.json)return D(r);if(!r.created){j(`Template ${e} needs provider connections before it can run:`);for(let e of r.connectionRequirements)console.log(` ${e.connected?`✓`:`✗`} ${Ic(e,r.connectionRequirements)}`);process.exitCode=1;return}let{workflow:i}=r;if(i.definitionYaml===null)throw Error(`Workflow ${i.id} was created but the server returned no definition YAML`);if(j(`Created workflow ${i.id} (${i.name}).`),t.file){Pc(t.file,i.definitionYaml),j(`Wrote ${t.file}.`);return}process.stdout.write(i.definitionYaml.endsWith(`
|
|
148
|
-
`)?i.definitionYaml:`${i.definitionYaml}\n`)}catch(e){Q(e,t)}}),e.command(`revisions`).description(`List a workflow's definition revision history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`
|
|
149
|
-
`)?i.yaml:`${i.yaml}\n`)}catch(e){Q(e,n)}}),e.command(`rollback`).description(`Restore a prior revision's definition as a NEW head revision (re-validated)`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number to restore`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=G(t,`<rev>`),i=await Z(n).workflows.rollback(e,r);if(n.json)return D(i);j(`Rolled back workflow ${i.id} to rev ${r}.`),Tc(i)}catch(e){Q(e,n)}});let n=e.command(`kv`).description(`Read and write a workflow's cross-run KV state`);return n.command(`list`).description(`List every KV entry of a workflow`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await Z(t).workflows.listKv(e);if(t.json)return D(n);Rc(n.entries)}catch(e){Q(e,t)}}),n.command(`get`).description(`Show one KV entry (value and version)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.getKv(e,t);if(n.json)return D(r);zc(r)}catch(e){Q(e,n)}}),n.command(`set`).description(`Write a KV entry from a JSON value`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).argument(`<json>`,`Value as JSON (e.g. '{"cursor":123}' or '"abc"')`).option(`--cas <version>`,`Compare-and-swap: write only if the stored version still equals this`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=Nc(n,`<json>`),a=r.cas===void 0?void 0:G(r.cas,`--cas`),o=Z(r),s=a===void 0?await o.workflows.putKv(e,t,i):await o.workflows.casKv(e,t,a,i);if(r.json)return D(s);zc(s)}catch(e){Q(e,r)}}),n.command(`delete`).description(`Delete a KV entry (idempotent)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.deleteKv(e,t);if(n.json)return D(r);j(r.deleted?`Deleted KV entry "${t}" of workflow ${e}.`:`No KV entry "${t}" on workflow ${e}.`)}catch(e){Q(e,n)}}),e.command(`artifacts`).description(`List a run's artifact metadata (never the bytes)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.listArtifacts(e,t);if(n.json)return D(r);Bc(r.artifacts)}catch(e){Q(e,n)}}),e.command(`artifact-download`).description(`Download one run artifact's bytes to a file`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).argument(`<artifactId>`,`Artifact ID`).option(`--out <file>`,`Destination file (defaults to the artifact ID)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=await Z(r).workflows.downloadArtifact(e,t,n),a=r.out??n;try{f(a,i.bytes)}catch(e){throw Error(`Could not write artifact to "${a}": ${e instanceof Error?e.message:String(e)}`)}if(r.json)return D({file:a,contentType:i.contentType,bytes:i.bytes.length});j(`Wrote ${a} (${i.bytes.length} bytes, ${i.contentType}).`)}catch(e){Q(e,r)}}),e.command(`decisions`).description(`List a workflow's pending human decisions`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=(await Z(t).workflows.listPendingDecisions()).decisions.filter(t=>t.workflowId===e);if(t.json)return D({decisions:n});Vc(n)}catch(e){Q(e,t)}}),e.command(`decision-resolve`).description(`Answer the decision a run is parked on and resume it`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).requiredOption(`--choice <choice>`,`The option to resolve with (one of the decision's options)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=Z(n),i=await r.workflows.getRunDecision(e,t),a=await r.workflows.resolveRunDecision(e,t,{decisionId:i.id,choice:n.choice});if(n.json)return D(a);if(a.resumed){j(`Resolved decision ${a.decisionId} with "${a.choice}" — run ${a.runId} resumed.`);return}j(`Resolved decision ${a.decisionId} with "${a.choice}", but run ${a.runId} had already finished — nothing to resume.`)}catch(e){Q(e,n)}}),e}async function yc(e,t,n){try{let r=await Z(n).workflows.setEnabled(e,t);if(n.json)return D(r);j(`${t?`Enabled`:`Disabled`} workflow ${r.id}.`),Tc(r)}catch(e){Q(e,n)}}function bc(e){try{return u(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function Z(e){let t=C({apiKey:Ft(e.apiKey),baseUrl:e.baseUrl??Rt(process.env.TANGLE_HUB_URL)});return new xe({baseUrl:t.baseUrl,apiKey:t.apiKey})}function xc(e){if(!Sc(e,`json`)||e.getOptionValue(`json`)!==void 0)return;let t=e.parent;for(;t;){let n=t.getOptionValue(`json`);if(n!==void 0){e.setOptionValue(`json`,n);return}t=t.parent}}function Sc(e,t){return e.options.some(e=>e.attributeName()===t)}function Q(e,t){return L(e,t.json===!0)}function Cc(e){E(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function wc(e){let t=e.workflows.filter(e=>e.failed>0).length,n=e.workflows.filter(e=>e.failed===0&&e.waiting>0).length,r=e.workflows.filter(e=>e.failed===0&&e.waiting===0&&e.runsInWindow>0).length;j(`${t} failing · ${n} waiting · ${r} healthy · ${e.workflows.length} total over ${e.window}`),E(e.workflows.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,runs:e.runsInWindow,failed:e.failed,waiting:e.waiting,success:e.successRate===null?`—`:`${Math.round(e.successRate*100)}%`,lastRun:e.lastRunStatus??`—`,lastRunAt:e.lastRunAt??`—`})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`runs`,header:`Runs`},{key:`failed`,header:`Failed`},{key:`waiting`,header:`Waiting`},{key:`success`,header:`Success`},{key:`lastRun`,header:`Last Run`},{key:`lastRunAt`,header:`Last Run At`}])}function Tc(e){if(N({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(j(`Triggers`),Mc(e.triggers)),e.validationErrors.length>0){j(`Validation issues`);for(let t of e.validationErrors)console.log(` ${t.path}: ${t.message}`)}}function Ec(e,t){return[...t,e]}function Dc(e,t=`input`){if(!e||e.length===0)return;let n={};for(let r of e){let e=r.indexOf(`=`);if(e<=0)throw Error(`Invalid --${t} "${r}": expected key=value (e.g. pull_request.number=123)`);n[r.slice(0,e)]=r.slice(e+1)}return n}function Oc(e){E(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function kc(e){if(N({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0){j(`Actions`);let t=e.actionResults.some(e=>e.nodeId!==void 0||e.visit!==void 0);E(e.actionResults.map(e=>({index:e.index,...t?{node:e.nodeId??``,visit:e.visit??``}:{},kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},...t?[{key:`node`,header:`Node`},{key:`visit`,header:`Visit`}]:[],{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}])}e.graph&&(j(`Graph`),N({Nodes:e.graph.nodes.length,Edges:e.graph.edges.length,"Max node visits":e.graph.maxNodeVisits}),E(e.graph.edges.map(e=>({from:e.from,to:e.to,guard:e.when===void 0?``:JSON.stringify(e.when)})),[{key:`from`,header:`From`},{key:`to`,header:`To`},{key:`guard`,header:`Guard`}])),e.edgeVerdicts&&e.edgeVerdicts.length>0&&(j(`Edge verdicts`),E(e.edgeVerdicts.flatMap(e=>Object.entries(e.verdicts).map(([t,n])=>({node:e.nodeId,edge:t,verdict:n?`taken`:`not taken`}))),[{key:`node`,header:`Node`},{key:`edge`,header:`Edge`},{key:`verdict`,header:`Verdict`}]))}function Ac(e){if(e.status===`cancelled`){j(`Cancelled run ${e.runId}.`);return}if(e.signalled){j(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}j(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function jc(e){switch(e.type){case`snapshot`:j(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(` · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(` · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function Mc(e){E(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function Nc(e,t){try{return JSON.parse(e)}catch{throw Error(`Invalid ${t}: not valid JSON`)}}function Pc(e,t){try{f(e,t,`utf8`)}catch(t){throw Error(`Could not write workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function Fc(e){E(e.map(e=>({id:e.id,name:e.name,category:e.category,providers:e.providers.join(`, `),summary:e.summary})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`category`,header:`Category`},{key:`providers`,header:`Providers`},{key:`summary`,header:`Summary`}])}function Ic(e,t){let n=e.kind===`github_app`,r=n?`${e.provider} (App installation)`:e.provider,i=e.connectUrl?` — ${n?`install`:`connect`}: ${e.connectUrl}`:``,a=e.prerequisite;return`${r}${i}${a&&t.some(e=>e.provider===a.provider&&e.kind===a.kind&&!e.connected)?` (after connecting ${a.provider})`:``}`}function Lc(e){E(e.map(e=>({rev:e.rev,created:e.createdAt,by:e.createdBy,source:e.source,note:e.note??``})),[{key:`rev`,header:`Rev`},{key:`created`,header:`Created`},{key:`by`,header:`Created By`},{key:`source`,header:`Source`},{key:`note`,header:`Note`}])}function Rc(e){E(e.map(e=>({key:e.key,version:e.version,updated:e.updatedAt})),[{key:`key`,header:`Key`},{key:`version`,header:`Version`},{key:`updated`,header:`Updated`}])}function zc(e){N({Key:e.key,Version:e.version,Updated:e.updatedAt}),j(`Value`),D(e.value)}function Bc(e){E(e.map(e=>({id:e.id,node:e.nodeId,name:e.name,type:e.contentType,bytes:e.byteSize,created:e.createdAt})),[{key:`id`,header:`ID`},{key:`node`,header:`Node`},{key:`name`,header:`Name`},{key:`type`,header:`Content Type`},{key:`bytes`,header:`Bytes`},{key:`created`,header:`Created`}])}function Vc(e){E(e.map(e=>({id:e.id,run:e.runId,title:e.title,options:e.options.join(`, `),requested:e.requestedAt,expires:e.expiresAt??``})),[{key:`id`,header:`ID`},{key:`run`,header:`Run`},{key:`title`,header:`Title`},{key:`options`,header:`Options`},{key:`requested`,header:`Requested`},{key:`expires`,header:`Expires`}])}function Hc(e){let t={...Uc(e)??{},...e.optsWithGlobals()};for(let n of e.options){let r=n.attributeName();e.getOptionValue(r)===void 0&&t[r]!==void 0&&e.setOptionValue(r,t[r])}}function Uc(e){let t=e;for(;t?.parent;)t=t.parent;return t?t.opts():void 0}const Wc=e(import.meta.url)(`../package.json`),$=new t;$.name(`tangle`).description(`CLI for Tangle Sandbox operations`).version(Wc.version??`0.0.0`).option(`--api-key <key>`,`API key (or set TANGLE_API_KEY)`).option(`--base-url <url>`,`API base URL`),$.hook(`preAction`,(e,t)=>{Hc(t)}),$.addCommand(vr()),$.addCommand(Qo()),$.addCommand(gc()),$.addCommand(us()),$.addCommand(Fo()),$.addCommand(Sa()),$.addCommand(Cs()),$.addCommand(ws()),$.addCommand(Es()),$.addCommand(er()),$.addCommand(ps()),$.addCommand(Ma()),$.addCommand(pc()),$.addCommand(Us()),$.addCommand(Js()),$.addCommand(Lo()),$.addCommand(Tr()),$.addCommand(Ir()),$.addCommand(zo()),$.addCommand(Ua()),$.addCommand(Ka()),$.addCommand(qa()),$.addCommand(vc()),$.addCommand(xa()),$.addCommand(Ys()),$.addCommand(ls()),$.addCommand(fs()),$.addCommand(Lr()),$.addCommand(Ro()),$.addCommand(_o()),$.addCommand(sa()),$.addCommand(ca()),$.addCommand(Go()),$.addCommand(Io()),$.addCommand(Xs()),$.addCommand(Hs()),$.parseAsync(process.argv).catch(e=>{console.error(`Fatal error:`,e.message),process.exit(1)});export{};
|
|
139
|
+
`)?`${e}\n`:`${e}\n\n`}function Zi(e){let t=[],n={header:null,body:[]};for(let r of e.split(`
|
|
140
|
+
`))Qi(r)?(t.push(n),n={header:r.trim(),body:[]}):n.body.push(r);return t.push(n),t.length>1&&t[0].header===null&&t[0].body.every(e=>e.trim()===``)&&t.shift(),t}function Qi(e){let t=e.trim();return t.startsWith(`[`)&&t.endsWith(`]`)&&!t.includes(`=`)||t.startsWith(`[[`)&&t.endsWith(`]]`)}function $i(e){let t=[];for(let n of e)n.header!==null&&t.push(n.header),t.push(...n.body);return t.join(`
|
|
141
|
+
`)}function ea(e){return[{key:`environment`,line:`environment = "prod"`},{key:`log_user_prompt`,line:`log_user_prompt = true`},{key:`exporter`,line:`exporter = { otlp-http = { endpoint = "${U(e.endpoint)}/v1/logs", protocol = "json", headers = { "Authorization" = "Bearer ${e.apiKey??"${TANGLE_API_KEY}"}" } } }`}]}function ta(e){let t=e.trim();if(t===``||t.startsWith(`#`))return null;let n=t.indexOf(`=`);if(n===-1)return null;let r=t.slice(0,n).trim();return/^[A-Za-z0-9_-]+$/.test(r)?r:null}function na(e,t){let n=ea(t),r=new Set(n.map(e=>e.key));if(e.trim()===``)return{contents:`${[`[otel]`,...n.map(e=>e.line)].join(`
|
|
142
|
+
`)}\n`,changed:!0};let i=Zi(e),a=i.find(e=>e.header===`[otel]`);if(!a){let t={header:`[otel]`,body:n.map(e=>e.line)},r=i[i.length-1];r&&!ra(r)&&r.body.push(``),i.push(t);let a=ia($i(i));return{contents:a,changed:a!==ia(e)}}let o=a.body.filter(e=>{let t=ta(e);return t===null||!r.has(t)}),s=[];for(;o.length>0&&o[o.length-1].trim()===``;)s.unshift(o.pop());a.body=[...o,...n.map(e=>e.line),...s];let c=ia($i(i));return{contents:c,changed:c!==ia(e)}}function ra(e){return e.body.length>0&&e.body[e.body.length-1].trim()===``}function ia(e){return e.endsWith(`
|
|
143
|
+
`)?e:`${e}\n`}function aa(e){switch(e){case`claude-code`:return`Claude Code: set OTEL_LOGS_EXPORTER=otlp and the four OTEL_LOG_* gates (OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_TOOL_CONTENT, OTEL_LOG_RAW_API_BODIES).`;case`codex`:return`Codex: set log_user_prompt = true in [otel] (default false redacts content).`;case`opencode`:return`OpenCode: a standalone install emits nothing without the tangle-opencode-exporter shim; inside a Tangle sandbox it is already instrumented.`;case`openclaw`:case`hermes`:case`nanoclaw`:return`${zi[e]}: no native OTLP exporter and no standalone server to subscribe to — run it inside a Tangle sandbox, where the sidecar adapter exports its content with gen_ai.system=${e}. A bare standalone install emits metadata only.`}}function oa(){let e=process.env.SHELL??``;return e.includes(`zsh`)?h(ge(),`.zshrc`):e.includes(`bash`)?h(ge(),`.bashrc`):h(ge(),`.zshrc`)}function sa(e){return c(e)?u(e,`utf8`):``}function ca(e,t){l(ee(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;f(n,t,{mode:384}),s(n,384),d(n,e)}function la(){return new t(`connect`).description(`Connect a local coding agent's telemetry to Tangle Intelligence, content on (for SDK integration snippets, see 'tangle agent connect')`).argument(`[agent]`,`claude-code | codex | opencode | openclaw | hermes | nanoclaw`).option(`--api-key <key>`,`Tangle API key (or set TANGLE_API_KEY)`).option(`--endpoint <url>`,`OTLP endpoint base`,Vr).option(`-p, --project <key>`,`Project label (tangle.subject.key) to group runs; omit to set it yourself`).option(`--rc <path>`,`Shell rc file to append the Claude Code env block to`).option(`--no-write`,`Print the config instead of writing files (Claude Code / Codex)`).option(`--inline-key`,"Embed the resolved API key literally in the config (default: keep ${TANGLE_API_KEY})").option(`--verify`,`Poll onboarding status and report whether CONTENT is flowing`).option(`--timeout <seconds>`,`Verify poll timeout in seconds`,`120`).option(`--run`,`OpenCode only: run the content exporter against a live OpenCode server until interrupted`).option(`--opencode-url <url>`,`OpenCode server base URL for --run (or set OPENCODE_BASE_URL)`).option(`--format <kind>`,`Claude Code output: shell (export block) | env (.env / docker --env-file) | dockerfile (ENV lines). env/dockerfile are the cron/container path — printed to stdout, no shell-rc edit, no TTY`,`shell`).option(`--content <tier>`,`Claude Code content tier: full (everything) | prompts (task+prompts+tool-args) | metadata (telemetry on, content off)`,`full`).action(async(e,t)=>{try{let n=U(t.endpoint);if(t.run){if((e?da(e):`opencode`)!==`opencode`)throw Error(`--run is OpenCode-only: it runs the content exporter against a live OpenCode server. Other agents export natively once configured.`);await ya({endpoint:n,apiKey:Ui(t.apiKey),opencodeUrl:t.opencodeUrl});return}if(t.verify){await ba({endpoint:n,apiKey:Ui(t.apiKey),agent:e?da(e):void 0,timeoutSeconds:G(t.timeout,`--timeout`)});return}let r=e?da(e):await ma(),i=t.inlineKey?Ui(t.apiKey):void 0;r===`claude-code`?await ha({endpoint:n,apiKey:i,projectKey:t.project,rcPath:t.rc,write:t.write!==!1,content:pa(t.content),format:fa(t.format)}):r===`codex`?ga({endpoint:n,apiKey:i,projectKey:t.project,write:t.write!==!1}):r===`opencode`?_a({endpoint:n}):va(r,{endpoint:n}),console.log(),j(`Run your agent on a real task, then verify content is flowing: tangle connect ${r} --verify`)}catch(e){L(e)}})}function ua(){return new t(`opencode-exporter`).description(`Export a running OpenCode's content to Tangle Intelligence (standalone shim)`).option(`--api-key <key>`,`Tangle API key (or set TANGLE_API_KEY)`).option(`--endpoint <url>`,`OTLP endpoint base`,Vr).option(`--opencode-url <url>`,`OpenCode server base URL (or set OPENCODE_BASE_URL)`).action(async e=>{try{await ya({endpoint:U(e.endpoint),apiKey:Ui(e.apiKey),opencodeUrl:e.opencodeUrl})}catch(e){L(e)}})}function da(e){if(Hi(e))return e;throw Error(`Unknown agent '${e}'. Choose one of: ${Ri.join(`, `)}`)}function fa(e){if(e===`shell`||e===`env`||e===`dockerfile`)return e;throw Error(`--format must be one of: shell, env, dockerfile (got '${e}')`)}function pa(e){if(e===`full`||e===`prompts`||e===`metadata`)return e;throw Error(`--content must be one of: full, prompts, metadata (got '${e}')`)}async function ma(){if(!process.stdin.isTTY)throw Error(`Specify an agent: tangle connect <${Ri.join(`|`)}>`);console.log(`Which coding agent are you connecting?`),Ri.forEach((e,t)=>{console.log(` ${t+1}) ${zi[e]} (${e})`)});let e=await H(`Enter a number or name`,`1`);return Ri[Number.parseInt(e,10)-1]||da(e.trim())}async function ha(e){let t=qi({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format});if(console.log(t),e.format!==`shell`){console.log(),j(e.format===`env`?"Cron/container path: feed these to your service env (.env, `docker run --env-file`, k8s envFrom). No shell-rc edit, no TTY needed.":`Dockerfile path: paste these ENV lines into your image. No shell-rc edit, no TTY needed.`);return}if(console.log(),j(`Privacy tiers: --content full ships the whole conversation; --content prompts keeps task, prompts, and tool args only; --content metadata turns content off (telemetry still flows). Secrets are scrubbed server-side regardless.`),!e.write)return;let n=e.rcPath??oa(),r=process.stdin.isTTY?await H(`Append this idempotent block to ${n}? (y/N)`,`n`):`n`;if(r.toLowerCase()!==`y`&&r.toLowerCase()!==`yes`){console.log(),j(`Not writing. To append later: tangle connect claude-code --rc ${n}`);return}let i=Ji({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format}),{contents:a,changed:o}=Yi(sa(n),i);if(!o){console.log(),O(`Already present in ${n} — nothing to change.`);return}ca(n,a),console.log(),O(`Wrote Tangle Intelligence env block to ${n}.`),j(`Reload your shell (e.g. 'source ${n}') before running the agent.`)}function ga(e){let t=h(ge(),`.codex`,`config.toml`),{contents:n,changed:r}=na(sa(t),{endpoint:e.endpoint,apiKey:e.apiKey});if(!e.write){console.log(n.trimEnd());return}if(!r){O(`${t} already has the Tangle [otel] block — nothing to change.`);return}ca(t,n),O(`Merged the Tangle [otel] block into ${t}.`),j("Codex emits content on the logs signal (codex.* events). Set TANGLE_API_KEY in your env before running if you kept the ${TANGLE_API_KEY} reference."),j(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=${e.projectKey??`<your project>`} before running codex.`)}function _a(e){let t=U(e.endpoint);A(`OpenCode has no native OTel exporter, so a standalone install emits nothing without a shim.`),console.log(),N({"Inside a Tangle sandbox":`already instrumented — our adapter exports OpenCode's event-stream content. Nothing to do.`,Standalone:`run 'tangle connect opencode --run' alongside a running OpenCode, exporting to ${t}.`}),console.log(),j(`Start OpenCode in server mode ('opencode serve'), then in another terminal run: tangle connect opencode --run`),j(`The exporter subscribes to OpenCode's SSE event bus and exports content-bearing OTLP (prompt/completion/tool content) to Tangle. Verify with: tangle connect opencode --verify`),j(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting the exporter.`)}function va(e,t){let n=U(t.endpoint),r=zi[e];A(`${r} has no native OTel exporter, so a standalone install emits nothing without instrumentation.`),console.log(),N({"Inside a Tangle sandbox":`already instrumented — the sidecar adapter exports ${r}'s prompt/completion/tool content (gen_ai.system=${e}) to ${n}. Nothing to do.`,Standalone:`${r} exposes no OTLP and no event-bus server; run it inside a Tangle sandbox to capture content.`}),console.log(),j(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting ${r}.`),j(`Verify content is flowing: tangle connect ${e} --verify`)}async function ya(e){let t=Ni(e.opencodeUrl),n=new AbortController,r=()=>n.abort();process.on(`SIGINT`,r),process.on(`SIGTERM`,r),j(`Subscribing to OpenCode at ${t} — exporting content to Tangle.`),j(`Run OpenCode tasks now. Press Ctrl-C to stop.`),console.log();let i=0,a;try{a=await Li({endpoint:e.endpoint,apiKey:e.apiKey,opencodeBaseUrl:t,signal:n.signal,onExport:({eventType:e,records:t})=>{i+=t,j(`exported ${t} record(s) from ${e} (total ${i})`)}})}catch(e){if(e instanceof Fi){let{recordsExported:t,contentEventsExported:n}=e.partial;console.log(),A(`Exporter failed after exporting ${t} content record(s) from ${n} event(s): ${e.message}`)}throw e}finally{process.off(`SIGINT`,r),process.off(`SIGTERM`,r)}if(console.log(),a.contentEventsExported===0){A(`Saw ${a.eventsSeen} event(s) but none carried content. Run a real OpenCode task (a prompt that produces text or a tool call), then re-run.`);return}O(`Exported ${a.recordsExported} content record(s) from ${a.contentEventsExported} event(s).`),j(`Verify it landed: tangle connect opencode --verify`)}async function ba(e){let t=Date.now()+e.timeoutSeconds*1e3,n=3e3,r=Math.min(e.timeoutSeconds*1e3,1e4),i=M(`Checking whether content is flowing…`);i.start();let a;try{for(;;){try{a=await ni({endpoint:e.endpoint,apiKey:e.apiKey,timeoutMs:r})}catch(e){if(Date.now()>=t)throw e;await Sa(n);continue}if(a.contentSeen||Date.now()>=t)break;await Sa(n)}}finally{i.stop()}if(!a)throw Error(`onboarding status check returned no result`);xa(a,e.agent),a.contentSeen||(process.exitCode=1)}function xa(e,t){if(e.contentSeen){O(`Content flowing — Tangle Intelligence can analyze this feed.`),N({"Last seen":e.lastSeenAt??`just now`,Window:`${e.windowDays}d`});return}if(e.tracesSeen){A(`Metadata-only — traces are arriving but carry no content. You missed a content gate.`);let n=t?[t]:Object.keys(e.byAgent).filter(Hi),r=n.length>0?n:Ri;for(let n of r){let r=e.byAgent[n];(t||!r||r.tracesSeen&&!r.contentSeen)&&j(aa(n))}return}A(`No traces yet for your tenant. Run your agent once on a real task, then re-run --verify.`),t&&j(aa(t))}function Sa(e){return new Promise(t=>setTimeout(t,e))}function Ca(){let e=new t(`environments`).alias(`env`).description(`Manage sandbox environments`);return e.command(`list`).alias(`ls`).description(`List available environments`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Fetching environments...`);e.json||n.start();let r=await t.environments.list();n.stop(),e.json?D(r):r.length===0?console.log(`No environments found`):I([`ID`,`Description`,`Version`],r.map(e=>[e.id,e.description??``,e.version]))}catch(e){L(e)}}),e.command(`get`).description(`Get environment details`).argument(`<id>`,`Environment ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Fetching environment...`);t.json||r.start();let i=await n.environments.get(e);if(r.stop(),!i){console.error(`Environment not found: ${e}`),process.exit(1);return}t.json?D(i):(console.log(`ID: ${i.id}`),console.log(`Description: ${i.description??`-`}`),console.log(`Version: ${i.version}`),i.base&&console.log(`Base: ${i.base}`))}catch(e){L(e)}}),e}function wa(){return new t(`exec`).description(`Execute a command in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command...>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`60000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=t.join(` `),o={};if(n.env)for(let e of n.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(o[t]=n.join(`=`))}let s=M(`Executing: ${a}`);n.json||s.start();let c=await z(i,r,e);c=await B(c);let l=await c.exec(a,{cwd:n.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:Number.parseInt(n.timeout,10)});s.stop(),n.json?D(l):(l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr),l.exitCode!==0&&process.exit(l.exitCode))}catch(e){if(e instanceof _){let t=`Exec transport lost before command status was confirmed. Remote command status is unknown. Original error: ${e.message}. For long-running commands, use \`tangle process spawn\`, \`tangle process logs\`, and \`tangle process kill --tree\`.`;return L(Error(t,{cause:e}))}L(e)}})}const Ta=[`runpod`,`vast-ai`,`lambda-labs`,`tensordock`,`paperspace`,`aws`,`gcp`,`azure`,`crusoe`,`fluidstack`];function Ea(e){let t=e.memory?K(e.memory,`--accelerator-memory`):void 0;return{kind:ja(e.kind),count:e.count?K(e.count,`--accelerator-count`):1,...t===void 0?{}:{memoryMB:t}}}function Da(e,t,n){let r=!!(e.provider||e.image||e.env||e.maxSpendUsd||e.maxLifetime||e.idleTimeout);if(!t&&r)throw Error(n);if(t){if(!e.maxSpendUsd||!e.maxLifetime)throw Error(`--accelerator-kind requires --gpu-max-spend-usd and --gpu-max-lifetime`);return{...e.provider?{provider:Aa(e.provider,`--gpu-provider`)}:{},...e.image?{image:e.image}:{},...e.env?{env:ka(e.env,`--gpu-env`,`GPU env`)}:{},maxSpendUsd:Ma(e.maxSpendUsd,`--gpu-max-spend-usd`),maxLifetimeSeconds:K(e.maxLifetime,`--gpu-max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:K(e.idleTimeout,`--gpu-idle-timeout`)}:{}}}}function Oa(e){return{...e.provider?{provider:Aa(e.provider,`GPU provider`)}:{},accelerator:Ea({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory}),...e.image?{image:e.image}:{},...e.env?{env:ka(e.env,`--env`,`env`)}:{},maxSpendUsd:Ma(e.maxSpendUsd,`--max-spend-usd`),maxLifetimeSeconds:K(e.maxLifetime,`--max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:K(e.idleTimeout,`--idle-timeout`)}:{}}}function ka(e,t,n){let r={};for(let i of e){let[e,...a]=i.split(`=`);if(!e||a.length===0)throw Error(`${t} expects ${n} values in KEY=VALUE format`);r[e]=a.join(`=`)}return r}function K(e,t){if(!/^\d+$/.test(e))throw Error(`${t} must be a positive integer`);let n=Number.parseInt(e,10);if(Number.isNaN(n)||n<1)throw Error(`${t} must be a positive integer`);return n}function Aa(e,t){if(Ta.includes(e))return e;throw Error(`${t} must be one of ${Ta.join(`, `)}`)}function ja(e){let t=e.trim().toLowerCase();if(/^[a-z0-9][a-z0-9._-]*$/.test(t))return t;throw Error(`--accelerator-kind must contain only letters, numbers, dots, underscores, or hyphens`)}function Ma(e,t){if(!/^(?:\d+|\d+\.\d+|\.\d+)$/.test(e))throw Error(`${t} must be a positive number`);let n=Number.parseFloat(e);if(!Number.isFinite(n)||n<=0)throw Error(`${t} must be a positive number`);return n}const Na=[`list`,`create`,`delete`,`exec`,`prompt`,`read`,`write`];function Pa(){let e=new t(`fleet`).description(`Manage sandbox fleets`);return e.command(`create`).description(`Create a sandbox fleet`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--count <n>`,`Number of worker machines`,`1`).option(`--environment <environment>`,`Named environment, container image, or built image ID for each machine`).option(`--cpu <cores>`,`CPU cores per machine`).option(`--memory <mb>`,`Memory in MB per machine`).option(`--disk <gb>`,`Disk in GB per machine`).option(`--accelerator-kind <kind>`,`Accelerator kind per machine, for example nvidia-l4 or nvidia-h100`).option(`--accelerator-count <count>`,`Accelerator devices per machine`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB per machine`).option(`--gpu-provider <provider>`,`GPU cloud provider per machine; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for each GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum spend per machine GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum GPU lease lifetime per machine in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy each GPU lease after this many idle seconds`).option(`--driver <type>`,`Infrastructure driver type`).option(`--backend <id>`,`Agent backend type`).option(`--workspace <mode>`,`Workspace mode: isolated | shared`,`isolated`).option(`--max-spend-usd <n>`,`Fleet spend cap in USD (policy)`).option(`--max-lifetime <s>`,`Max machine lifetime in seconds (policy)`).option(`--spec <file.json>`,`Path to a JSON file describing the fleet (overrides synthesized machines)`).option(`--coordinator`,`Create a coordinator + workers fleet (routes to createWithCoordinator)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Creating fleet...`);n.start();let r=e.coordinator?await t.fleets.createWithCoordinator(Ra(e)):await t.fleets.create(La(e));n.stop();let i=Ha(r.machines);e.json?D({fleetId:r.fleetId,machines:i}):(O(`Fleet created: ${r.fleetId}`),E(i,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}]))}catch(e){L(e)}}),e.command(`list <fleet-id>`).description(`List the machines of one fleet (fleet id is required)`).option(`--status <status>`,`Filter machines by status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Fetching fleet...`);r.start();let i=await n.fleets.list({fleetId:e,status:t.status});r.stop();let a=Ha(i.machines);t.json?D({fleetId:i.fleetId,machines:a}):E(a,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}])}catch(e){L(e)}}),e.command(`get <fleet-id>`).description(`Show one fleet's manifest (server record)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Fetching manifest...`);r.start();let i=await n.fleets.manifest(e);r.stop(),t.json?D(i):(N({"Fleet ID":i.fleetId??i.id,Machines:i.machines.length,"Workspace mode":i.workspace?.mode,"Workspace status":i.workspace?.status,"Max lifetime (s)":i.policy?.maxLifetimeSeconds,"Max spend (USD)":i.policy?.maxSpendUsd,Created:i.createdAt,Updated:i.updatedAt}),E(i.machines.map(e=>({machineId:e.machineId,sandboxId:e.sandboxId,role:e.role,status:e.status})),[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`role`,header:`Role`,width:14},{key:`status`,header:`Status`,width:14}]))}catch(e){L(e)}}),e.command(`delete <fleet-id>`).description(`Delete a fleet's machine sandboxes and its record`).option(`--continue-on-error`,`Keep deleting remaining machines if one delete fails`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Deleting fleet...`);r.start(),await n.fleets.delete(e,{continueOnError:t.continueOnError}),r.stop(),t.json?D({success:!0,fleetId:e}):O(`Fleet deleted: ${e}`)}catch(e){L(e)}}),e.command(`reap`).description(`TTL cleanup of all expired fleets (fleet-wide)`).option(`--dry-run`,`Report what would be reaped without deleting`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Reaping expired fleets...`);n.start();let r=await t.fleets.reapExpired({dryRun:e.dryRun});n.stop(),e.json?D(r):(N({"Dry run":r.dryRun,Expired:r.expired,Deleted:r.deleted}),E(r.fleets.map(e=>({fleetId:e.fleetId,expiredAt:e.expiredAt,deleted:e.deleted})),[{key:`fleetId`,header:`Fleet`,width:24},{key:`expiredAt`,header:`Expired`,width:18},{key:`deleted`,header:`Deleted`,width:10}]))}catch(e){L(e)}}),e.command(`reconcile`).description(`Drop fleet records whose underlying sandboxes vanished`).option(`--dry-run`,`Report orphans without removing them`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Reconciling fleets...`);n.start();let r=await t.fleets.reconcile({dryRun:e.dryRun});n.stop(),e.json?D(r):(N({"Dry run":r.dryRun,Checked:r.checked,Orphaned:r.orphaned,Removed:r.removed}),E(r.machines.map(e=>({fleetId:e.fleetId,machineId:e.machineId,sandboxId:e.sandboxId,removed:e.removed})),[{key:`fleetId`,header:`Fleet`,width:24},{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`removed`,header:`Removed`,width:10}]))}catch(e){L(e)}}),e.addCommand(Fa()),e.command(`exec <fleet-id> <command>`).description(`Run a shell command across the fleet's machines`).option(`--machine <id...>`,`Restrict to a subset of machine ids (default: all)`).option(`--cwd <dir>`,`Working directory for the command`).option(`--timeout <ms>`,`Per-machine timeout in milliseconds`).option(`--max-concurrent <n>`,`Max concurrent dispatches`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=T(C({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=M(`Dispatching command...`);i.start();let a=await(await r.fleets.list({fleetId:e})).dispatchExecDetailed(t,{machines:n.machine,cwd:n.cwd,timeoutMs:n.timeout?Number(n.timeout):void 0,maxConcurrent:n.maxConcurrent?Number(n.maxConcurrent):void 0});if(i.stop(),n.json)D(a);else{E(a.results.map(e=>({machineId:e.machineId,ok:e.ok,exitCode:e.result?.exitCode,durationMs:e.durationMs})),[{key:`machineId`,header:`Machine`,width:20},{key:`ok`,header:`OK`,width:6},{key:`exitCode`,header:`Exit`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14}]);for(let e of a.results){let t=e.result?.stdout,n=e.result?.stderr;t&&(console.log(`\n[${e.machineId}] stdout:`),console.log(t)),n&&(console.log(`\n[${e.machineId}] stderr:`),console.log(n)),e.error&&console.log(`\n[${e.machineId}] error: ${e.error.message}`)}}a.results.some(e=>e.ok===!1)&&(process.exitCode=1)}catch(e){L(e)}}),e.command(`capabilities`).description(`List fleet drivers and their supported features`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Fetching capabilities...`);n.start();let r=await t.fleets.capabilities();n.stop(),e.json?D(r):E(r.drivers.map(e=>({driverType:e.driverType,sharedWorkspace:e.sharedWorkspace,accelerators:e.accelerators,queueTimings:e.queueTimings})),[{key:`driverType`,header:`Driver`,width:16},{key:`sharedWorkspace`,header:`Shared WS`,width:12},{key:`accelerators`,header:`Accel`,width:8},{key:`queueTimings`,header:`Queue`,width:8}])}catch(e){L(e)}}),e.command(`usage <fleet-id>`).description(`Show fleet usage and reliability insights`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Fetching usage...`);r.start();let i=await n.fleets.usage(e);if(r.stop(),t.json)D(i);else if(N({"Fleet ID":i.usage.fleetId,Status:i.usage.status,Machines:i.usage.machineCount,Running:i.usage.runningMachines,Failed:i.usage.failedMachines,"Runtime (ms)":i.usage.meteredUsage?.runtimeMs,"Reliability score":i.insights.reliabilityScore,"Failure rate":i.insights.failureRate}),i.insights.recommendedActions.length>0){console.log(`
|
|
144
|
+
Recommended actions:`);for(let e of i.insights.recommendedActions)console.log(` - ${e}`)}}catch(e){L(e)}}),e.command(`cost <fleet-id>`).description(`Show the fleet's cost estimate`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Estimating cost...`);r.start();let i=await n.fleets.cost(e);r.stop(),t.json?D(i):N({Plan:i.plan,Currency:i.currency,"Hourly (USD)":i.hourlyUsd,"Max lifetime (s)":i.maxLifetimeSeconds,"Estimated max lifetime (USD)":i.estimatedMaxLifetimeUsd,Machines:i.requestedResources.machines,"Total CPU":i.requestedResources.totalCpu,"Total memory (MB)":i.requestedResources.totalMemoryMb})}catch(e){L(e)}}),e.command(`token <fleet-id>`).description(`Mint a scoped fleet bearer token (treated as a secret)`).option(`--action <a...>`,`Allowed actions: list create delete exec prompt read write`).option(`--ttl-minutes <n>`,`Token lifetime in minutes`).option(`--json`,`Output as JSON (only path that prints the full token)`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Minting fleet token...`);r.start();let i=await n.fleets.createToken(e,{actions:Ua(t.action),ttlMinutes:t.ttlMinutes?Number(t.ttlMinutes):void 0});r.stop(),t.json?D(i):(N({"Fleet ID":i.fleetId,Token:Wa(i.token),"Expires at":new Date(i.expiresAt).toISOString(),Actions:i.actions.join(`, `)}),console.log(`
|
|
145
|
+
Re-run with --json to print the full token value.`))}catch(e){L(e)}}),e}function Fa(){let e=new t(`workspace`).description(`Manage a fleet's shared workspace`);return e.command(`snapshot <fleet-id>`).description(`Snapshot the fleet's shared workspace`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Creating workspace snapshot...`);r.start();let i=await n.fleets.createWorkspaceSnapshot(e);r.stop(),t.json?D(i):O(`Workspace snapshot created: ${i.snapshotId??i.id}`)}catch(e){L(e)}}),e.command(`restore <fleet-id> <snapshot-id>`).description(`Restore the fleet's shared workspace from a snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=T(C({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=M(`Restoring workspace...`);i.start();let a=await r.fleets.restoreWorkspaceSnapshot(e,t);i.stop(),n.json?D(a):O(`Workspace restored from ${a.snapshotId??t}`)}catch(e){L(e)}}),e.command(`reconcile <fleet-id>`).description(`Re-mount the shared workspace on all fleet machines`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=M(`Reconciling workspace...`);r.start();let i=await n.fleets.reconcileWorkspace(e);r.stop(),t.json?D(i):(N({"Fleet ID":i.fleetId,Checked:i.checked,"Orphaned mounts":i.orphanedMounts}),E(i.machines.map(e=>({machineId:e.machineId,sandboxId:e.sandboxId,mounted:e.mounted})),[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`mounted`,header:`Mounted`,width:10}]))}catch(e){L(e)}}),e}function Ia(e){if(e.spec){let t=JSON.parse(u(e.spec,`utf8`));return{base:{fleetId:e.fleetId,defaults:t.defaults,policy:t.policy,workspace:t.workspace,metadata:t.metadata},machines:t.machines??[]}}let t=za(e),n=Ba(e,!!t?.accelerator),r={...e.environment?{environment:e.environment}:{},...t?{resources:t}:{},...e.driver?{driver:{type:e.driver}}:{},...n?{gpuLease:n}:{},...e.backend?{backend:{type:e.backend}}:{}},i=Va(e),a=Math.max(1,Number(e.count)||1),o=Array.from({length:a},(e,t)=>({machineId:`worker-${t+1}`}));return{base:{fleetId:e.fleetId,defaults:Object.keys(r).length>0?r:void 0,policy:i,workspace:{mode:e.workspace}},machines:o}}function La(e){let{base:t,machines:n}=Ia(e);return{...t,machines:n}}function Ra(e){let{base:t,machines:n}=Ia(e);return{...t,workers:n}}function za(e){let t={};if(e.cpu&&(t.cpuCores=Number(e.cpu)),e.memory&&(t.memoryMB=Number(e.memory)),e.disk&&(t.diskGB=Number(e.disk)),e.acceleratorKind)t.accelerator=Ea({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory});else if(e.acceleratorCount||e.acceleratorMemory)throw Error(`--accelerator-count and --accelerator-memory require --accelerator-kind`);return Object.keys(t).length>0?t:void 0}function Ba(e,t){return Da({provider:e.gpuProvider,image:e.gpuWorkerImage,env:e.gpuEnv,maxSpendUsd:e.gpuMaxSpendUsd,maxLifetime:e.gpuMaxLifetime,idleTimeout:e.gpuIdleTimeout},t,`Fleet GPU lease flags require --accelerator-kind`)}function Va(e){let t={};return e.maxSpendUsd&&(t.maxSpendUsd=Number(e.maxSpendUsd)),e.maxLifetime&&(t.maxLifetimeSeconds=Number(e.maxLifetime)),Object.keys(t).length>0?t:void 0}function Ha(e){return[...e.entries()].map(([e,t])=>({machineId:e,sandboxId:t.id,status:t.status}))}function Ua(e){if(!(!e||e.length===0)){for(let t of e)if(!Na.includes(t))throw Error(`Invalid token action '${t}'. Allowed: ${Na.join(`, `)}`);return e}}function Wa(e){return e.length<=12?`****`:`${e.slice(0,6)}...${e.slice(-4)} (masked — use --json for full value)`}function Ga(){let e=new t(`fs`).description(`File system operations on sandboxes`);return q(e.command(`upload`).description(`Upload a file to a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<local-path>`,`Local file path`).argument(`<remote-path>`,`Remote destination path`).option(`--json`,`Output as JSON`)).action(async(e,t,n,r)=>{try{let{context:i,client:a}=J(r),s=await z(a,i,e);if(s=await B(s),!o.existsSync(t))throw Error(`Local file not found: ${t}`);let c=o.statSync(t),l=Date.now();console.log(`Uploading ${t} to ${n}...`),await s.fs.upload(t,n,{onProgress:e=>{let t=e.percentage.toFixed(1);process.stdout.write(`\rProgress: ${t}% (${e.bytesUploaded}/${e.totalBytes} bytes)`)}});let u=Date.now()-l;console.log(``),r.json?F({success:!0,localPath:t,remotePath:n,size:c.size,durationMs:u}):console.log(`✓ Uploaded ${c.size} bytes in ${u}ms`)}catch(e){P(e,r.json)}}),q(e.command(`download`).description(`Download a file from a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<remote-path>`,`Remote file path`).argument(`<local-path>`,`Local destination path`).option(`--json`,`Output as JSON`)).action(async(e,t,n,r)=>{try{let{context:i,client:a}=J(r),s=await z(a,i,e);s=await B(s);let c=Date.now();console.log(`Downloading ${t} to ${n}...`),await s.fs.download(t,n,{onProgress:e=>{let t=e.percentage.toFixed(1);process.stdout.write(`\rProgress: ${t}% (${e.bytesDownloaded}/${e.totalBytes} bytes)`)}});let l=Date.now()-c,u=o.statSync(n);console.log(``),r.json?F({success:!0,remotePath:t,localPath:n,size:u.size,durationMs:l}):console.log(`✓ Downloaded ${u.size} bytes in ${l}ms`)}catch(e){P(e,r.json)}}),q(e.command(`ls`).description(`List directory contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`[path]`,`Directory path`,`.`).option(`-l, --long`,`Show detailed information`).option(`-a, --all`,`Include hidden files`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a);let o=await a.fs.list(t,{all:n.all,long:n.long});if(n.json)F(o);else if(n.long)I([`Mode`,`Owner`,`Group`,`Size`,`Modified`,`Name`],o.map(e=>{let t=e.isDir?`d`:e.isSymlink?`l`:`-`,n=Ka(e.permissions),r=e.isDir?`<DIR>`:qa(e.size),i=e.modTime.toLocaleDateString();return[t+n,e.owner,e.group,r,i,e.name]}));else{let e=o.map(e=>e.isDir?`${e.name}/`:e.name);console.log(e.join(` `))}}catch(e){P(e,n.json)}}),q(e.command(`stat`).description(`Get file or directory information`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file or directory`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a);let o=await a.fs.stat(t);n.json?F(o):(console.log(` File: ${o.name}`),console.log(` Path: ${o.path}`),console.log(` Size: ${qa(o.size)} (${o.size} bytes)`),console.log(` Type: ${o.isDir?`directory`:o.isSymlink?`symlink`:`file`}`),console.log(` Mode: ${Ka(o.permissions)} (${o.permissions.toString(8)})`),console.log(` Owner: ${o.owner}`),console.log(` Group: ${o.group}`),console.log(` Modified: ${o.modTime.toISOString()}`),console.log(` Accessed: ${o.accessTime.toISOString()}`))}catch(e){P(e,n.json)}}),q(e.command(`cat`).description(`Print file contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a);let o=await a.read(t);n.json?F({path:t,content:o}):console.log(o)}catch(e){P(e,n.json)}}),q(e.command(`rm`).description(`Delete a file or directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to delete`).option(`-r, --recursive`,`Delete directories recursively`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a),await a.fs.delete(t,{recursive:n.recursive}),n.json?F({success:!0,path:t,deleted:!0}):console.log(`✓ Deleted: ${t}`)}catch(e){P(e,n.json)}}),q(e.command(`mkdir`).description(`Create a directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Directory path to create`).option(`-p, --parents`,`Create parent directories as needed`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a),await a.fs.mkdir(t,{recursive:n.parents}),n.json?F({success:!0,path:t,created:!0}):console.log(`✓ Created: ${t}`)}catch(e){P(e,n.json)}}),q(e.command(`exists`).description(`Check if a path exists`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to check`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await z(i,r,e);a=await B(a);let o=await a.fs.exists(t);n.json?F({path:t,exists:o}):(console.log(o?`exists`:`not found`),process.exit(+!o))}catch(e){P(e,n.json)}}),e}function Ka(e){let t=[`r`,`w`,`x`],n=``;for(let r=2;r>=0;r--){let i=r*3;for(let r=0;r<3;r++)n+=e>>i+(2-r)&1?t[r]:`-`}return n}function qa(e){let t=[`B`,`KB`,`MB`,`GB`,`TB`],n=e,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r++;return r===0?`${n}${t[r]}`:`${n.toFixed(1)}${t[r]}`}function q(e){return e.option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`)}function J(e){let t=C({apiKey:e.apiKey,baseUrl:e.baseUrl});return{context:t,client:T(t)}}function Ja(){let e=new t(`git`).description(`Git operations in a sandbox workspace`);return e.command(`status`).description(`Show git repository status`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching status...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.status();if(i.stop(),t.json)D(o);else if(!o.isRepo)console.log(`No git repository in the sandbox workspace.`);else{if(console.log(`Branch: ${o.branch??`unknown`}`),console.log(`HEAD: ${o.head.slice(0,7)||`(no commits)`}`),console.log(`Dirty: ${o.isDirty?`yes`:`no`}`),o.ahead&&console.log(`Ahead: ${o.ahead}`),o.behind&&console.log(`Behind: ${o.behind}`),o.staged.length>0){console.log(`\nStaged (${o.staged.length}):`);for(let e of o.staged)console.log(` + ${e}`)}if(o.modified.length>0){console.log(`\nModified (${o.modified.length}):`);for(let e of o.modified)console.log(` M ${e}`)}if(o.untracked.length>0){console.log(`\nUntracked (${o.untracked.length}):`);for(let e of o.untracked)console.log(` ? ${e}`)}}}catch(e){L(e)}}),e.command(`log`).description(`Show commit log`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`-n, --limit <count>`,`Max commits to show`,`10`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching log...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.log(Number.parseInt(t.limit,10));if(i.stop(),t.json)D(o);else if(o.length===0)console.log(`No commits found`);else for(let e of o)console.log(`${e.shortSha} ${e.message.split(`
|
|
146
|
+
`)[0]} (${e.author}, ${e.date.toLocaleDateString()})`)}catch(e){L(e)}}),e.command(`diff`).description(`Show diff`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--ref <ref>`,`Ref to diff against`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching diff...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.diff(t.ref);i.stop(),t.json?D(o):o.raw?console.log(o.raw):console.log(`${o.additions} additions, ${o.deletions} deletions across ${o.files.length} files`)}catch(e){L(e)}}),e.command(`add`).description(`Stage files`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<paths...>`,`Paths to stage`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await z(T(r),r,e);i=await B(i),await i.git.add(t),O(`Staged: ${t.join(`, `)}`)}catch(e){L(e)}}),e.command(`commit`).description(`Create a commit`).argument(`<id-or-name>`,`Sandbox ID or name`).requiredOption(`-m, --message <msg>`,`Commit message`).option(`--amend`,`Amend the previous commit`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await z(T(n),n,e);r=await B(r);let i=await r.git.commit(t.message,{amend:t.amend});t.json?D(i):O(`Committed: ${i.shortSha} ${i.message}`)}catch(e){L(e)}}),e.command(`push`).description(`Push to remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--force`,`Force push`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Pushing...`);i.start();let a=await z(r,n,e);a=await B(a),await a.git.push({force:t.force}),i.stop(),O(`Pushed to remote`)}catch(e){L(e)}}),e.command(`pull`).description(`Pull from remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--rebase`,`Rebase instead of merge`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Pulling...`);i.start();let a=await z(r,n,e);a=await B(a),await a.git.pull({rebase:t.rebase}),i.stop(),O(`Pulled from remote`)}catch(e){L(e)}}),e.command(`branches`).description(`List branches`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching branches...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.branches();i.stop(),t.json?D(o):o.length===0?console.log(`No branches found`):I([`Name`,`Current`,`Remote`],o.map(e=>[e.name,e.current?`* `:` `,e.upstream??`-`]))}catch(e){L(e)}}),e.command(`checkout`).description(`Checkout a branch or ref`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<ref>`,`Branch name or ref`).option(`-b, --create`,`Create a new branch`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await z(T(r),r,e);i=await B(i),await i.git.checkout(t,{create:n.create}),O(`Checked out: ${t}${n.create?` (new)`:``}`)}catch(e){L(e)}}),e}function Ya(){let e=new t(`hub`).description(`Discover and run Tangle Hub tools`);e.option(`--json`,`Output as JSON`),e.hook(`preAction`,(e,t)=>{Za(t)}),e.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--parameter <key=value>`,`Provider-specific OAuth value. Repeatable.`,mo,[]).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=ho(t.parameter),r=await(await R(t)).connections.start(e,{cli:!0,connectionParameters:n});if(t.json){D(_o(r));return}go(r,t.browser===!1?!1:await dr(r.redirectUrl))}catch(e){Y(e,t)}});let n=new t(`connections`).description(`List Hub provider connections`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).connections.list();if(e.json){D(t);return}po(t.connections)}catch(t){Y(t,e)}});n.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await R(t),r=await Zt(n,e);if(!t.force&&!await V(`Revoke Hub connection ${r}? `)){j(`Revoke cancelled.`);return}let i=await n.connections.revoke(r);if(t.json){D(i);return}j(`Revoked Hub connection ${i.connection.id}.`)}catch(e){Y(e,t)}}),e.addCommand(n);let r=new t(`permissions`).description(`Manage Hub action permissions`);r.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);let t=await R(e),n=await Zt(t,e.connection),r=await t.permissions.list(n);if(e.json){D(r);return}so(r.policies)}catch(t){Y(t,e)}}),r.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);if(!e.action)throw Error(`--action is required.`);let t=co(e.decision),n=await R(e),r=await Zt(n,e.connection),i=await n.permissions.set({connectionId:r,actionPath:e.action,decision:t});if(e.json){D(i);return}so([i.policy])}catch(t){Y(t,e)}}),r.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);let t=await R(e),n=await Zt(t,e.connection),r=await t.permissions.revertWrites(n);if(e.json){D(r);return}j(`Reverted ${r.reverted} write permission${r.reverted===1?``:`s`} for connection ${r.connectionId}.`)}catch(t){Y(t,e)}}),e.addCommand(r);let i=new t(`approvals`).description(`List and resolve Hub execution approvals`);i.command(`list`).description(`List pending Hub execution approvals`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).approvals.list();if(e.json){D(t);return}no(t.approvals)}catch(t){Y(t,e)}}),i.command(`approve`).description(`Approve a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{to(e),ro(await(await R(t)).approvals.approve(e),t.json===!0)}catch(e){Y(e,t)}}),i.command(`deny`).description(`Deny a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{to(e),ro(await(await R(t)).approvals.deny(e),t.json===!0)}catch(e){Y(e,t)}}),e.addCommand(i);let a=new t(`tools`).description(`Discover Hub tools`);return a.command(`sources`).description(`List Hub tool sources`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).tools.sources();if(e.json){D(t);return}lo(t.sources)}catch(t){Y(t,e)}}),a.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await(await R(t)).tools.describe(e);if(t.json){D(n);return}uo(n.tool)}catch(e){Y(e,t)}}),a.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await(await R(t)).tools.search(e.join(` `),{provider:t.provider});if(t.json){D(n);return}oo(n.tools)}catch(e){Y(e,t)}}),e.addCommand(a),e.addCommand(Xa(`call`)),e.addCommand(Xa(`exec`)),e.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(to(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await R(t);ro(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}catch(e){Y(e,t)}}),e.command(`status`).description(`Show Hub auth and connection status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).status();if(e.json){D(t);return}vo(t)}catch(t){Y(t,e)}}),e}function Xa(e){return new t(e).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let{args:n,approve:r}=eo(e,t),{path:i,input:a}=ao(n),o=await R(t),s=t.connection?await Zt(o,t.connection):void 0;D((await o.tools.invoke(i,a,{connectionId:s,approve:r})).result)}catch(e){Y(e,t)}})}function Za(e){if(!Qa(e,`json`)||e.getOptionValue(`json`)!==void 0)return;let t=e.parent;for(;t;){let n=t.getOptionValue(`json`);if(n!==void 0){e.setOptionValue(`json`,n);return}t=t.parent}}function Qa(e,t){return e.options.some(e=>e.attributeName()===t)}function $a(e){return e.json===!0}function Y(e,t){return $a(t)?L(e,!0):L(e)}function eo(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function to(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function no(e){E(e.map(e=>({id:e.id,provider:e.providerId,action:e.actionPath,connection:e.connectionId,status:e.status,expires:e.expiresAt})),[{key:`id`,header:`ID`},{key:`provider`,header:`Provider`},{key:`action`,header:`Action`},{key:`connection`,header:`Connection`},{key:`status`,header:`Status`},{key:`expires`,header:`Expires`}])}function ro(e,t){if(t){D(io(e));return}j(`Hub approval ${e.approval.id} ${e.approval.status}.`),e.capabilityToken&&j("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function io(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function ao(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e.at(-1);if(t===void 0)throw Error(`Usage: tangle hub call <path> <json-input>`);try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function oo(e){E(e.map(e=>({path:e.path,provider:e.providerId??e.requiredConnectionProviderId,title:e.title,description:e.description,connection:fo(e),policy:e.policyState})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policy`,header:`Policy`}])}function so(e){E(e.map(e=>({connection:e.connectionId,provider:e.providerId,action:e.actionPath,decision:e.decision,updated:e.updatedAt})),[{key:`connection`,header:`Connection`},{key:`provider`,header:`Provider`},{key:`action`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updated`,header:`Updated`}])}function co(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function lo(e){E(e.map(e=>({source:e.sourceId,provider:e.displayName,tools:e.toolCount,connection:e.connectionStatus,health:e.health,configured:e.configured})),[{key:`source`,header:`Source`},{key:`provider`,header:`Provider`},{key:`tools`,header:`Tools`},{key:`connection`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function uo(e){N({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:fo(e),Policy:e.policyState}),e.inputSchema!==void 0&&(j(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(j(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function fo(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function po(e){E(e.map(e=>({id:e.id,provider:e.providerId,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `),status:e.status,health:e.health,lastUsed:e.lastUsedAt})),[{key:`id`,header:`ID`},{key:`provider`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsed`,header:`Last Used`}])}function mo(e,t){return[...t,e]}function ho(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0||e===n.length-1)throw Error(`Invalid --parameter "${n}": expected key=value (for example subdomain=acme)`);let r=n.slice(0,e);if(Object.hasOwn(t,r))throw Error(`Duplicate --parameter key "${r}".`);t[r]=n.slice(e+1)}return t}function go(e,t){t?j(`Opened browser to connect ${e.provider}.`):(j(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),j("Finish authorization in the browser, then rerun `tangle hub status`.")}function _o(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function vo(e){let{principal:t,connections:n}=e;j(`Hub status`),N({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&j(`Some providers require reconnect.`)}function yo(){let e=new t(`intelligence`).description(`Create and inspect trace intelligence reports`);return e.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`,Vr).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).option(`--json`,`Output as JSON`).action(async(e,t)=>{try{let n=e??`local`;Kr(n);let r=xo(t.apiKey),i=await Zr({selection:n,workspace:t.workspace,apiKey:r,endpoint:t.endpoint,serviceName:t.serviceName??Jr(t.workspace),environment:t.environment,smoke:t.smoke,dryRun:!!t.dryRun,hookCommand:t.hookCommand}),a={configPath:i.configPath,agents:i.agents,nativeAgents:i.nativeAgents,manual:i.manual,written:i.written,smokeTraceId:i.smokeTraceId};if(t.json){D(a);return}N({Config:i.configPath,Agents:i.agents.join(`, `),"Native Hooks":i.nativeAgents.join(`, `)||void 0,"Manual Setup":i.manual.length?i.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:i.written.join(`, `),"Smoke Trace":i.smokeTraceId})}catch(e){L(e)}}),e.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`,Vr).option(`--json`,`Output as JSON`).action(async e=>{try{let t=Xr(),n=await ni({endpoint:e.endpoint===`https://intelligence.tangle.tools/v1/otlp`?t?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:e.endpoint,apiKey:xo(e.apiKey??t?.apiKey)});e.json?D(n):bo(n),n.contentSeen||(process.exitCode=1)}catch(e){L(e)}}),e.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).option(`--json`,`Output as JSON`).action(async e=>{try{let t=So(e.agent),n=Xr(),r={agent:t,event:e.event,endpoint:e.endpoint??n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:xo(e.apiKey??n?.apiKey),serviceName:e.serviceName??n?.serviceName??Jr(process.cwd()),environment:e.environment??n?.environment??`local`,sessionId:e.sessionId,payload:e.payload===void 0?await wo():Co(e.payload)};if(e.dryRun){let n=$r(r);if(e.json){D(n);return}N({Trace:n.traceId,Agent:t,Event:e.event});return}let i=await ei(r);if(e.json){D({traceId:i});return}N({Trace:i,Agent:t,Event:e.event})}catch(t){if(e.nonBlocking){let n=t instanceof Error?t.message:String(t);e.json?D({ok:!1,error:n}):console.error(`Tangle Intelligence hook skipped: ${n}`);return}L(t)}}),e.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await To({type:`sandbox`,id:e},t)}),e.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await To({type:`fleet`,id:e},t)}),e.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{await To({type:Do(e.subjectType),id:e.subjectId},e)}),e.command(`get <job-id>`).description(`Get an intelligence report`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=t.json?null:M(`Fetching intelligence report...`);r?.start();let i=await n.intelligence.getReport(e);if(r?.stop(),t.json){D(i);return}Eo(i)}catch(e){L(e)}}),e.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=e.json?null:M(`Fetching intelligence reports...`);n?.start();let r=await t.intelligence.listReports({subjectType:e.subjectType===void 0?void 0:Do(e.subjectType),subjectId:e.subjectId,limit:e.limit===void 0?void 0:Ao(e.limit)});if(n?.stop(),e.json){D(r);return}E(r.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}catch(e){L(e)}}),e}function bo(e){N({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let t=Object.entries(e.byAgent);t.length>0&&(console.log(),E(t.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function xo(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function So(e){if(qr(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function Co(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function wo(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function To(e,t){try{let n=Oo(t.mode),r=jo(t.metadata),i=t.maxUsd===void 0?void 0:ko(t.maxUsd);if(n===`agentic`&&i===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let a=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl})),o=t.json?null:M(`Creating intelligence report...`);o?.start();let s=await a.intelligence.createReport({subject:e,mode:n,...i===void 0?{}:{budget:{billTo:`customer`,maxUsd:i}},...r===void 0?{}:{metadata:r}});if(o?.stop(),t.json){D(s);return}Eo(s)}catch(e){L(e)}}function Eo(e){N({Job:e.jobId,Subject:`${e.subject.type}:${e.subject.id}`,Mode:e.mode,Status:e.status,"Billed To":e.billing.billedTo,Cost:`$${e.billing.costUsd.toFixed(2)}`,Budget:e.billing.budgetMaxUsd===void 0?void 0:`$${e.billing.budgetMaxUsd.toFixed(2)}`,Updated:e.updatedAt}),e.result!==null&&(console.log(),D(e.result))}function Do(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function Oo(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function ko(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function Ao(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function jo(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const Mo=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];async function No(e,t,n={}){let r=new Headers(n.headers);r.set(`Authorization`,`Bearer ${t}`),n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await fetch(e,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected){let t=await i.text().catch(()=>``),n=t?`: ${t.slice(0,400)}`:``;throw Error(`Platform request to ${e} returned ${i.status}${n}`)}return i}const Po=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function Fo(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function Io(){let e=new t(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return e.command(`list`).description(`List your active API keys`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async e=>{try{let t=C({apiKey:e.apiKey,baseUrl:e.baseUrl}),n=await(await No(`${Bt({flag:e.platformUrl})}/v1/keys`,t.apiKey,{expected:200})).json();if(e.json){D(n);return}I(Po,n.data.map(Fo))}catch(e){L(e)}}),e.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${Mo.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{try{if(t.product!==void 0&&!Mo.includes(t.product))throw Error(`Invalid --product. Expected one of ${Mo.join(`, `)}`);let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=Bt({flag:t.platformUrl}),i=t.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(t.expiresInDays,10)*24*60*60*1e3).toISOString(),a=M(`Creating API key...`);a.start();let o=await No(`${r}/v1/keys`,n.apiKey,{method:`POST`,expected:201,body:JSON.stringify({name:e,product:t.product,budgetUsd:t.budgetUsd?Number.parseFloat(t.budgetUsd):void 0,rpmLimit:t.rpmLimit?Number.parseInt(t.rpmLimit,10):void 0,expiresAt:i})});a.stop();let s=await o.json();if(t.json){D(s);return}O(`API key created: ${s.data.prefix}…`),j(`Copy this key now — it will never be shown again:\n${s.data.key}`)}catch(e){L(e)}}),e.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=Bt({flag:t.platformUrl});if(!t.yes&&!await V(`Revoke key ${e}? Any service still using it will start to fail.`)){j(`Aborted.`);return}let i=await(await No(`${r}/v1/keys/${encodeURIComponent(e)}`,n.apiKey,{method:`DELETE`,expected:200})).json();if(t.json){D(i);return}O(`Revoked ${e}`)}catch(e){L(e)}}),e}function Lo(){let e=new t(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await z(T(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await Ae(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}catch(e){L(e)}}),e}function Ro(){let e=new t(`permissions`).description(`Manage sandbox user permissions`);return e.command(`list <sandboxId-or-name>`).description(`List all users in a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching users...`);i.start();let a=await(await z(r,n,e)).permissions.list();i.stop(),t.json?D(a):E(a.map(e=>({userId:e.userId,username:e.username,role:e.role,homeDir:e.homeDir,createdAt:e.createdAt.toISOString().split(`T`)[0]})),[{key:`userId`,header:`User ID`,width:20},{key:`username`,header:`Username`,width:16},{key:`role`,header:`Role`,width:12},{key:`homeDir`,header:`Home Directory`,width:24},{key:`createdAt`,header:`Created`,width:16}])}catch(e){L(e)}}),e.command(`get <sandboxId-or-name> <userId>`).description(`Get details for a specific user`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Fetching user...`);a.start();let o=await(await z(i,r,e)).permissions.get(t);if(a.stop(),!o)throw Error(`User ${t} not found in sandbox ${e}`);n.json?D(o):(j(`User: ${o.userId}`),j(` Username: ${o.username}`),j(` Role: ${o.role}`),j(` Home: ${o.homeDir}`),j(` SSH Keys: ${o.sshKeys.length}`),j(` Created: ${o.createdAt.toISOString()}`))}catch(e){L(e)}}),e.command(`add <sandboxId-or-name>`).description(`Add a user to a sandbox`).requiredOption(`--user-id <id>`,`User ID (from your auth system)`).option(`--username <name>`,`Preferred username`).option(`--role <role>`,`Permission level (owner, admin, developer, viewer)`,`developer`).option(`--ssh-key <key>`,`SSH public key for access`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Adding user...`);i.start();let a=await(await z(r,n,e)).permissions.add({userId:t.userId,username:t.username,role:t.role,sshKeys:t.sshKey?[t.sshKey]:void 0});i.stop(),t.json?D(a):(O(`User ${a.userId} added as ${a.role}`),j(` Username: ${a.username}`),j(` Home: ${a.homeDir}`))}catch(e){L(e)}}),e.command(`update <sandboxId-or-name> <userId>`).description(`Update a user's permissions`).option(`--role <role>`,`New permission level (owner, admin, developer, viewer)`).option(`--add-ssh-key <key>`,`Add SSH public key`).option(`--remove-ssh-key <key>`,`Remove SSH public key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Updating user...`);a.start();let o=await(await z(i,r,e)).permissions.update(t,{role:n.role,addSshKeys:n.addSshKey?[n.addSshKey]:void 0,removeSshKeys:n.removeSshKey?[n.removeSshKey]:void 0});a.stop(),n.json?D(o):(O(`User ${t} updated`),j(` Role: ${o.role}`),j(` SSH Keys: ${o.sshKeys.length}`))}catch(e){L(e)}}),e.command(`remove <sandboxId-or-name> <userId>`).description(`Remove a user from a sandbox`).option(`--preserve-home`,`Keep user's home directory`).option(`-f, --force`,`Skip confirmation`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{if(!n.force){let e=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(n=>{e.question(`Remove user ${t} from sandbox? [y/N] `,t=>{e.close(),n(t.toLowerCase()===`y`)})})){j(`Cancelled.`);return}}let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Removing user...`);a.start(),await(await z(i,r,e)).permissions.remove(t,{preserveHomeDir:n.preserveHome}),a.stop(),O(`User ${t} removed from sandbox ${e}`)}catch(e){L(e)}}),e.command(`policies <sandboxId-or-name> <userId>`).description(`Get access policies for a user`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Fetching policies...`);a.start();let o=await(await z(i,r,e)).permissions.getAccessPolicies(t);a.stop(),n.json?D(o):o.length===0?j(`No access policies configured`):E(o.map(e=>({pattern:e.pattern,permission:e.permission,priority:e.priority??0})),[{key:`pattern`,header:`Pattern`,width:30},{key:`permission`,header:`Permission`,width:12},{key:`priority`,header:`Priority`,width:10}])}catch(e){L(e)}}),e.command(`check <sandboxId-or-name> <userId> <path> <action>`).description(`Check if a user can perform an action on a path`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r,i)=>{try{if(![`read`,`write`,`execute`].includes(r))throw Error(`Action must be: read, write, or execute`);let a=C({apiKey:i.apiKey,baseUrl:i.baseUrl}),o=T(a),s=M(`Checking access...`);s.start();let c=await(await z(o,a,e)).permissions.checkAccess(t,n,r);s.stop(),c?O(`✓ User ${t} CAN ${r} ${n}`):j(`✗ User ${t} CANNOT ${r} ${n}`)}catch(e){L(e)}}),e}function zo(){let e=new t(`preview`).description(`Manage sandbox preview links`);return e.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching preview links...`);t.json||i.start();let a=await(await z(r,n,e)).previewLinks.list();i.stop(),t.json?D(a):a.length===0?console.log(`No preview links found`):I([`Preview ID`,`Port`,`URL`,`Status`],a.map(e=>[e.previewId.slice(0,12),String(e.port),e.url,e.status]))}catch(e){L(e)}}),e.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Creating preview for port ${t}...`);n.json||a.start();let o=await(await z(i,r,e)).previewLinks.create(Number.parseInt(t,10));a.stop(),n.json?D(o):(O(`Preview created: ${o.url}`),console.log(`Preview ID: ${o.previewId}`))}catch(e){L(e)}}),e.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Removing preview...`);n.json||a.start(),await(await z(i,r,e)).previewLinks.remove(t),a.stop(),n.json?D({success:!0,previewId:t}):O(`Preview removed: ${t}`)}catch(e){L(e)}}),e}function Bo(){let e=new t(`process`).description(`Manage processes in a sandbox`);return e.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a={};if(n.env)for(let e of n.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(a[t]=n.join(`=`))}let o=M(`Spawning: ${t}`);n.json||o.start();let s=await z(i,r,e);if(s=await B(s),n.blocking){let e=await s.exec(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?D(e):(e.stdout&&globalThis.process.stdout.write(e.stdout),e.stderr&&globalThis.process.stderr.write(e.stderr),e.exitCode!==0&&globalThis.process.exit(e.exitCode))}else{let r=await s.process.spawn(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?D({pid:r.pid,command:r.command}):(console.log(`Process started with PID: ${r.pid}`),console.log(`Use 'tangle process logs ${e} ${r.pid}' to view output`))}}catch(e){L(e)}}),e.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching processes...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.process.list();t.running&&(o=o.filter(e=>e.running)),i.stop(),t.json?D(o):o.length===0?console.log(`No processes found`):I([`PID`,`Command`,`Status`,`Exit Code`,`Started`],o.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}catch(e){L(e)}}),e.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Fetching process info...`);n.json||a.start();let o=await z(i,r,e);o=await B(o);let s=await o.process.get(Number.parseInt(t,10));if(a.stop(),!s){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}let c=await s.status();n.json?D(c):(console.log(`PID: ${c.pid}`),console.log(`Command: ${c.command}`),console.log(`CWD: ${c.cwd||`(default)`}`),console.log(`Status: ${c.running?`running`:`exited`}`),console.log(`Exit Code: ${c.exitCode}`),c.exitSignal&&console.log(`Signal: ${c.exitSignal}`),console.log(`Started: ${c.startedAt.toLocaleString()}`),c.exitedAt&&console.log(`Exited: ${c.exitedAt.toLocaleString()}`))}catch(e){L(e)}}),e.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Sending ${n.signal} to PID ${t}...`);n.json||a.start();let o=await z(i,r,e);o=await B(o);let s=await o.process.get(Number.parseInt(t,10));if(!s){a.stop(),console.error(`Process ${t} not found`),globalThis.process.exit(1);return}n.tree?await s.kill(n.signal,{tree:!0}):await s.kill(n.signal),a.stop(),n.json?D({pid:Number.parseInt(t,10),signal:n.signal,...n.tree===!0?{tree:!0}:{},killed:!0}):console.log(n.tree?`Sent ${n.signal} to process tree ${t}`:`Sent ${n.signal} to process ${t}`)}catch(e){L(e)}}),e.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).option(`--json`,`Output as JSON lines`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await z(T(r),r,e);i=await B(i);let a=await i.process.get(Number.parseInt(t,10));if(!a){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of a.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}catch(e){L(e)}}),e}const Vo=[`python`,`node`,`typescript`,`bash`];function Ho(e){switch(te(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function Uo(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await je(ne(e),`utf8`)}async function Wo(e,t,n=Uo){let r=t?Vo.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${Vo.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=Ho(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function Go(e){return h(_e(),`tangle-run-images`,e)}function Ko(){return new t(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${Vo.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).option(`--json`,`Output the full CodeExecutionResult as JSON`).action(async(e,t,n)=>{try{let{language:r,source:i}=await Wo(t,n.lang),o=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),s=await z(T(o),o,e);s=await B(s);let c=M(`Running ${r} (${i.length}b)…`);n.json||c.start();let u=await s.runCode(r,i,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10)});if(c.stop(),n.json){D(u),u.exitCode!==0&&process.exit(u.exitCode);return}u.stdout&&process.stdout.write(u.stdout),u.stderr&&process.stderr.write(u.stderr);let d=0;for(let t of u.results)if(t.type===`image`)if(n.saveImages!==!1){let r=typeof n.saveImages==`string`?n.saveImages:Go(e);l(r,{recursive:!0});let i=`${r}/${Date.now()}-${d}.${t.format}`;f(i,Buffer.from(t.data,`base64`)),process.stderr.write(a.green(`✓ image → ${i}\n`)),d++}else process.stderr.write(a.gray(`[image: ${t.format}, ${t.data.length}b base64]\n`));else if(t.type===`dataframe`){let e=t.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(a.gray(`[dataframe ${t.rows.length}×${t.columns.length}${t.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${e}\n`);for(let e of t.rows.slice(0,20))process.stderr.write(`${e.map(e=>String(e)).join(` | `)}\n`);t.rows.length>20&&process.stderr.write(a.gray(`… ${t.rows.length-20} more rows\n`))}else t.type===`json`?(process.stderr.write(a.gray(`[json] `)),process.stderr.write(`${JSON.stringify(t.value,null,2)}\n`)):t.type===`html`?process.stderr.write(a.gray(`[html ${t.value.length}b]\n`)):t.type===`error`?(process.stderr.write(a.red(`✗ ${t.name}: ${t.message}\n`)),t.traceback&&process.stderr.write(`${t.traceback}\n`)):t.type===`text`&&process.stderr.write(`${t.value}\n`);u.error&&(process.stderr.write(a.red(`\n✗ ${u.error.name}: ${u.error.message}\n`)),u.error.traceback&&process.stderr.write(`${u.error.traceback}\n`)),u.exitCode!==0&&process.exit(u.exitCode)}catch(e){L(e)}})}function qo(e){return`${e.name} (${e.id})`}async function Jo(e,t){if(t.startsWith(`team_`))return e.teams.get(t);let n=(await e.teams.list()).filter(e=>e.name.toLowerCase()===t.toLowerCase());if(n.length===0)throw Error(`Team not found: ${t}`);if(n.length>1)throw Error(`Team name is ambiguous: ${t}. Use a team id instead.`);return n[0]}async function X(e,t,n){if(t)return Jo(e,t);let r=Vt(n);if(!r.activeTeamId)throw Error("No active team. Run `tangle team switch <team>` or pass `--team <team>`.");return e.teams.get(r.activeTeamId)}function Yo(e,t){Ht({id:e.id,name:e.name},t)}function Xo(e){Ut(e)}async function Zo(e){let t=typeof e.envVarName==`string`&&e.envVarName.length>0?e.envVarName:null,n=!!e.fromStdin;if(t&&n)throw Error(`Pass either ${e.flagPrefix}-env or ${e.flagPrefix}-stdin, not both`);if(t){let n=process.env[t];if(!n||n.length===0)throw Error(`${e.flagPrefix}-env points at ${t}, but that environment variable is empty or unset`);return n}if(n){let t=await zn();if(t.length===0)throw Error(`${e.flagPrefix}-stdin received empty input on stdin`);return t}}function Qo(e){let t=e.split(`/`);return t.length>=2?{provider:t[0],model:t.slice(1).join(`/`)}:{model:e}}function $o(){let e=new t(`sandbox`).description(`Manage sandboxes`);e.command(`create`).description(`Create a new sandbox`).option(`-n, --name <name>`,`Sandbox name`).option(`-e, --environment <environment>`,`Named environment, container image, or built image ID`).option(`--bare`,`Create a bare sandbox without the agent runtime`).option(`--ssh`,`Enable SSH access`).option(`--ssh-key <key>`,`SSH public key for authentication`).option(`--ssh-keys <names...>`,`Stored SSH key names or IDs for authentication`).option(`--ssh-key-file <paths...>`,`SSH public key file paths for authentication`).option(`--web-terminal`,`Enable web terminal`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--secret <names...>`,`Secrets to inject as environment variables`).option(`--metadata <entries...>`,`Metadata entries (KEY=VALUE or KEY=JSON)`).option(`--cpu <cores>`,`CPU cores`,`2`).option(`--memory <mb>`,`Memory in MB`,`4096`).option(`--disk <gb>`,`Disk size in GB`,`20`).option(`--accelerator-kind <kind>`,`Accelerator kind, for example nvidia-h100 or amd-mi300x`).option(`--accelerator-count <count>`,`Accelerator device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB`).option(`--gpu-provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum customer spend for the create-time GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum create-time GPU lease lifetime in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy the create-time GPU lease after this many idle seconds`).option(`--lifetime <seconds>`,`Max wall-clock lifetime before the sandbox is suspended — stopped, not deleted; resume it within the cold window (default 3600 = 1h). Raise it for long sessions, e.g. --lifetime 7200`,`3600`).option(`--idle-timeout <seconds>`,"Idle time before the sandbox is stopped — not deleted (default 900 = 15m). Resume it later with `tangle sandbox resume <id-or-name>`, or it auto-resumes on next use. Raise it for demos, e.g. --idle-timeout 3600",`900`).option(`--from-snapshot <id>`,`Create the sandbox from a snapshot`).option(`--public-template <id-or-slug>`,`Create the sandbox from a published public template`).option(`--public-template-version <id>`,`Pin creation to a specific published public-template version`).option(`--billing-owner <userId>`,`Platform user that pays for the sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--team <team>`,`Create in a team by id or name`).option(`--personal`,`Create a personal sandbox even when a team is active`).option(`--git-url <url>`,`Git repository URL to clone during provisioning`).option(`--git-ref <ref>`,`Git branch, tag, or commit to checkout`).option(`--git-depth <depth>`,`Git clone depth`).option(`--git-sparse <paths...>`,`Sparse checkout paths`).option(`--git-token-env <name>`,`Name of an environment variable containing the Git HTTPS auth token`).option(`--git-token-stdin`,`Read the Git HTTPS auth token from stdin`).option(`--storage-type <type>`,`BYOS3 storage type (s3, gcs, r2)`).option(`--storage-bucket <name>`,`BYOS3 bucket name`).option(`--storage-endpoint <url>`,`BYOS3 endpoint URL`).option(`--storage-region <region>`,`BYOS3 region`).option(`--storage-prefix <prefix>`,`BYOS3 path prefix`).option(`--storage-access-key-id <id>`,`BYOS3 access key ID`).option(`--storage-secret-access-key-env <name>`,`Name of an environment variable containing the BYOS3 secret access key`).option(`--storage-secret-access-key-stdin`,`Read the BYOS3 secret access key from stdin`).option(`--driver <type>`,`Infrastructure driver (docker, firecracker, host-agent, tangle)`).option(`--driver-criu`,`Enable CRIU checkpointing (firecracker only)`).option(`--driver-region <region>`,`Preferred region for host-agent driver`).option(`--backend <type>`,`Backend agent type (opencode, claude-code, kimi-code, codex, amp)`).option(`--backend-model <model>`,`Model override (format: provider/model)`).option(`--backend-api-key-env <name>`,`Name of an environment variable containing the BYOK backend API key`).option(`--backend-api-key-stdin`,`Read the BYOK backend API key from stdin`).option(`--tee <type>`,`Require a TEE backend (any, tdx, nitro, sev-snp, phala-dstack)`).option(`--sealed`,`Request TEE sealed-secret support`).option(`--attestation-nonce <hex|auto>`,`Deploy-time attestation nonce; use auto to generate one`).option(`--attestation-refresh`,`Generate a fresh deploy-time attestation nonce when --tee is set`).option(`--require-attestation`,`Fail unless TEE attestation evidence is returned`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`--timeout <ms>`,`HTTP timeout in milliseconds`,`30000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=[[`cpu`,`cpuCores`],[`memory`,`memoryMB`],[`disk`,`diskGB`]].filter(([e])=>t.getOptionValueSource(e)===`default`).map(([,e])=>e),r=await Zo({envVarName:e.gitTokenEnv,fromStdin:e.gitTokenStdin,flagPrefix:`--git-token`}),i=await Zo({envVarName:e.storageSecretAccessKeyEnv,fromStdin:e.storageSecretAccessKeyStdin,flagPrefix:`--storage-secret-access-key`}),a=await Zo({envVarName:e.backendApiKeyEnv,fromStdin:e.backendApiKeyStdin,flagPrefix:`--backend-api-key`}),o=C({apiKey:e.apiKey,baseUrl:e.baseUrl,timeout:e.timeout?Number.parseInt(e.timeout,10):void 0}),s=T(o),c=M(`Creating sandbox...`);c.start();let l=await as({client:s,explicitTeam:e.team,personal:e.personal,activeTeamId:o.activeTeamId}),d={};if(e.env)for(let t of e.env){let[e,...n]=t.split(`=`);e&&n.length>0&&(d[e]=n.join(`=`))}let f=e.metadata?ts(e.metadata):void 0,p=rs(e,r),m=is(e,i),ee=e.acceleratorKind?Ea({kind:String(e.acceleratorKind),count:String(e.acceleratorCount),memory:typeof e.acceleratorMemory==`string`?e.acceleratorMemory:void 0}):void 0,te=Da({provider:typeof e.gpuProvider==`string`?e.gpuProvider:void 0,image:typeof e.gpuWorkerImage==`string`?e.gpuWorkerImage:void 0,env:Array.isArray(e.gpuEnv)?e.gpuEnv:void 0,maxSpendUsd:typeof e.gpuMaxSpendUsd==`string`?e.gpuMaxSpendUsd:void 0,maxLifetime:typeof e.gpuMaxLifetime==`string`?e.gpuMaxLifetime:void 0,idleTimeout:typeof e.gpuIdleTimeout==`string`?e.gpuIdleTimeout:void 0},!!ee,`Create-time GPU lease flags require --accelerator-kind`),h=e.driver?{type:e.driver,enableCriu:e.driverCriu||void 0,preferredRegion:e.driverRegion}:void 0,ne=e.backend||e.backendModel?{...e.backend?{type:fe(e.backend)}:{},model:e.backendModel||a?{...e.backendModel?Qo(e.backendModel):{},apiKey:a}:void 0}:void 0,g=[...e.sshKey?[e.sshKey]:[],...(e.sshKeyFile??[]).map(e=>u(e,`utf8`).trim())],_={name:e.name,environment:e.environment,bare:e.bare||void 0,sshEnabled:e.ssh||!!e.sshKey||g.length>0||!!e.sshKeys?.length,sshPublicKeys:g.length>0?g:void 0,sshKeyIds:e.sshKeys,webTerminalEnabled:e.webTerminal,env:Object.keys(d).length>0?d:void 0,git:p,resources:{cpuCores:Number.parseInt(e.cpu,10),memoryMB:Number.parseInt(e.memory,10),diskGB:Number.parseInt(e.disk,10),accelerator:ee,...n.length>0?{advisoryFields:n}:{}},gpuLease:te,maxLifetimeSeconds:Number.parseInt(e.lifetime,10),idleTimeoutSeconds:Number.parseInt(e.idleTimeout,10),storage:m,fromSnapshot:e.fromSnapshot,publicTemplateId:e.publicTemplate,publicTemplateVersionId:e.publicTemplateVersion,teamId:l,...e.billingOwner?{billingOwnerId:e.billingOwner}:{},secrets:e.secret,metadata:f,driver:h,backend:ne},re=e.tee?{tee:e.tee,sealed:e.sealed||void 0,attestationRefresh:e.attestationRefresh||e.attestationNonce===`auto`||void 0}:void 0,ie=re?await ue(s,{..._,confidential:re,attestationNonce:e.attestationNonce??(e.attestationRefresh?`auto`:void 0),requireAttestation:e.requireAttestation??!0}):void 0,v=ie?.sandbox??await s.create(_);e.wait&&(c.text=`Waiting for sandbox to start...`,await v.waitFor(`running`,{timeoutMs:12e4}),await v.refresh()),c.stop(),e.json?D({id:v.id,name:v.name,status:v.status,createdAt:v.createdAt,expiresAt:v.expiresAt,connection:es(v.connection),teamId:l,gpuLease:v.gpuLease,confidential:re,attestation:ie?.attestation,attestationNonce:ie?.attestationNonce}):(O(`Sandbox created: ${v.id}`),un({id:v.id,name:v.name,status:v.status,createdAt:v.createdAt?.toISOString(),expiresAt:v.expiresAt?.toISOString(),connection:v.connection}),l&&console.log(`Team: ${l}`),v.gpuLease&&(console.log(`GPU lease: ${v.gpuLease.id}`),cs(v.gpuLease)),re&&(console.log(`TEE: ${re.tee}`),console.log(`Attestation: ${ie?.attestation?`present`:`not returned`}`),ie?.attestationNonce&&console.log(`Attestation nonce: ${ie.attestationNonce}`)))}catch(e){L(e)}}),e.command(`attestation <id-or-name>`).description(`Fetch TEE attestation evidence for a sandbox`).option(`--nonce <hex|auto>`,`Nonce to bind into a fresh attestation report; use auto to generate one`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=t.nonce===`auto`?de():t.nonce,a=M(`Fetching TEE attestation...`);a.start();let o=await(await z(r,n,e)).getTeeAttestation(i?{attestationNonce:i}:void 0);a.stop(),t.json?D(o):(O(`Attestation fetched for ${e}`),console.log(`TEE type: ${o.attestation.tee_type}`),console.log(`Evidence bytes: ${o.attestation.evidence.length}`),console.log(`Measurement bytes: ${o.attestation.measurement.length}`),console.log(`Timestamp: ${o.attestation.timestamp}`),o.attestationNonce&&console.log(`Nonce: ${o.attestationNonce}`))}catch(e){L(e)}}),e.command(`list`).description(`List all sandboxes`).option(`-s, --status <status>`,`Filter by status (running, stopped, all)`).option(`-l, --limit <n>`,`Limit results`,`50`).option(`--team <team>`,`List sandboxes for a team by id or name`).option(`--personal`,`List personal sandboxes`).option(`--all-scopes`,`List personal and team sandboxes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=C({apiKey:e.apiKey,baseUrl:e.baseUrl}),n=T(t),r=M(`Fetching sandboxes...`);r.start();let i=await os({client:n,explicitTeam:e.team,personal:e.personal,allScopes:e.allScopes,activeTeamId:t.activeTeamId}),a=await n.list({status:e.status===`all`?void 0:e.status,limit:Number.parseInt(e.limit,10),scope:i});r.stop(),e.json?D(a):E(a.map(e=>({id:e.id,status:e.status,createdAt:e.createdAt,name:e.name??``})),[{key:`id`,header:`ID`,width:24},{key:`status`,header:`Status`,width:14},{key:`createdAt`,header:`Created`,width:16},{key:`name`,header:`Name`,width:20}])}catch(e){L(e)}}),e.command(`get <id-or-name>`).description(`Get sandbox details`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching sandbox...`);i.start();let a=await z(r,n,e);i.stop(),t.json?D(a):un({id:a.id,name:a.name,status:a.status,createdAt:a.createdAt?.toISOString(),expiresAt:a.expiresAt?.toISOString(),connection:a.connection})}catch(e){L(e)}}),e.command(`delete <id-or-name>`).description(`Delete a sandbox`).option(`-f, --force`,`Skip confirmation`).option(`--name`,`Treat the reference as a sandbox name`).option(`--retry-cleanup`,`Retry server-side cleanup after the sandbox disappeared from get/list`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(!t.force){let t=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(n=>{t.question(`Delete sandbox ${e}? [y/N] `,e=>{t.close(),n(e.toLowerCase()===`y`)})})){j(`Cancelled.`);return}}let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Deleting sandbox...`);i.start();let a=await Nn(r,n,e,{retryCleanup:t.retryCleanup,name:t.name});i.stop(),O(a===`already_absent`?`Sandbox ${e} was already gone.`:`Sandbox ${e} deleted.`)}catch(e){L(e)}}),e.command(`stop <id-or-name>`).description(`Stop a running sandbox`).option(`--name`,`Treat the reference as a sandbox name`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Stopping sandbox...`);i.start(),await(await z(r,n,e,{nameOnly:t.name})).stop(),i.stop(),O(`Sandbox ${e} stopped.`)}catch(e){L(e)}}),e.command(`resume <id-or-name>`).description(`Resume a stopped sandbox`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`-t, --timeout <ms>`,`Resume timeout in milliseconds; a cold resume re-provisions the sandbox, so this defaults higher than other commands (default 120000)`,`120000`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Number.parseInt(t.timeout,10);if(!Number.isFinite(n)||n<=0)throw Error(`--timeout must be a positive number of milliseconds`);let r=C({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:n}),i=T(r),a=M(`Resuming sandbox...`);a.start();let o=await z(i,r,e);await o.resume({timeoutMs:n}),t.wait&&(a.text=`Waiting for sandbox to start...`,await o.waitFor(`running`,{timeoutMs:n})),a.stop(),O(`Sandbox ${o.id} resumed.`)}catch(e){L(e)}});let n=e.command(`gpu`).description(`Manage on-demand GPU leases for a sandbox`);return n.command(`attach <id-or-name>`).description(`Attach a temporary GPU worker to a sandbox`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Attaching GPU lease...`);i.start();let a=await(await z(r,n,e)).gpu.attach(Oa(t));i.stop(),t.json?D(a):(O(`GPU lease attached: ${a.id}`),cs(a))}catch(e){L(e)}}),n.command(`run <id-or-name> <command...>`).description(`Attach a temporary GPU, run a command, then destroy it`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker and command (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{let r,i,a,o;try{let a=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),o=await z(T(a),a,e),s=M(`Attaching GPU lease...`);s.start(),r=await o.gpu.attach(Oa(n)),s.stop();let c=M(`Running GPU command...`);c.start(),i=await o.gpu.exec(r.id,{command:t.join(` `),timeoutMs:n.timeout?K(String(n.timeout),`--timeout`):void 0,cwd:n.cwd,env:n.env?ka(n.env,`--env`,`env`):void 0}),c.stop(),n.json||ls(i)}catch(e){a=e}finally{if(r)try{let t=C({apiKey:n.apiKey,baseUrl:n.baseUrl});r=await(await z(T(t),t,e)).gpu.detach(r.id)}catch(e){o=e}}if(a){L(a),o&&L(o);return}if(o){L(o);return}n.json?D({lease:r,result:i}):r&&O(`GPU lease detached: ${r.id}`);let s=i?.result.exitCode;s&&s!==0&&(process.exitCode=s)}),n.command(`list <id-or-name>`).description(`List GPU leases attached to a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching GPU leases...`);i.start();let a=await(await z(r,n,e)).gpu.list();i.stop(),t.json?D(a):a.length===0?j(`No GPU leases attached.`):E(a.map(e=>({id:e.id,status:e.status,provider:e.provider,accelerator:`${e.accelerator.kind}x${e.accelerator.count}`,customerUsdHr:e.customerPricePerHourUsd??``})),[{key:`id`,header:`ID`,width:28},{key:`status`,header:`Status`,width:12},{key:`provider`,header:`Provider`,width:12},{key:`accelerator`,header:`GPU`,width:24},{key:`customerUsdHr`,header:`$/hr`,width:10}])}catch(e){L(e)}}),n.command(`exec <id-or-name> <lease-id> <command...>`).description(`Run a command on an attached GPU lease`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=C({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=T(i),o=M(`Running GPU command...`);o.start();let s=await(await z(a,i,e)).gpu.exec(t,{command:n.join(` `),timeoutMs:r.timeout?K(String(r.timeout),`--timeout`):void 0,cwd:r.cwd,env:r.env?ka(r.env,`--env`,`env`):void 0});o.stop(),r.json?D(s):ls(s)}catch(e){L(e)}}),n.command(`detach <id-or-name> <lease-id>`).description(`Detach and destroy a GPU lease`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Detaching GPU lease...`);a.start();let o=await(await z(i,r,e)).gpu.detach(t);a.stop(),n.json?D(o):(O(`GPU lease detached: ${o.id}`),cs(o))}catch(e){L(e)}}),e.command(`network <id-or-name>`).description(`Show runtime network state (exposed ports) for a sandbox. Outbound policy is not settable here — see the outbound flags.`).option(`--block-outbound`,`Unenforceable; the server rejects it. Block outbound traffic with an egress policy of mode "blocked"`).option(`--allow-list <cidrs>`,`Unenforceable; the server rejects it. Egress policy allowlists domains, not CIDRs`).option(`--clear`,`Unenforceable; the server rejects it. There is no per-sandbox outbound restriction here to clear`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Updating network configuration...`);i.start();let a=await z(r,n,e);if(t.clear)await a.network.update({blockOutbound:!1,allowList:[]});else if(t.blockOutbound)await a.network.update({blockOutbound:!0});else if(t.allowList){let e=t.allowList.split(`,`).map(e=>e.trim());await a.network.update({allowList:e})}else{i.stop();let e=await a.network.getConfig();t.json?D(e):(j(`Network Configuration:`),e.ports&&e.ports.length>0?j(` Exposed Ports: ${e.ports.join(`, `)}`):j(` No exposed ports`));return}i.stop();let o=await a.network.getConfig();t.json?D(o):(O(`Network configuration updated.`),o.ports&&o.ports.length>0&&j(` Exposed Ports: ${o.ports.join(`, `)}`))}catch(e){L(e)}}),e.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=Number.parseInt(t.port,10);if(Number.isNaN(i)||i<1||i>65535)throw Error(`Port must be a number between 1 and 65535`);let a=M(`Exposing port ${i}...`);a.start();let o=await(await z(r,n,e)).network.exposePort(i);a.stop(),t.json?D({port:i,url:o}):(O(`Port ${i} exposed.`),j(` URL: ${o}`))}catch(e){L(e)}}),e.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching exposed URLs...`);i.start();let a=await(await z(r,n,e)).network.listUrls();if(i.stop(),t.json)D(a);else{let e=Object.entries(a);if(e.length===0)j(`No ports exposed.`);else{j(`Exposed Ports:`);for(let[t,n]of e)j(` ${t}: ${n}`)}}}catch(e){L(e)}}),e}function es(e){return!e||e.authToken===void 0?e:{...e,authToken:`[REDACTED]`}}function ts(e){let t={};for(let n of e){let[e,...r]=n.split(`=`);if(!e||r.length===0)throw Error(`--metadata expects values in KEY=VALUE or KEY=JSON format`);t[e]=ns(r.join(`=`))}return t}function ns(e){try{return JSON.parse(e)}catch{return e}}function rs(e,t){if(!(!e.gitUrl&&!e.gitRef&&!e.gitDepth&&!e.gitSparse&&!t)){if(!e.gitUrl||typeof e.gitUrl!=`string`)throw Error(`--git-url is required when using git provisioning options`);return{url:e.gitUrl,ref:typeof e.gitRef==`string`?e.gitRef:void 0,depth:typeof e.gitDepth==`string`?K(e.gitDepth,`--git-depth`):void 0,sparse:Array.isArray(e.gitSparse)?e.gitSparse:void 0,auth:t?{token:t}:void 0}}}function is(e,t){if(!(!e.storageType&&!e.storageBucket&&!e.storageEndpoint&&!e.storageRegion&&!e.storagePrefix&&!e.storageAccessKeyId&&!t)){if(typeof e.storageType!=`string`||typeof e.storageBucket!=`string`||typeof e.storageAccessKeyId!=`string`||!t)throw Error(`Storage config requires --storage-type, --storage-bucket, --storage-access-key-id, and one of --storage-secret-access-key-env / --storage-secret-access-key-stdin`);return{type:ss(e.storageType),bucket:e.storageBucket,endpoint:typeof e.storageEndpoint==`string`?e.storageEndpoint:void 0,region:typeof e.storageRegion==`string`?e.storageRegion:void 0,prefix:typeof e.storagePrefix==`string`?e.storagePrefix:void 0,credentials:{accessKeyId:e.storageAccessKeyId,secretAccessKey:t}}}}async function as(e){if(e.explicitTeam&&e.personal)throw Error(`--team and --personal cannot be used together`);if(!e.personal)return e.explicitTeam?(await Jo(e.client,e.explicitTeam)).id:e.activeTeamId}async function os(e){if([!!e.explicitTeam,!!e.personal,!!e.allScopes].filter(Boolean).length>1)throw Error(`--team, --personal, and --all-scopes are mutually exclusive`);if(e.allScopes)return`all`;if(e.personal)return`personal`;if(e.explicitTeam)return`team:${(await Jo(e.client,e.explicitTeam)).id}`;if(e.activeTeamId)return`team:${e.activeTeamId}`}function ss(e){if(e===`s3`||e===`gcs`||e===`r2`)return e;throw Error(`--storage-type must be one of s3, gcs, or r2`)}function cs(e){j(` Status: ${e.status}`),j(` Provider: ${e.provider}`),j(` GPU: ${e.accelerator.kind} x ${e.accelerator.count}`),e.customerPricePerHourUsd!==void 0&&j(` Customer price: $${e.customerPricePerHourUsd}/hr`),e.estimatedCustomerCostUsd!==void 0&&j(` Max estimate: $${e.estimatedCustomerCostUsd}`),e.billing&&(j(` Billed seconds: ${e.billing.seconds}`),j(` Customer cost: $${e.billing.customerCostUsd}`))}function ls(e){e.result.stdout&&process.stdout.write(e.result.stdout),e.result.stderr&&process.stderr.write(e.result.stderr),j(`Exit code: ${e.result.exitCode}`)}function us(){return new t(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).option(`--json`,`Output as JSON lines`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Searching...`);n.json||a.start();let o=await z(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)}catch(e){L(e)}})}function ds(){let e=new t(`secret`).description(`Manage secrets`);return e.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=T(C({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=await fs({value:t,valueStdin:n.valueStdin,prompt:`Enter value for secret '${e}': `}),a=M(`Creating secret...`);a.start();let o=await r.secrets.create(e,i);a.stop(),n.json?D({name:o.name,createdAt:o.createdAt.toISOString(),updatedAt:o.updatedAt.toISOString()}):(O(`Secret created: ${o.name}`),j(`Use --secrets ${o.name} when creating a sandbox to inject it as an environment variable.`))}catch(e){L(e)}}),e.command(`list`).description(`List all secrets`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=M(`Fetching secrets...`);n.start();let r=await t.secrets.list();n.stop(),e.json?D(r.map(e=>({name:e.name,createdAt:e.createdAt.toISOString(),updatedAt:e.updatedAt.toISOString()}))):r.length===0?(j(`No secrets found.`),j(`Use 'tangle secret create <name> [value]' to create one.`)):I([`Name`,`Created At`,`Updated At`],r.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}catch(e){L(e)}}),e.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=T(C({apiKey:t.apiKey,baseUrl:t.baseUrl}));if(!t.force&&!await V(`Are you sure you want to delete secret '${e}'? This cannot be undone. (y/N) `)){j(`Cancelled.`);return}let r=M(`Deleting secret...`);r.start(),await n.secrets.delete(e),r.stop(),t.json?D({success:!0,deleted:e}):O(`Secret deleted: ${e}`)}catch(e){L(e)}}),e}async function fs(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);if(e.value!==void 0){if(e.value.length===0)throw Error(`Secret value cannot be empty`);return e.value}if(e.valueStdin){let e=await zn();if(e.length===0)throw Error(`Secret value from stdin cannot be empty`);return e}let t=await Rn(e.prompt);if(t.length===0)throw Error(`Secret value cannot be empty`);return t}function ps(){let e=new t(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=p.dirname(Me(import.meta.url)),t=p.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function ms(){let e=new t(`snapshot`).description(`Manage snapshots`);return e.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Creating snapshot...`);i.start();let a=await(await z(r,n,e)).snapshot({tags:t.tags});i.stop(),t.json?D(a):(O(`Snapshot created: ${a.snapshotId}`),console.log(`Size: ${hs(a.sizeBytes??0)}`))}catch(e){L(e)}}),e.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching snapshots...`);i.start();let a=await(await z(r,n,e)).listSnapshots();i.stop(),t.json?D(a):E(a.map(e=>({...e,size:hs(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}catch(e){L(e)}}),e.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--billing-owner <userId>`,`Platform user that pays for the restored sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=T(C({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=M(`Restoring from snapshot...`);i.start();let a=await r.create({fromSnapshot:t,fromSandboxId:e,...n.billingOwner?{billingOwnerId:n.billingOwner}:{}});await a.waitFor(`running`,{timeoutMs:12e4}),i.stop(),n.json?D({sandboxId:a.id,restoredFrom:t,status:a.status}):(O(`New sandbox created: ${a.id}`),console.log(`Source snapshot: ${t}`))}catch(e){L(e)}}),e.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Reverting sandbox to snapshot...`);a.start();let o=await z(i,r,e),s=await o.revertToSnapshot(t);await o.refresh(),a.stop(),n.json?D({sandboxId:o.id,snapshotId:s.snapshotId,status:o.status}):(O(`Sandbox reverted: ${o.id}`),console.log(`Source snapshot: ${s.snapshotId}`))}catch(e){L(e)}}),e.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Deleting snapshot...`);a.start();let o=await(await z(i,r,e)).deleteSnapshot(t);a.stop(),n.json?D({success:!0,sandboxId:e,snapshotId:t,outcome:o.outcome}):o.outcome===`already_absent`?O(`Snapshot already gone: ${t}`):O(`Snapshot deleted: ${t}`)}catch(e){L(e)}}),e}function hs(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}function gs(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sidecar-proxy/${t}/ssh`}function _s(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function vs(e){return`'${e.replace(/'/g,`''`)}'`}function ys(e){return e===`win32`?`NUL`:`/dev/null`}function bs(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${vs(`<token>`)}; ssh ${e.map(vs).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${_s(`<token>`)} ssh ${e.map(_s).join(` `)}`}function xs(e){return e.connection!==void 0&&!e.connection.ssh}function Ss(){k(`SSH is not enabled for this sandbox.`),j(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function Cs(e,t=[],n=process.platform){let r=ys(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function ws(){return new t(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).allowUnknownOption(!0).action(async(e,t,n)=>{try{let r=C({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=T(r),a=M(`Getting SSH credentials...`);a.start();let o=await z(i,r,e);if(xs(o)){a.stop(),Ss();return}o=await B(o);let s=await o.ssh();if(a.stop(),!s){Ss();return}let c={...s,proxyCommand:gs(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let l=Cs(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(bs(l,process.platform));return}j(`Connecting via tunnel...`);let u=ye(`ssh`,l,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});u.on(`error`,e=>{e.code===`ENOENT`&&(k(`SSH client not found. Please install OpenSSH.`),process.exit(1)),L(e)}),u.on(`exit`,e=>{process.exit(e??0)})}catch(e){L(e)}})}function Ts(){let e=new t(`ssh-keys`).description(`Manage SSH keys`);return e.command(`list`).description(`List SSH keys`).option(`--json`,`Output as JSON`).action(async e=>{let t=M(`Fetching SSH keys...`);try{t.start();let n=await T(C(e)).sshKeys.list();t.stop(),e.json?D({sshKeys:n}):n.length===0?j(`No SSH keys found.`):I([`Name`,`Type`,`Fingerprint`,`Created`],n.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){t.stop(),L(e)}}),e.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).option(`--json`,`Output as JSON`).action(async(e,t)=>{let n=M(`Adding SSH key...`);try{let r=u(t.keyFile,`utf8`).trim();n.start();let i=await T(C(t)).sshKeys.create(e,r);n.stop(),t.json?D({sshKey:i}):O(`Added SSH key ${i.name} (${i.fingerprint})`)}catch(e){n.stop(),L(e)}}),e.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=M(`Deleting SSH key...`);try{n.start(),await T(C(t)).sshKeys.delete(e),n.stop(),O(`Deleted SSH key ${e}`)}catch(e){n.stop(),L(e)}}),e}function Es(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function Ds(){return new t(`ssh-proxy`).description(`SSH proxy helper that pipes stdin/stdout to WebSocket`).argument(`<runtime-url>`,`Runtime WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||Es(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new Ne(new URL(e.replace(/^http/,`ws`)),{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),r;function i(){r&&=(clearInterval(r),void 0)}n.on(`open`,()=>{r=setInterval(()=>{n.readyState===Ne.OPEN&&n.ping()},15e3),r.unref?.(),process.stdin.on(`data`,e=>{n.readyState===Ne.OPEN&&n.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>n.close(1e3))}),n.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),n.on(`error`,e=>{i(),Es(`WebSocket error: ${e.message}`)}),n.on(`close`,e=>{i(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>n.close())})}const Os=[`claude-code`,`opencode`,`codex`,`kimi-code`,`prime`],ks=[`project`,`read-only`],As={min:1,max:15},js=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function Ms(e){let t=Pe(e);if(t)return t;throw Error(`--model '${e}' has no provider. Pass a canonical id, for example 'deepseek/${e}'.`)}function Ns(e,t){return{...e,harness:t}}function Ps(e){let t=e.harness??`claude-code`;if(!Os.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${Os.join(`, `)}.`);let n=e.tokenScope??`project`;if(!ks.includes(n))throw Error(`Unknown --token-scope '${n}'. Supported: ${ks.join(`, `)}.`);let r=Fs(e.maxTokens,2e5,`--max-tokens`),i=Fs(e.maxIterations,50,`--max-iterations`),a=Fs(e.tokenTtl,10,`--token-ttl`);if(a<As.min||a>As.max)throw Error(`--token-ttl ${a} out of range; the SDK clamps to [${As.min}, ${As.max}] minutes.`);let o=e.maxWorkers===void 0?void 0:Fs(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:r,maxIterations:i,tokenScope:n,tokenTtl:a,...o===void 0?{}:{maxWorkers:o}}}function Fs(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function Is(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function Ls(e){let{client:t,scope:n,ttlMinutes:r,onScope:i}=e,a={async create(e){let a=await t.create(Rs(e)),o={scope:n,ttlMinutes:r},s=await a.mintScopedToken(o);return i({id:a.id,scope:s.scope,expiresAt:s.expiresAt,status:`spawned`}),a}};return typeof t.criuStatus==`function`&&(a.criuStatus=t.criuStatus.bind(t)),a}function Rs(e){if(!e?.env)return e;let{TANGLE_API_KEY:t,...n}=e.env;return{...e,env:n}}function zs(e){if(e.kind===`no-winner`)return{text:``,tokenUsage:{input:0,output:0},costUsd:0,status:`no-winner (${e.reason})`};let t=e.out;return{text:typeof t==`string`?t:Bs(t)?t.content:JSON.stringify(t),tokenUsage:{input:e.spentTotal.tokens.input,output:e.spentTotal.tokens.output},costUsd:e.spentTotal.usd,status:`winner`}}function Bs(e){return typeof e==`object`&&!!e&&typeof e.content==`string`}const Vs={makeClient:e=>T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),resolveRouter:e=>({routerBaseUrl:js,routerKey:C({apiKey:e.apiKey}).apiKey}),supervise:Fe};async function Hs(e,t,n,r=Vs){let a=r.makeClient({apiKey:n.apiKey,baseUrl:n.baseUrl}),{budget:o,perWorker:s}=Is(t),c=[],l=Ie({backend:`sandbox`,sandboxClient:Ls({client:a,scope:t.tokenScope,ttlMinutes:t.tokenTtl,onScope:e=>{if(c.push(e),!n.json){let n=`ttl ${t.tokenTtl}m`;j(`worker ${e.id} [${e.scope} token ${n}] spawned`)}}}),maxIterations:1}),u=(e,n)=>l(Ns(e,t.harness),n),d={name:`supervisor`,harness:`cli-base`,model:{default:t.model??`deepseek-v4-flash`,provider:t.model?Ms(t.model):`deepseek`}},f=r.resolveRouter({apiKey:n.apiKey}),p=zs(await r.supervise(d,{goal:e},{budget:o,makeWorkerAgent:u,router:f,...s?{perWorker:s}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${i()}`})),m=p.status===`winner`?`settled`:`failed`;for(let e of c)e.status=m,n.json||j(`worker ${e.id} [${e.scope} token ttl ${t.tokenTtl}m] settled (${e.status})`);return{task:e,result:p.text,workers:c,tokenUsage:p.tokenUsage,costUsd:p.costUsd,status:p.status}}function Us(){let e=new t(`supervise`);return e.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task. Each worker box mints a short-lived scoped token instead of receiving the root API key.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${Os.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--token-scope <scope>`,`Per-worker token scope (${ks.join(` | `)})`,`project`).option(`--token-ttl <min>`,`Per-worker token TTL in minutes (SDK clamps to [1, 15])`,`10`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Ps({harness:t.harness,model:t.model,maxTokens:t.maxTokens,maxIterations:t.maxIterations,tokenScope:t.tokenScope,tokenTtl:t.tokenTtl,maxWorkers:t.maxWorkers});t.json||(j(`Supervising: ${e}`),j(`harness=${n.harness} budget=${n.maxTokens}tok/${n.maxIterations}it scope=${n.tokenScope} ttl=${n.tokenTtl}m`),console.log());let r=await Hs(e,n,{apiKey:t.apiKey,baseUrl:t.baseUrl,json:t.json});if(t.json){D(r),r.status!==`winner`&&(process.exitCode=1);return}if(console.log(),r.status!==`winner`)throw Error(`Supervisor finished without a winner: ${r.status}`);console.log(r.result),console.log(),N({"Input Tokens":r.tokenUsage.input,"Output Tokens":r.tokenUsage.output,Cost:`$${r.costUsd.toFixed(4)}`})}catch(e){L(e,t.json)}}),e}function Ws(){let e=new t(`team`).description(`Manage teams`);return e.command(`list`).description(`List teams for the current account`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async e=>{try{let t=C(e),n=T(t),r=e.json?null:M(`Fetching teams...`);r?.start();let i=await n.teams.list();if(r?.stop(),e.json){D({teams:i,activeTeamId:t.activeTeamId??null});return}E(i.map(e=>({active:e.id===t.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}catch(e){L(e)}}),e.command(`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=t.json?null:M(`Creating team...`);i?.start();let a=await r.teams.create({name:e,orgId:t.orgId});if(t.switch&&Yo(a,n.profile),i?.stop(),t.json){D({team:a,active:!!t.switch});return}O(`Team created: ${qo(a)}`),t.switch&&O(`Active team set to ${a.name}`)}catch(e){L(e)}}),e.command(`switch <team>`).description(`Set the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=await Jo(T(n),e);if(Yo(r,n.profile),t.json){D({team:r,activeTeamId:r.id});return}O(`Active team set to ${qo(r)}`)}catch(e){L(e)}}),e.command(`current`).description(`Show the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--profile <profile>`,`Credential profile`).action(e=>{try{let t=Vt(e.profile);if(e.json){D(t.activeTeamId?t:{activeTeamId:null});return}if(!t.activeTeamId){console.log(`No active team.`);return}N({ID:t.activeTeamId,Name:t.activeTeamName})}catch(e){L(e)}}),e.command(`clear`).description(`Clear the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--profile <profile>`,`Credential profile`).action(e=>{try{if(Xo(e.profile),e.json){D({activeTeamId:null});return}O(`Active team cleared.`)}catch(e){L(e)}}),e.command(`members [team]`).description(`List team members`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile),a=await r.teams.listMembers(i.id);if(t.json){D({team:i,members:a});return}E(a.map(e=>({id:e.id,email:e.customerEmail,role:e.role,status:e.status,joinedAt:e.joinedAt})),[{key:`id`,header:`ID`,width:36},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}catch(e){L(e)}}),e.command(`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile),a=Gs(t.role),o=await r.teams.updateMember(i.id,e,{role:a});if(t.json){D({team:i,member:o});return}O(`Member updated: ${o.customerEmail}`),N({Team:i.name,Role:o.role,Status:o.status})}catch(e){L(e)}}),e.command(`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile),a=Gs(t.role),o=await r.teams.invite(i.id,{email:e,role:a,ttlHours:t.ttlHours?Number.parseInt(t.ttlHours,10):void 0});if(t.json){D({team:i,invitation:o});return}O(`Invitation created for ${o.email}`),N({Team:i.name,Role:o.role,Expires:o.expiresAt,"Invitation ID":o.id}),O(`Re-run with --json to retrieve the invitation token for sharing.`)}catch(e){L(e)}}),e.command(`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile);if(!t.force&&!t.json&&!await V(`Leave team '${i.name}'? (y/N) `))return;if(await r.teams.leave(i.id),n.activeTeamId===i.id&&Xo(n.profile),t.json){D({success:!0,teamId:i.id});return}O(`Left team: ${i.name}`)}catch(e){L(e)}}),e.command(`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=C(n),i=T(r),a=await X(i,t,r.profile);if(!n.force&&!n.json&&!await V(`Transfer ownership of '${a.name}' to ${e}? This cannot be undone without the new owner's cooperation. (y/N) `))return;if(await i.teams.transferOwnership(a.id,e),n.json){D({success:!0,teamId:a.id,newOwnerCustomerId:e});return}O(`Ownership transferred for ${a.name}`)}catch(e){L(e)}}),e.addCommand(Ks()),e.addCommand(qs()),e.command(`invitations [team]`).description(`List pending and historical team invitations`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile),a=await r.teams.listInvitations(i.id);if(t.json){D({team:i,invitations:a});return}E(a.map(e=>({id:e.id,email:e.email,role:e.role,status:e.status,expiresAt:e.expiresAt})),[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}catch(e){L(e)}}),e.command(`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await r.teams.acceptInvitation(e),a=t.switch===!1?null:await r.teams.get(i.teamId);if(a&&Yo(a,n.profile),t.json){D({member:i,activeTeamId:a?.id??null});return}O(`Invitation accepted for team ${i.teamId}`),a&&O(`Active team set to ${a.name}`)}catch(e){L(e)}}),e.command(`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{if(await T(C(t)).teams.revokeInvitation(e),t.json){D({success:!0,invitationId:e});return}O(`Invitation revoked: ${e}`)}catch(e){L(e)}}),e.command(`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile);if(await r.teams.removeMember(i.id,e),t.json){D({success:!0,teamId:i.id,memberId:e});return}O(`Member removed: ${e}`)}catch(e){L(e)}}),e}function Gs(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function Ks(){let e=new t(`secret`).description(`Manage team secrets`);return e.command(`list [team]`).description(`List team secret names`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile),a=await r.teams.listSecrets(i.id);if(t.json){D({team:i,secrets:a});return}E(a.map(e=>({name:e.name,updatedAt:e.updatedAt,updatedBy:e.updatedBy})),[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}catch(e){L(e)}}),e.command(`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=C(n),i=T(r),a=await X(i,n.team,r.profile),o=await Js({value:t,valueStdin:n.valueStdin,prompt:`Enter value for team secret '${e}': `}),s=await i.teams.upsertSecret(a.id,e,o);if(n.json){D({team:a,secret:s});return}O(`Team secret saved: ${s.name}`)}catch(e){L(e)}}),e.command(`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile);if(!t.force&&!t.json&&!await V(`Delete team secret '${e}' from '${i.name}'? (y/N) `))return;if(await r.teams.deleteSecret(i.id,e),t.json){D({success:!0,teamId:i.id,name:e});return}O(`Team secret deleted: ${e}`)}catch(e){L(e)}}),e.command(`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile),a=await r.teams.revealSecret(i.id,e);if(t.json){D({teamId:i.id,...a});return}console.log(a.value)}catch(e){L(e)}}),e}function qs(){let e=new t(`templates`).description(`Manage team golden-path templates`);return e.command(`list [team]`).description(`List a team's golden-path templates`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,e,n.profile),a=await r.teams.listTemplates(i.id);if(t.json){D({team:i,templates:a});return}if(a.length===0){console.log(`No templates yet for ${i.name}.`);return}E(a.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}catch(e){L(e)}}),e.command(`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=C(n),i=T(r),a=await X(i,n.team,r.profile),o;if(n.config)try{let e=JSON.parse(n.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);o=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let s=await i.teams.createTemplate(a.id,{name:e,snapshotId:t,description:n.description,environment:n.environment,config:o});if(n.json){D({team:a,template:s});return}O(`Team template created: ${s.name} (${s.id})`)}catch(e){L(e)}}),e.command(`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=C(t),r=T(n),i=await X(r,t.team,n.profile);if(!t.force&&!t.json&&!await V(`Delete template '${e}' from '${i.name}'? (y/N) `))return;if(await r.teams.deleteTemplate(i.id,e),t.json){D({success:!0,teamId:i.id,templateId:e});return}O(`Team template deleted: ${e}`)}catch(e){L(e)}}),e}async function Js(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);if(e.value!==void 0){if(e.value.length===0)throw Error(`Secret value cannot be empty`);return e.value}if(e.valueStdin){let e=await zn();if(e.length===0)throw Error(`Secret value from stdin cannot be empty`);return e}let t=await Rn(e.prompt);if(t.length===0)throw Error(`Secret value cannot be empty`);return t}function Ys(){let e=new t(`template`).description(`Manage published public templates`);return e.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C(e)),n=e.featured?await t.publicTemplates.featured():await t.publicTemplates.list({query:e.query,tag:e.tag});if(e.json){D({templates:n});return}E(n.map(e=>({slug:e.slug,name:e.name,forks:e.forkCount,sandboxes:e.sandboxCount,updated:e.updatedAt})),[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forks`,header:`Forks`,width:8},{key:`sandboxes`,header:`Sandboxes`,width:12},{key:`updated`,header:`Updated`,width:24}])}catch(e){L(e)}}),e.command(`get <id-or-slug>`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await T(C(t)).publicTemplates.get(e);if(t.json){D({template:n});return}D(n)}catch(e){L(e)}}),e.command(`versions <id-or-slug>`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await T(C(t)).publicTemplates.versions(e);if(t.json){D({versions:n});return}E(n.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`snapshotId`,header:`Snapshot`,width:20},{key:`createdAt`,header:`Created`,width:24}])}catch(e){L(e)}}),e.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=await T(C(r)).publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom});if(r.json){D({template:i});return}O(`Published template: ${i.slug}`)}catch(e){L(e)}}),e.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=await T(C(r)).publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes});if(r.json){D({version:i});return}O(`Published template version: ${i.id}`)}catch(e){L(e)}}),e}function Xs(){let e=new t(`tools`).description(`Manage language runtimes and tools in a sandbox (via mise)`);return e.command(`list`).alias(`ls`).description(`List installed tools in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=C({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=T(n),i=M(`Fetching tools...`);t.json||i.start();let a=await(await z(r,n,e)).tools.list();i.stop(),t.json?D(a):a.length===0?console.log(`No tools installed`):I([`Tool`,`Version`,`Active`],a.map(e=>[e.name,e.version,e.active?`yes`:`no`]))}catch(e){L(e)}}),e.command(`install`).description(`Install a tool version`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name (e.g. node, python, go)`).argument(`<version>`,`Version to install (e.g. 20, 3.12, latest)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=C({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=T(i),o=M(`Installing ${t}@${n}...`);r.json||o.start(),await(await z(a,i,e)).tools.install(t,n),o.stop(),r.json?D({tool:t,version:n,installed:!0}):O(`Installed ${t}@${n}`)}catch(e){L(e)}}),e.command(`use`).description(`Activate a tool version for the current session`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name`).argument(`<version>`,`Version to activate`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=C({apiKey:r.apiKey,baseUrl:r.baseUrl});await(await z(T(i),i,e)).tools.use(t,n),O(`Activated ${t}@${n}`)}catch(e){L(e)}}),e.command(`run`).description(`Run a command with a specific tool`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name`).argument(`<args...>`,`Command arguments`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=C({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=T(i),o=M(`Running ${t} ${n.join(` `)}...`);r.json||o.start();let s=await(await z(a,i,e)).tools.run(t,n);o.stop(),r.json?D(s):(s.stdout&&process.stdout.write(s.stdout),s.stderr&&process.stderr.write(s.stderr),s.exitCode!==0&&process.exit(s.exitCode))}catch(e){L(e)}}),e}function Zs(){let e=new t(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return e.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async e=>{try{let t={from:e.from,to:e.to,model:e.model,runId:e.run,status:e.status===void 0?void 0:cc(e.status),q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:pc(e.limit)},n=$s(e),r=e.json?null:M(`Fetching traces...`);r?.start();let i=await n.listTraces(t);if(r?.stop(),e.json)return D(i);nc(i.items),oc(i.nextCursor)}catch(t){tc(t,e)}}),e.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async(e,t)=>{try{let n=$s(t);if(t.ndjson){await ec(n,e);return}let r=t.json?null:M(`Fetching trace spans...`);r?.start();let i=await n.getTraceSpans(e,{cursor:t.cursor,limit:t.limit===void 0?void 0:pc(t.limit)});if(r?.stop(),t.json)return D(i);rc(i.items),i.truncated&&N({Spans:`${i.items.length} of ${i.total} (truncated)`}),oc(i.nextCursor)}catch(e){tc(e,t)}}),e.addCommand(Qs()),e}function Qs(){let e=new t(`runs`).description(`Read eval-runs pivoted off the trace surface`);return e.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async e=>{try{let t={status:e.status===void 0?void 0:uc(e.status),gate:e.gate===void 0?void 0:fc(e.gate),label:e.label,from:e.from,to:e.to,q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:pc(e.limit)},n=$s(e),r=e.json?null:M(`Fetching runs...`);r?.start();let i=await n.listRuns(t);if(r?.stop(),e.json)return D(i);ic(i.items),oc(i.nextCursor)}catch(t){tc(t,e)}}),e.command(`get <runId>`).description(`Show a single eval-run`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async(e,t)=>{try{let n=$s(t),r=t.json?null:M(`Fetching run...`);r?.start();let i=await n.getRun(e);if(r?.stop(),t.json)return D(i);ac(i)}catch(e){tc(e,t)}}),e}function $s(e){let t=Ft(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return Le({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function ec(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function tc(e,t){return L(e,t.json===!0)}function nc(e){E(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:sc(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function rc(e){E(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function ic(e){E(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function ac(e){N({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function oc(e){e&&N({"Next page":`--cursor ${e}`})}function sc(e){return e===null?`-`:`$${e.toFixed(4)}`}function cc(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const lc=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function uc(e){let t=lc.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${lc.join(`, `)}`)}const dc=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function fc(e){let t=dc.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${dc.join(`, `)}`)}function pc(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function mc(){return new t(`usage`).description(`Show account usage and billing information`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=T(C({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=e.json?null:M(`Fetching usage...`);n?.start();let[r,i]=await Promise.all([t.usage(),t.subscription().catch(()=>null)]);n?.stop(),e.json?D({...r,subscription:i}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),N({"Active Sandboxes":r.activeSandboxes,"Total Sandboxes":r.totalSandboxes,"Compute Minutes":hc(r.computeMinutes),"GPU Seconds":r.gpuSeconds,"GPU Spend":gc(r.gpuCostUsd)}),i&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),N({Plan:i.plan,Status:i.status,"Credits Available":gc(i.creditsAvailableUsd),"Credits Used":gc(i.creditsUsedUsd),"Monthly Balance":gc(i.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),N({Start:r.periodStart.toLocaleDateString(),End:r.periodEnd.toLocaleDateString()}),console.log())}catch(e){L(e)}})}function hc(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function gc(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function _c(){return new t(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{try{if(t.clear){Ot(),j(`Cleared the active sandbox.`);return}if(e){Dt(e),j(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=Et();j(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")}catch(e){L(e)}})}const vc=1e3;function yc(){let e=new t(`workflows`).description(`Create and manage Tangle workflows`);e.option(`--json`,`Output as JSON`),e.hook(`preAction`,(e,t)=>{Sc(t)}),e.command(`list`).description(`List your workflows`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async e=>{try{let t=await Z(e).workflows.list();if(e.json)return D(t);wc(t)}catch(t){Q(t,e)}}),e.command(`fleet`).description(`Fleet overview: every workflow's run tallies over a trailing window, failing-first`).option(`--window <window>`,`Trailing window: 24h, 7d, or 30d`,`7d`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async e=>{try{let t=await Z(e).workflows.fleetInsights({window:e.window});if(e.json)return D(t);Tc(t)}catch(t){Q(t,e)}}),e.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--yaml`,`Print only the raw definition YAML (the export path — pipe to a file)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=await Z(t).workflows.get(e);if(t.yaml){if(n.definitionYaml===null)throw Error(`Workflow ${n.id} has no stored definition YAML to export`);process.stdout.write(n.definitionYaml.endsWith(`
|
|
147
|
+
`)?n.definitionYaml:`${n.definitionYaml}\n`);return}if(t.json)return D(n);Ec(n)}catch(e){Q(e,t)}}),e.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=xc(e),r=await Z(t).workflows.create(n);if(t.json)return D(r);j(`Created workflow ${r.id} (${r.name}).`),Ec(r)}catch(e){Q(e,t)}}),e.command(`apply`).description(`Create or update a workflow idempotently, matched by the definition's name`).argument(`<file>`,`Path to the workflow YAML`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=xc(e),r=Z(t),i=await r.workflows.validate(n,{structural:!0});if(!i.valid){if(process.exitCode=1,t.json)return D(i);j(`Invalid workflow:`);for(let e of i.errors)console.log(` ${e.path}: ${e.message}`);return}let a=(await r.workflows.list()).find(e=>e.name===i.name);if(a){let e=await r.workflows.update(a.id,n);if(t.json)return D({action:`updated`,workflow:e});j(`Updated workflow ${e.id} (${e.name}) — matched by name.`),Ec(e);return}let o=await r.workflows.create(n);if(t.json)return D({action:`created`,workflow:o});j(`Created workflow ${o.id} (${o.name}).`),Ec(o)}catch(e){Q(e,t)}}),e.command(`update`).description(`Replace a workflow's definition from a YAML file`).argument(`<id>`,`Workflow ID`).argument(`<file>`,`Path to the workflow YAML`).option(`--note <note>`,`Revision note recorded on the appended revision (why this change)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=xc(t),i=await Z(n).workflows.update(e,r,{...n.note===void 0?{}:{note:n.note}});if(n.json)return D(i);j(`Updated workflow ${i.id} (${i.name}).`),Ec(i)}catch(e){Q(e,n)}}),e.command(`delete`).description(`Delete a workflow and its triggers`).argument(`<id>`,`Workflow ID`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{if(!t.force&&!await V(`Delete workflow ${e}? `)){j(`Delete cancelled.`);return}if(await Z(t).workflows.delete(e),t.json)return D({deleted:!0,id:e});j(`Deleted workflow ${e}.`)}catch(e){Q(e,t)}}),e.command(`validate`).description(`Validate a workflow YAML file without saving it`).argument(`<file>`,`Path to the workflow YAML`).option(`--structural`,`CI mode: compile + capability checks only, no connection resolution — the verdict is the same regardless of connected providers`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=xc(e),r=await Z(t).workflows.validate(n,{...t.structural?{structural:!0}:{}});if(t.json)return D(r);if(r.valid)j(`Valid: ${r.name} (${r.actionCount} action(s), ${r.triggerCount} trigger(s)).`);else{j(`Invalid workflow:`);for(let e of r.errors)console.log(` ${e.path}: ${e.message}`);process.exitCode=1}}catch(e){Q(e,t)}}),e.command(`schema`).description(`Print the JSON Schema for the workflow YAML`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async e=>{try{D(await Z(e).workflows.schema())}catch(t){Q(t,e)}}),e.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,Dc,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=Oc(t.input),r=t.timeout===void 0?void 0:G(t.timeout,`--timeout`),i=t.pollInterval===void 0?void 0:G(t.pollInterval,`--poll-interval`),a=Z(t),{runId:o}=await a.workflows.run(e,n);if(!t.wait){if(t.json)return D({runId:o});j(`Started run ${o} for workflow ${e}.`),j(`Inspect it with: tangle workflows run-detail ${e} ${o}`);return}let s=t.json?null:M(`Waiting for run ${o} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),t.json)return D(c);Ac(c)}catch(e){Q(e,t)}}),e.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=Z(t),r=t.limit===void 0?void 0:G(t.limit,`--limit`);if(t.all){let i=[],a=t.cursor,o=0,s=null;for(;;){let c=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...a===void 0?{}:{cursor:a}});if(i.push(...c.runs),o+=1,!c.nextCursor)break;if(o>=vc){s=c.nextCursor,t.json||j(`Stopped after ${vc} pages (${i.length} runs); more may exist — resume with --cursor ${c.nextCursor}`);break}a=c.nextCursor}if(t.json)return D({runs:i,nextCursor:s});kc(i);return}let i=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...t.cursor===void 0?{}:{cursor:t.cursor}});if(t.json)return D(i);kc(i.runs),i.nextCursor&&j(`More runs available — next page: --cursor ${i.nextCursor}`)}catch(e){Q(e,t)}}),e.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.getRun(e,t);if(n.json)return D(r);Ac(r)}catch(e){Q(e,n)}}),e.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.cancel(e,t);if(n.json)return D(r);jc(r)}catch(e){Q(e,n)}}),e.command(`retry`).description(`Re-run a failed or cancelled run (a fresh run with the same trigger context)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID of the failed/cancelled run to retry`).option(`--wait`,`Wait for the new run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=n.timeout===void 0?void 0:G(n.timeout,`--timeout`),i=n.pollInterval===void 0?void 0:G(n.pollInterval,`--poll-interval`),a=Z(n),o=await a.workflows.retryRun(e,t);if(!n.wait){if(n.json)return D(o);j(`Started run ${o.runId} (retry of ${t}).`),j(`Inspect it with: tangle workflows run-detail ${e} ${o.runId}`);return}let s=n.json?null:M(`Waiting for run ${o.runId} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o.runId,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),n.json)return D(c);Ac(c)}catch(e){Q(e,n)}}),e.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Emit each event as a JSON line`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=Z(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):Mc(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)}catch(e){Q(e,n)}}),e.command(`enable`).description(`Enable a workflow so its triggers and manual runs fire`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{await bc(e,!0,t)}),e.command(`disable`).description(`Disable a workflow (pause its triggers and manual runs)`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{await bc(e,!1,t)}),e.command(`templates`).description(`List the curated starter workflow templates`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async e=>{try{let t=await Z(e).workflows.listTemplates();if(e.json)return D(t);Ic(t)}catch(t){Q(t,e)}}),e.command(`init`).description(`Create a workflow from a gallery template and print (or save) its YAML`).argument(`<template-id>`,"Template ID from `workflows templates`").option(`--param <key=value>`,`Template parameter value. Repeatable.`,Dc,[]).option(`--file <out>`,`Write the instantiated workflow YAML to this file instead of stdout`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=Oc(t.param,`param`)??{},r=await Z(t).workflows.instantiateTemplate(e,n);if(t.json)return D(r);if(!r.created){j(`Template ${e} needs provider connections before it can run:`);for(let e of r.connectionRequirements)console.log(` ${e.connected?`✓`:`✗`} ${Lc(e,r.connectionRequirements)}`);process.exitCode=1;return}let{workflow:i}=r;if(i.definitionYaml===null)throw Error(`Workflow ${i.id} was created but the server returned no definition YAML`);if(j(`Created workflow ${i.id} (${i.name}).`),t.file){Fc(t.file,i.definitionYaml),j(`Wrote ${t.file}.`);return}process.stdout.write(i.definitionYaml.endsWith(`
|
|
148
|
+
`)?i.definitionYaml:`${i.definitionYaml}\n`)}catch(e){Q(e,t)}}),e.command(`revisions`).description(`List a workflow's definition revision history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=await Z(t).workflows.listRevisions(e);if(t.json)return D(n);Rc(n)}catch(e){Q(e,t)}}),e.command(`revision`).description(`Show one revision's metadata and definition YAML`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=G(t,`<rev>`),i=await Z(n).workflows.getRevision(e,r);if(n.json)return D(i);N({Revision:i.rev,Created:i.createdAt,"Created by":i.createdBy,Source:i.source,Note:i.note??``}),process.stdout.write(i.yaml.endsWith(`
|
|
149
|
+
`)?i.yaml:`${i.yaml}\n`)}catch(e){Q(e,n)}}),e.command(`rollback`).description(`Restore a prior revision's definition as a NEW head revision (re-validated)`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number to restore`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=G(t,`<rev>`),i=await Z(n).workflows.rollback(e,r);if(n.json)return D(i);j(`Rolled back workflow ${i.id} to rev ${r}.`),Ec(i)}catch(e){Q(e,n)}});let n=e.command(`kv`).description(`Read and write a workflow's cross-run KV state`);return n.command(`list`).description(`List every KV entry of a workflow`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=await Z(t).workflows.listKv(e);if(t.json)return D(n);zc(n.entries)}catch(e){Q(e,t)}}),n.command(`get`).description(`Show one KV entry (value and version)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.getKv(e,t);if(n.json)return D(r);Bc(r)}catch(e){Q(e,n)}}),n.command(`set`).description(`Write a KV entry from a JSON value`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).argument(`<json>`,`Value as JSON (e.g. '{"cursor":123}' or '"abc"')`).option(`--cas <version>`,`Compare-and-swap: write only if the stored version still equals this`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n,r)=>{try{let i=Pc(n,`<json>`),a=r.cas===void 0?void 0:G(r.cas,`--cas`),o=Z(r),s=a===void 0?await o.workflows.putKv(e,t,i):await o.workflows.casKv(e,t,a,i);if(r.json)return D(s);Bc(s)}catch(e){Q(e,r)}}),n.command(`delete`).description(`Delete a KV entry (idempotent)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.deleteKv(e,t);if(n.json)return D(r);j(r.deleted?`Deleted KV entry "${t}" of workflow ${e}.`:`No KV entry "${t}" on workflow ${e}.`)}catch(e){Q(e,n)}}),e.command(`artifacts`).description(`List a run's artifact metadata (never the bytes)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.listArtifacts(e,t);if(n.json)return D(r);Vc(r.artifacts)}catch(e){Q(e,n)}}),e.command(`artifact-download`).description(`Download one run artifact's bytes to a file`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).argument(`<artifactId>`,`Artifact ID`).option(`--out <file>`,`Destination file (defaults to the artifact ID)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n,r)=>{try{let i=await Z(r).workflows.downloadArtifact(e,t,n),a=r.out??n;try{f(a,i.bytes)}catch(e){throw Error(`Could not write artifact to "${a}": ${e instanceof Error?e.message:String(e)}`)}if(r.json)return D({file:a,contentType:i.contentType,bytes:i.bytes.length});j(`Wrote ${a} (${i.bytes.length} bytes, ${i.contentType}).`)}catch(e){Q(e,r)}}),e.command(`decisions`).description(`List a workflow's pending human decisions`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=(await Z(t).workflows.listPendingDecisions()).decisions.filter(t=>t.workflowId===e);if(t.json)return D({decisions:n});Hc(n)}catch(e){Q(e,t)}}),e.command(`decision-resolve`).description(`Answer the decision a run is parked on and resume it`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).requiredOption(`--choice <choice>`,`The option to resolve with (one of the decision's options)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=Z(n),i=await r.workflows.getRunDecision(e,t),a=await r.workflows.resolveRunDecision(e,t,{decisionId:i.id,choice:n.choice});if(n.json)return D(a);if(a.resumed){j(`Resolved decision ${a.decisionId} with "${a.choice}" — run ${a.runId} resumed.`);return}j(`Resolved decision ${a.decisionId} with "${a.choice}", but run ${a.runId} had already finished — nothing to resume.`)}catch(e){Q(e,n)}}),e}async function bc(e,t,n){try{let r=await Z(n).workflows.setEnabled(e,t);if(n.json)return D(r);j(`${t?`Enabled`:`Disabled`} workflow ${r.id}.`),Ec(r)}catch(e){Q(e,n)}}function xc(e){try{return u(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function Z(e){let t=C({apiKey:Ft(e.apiKey),baseUrl:Bt({flag:e.baseUrl})});return new be({baseUrl:t.baseUrl,apiKey:t.apiKey})}function Sc(e){if(!Cc(e,`json`)||e.getOptionValue(`json`)!==void 0)return;let t=e.parent;for(;t;){let n=t.getOptionValue(`json`);if(n!==void 0){e.setOptionValue(`json`,n);return}t=t.parent}}function Cc(e,t){return e.options.some(e=>e.attributeName()===t)}function Q(e,t){return L(e,t.json===!0)}function wc(e){E(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function Tc(e){let t=e.workflows.filter(e=>e.failed>0).length,n=e.workflows.filter(e=>e.failed===0&&e.waiting>0).length,r=e.workflows.filter(e=>e.failed===0&&e.waiting===0&&e.runsInWindow>0).length;j(`${t} failing · ${n} waiting · ${r} healthy · ${e.workflows.length} total over ${e.window}`),E(e.workflows.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,runs:e.runsInWindow,failed:e.failed,waiting:e.waiting,success:e.successRate===null?`—`:`${Math.round(e.successRate*100)}%`,lastRun:e.lastRunStatus??`—`,lastRunAt:e.lastRunAt??`—`})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`runs`,header:`Runs`},{key:`failed`,header:`Failed`},{key:`waiting`,header:`Waiting`},{key:`success`,header:`Success`},{key:`lastRun`,header:`Last Run`},{key:`lastRunAt`,header:`Last Run At`}])}function Ec(e){if(N({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(j(`Triggers`),Nc(e.triggers)),e.validationErrors.length>0){j(`Validation issues`);for(let t of e.validationErrors)console.log(` ${t.path}: ${t.message}`)}}function Dc(e,t){return[...t,e]}function Oc(e,t=`input`){if(!e||e.length===0)return;let n={};for(let r of e){let e=r.indexOf(`=`);if(e<=0)throw Error(`Invalid --${t} "${r}": expected key=value (e.g. pull_request.number=123)`);n[r.slice(0,e)]=r.slice(e+1)}return n}function kc(e){E(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function Ac(e){if(N({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0){j(`Actions`);let t=e.actionResults.some(e=>e.nodeId!==void 0||e.visit!==void 0);E(e.actionResults.map(e=>({index:e.index,...t?{node:e.nodeId??``,visit:e.visit??``}:{},kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},...t?[{key:`node`,header:`Node`},{key:`visit`,header:`Visit`}]:[],{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}])}e.graph&&(j(`Graph`),N({Nodes:e.graph.nodes.length,Edges:e.graph.edges.length,"Max node visits":e.graph.maxNodeVisits}),E(e.graph.edges.map(e=>({from:e.from,to:e.to,guard:e.when===void 0?``:JSON.stringify(e.when)})),[{key:`from`,header:`From`},{key:`to`,header:`To`},{key:`guard`,header:`Guard`}])),e.edgeVerdicts&&e.edgeVerdicts.length>0&&(j(`Edge verdicts`),E(e.edgeVerdicts.flatMap(e=>Object.entries(e.verdicts).map(([t,n])=>({node:e.nodeId,edge:t,verdict:n?`taken`:`not taken`}))),[{key:`node`,header:`Node`},{key:`edge`,header:`Edge`},{key:`verdict`,header:`Verdict`}]))}function jc(e){if(e.status===`cancelled`){j(`Cancelled run ${e.runId}.`);return}if(e.signalled){j(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}j(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function Mc(e){switch(e.type){case`snapshot`:j(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(` · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(` · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function Nc(e){E(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function Pc(e,t){try{return JSON.parse(e)}catch{throw Error(`Invalid ${t}: not valid JSON`)}}function Fc(e,t){try{f(e,t,`utf8`)}catch(t){throw Error(`Could not write workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function Ic(e){E(e.map(e=>({id:e.id,name:e.name,category:e.category,providers:e.providers.join(`, `),summary:e.summary})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`category`,header:`Category`},{key:`providers`,header:`Providers`},{key:`summary`,header:`Summary`}])}function Lc(e,t){let n=e.kind===`github_app`,r=n?`${e.provider} (App installation)`:e.provider,i=e.connectUrl?` — ${n?`install`:`connect`}: ${e.connectUrl}`:``,a=e.prerequisite;return`${r}${i}${a&&t.some(e=>e.provider===a.provider&&e.kind===a.kind&&!e.connected)?` (after connecting ${a.provider})`:``}`}function Rc(e){E(e.map(e=>({rev:e.rev,created:e.createdAt,by:e.createdBy,source:e.source,note:e.note??``})),[{key:`rev`,header:`Rev`},{key:`created`,header:`Created`},{key:`by`,header:`Created By`},{key:`source`,header:`Source`},{key:`note`,header:`Note`}])}function zc(e){E(e.map(e=>({key:e.key,version:e.version,updated:e.updatedAt})),[{key:`key`,header:`Key`},{key:`version`,header:`Version`},{key:`updated`,header:`Updated`}])}function Bc(e){N({Key:e.key,Version:e.version,Updated:e.updatedAt}),j(`Value`),D(e.value)}function Vc(e){E(e.map(e=>({id:e.id,node:e.nodeId,name:e.name,type:e.contentType,bytes:e.byteSize,created:e.createdAt})),[{key:`id`,header:`ID`},{key:`node`,header:`Node`},{key:`name`,header:`Name`},{key:`type`,header:`Content Type`},{key:`bytes`,header:`Bytes`},{key:`created`,header:`Created`}])}function Hc(e){E(e.map(e=>({id:e.id,run:e.runId,title:e.title,options:e.options.join(`, `),requested:e.requestedAt,expires:e.expiresAt??``})),[{key:`id`,header:`ID`},{key:`run`,header:`Run`},{key:`title`,header:`Title`},{key:`options`,header:`Options`},{key:`requested`,header:`Requested`},{key:`expires`,header:`Expires`}])}function Uc(e){let t={...Wc(e)??{},...e.optsWithGlobals()};for(let n of e.options){let r=n.attributeName();e.getOptionValue(r)===void 0&&t[r]!==void 0&&e.setOptionValue(r,t[r])}}function Wc(e){let t=e;for(;t?.parent;)t=t.parent;return t?t.opts():void 0}const Gc=e(import.meta.url)(`../package.json`),$=new t;$.name(`tangle`).description(`CLI for Tangle Sandbox operations`).version(Gc.version??`0.0.0`).option(`--api-key <key>`,`API key (or set TANGLE_API_KEY)`).option(`--base-url <url>`,`API base URL`),$.hook(`preAction`,(e,t)=>{Uc(t)}),$.addCommand(br()),$.addCommand($o()),$.addCommand(_c()),$.addCommand(ds()),$.addCommand(Io()),$.addCommand(wa()),$.addCommand(ws()),$.addCommand(Ts()),$.addCommand(Ds()),$.addCommand(nr()),$.addCommand(ms()),$.addCommand(Pa()),$.addCommand(mc()),$.addCommand(Ws()),$.addCommand(Ys()),$.addCommand(Ro()),$.addCommand(Dr()),$.addCommand(Rr()),$.addCommand(Bo()),$.addCommand(Ga()),$.addCommand(Ja()),$.addCommand(Ya()),$.addCommand(yc()),$.addCommand(Ca()),$.addCommand(Xs()),$.addCommand(us()),$.addCommand(ps()),$.addCommand(zr()),$.addCommand(zo()),$.addCommand(yo()),$.addCommand(la()),$.addCommand(ua()),$.addCommand(Ko()),$.addCommand(Lo()),$.addCommand(Zs()),$.addCommand(Us()),$.parseAsync(process.argv).catch(e=>{console.error(`Fatal error:`,e.message),process.exit(1)});export{};
|