@tokensize/cli 0.3.0-beta.0

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 TokenSize
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,32 @@
+# TokenSize CLI
+
+TokenSize discovers local coding harnesses and sends only capability/task metadata to the hosted router by default. Credentials and execution remain local.
+
+The easiest setup is the browser callback flow:
+
+```sh
+npx @tokensize/cli auth login
+```
+
+It opens `tokensize.dev`, asks the signed-in user to approve the terminal, and stores the credential in `~/.tokensize/credentials.json` with owner-only permissions. For headless systems, create a key at [tokensize.dev/account](https://tokensize.dev/account), then set it manually:
+
+```sh
+export TOKENSIZE_API_URL=https://api.tokensize.dev
+read -rsp "TokenSize API key: " TOKENSIZE_API_KEY; echo
+npx @tokensize/cli doctor --json
+npx @tokensize/cli allowance --refresh --json
+npx @tokensize/cli route --task "Review the auth boundary" --role review --permission inspect --json
+npx @tokensize/cli delegate --task "Implement issue 42" --role implement --permission edit --json
+```
+
+The hosted service defaults to `https://api.tokensize.dev`; set `TOKENSIZE_API_URL` only for an authorized alternative deployment. If the CLI says `TOKENSIZE_API_KEY` is missing, repeat the `export` and `read -rsp` commands in the same terminal. Never print, commit, or put the key in command arguments.
+
+`route` never executes a harness. `delegate` is also a preview unless `--execute` is present. Codex and Claude Code execution adapters are available for inspect/edit tasks; Cursor Agent and OpenCode execution are inspect-only; Copilot is currently discovery-only. Subscription-backed harnesses must explicitly set `TOKENSIZE_ALLOW_SUBSCRIPTION_HARNESSES=claude,codex,cursor,opencode` when their product and provider terms permit automated use.
+
+Discovery is cached owner-only for six hours at `~/.tokensize/discovery.json`. Use `--refresh` after installing, upgrading, authenticating, or changing a harness. Selected-target and execution availability failures trigger a bounded refresh automatically.
+
+Feedback uses a private `~/.tokensize/last-route.json` receipt containing only the route ID, short-lived feedback token, expiry, and selected target. Never include code, prompts, model output, secrets, personal information, or repository details in comments.
+
+Allowance checks do not invoke a model. Normalized remaining fractions are cached owner-only for five minutes at `~/.tokensize/allowance.json`; raw account output and identity are discarded. The router never trades down in quality: among the top quality-equivalent candidates it prefers unmetered, known-available, unknown, then known-low allowance, with the selected cost/latency objective as the final tie-breaker. Codex and macOS Claude Code expose live data in the tested clients; unsupported harness interfaces remain `unknown` rather than being guessed.
+
+The CLI is the canonical TokenSize local-client implementation. The public `$delegate` skill is a pinned launcher for this package; it does not contain a second copy of discovery, routing, or execution logic.

package/dist/cli.d.ts

@@ -0,0 +1 @@
+import '@tokensize/agent-client';

package/dist/cli.js

@@ -0,0 +1,436 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { execFile } from "child_process";
+import { randomUUID } from "crypto";
+import { access, mkdir } from "fs/promises";
+import { createServer } from "http";
+import path from "path";
+import {
+  AGENT_ROUTER_SCHEMA_VERSION,
+  agentRouteResponseSchema,
+  featurizeAgentTask
+} from "@tokensize/agent-router";
+import {
+  allowanceReport,
+  allowanceScopesForHarness,
+  allowances,
+  applyAllowances,
+  discoverHarnessesCached,
+  executionArgs,
+  flattenModels,
+  home,
+  installationId,
+  readApiKey,
+  readLastRoute,
+  readLocalPolicy,
+  rootAllowance,
+  run,
+  saveApiKey,
+  saveLastRoute,
+  saveLocalPolicy
+} from "@tokensize/agent-client";
+var roles = ["inspect", "plan", "implement", "review", "test"];
+var permissions = ["inspect", "edit", "test", "network"];
+function value(flag) {
+  const index = process.argv.indexOf(flag);
+  return index < 0 ? void 0 : process.argv[index + 1];
+}
+function has(flag) {
+  return process.argv.includes(flag);
+}
+function output(data) {
+  process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+}
+function fail(message) {
+  process.stderr.write(`tokensize: ${message}
+`);
+  process.exit(1);
+}
+function apiUrl() {
+  return (process.env.TOKENSIZE_API_URL ?? "https://api.tokensize.dev").replace(/\/$/, "");
+}
+function presented(route) {
+  return has("--include-feedback-token") ? route : { ...route, feedbackToken: "[redacted]" };
+}
+async function apiKey(required = true) {
+  const key = process.env.TOKENSIZE_API_KEY ?? await readApiKey();
+  if (!key && required) fail("TokenSize API key is missing. Run: npx @tokensize/cli auth login");
+  return key;
+}
+async function api(pathname, options = {}) {
+  const key = await apiKey();
+  const response = await fetch(`${apiUrl()}${pathname}`, {
+    ...options,
+    headers: {
+      authorization: `Bearer ${key}`,
+      ...options.body ? { "content-type": "application/json" } : {},
+      ...options.headers
+    }
+  });
+  const text = await response.text();
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    body = { message: text.slice(0, 500) };
+  }
+  if (!response.ok) {
+    const record = body;
+    throw new Error(`service returned ${response.status}: ${record.error?.message ?? record.message ?? "request failed"}`);
+  }
+  return body;
+}
+function publicDiscovery(harnesses) {
+  if (has("--verbose")) return harnesses;
+  return harnesses.map((item) => ({
+    harness: item.harness,
+    installed: item.installed,
+    authenticated: item.authenticated,
+    version: item.version,
+    modelCount: item.models.length,
+    allowanceScopes: allowanceScopesForHarness(item),
+    warnings: item.warnings
+  }));
+}
+async function prepare(task) {
+  const role = value("--role") ?? "inspect";
+  const permission = value("--permission") ?? "inspect";
+  if (!roles.includes(role)) fail("invalid --role");
+  if (!permissions.includes(permission)) fail("invalid --permission");
+  const discovered = await discoverHarnessesCached({ forceRefresh: has("--refresh"), reason: has("--refresh") ? "manual" : void 0 });
+  const allowanceSnapshot = await allowances(discovered.harnesses, has("--refresh"));
+  const discovery = applyAllowances(discovered.harnesses, allowanceSnapshot);
+  const rootHarness = process.env.TOKENSIZE_ROOT_HARNESS ?? "codex";
+  const rootActive = process.env.TOKENSIZE_ROOT_ACTIVE === "1";
+  const body = {
+    schemaVersion: AGENT_ROUTER_SCHEMA_VERSION,
+    client: {
+      surface: process.env.TOKENSIZE_CLIENT_SURFACE ?? "cli",
+      version: process.env.TOKENSIZE_CLIENT_VERSION ?? "0.2.0-beta.0"
+    },
+    requestId: randomUUID(),
+    installationId: await installationId(),
+    routerMode: has("--share-prompt") ? "prompt-assisted" : "metadata-only",
+    task: featurizeAgentTask({ task, role, permissionProfile: permission }),
+    ...has("--share-prompt") ? { prompt: task } : {},
+    candidates: flattenModels(discovery),
+    root: {
+      harness: rootHarness,
+      active: rootActive,
+      qualityPrior: Number(process.env.TOKENSIZE_ROOT_QUALITY_PRIOR ?? 0.82),
+      allowance: rootAllowance(rootHarness, allowanceSnapshot)
+    },
+    policy: {
+      objective: value("--objective") ?? "balanced",
+      maxDelegationDepth: 1,
+      delegationDepth: Number(process.env.TOKENSIZE_DELEGATION_DEPTH ?? 0),
+      permissionCeiling: permission,
+      wallTimeBudgetMs: Number(value("--timeout-ms") ?? 9e5)
+    }
+  };
+  return { body, discovery, cache: { discovery: discovered.cache, allowance: allowanceSnapshot.cache } };
+}
+async function requestRoute(body) {
+  const response = await api("/v1/agent-routes", { method: "POST", body: JSON.stringify(body) });
+  const parsed = agentRouteResponseSchema.safeParse(response);
+  if (!parsed.success) fail("router returned an incompatible response");
+  const runId = typeof response.runId === "string" ? response.runId : void 0;
+  return { route: parsed.data, ...runId ? { runId } : {} };
+}
+function dashboardUrl(runId) {
+  return `https://tokensize.dev/runs/${runId}`;
+}
+async function appendRunEvent(runId, receiptToken, actor, type, data) {
+  if (!runId) return;
+  try {
+    await api(`/v1/runs/${runId}/events`, {
+      method: "POST",
+      body: JSON.stringify({ receiptToken, autoSeq: true, event: { seq: 0, at: (/* @__PURE__ */ new Date()).toISOString(), actor, type, data } })
+    });
+  } catch {
+  }
+}
+async function refreshDiscovery(reason) {
+  return (await discoverHarnessesCached({ forceRefresh: true, reason })).cache;
+}
+async function execute(task, route, discovery, cache, runId) {
+  if (!route.plan.targetId) fail(`no local target selected (${route.reasonCodes.join(", ")})`);
+  if (route.plan.permissionProfile === "network") fail("network delegation is not supported");
+  const target = discovery.flatMap((item) => item.models.map((model) => ({ item, model }))).find(({ model }) => model.id === route.plan.targetId);
+  if (!target?.item.executable || !target.item.authenticated) {
+    await refreshDiscovery("selected-target-unavailable");
+    fail("selected target is no longer available; local discovery cache refreshed");
+  }
+  try {
+    await access(target.item.executable);
+  } catch {
+    await refreshDiscovery("selected-executable-missing");
+    fail("selected harness executable no longer exists; local discovery cache refreshed");
+  }
+  if (!["codex", "claude", "cursor", "opencode"].includes(target.model.harness)) fail(`${target.model.harness} is discovery-only in this client`);
+  if (["cursor", "opencode"].includes(target.model.harness) && route.plan.permissionProfile !== "inspect") fail(`${target.model.harness === "cursor" ? "Cursor" : "OpenCode"} execution is inspect-only`);
+  let cwd = process.cwd();
+  let worktree = null;
+  if (route.plan.requiresWorktree) {
+    const gitCheck = await run("git", ["rev-parse", "--show-toplevel"], { cwd, timeoutMs: 15e3 });
+    if (gitCheck.code !== 0) fail("edit/test delegation requires a Git repository");
+    worktree = path.join(home(), "worktrees", route.routeId);
+    await mkdir(path.dirname(worktree), { recursive: true, mode: 448 });
+    const branch = `tokensize/${route.routeId.slice(0, 8)}`;
+    const created = await run("git", ["worktree", "add", "-b", branch, worktree, "HEAD"], { cwd, timeoutMs: 3e4 });
+    if (created.code !== 0) fail(`could not create isolated worktree: ${created.stderr.trim()}`);
+    cwd = worktree;
+  }
+  await appendRunEvent(runId, route.feedbackToken, "delegate", "execution-started", {
+    targetId: target.model.id,
+    permissionProfile: route.plan.permissionProfile,
+    worktree: worktree !== null
+  });
+  const started = Date.now();
+  const result = await run(target.item.executable, executionArgs(target.model.harness, target.model.nativeModelId, route.plan.permissionProfile, cwd), {
+    cwd,
+    input: task,
+    timeoutMs: route.plan.maxWallMs,
+    env: {
+      ...process.env,
+      TOKENSIZE_ROOT_HARNESS: target.model.harness,
+      TOKENSIZE_ROOT_ACTIVE: "1",
+      TOKENSIZE_DELEGATION_DEPTH: String(Number(process.env.TOKENSIZE_DELEGATION_DEPTH ?? 0) + 1),
+      TOKENSIZE_CLIENT_SURFACE: "cli"
+    }
+  });
+  const elapsed = Date.now() - started;
+  await appendRunEvent(runId, route.feedbackToken, "delegate", "execution-finished", {
+    outcome: result.timedOut ? "timeout" : result.code === 0 ? "success" : "failure",
+    ...result.code === 0 && !result.timedOut ? {} : { failureCode: result.timedOut ? "EXECUTION_TIMEOUT" : "EXECUTION_FAILED" },
+    elapsedMs: elapsed,
+    usage: { contextTokensEstimated: route.expected.contextTokens, source: "estimated" }
+  });
+  const combined = `${result.stderr}
+${result.stdout}`;
+  const availabilityFailure = result.timedOut || result.code !== 0 && /unknown model|model.{0,24}(not found|not available|unavailable|invalid)|invalid value.{0,80}--model|not logged in|unauthenticated|authentication|command not found|enoent/i.test(combined);
+  const allowanceFailure = result.code !== 0 && /rate.?limit|usage.?limit|quota|allowance|credit(?:s)? exhausted|insufficient credit/i.test(combined);
+  const discoveryRefresh = availabilityFailure ? await refreshDiscovery(result.timedOut ? "execution-timeout" : "execution-availability-failure") : void 0;
+  const allowanceRefresh = allowanceFailure ? (await allowances(discovery, true)).cache : void 0;
+  let feedbackWarning;
+  try {
+    await api("/v1/agent-feedback", {
+      method: "POST",
+      body: JSON.stringify({
+        schemaVersion: AGENT_ROUTER_SCHEMA_VERSION,
+        routeId: route.routeId,
+        feedbackToken: route.feedbackToken,
+        idempotencyKey: randomUUID(),
+        status: result.code === 0 ? "completed" : "failed",
+        confirmedTargetId: target.model.id,
+        identityConfirmed: true,
+        checksPassed: 0,
+        checksFailed: 0,
+        retries: 0,
+        usage: { contextTokensEstimated: route.expected.contextTokens, source: "estimated" },
+        timings: { totalMs: elapsed, routingMs: 0, executionMs: elapsed, verificationMs: 0 },
+        ...result.code === 0 ? {} : { failureCode: result.timedOut ? "EXECUTION_TIMEOUT" : "EXECUTION_FAILED" }
+      })
+    });
+  } catch (error) {
+    feedbackWarning = error instanceof Error ? error.message : String(error);
+  }
+  return { target: target.model.id, code: result.code, timedOut: result.timedOut, worktree, stdout: result.stdout, stderr: result.stderr, feedbackWarning, cacheUsed: cache, discoveryRefresh, allowanceRefresh };
+}
+async function login() {
+  const state = randomUUID();
+  let completed = false;
+  const server = createServer((request, response) => {
+    if (request.method === "OPTIONS" && request.url === `/callback/${state}`) {
+      response.writeHead(204, { "access-control-allow-origin": "https://tokensize.dev", "access-control-allow-methods": "POST", "access-control-allow-headers": "content-type" }).end();
+      return;
+    }
+    if (request.method !== "POST" || request.url !== `/callback/${state}`) {
+      response.writeHead(404).end();
+      return;
+    }
+    let body = "";
+    request.on("data", (chunk) => {
+      body += chunk;
+    });
+    request.on("end", async () => {
+      try {
+        const payload = JSON.parse(body);
+        if (payload.state !== state || typeof payload.apiKey !== "string" || payload.apiKey.length < 20 || /\s/.test(payload.apiKey)) throw new Error("invalid callback");
+        await saveApiKey(payload.apiKey);
+        completed = true;
+        response.writeHead(200, { "content-type": "text/plain", "access-control-allow-origin": "https://tokensize.dev" }).end("TokenSize connected. You can close this window.\n");
+        setTimeout(() => server.close(), 100);
+      } catch {
+        response.writeHead(400, { "access-control-allow-origin": "https://tokensize.dev" }).end("Invalid TokenSize callback.\n");
+      }
+    });
+  });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  if (!address || typeof address === "string") fail("could not start local callback");
+  const callback = `http://127.0.0.1:${address.port}/callback/${state}`;
+  const url = `https://tokensize.dev/authorize?callback=${encodeURIComponent(callback)}&state=${encodeURIComponent(state)}`;
+  process.stdout.write(`Opening TokenSize authorization\u2026
+${url}
+`);
+  execFile(process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open", process.platform === "win32" ? ["/c", "start", url] : [url]);
+  const timeout = setTimeout(() => server.close(), 10 * 60 * 1e3);
+  await new Promise((resolve) => server.on("close", resolve));
+  clearTimeout(timeout);
+  if (!completed) fail("browser authorization timed out or was cancelled");
+  process.stdout.write(`Saved credentials to ${path.join(home(), "credentials.json")}
+`);
+}
+async function main() {
+  const command = process.argv[2] ?? "help";
+  if (command === "auth") {
+    if (process.argv[3] !== "login") fail("use: tokensize auth login");
+    await login();
+    return;
+  }
+  if (command === "doctor" || command === "allowance") {
+    const [key, discovered] = await Promise.all([apiKey(false), discoverHarnessesCached({ forceRefresh: has("--refresh"), reason: has("--refresh") ? "manual" : void 0 })]);
+    const [catalog, allowanceSnapshot] = await Promise.all([
+      key ? api("/v1/agent-catalog").catch((error) => ({ warning: error instanceof Error ? error.message : String(error) })) : null,
+      allowances(discovered.harnesses, has("--refresh"))
+    ]);
+    const available = applyAllowances(discovered.harnesses, allowanceSnapshot);
+    if (command === "allowance") {
+      output({ format: "json", privacy: "only normalized allowance metadata is cached locally; raw account output is discarded", cache: allowanceSnapshot.cache, harnesses: allowanceReport(available, allowanceSnapshot) });
+      return;
+    }
+    output({
+      service: { url: apiUrl(), authenticated: Boolean(key), catalog },
+      installationId: await installationId(),
+      privacy: "credentials, raw account output, and prompts remain local unless prompt sharing is explicit",
+      cache: { discovery: discovered.cache, allowance: allowanceSnapshot.cache },
+      harnesses: publicDiscovery(available)
+    });
+    return;
+  }
+  if (command === "feedback") {
+    const rating = Number(value("--rating"));
+    const modelChoice = value("--model-choice");
+    const wouldUseAgain = value("--would-use-again");
+    if (!Number.isInteger(rating) || rating < 1 || rating > 5) fail("--rating must be an integer from 1 to 5");
+    if (!modelChoice || !["right", "acceptable", "wrong"].includes(modelChoice)) fail("--model-choice must be right, acceptable, or wrong");
+    if (!wouldUseAgain || !["yes", "no"].includes(wouldUseAgain)) fail("--would-use-again must be yes or no");
+    let receipt;
+    try {
+      receipt = await readLastRoute();
+    } catch {
+      fail("no valid local route receipt found; delegate a task first");
+    }
+    if (Date.parse(receipt.expiresAt) < Date.now()) fail("the last route has expired; delegate another task first");
+    const response = await api("/v1/agent-feedback", {
+      method: "POST",
+      body: JSON.stringify({
+        schemaVersion: AGENT_ROUTER_SCHEMA_VERSION,
+        routeId: receipt.routeId,
+        feedbackToken: receipt.feedbackToken,
+        idempotencyKey: randomUUID(),
+        status: modelChoice === "wrong" ? "failed" : "verified",
+        confirmedTargetId: receipt.targetId,
+        identityConfirmed: true,
+        checksPassed: modelChoice === "right" ? 1 : 0,
+        checksFailed: modelChoice === "wrong" ? 1 : 0,
+        retries: 0,
+        usage: { contextTokensEstimated: 0, source: "unknown" },
+        timings: { totalMs: 0, routingMs: 0, executionMs: 0, verificationMs: 0 }
+      })
+    });
+    output({ ...response, routeId: receipt.routeId, privacy: "feedback excludes prompts, repository contents, model output, and credentials" });
+    return;
+  }
+  if (command === "route" || command === "delegate") {
+    const task = value("--task");
+    if (!task) fail("--task is required");
+    const prepared = await prepare(task);
+    const { route: selected, runId } = await requestRoute(prepared.body);
+    await saveLastRoute({ routeId: selected.routeId, ...runId ? { runId } : {}, feedbackToken: selected.feedbackToken, expiresAt: selected.expiresAt, targetId: selected.plan.targetId });
+    if (command === "route" || !has("--execute")) {
+      output({ dryRun: true, ...runId ? { runId, run: dashboardUrl(runId) } : {}, route: presented(selected), cache: prepared.cache, harnesses: publicDiscovery(prepared.discovery) });
+      return;
+    }
+    const execution = await execute(task, selected, prepared.discovery, prepared.cache, runId);
+    output({ dryRun: false, ...runId ? { runId, run: dashboardUrl(runId) } : {}, route: presented(selected), execution });
+    if (execution.code !== 0) process.exitCode = 1;
+    return;
+  }
+  if (command === "runs") {
+    const sub = process.argv[3];
+    if (sub === "watch") {
+      const runId = process.argv[4] ?? (await readLastRoute().catch(() => null))?.runId;
+      if (!runId) fail("use: tokensize runs watch <runId>");
+      const deadline = Date.now() + Number(value("--timeout-ms") ?? 9e5);
+      let printed = 0;
+      for (; ; ) {
+        const doc = await api(`/v1/runs/${runId}`);
+        for (const event of doc.events.slice(printed)) output(event);
+        printed = doc.events.length;
+        if (["completed", "failed", "cancelled", "expired"].includes(doc.status)) {
+          output({ runId, status: doc.status, run: dashboardUrl(runId) });
+          if (doc.status !== "completed") process.exitCode = 1;
+          return;
+        }
+        if (Date.now() > deadline) fail("watch timed out; the run is still live on the dashboard");
+        await new Promise((resolve) => setTimeout(resolve, 2e3));
+      }
+    }
+    const limit = Number(value("--limit") ?? 25);
+    output(await api(`/v1/runs?limit=${Number.isInteger(limit) && limit > 0 ? Math.min(limit, 100) : 25}`));
+    return;
+  }
+  if (command === "approve" || command === "cancel") {
+    const runId = process.argv[3] ?? (await readLastRoute().catch(() => null))?.runId;
+    if (!runId) fail(`use: tokensize ${command} <runId>`);
+    const event = command === "approve" ? { seq: 0, at: (/* @__PURE__ */ new Date()).toISOString(), actor: "human", type: "approval-granted", data: { kind: value("--kind") ?? "subscription-use", grantedBy: "local-cli" } } : { seq: 0, at: (/* @__PURE__ */ new Date()).toISOString(), actor: "human", type: "cancelled", data: { by: "human" } };
+    const result = await api(`/v1/runs/${runId}/events`, { method: "POST", body: JSON.stringify({ autoSeq: true, event }) });
+    output({ ...result, run: dashboardUrl(runId) });
+    return;
+  }
+  if (command === "open") {
+    const runId = process.argv[3] ?? (await readLastRoute().catch(() => null))?.runId;
+    if (!runId) fail("use: tokensize open <runId>");
+    const url = dashboardUrl(runId);
+    process.stdout.write(`${url}
+`);
+    execFile(process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open", process.platform === "win32" ? ["/c", "start", url] : [url]);
+    return;
+  }
+  if (command === "policy") {
+    if (process.argv[3] === "set") {
+      const patch = {};
+      const objective = value("--objective");
+      const ceiling = value("--permission-ceiling");
+      const rootHarness = value("--root-harness");
+      const depth = value("--max-delegation-depth");
+      const share = value("--share-prompt");
+      const approve = value("--approve-subscription");
+      const revoke = value("--revoke-subscription");
+      if (objective) patch.objective = objective;
+      if (ceiling) patch.permissionCeiling = ceiling;
+      if (rootHarness) patch.rootHarness = rootHarness;
+      if (depth) patch.maxDelegationDepth = Number(depth);
+      if (share) patch.sharePromptDefault = share === "true";
+      if (approve || revoke) {
+        const current = (await readLocalPolicy()).subscriptionHarnesses ?? [];
+        const next = new Set(current);
+        if (approve) next.add(approve);
+        if (revoke) next.delete(revoke);
+        patch.subscriptionHarnesses = [...next];
+      }
+      if (Object.keys(patch).length === 0) fail("nothing to set; see tokensize help");
+      output({ policy: await saveLocalPolicy(patch), file: path.join(home(), "policy.json") });
+      return;
+    }
+    output({ policy: await readLocalPolicy(), file: path.join(home(), "policy.json"), note: "local ceilings always win; the hosted service can only narrow them" });
+    return;
+  }
+  process.stdout.write("TokenSize CLI\n\n  auth login\n  doctor [--refresh] [--verbose] [--json]\n  allowance [--refresh] [--json]\n  route --task TEXT [--role inspect|plan|implement|review|test] [--permission inspect|edit|test] [--refresh] [--verbose]\n  delegate --task TEXT [same options] [--execute]\n  runs [--limit N] | runs watch [runId] [--timeout-ms N]\n  approve [runId] [--kind subscription-use|execute|share-prompt]\n  cancel [runId]\n  open [runId]\n  policy [get] | policy set [--objective X] [--permission-ceiling X] [--root-harness X] [--max-delegation-depth N] [--share-prompt true|false] [--approve-subscription HARNESS] [--revoke-subscription HARNESS]\n  feedback --rating 1..5 --model-choice right|acceptable|wrong --would-use-again yes|no\n");
+}
+main().catch((error) => fail(error instanceof Error ? error.message : String(error)));
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { access, mkdir } from \"node:fs/promises\";\nimport { createServer } from \"node:http\";\nimport path from \"node:path\";\nimport {\n\tAGENT_ROUTER_SCHEMA_VERSION,\n\tagentRouteResponseSchema,\n\tfeaturizeAgentTask,\n\ttype AgentRouteRequest,\n\ttype AgentRouteResponse,\n} from \"@tokensize/agent-router\";\nimport {\n\tallowanceReport,\n\tallowanceScopesForHarness,\n\tallowances,\n\tapplyAllowances,\n\tdiscoverHarnessesCached,\n\texecutionArgs,\n\tflattenModels,\n\thome,\n\tinstallationId,\n\treadApiKey,\n\treadLastRoute,\n\treadLocalPolicy,\n\trootAllowance,\n\trun,\n\tsaveApiKey,\n\tsaveLastRoute,\n\tsaveLocalPolicy,\n\ttype DiscoveryCacheMetadata,\n\ttype HarnessDiscovery,\n\ttype LocalPolicy,\n} from \"@tokensize/agent-client\";\n\nconst roles = [\"inspect\", \"plan\", \"implement\", \"review\", \"test\"] as const;\nconst permissions = [\"inspect\", \"edit\", \"test\", \"network\"] as const;\n\nfunction value(flag: string): string | undefined {\n\tconst index = process.argv.indexOf(flag);\n\treturn index < 0 ? undefined : process.argv[index + 1];\n}\n\nfunction has(flag: string): boolean { return process.argv.includes(flag); }\nfunction output(data: unknown): void { process.stdout.write(`${JSON.stringify(data, null, 2)}\\n`); }\nfunction fail(message: string): never {\n\tprocess.stderr.write(`tokensize: ${message}\\n`);\n\tprocess.exit(1);\n}\nfunction apiUrl(): string { return (process.env.TOKENSIZE_API_URL ?? \"https://api.tokensize.dev\").replace(/\\/$/, \"\"); }\nfunction presented(route: AgentRouteResponse): AgentRouteResponse {\n\treturn has(\"--include-feedback-token\") ? route : { ...route, feedbackToken: \"[redacted]\" };\n}\n\nasync function apiKey(required = true): Promise<string | null> {\n\tconst key = process.env.TOKENSIZE_API_KEY ?? await readApiKey();\n\tif (!key && required) fail(\"TokenSize API key is missing. Run: npx @tokensize/cli auth login\");\n\treturn key;\n}\n\nasync function api<T>(pathname: string, options: RequestInit = {}): Promise<T> {\n\tconst key = await apiKey();\n\tconst response = await fetch(`${apiUrl()}${pathname}`, {\n\t\t...options,\n\t\theaders: {\n\t\t\tauthorization: `Bearer ${key}`,\n\t\t\t...(options.body ? { \"content-type\": \"application/json\" } : {}),\n\t\t\t...options.headers,\n\t\t},\n\t});\n\tconst text = await response.text();\n\tlet body: unknown;\n\ttry { body = JSON.parse(text); } catch { body = { message: text.slice(0, 500) }; }\n\tif (!response.ok) {\n\t\tconst record = body as { error?: { message?: string }; message?: string };\n\t\tthrow new Error(`service returned ${response.status}: ${record.error?.message ?? record.message ?? \"request failed\"}`);\n\t}\n\treturn body as T;\n}\n\nfunction publicDiscovery(harnesses: HarnessDiscovery[]): unknown[] {\n\tif (has(\"--verbose\")) return harnesses;\n\treturn harnesses.map((item) => ({\n\t\tharness: item.harness,\n\t\tinstalled: item.installed,\n\t\tauthenticated: item.authenticated,\n\t\tversion: item.version,\n\t\tmodelCount: item.models.length,\n\t\tallowanceScopes: allowanceScopesForHarness(item),\n\t\twarnings: item.warnings,\n\t}));\n}\n\nasync function prepare(task: string): Promise<{\n\tbody: AgentRouteRequest;\n\tdiscovery: HarnessDiscovery[];\n\tcache: { discovery: DiscoveryCacheMetadata; allowance: Awaited<ReturnType<typeof allowances>>[\"cache\"] };\n}> {\n\tconst role = (value(\"--role\") ?? \"inspect\") as AgentRouteRequest[\"task\"][\"role\"];\n\tconst permission = (value(\"--permission\") ?? \"inspect\") as AgentRouteRequest[\"policy\"][\"permissionCeiling\"];\n\tif (!roles.includes(role)) fail(\"invalid --role\");\n\tif (!permissions.includes(permission)) fail(\"invalid --permission\");\n\tconst discovered = await discoverHarnessesCached({ forceRefresh: has(\"--refresh\"), reason: has(\"--refresh\") ? \"manual\" : undefined });\n\tconst allowanceSnapshot = await allowances(discovered.harnesses, has(\"--refresh\"));\n\tconst discovery = applyAllowances(discovered.harnesses, allowanceSnapshot);\n\tconst rootHarness = (process.env.TOKENSIZE_ROOT_HARNESS ?? \"codex\") as AgentRouteRequest[\"root\"][\"harness\"];\n\tconst rootActive = process.env.TOKENSIZE_ROOT_ACTIVE === \"1\";\n\tconst body: AgentRouteRequest = {\n\t\tschemaVersion: AGENT_ROUTER_SCHEMA_VERSION,\n\t\tclient: {\n\t\t\tsurface: (process.env.TOKENSIZE_CLIENT_SURFACE ?? \"cli\") as AgentRouteRequest[\"client\"][\"surface\"],\n\t\t\tversion: process.env.TOKENSIZE_CLIENT_VERSION ?? \"0.2.0-beta.0\",\n\t\t},\n\t\trequestId: randomUUID(),\n\t\tinstallationId: await installationId(),\n\t\trouterMode: has(\"--share-prompt\") ? \"prompt-assisted\" : \"metadata-only\",\n\t\ttask: featurizeAgentTask({ task, role, permissionProfile: permission }),\n\t\t...(has(\"--share-prompt\") ? { prompt: task } : {}),\n\t\tcandidates: flattenModels(discovery),\n\t\troot: {\n\t\t\tharness: rootHarness,\n\t\t\tactive: rootActive,\n\t\t\tqualityPrior: Number(process.env.TOKENSIZE_ROOT_QUALITY_PRIOR ?? 0.82),\n\t\t\tallowance: rootAllowance(rootHarness, allowanceSnapshot),\n\t\t},\n\t\tpolicy: {\n\t\t\tobjective: (value(\"--objective\") ?? \"balanced\") as AgentRouteRequest[\"policy\"][\"objective\"],\n\t\t\tmaxDelegationDepth: 1,\n\t\t\tdelegationDepth: Number(process.env.TOKENSIZE_DELEGATION_DEPTH ?? 0),\n\t\t\tpermissionCeiling: permission,\n\t\t\twallTimeBudgetMs: Number(value(\"--timeout-ms\") ?? 900_000),\n\t\t},\n\t};\n\treturn { body, discovery, cache: { discovery: discovered.cache, allowance: allowanceSnapshot.cache } };\n}\n\nasync function requestRoute(body: AgentRouteRequest): Promise<{ route: AgentRouteResponse; runId?: string }> {\n\tconst response = await api<unknown>(\"/v1/agent-routes\", { method: \"POST\", body: JSON.stringify(body) });\n\tconst parsed = agentRouteResponseSchema.safeParse(response);\n\tif (!parsed.success) fail(\"router returned an incompatible response\");\n\tconst runId = typeof (response as { runId?: unknown }).runId === \"string\" ? (response as { runId: string }).runId : undefined;\n\treturn { route: parsed.data, ...(runId ? { runId } : {}) };\n}\n\nfunction dashboardUrl(runId: string): string {\n\treturn `https://tokensize.dev/runs/${runId}`;\n}\n\n/** Best-effort append to the Run document; local execution never blocks on it. */\nasync function appendRunEvent(runId: string | undefined, receiptToken: string, actor: string, type: string, data: Record<string, unknown>): Promise<void> {\n\tif (!runId) return;\n\ttry {\n\t\tawait api(`/v1/runs/${runId}/events`, {\n\t\t\tmethod: \"POST\",\n\t\t\tbody: JSON.stringify({ receiptToken, autoSeq: true, event: { seq: 0, at: new Date().toISOString(), actor, type, data } }),\n\t\t});\n\t} catch { /* offline or expired: the local receipt remains the fallback record */ }\n}\n\nasync function refreshDiscovery(reason: string): Promise<DiscoveryCacheMetadata> {\n\treturn (await discoverHarnessesCached({ forceRefresh: true, reason })).cache;\n}\n\nasync function execute(\n\ttask: string,\n\troute: AgentRouteResponse,\n\tdiscovery: HarnessDiscovery[],\n\tcache: { discovery: DiscoveryCacheMetadata; allowance: Awaited<ReturnType<typeof allowances>>[\"cache\"] },\n\trunId?: string,\n) {\n\tif (!route.plan.targetId) fail(`no local target selected (${route.reasonCodes.join(\", \")})`);\n\tif (route.plan.permissionProfile === \"network\") fail(\"network delegation is not supported\");\n\tconst target = discovery.flatMap((item) => item.models.map((model) => ({ item, model }))).find(({ model }) => model.id === route.plan.targetId);\n\tif (!target?.item.executable || !target.item.authenticated) {\n\t\tawait refreshDiscovery(\"selected-target-unavailable\");\n\t\tfail(\"selected target is no longer available; local discovery cache refreshed\");\n\t}\n\ttry { await access(target.item.executable); } catch {\n\t\tawait refreshDiscovery(\"selected-executable-missing\");\n\t\tfail(\"selected harness executable no longer exists; local discovery cache refreshed\");\n\t}\n\tif (![\"codex\", \"claude\", \"cursor\", \"opencode\"].includes(target.model.harness)) fail(`${target.model.harness} is discovery-only in this client`);\n\tif ([\"cursor\", \"opencode\"].includes(target.model.harness) && route.plan.permissionProfile !== \"inspect\") fail(`${target.model.harness === \"cursor\" ? \"Cursor\" : \"OpenCode\"} execution is inspect-only`);\n\n\tlet cwd = process.cwd();\n\tlet worktree: string | null = null;\n\tif (route.plan.requiresWorktree) {\n\t\tconst gitCheck = await run(\"git\", [\"rev-parse\", \"--show-toplevel\"], { cwd, timeoutMs: 15_000 });\n\t\tif (gitCheck.code !== 0) fail(\"edit/test delegation requires a Git repository\");\n\t\tworktree = path.join(home(), \"worktrees\", route.routeId);\n\t\tawait mkdir(path.dirname(worktree), { recursive: true, mode: 0o700 });\n\t\tconst branch = `tokensize/${route.routeId.slice(0, 8)}`;\n\t\tconst created = await run(\"git\", [\"worktree\", \"add\", \"-b\", branch, worktree, \"HEAD\"], { cwd, timeoutMs: 30_000 });\n\t\tif (created.code !== 0) fail(`could not create isolated worktree: ${created.stderr.trim()}`);\n\t\tcwd = worktree;\n\t}\n\n\tawait appendRunEvent(runId, route.feedbackToken, \"delegate\", \"execution-started\", {\n\t\ttargetId: target.model.id,\n\t\tpermissionProfile: route.plan.permissionProfile,\n\t\tworktree: worktree !== null,\n\t});\n\tconst started = Date.now();\n\tconst result = await run(target.item.executable, executionArgs(target.model.harness, target.model.nativeModelId, route.plan.permissionProfile, cwd), {\n\t\tcwd,\n\t\tinput: task,\n\t\ttimeoutMs: route.plan.maxWallMs,\n\t\tenv: {\n\t\t\t...process.env,\n\t\t\tTOKENSIZE_ROOT_HARNESS: target.model.harness,\n\t\t\tTOKENSIZE_ROOT_ACTIVE: \"1\",\n\t\t\tTOKENSIZE_DELEGATION_DEPTH: String(Number(process.env.TOKENSIZE_DELEGATION_DEPTH ?? 0) + 1),\n\t\t\tTOKENSIZE_CLIENT_SURFACE: \"cli\",\n\t\t},\n\t});\n\tconst elapsed = Date.now() - started;\n\tawait appendRunEvent(runId, route.feedbackToken, \"delegate\", \"execution-finished\", {\n\t\toutcome: result.timedOut ? \"timeout\" : result.code === 0 ? \"success\" : \"failure\",\n\t\t...(result.code === 0 && !result.timedOut ? {} : { failureCode: result.timedOut ? \"EXECUTION_TIMEOUT\" : \"EXECUTION_FAILED\" }),\n\t\telapsedMs: elapsed,\n\t\tusage: { contextTokensEstimated: route.expected.contextTokens, source: \"estimated\" },\n\t});\n\tconst combined = `${result.stderr}\\n${result.stdout}`;\n\tconst availabilityFailure = result.timedOut || (result.code !== 0 && /unknown model|model.{0,24}(not found|not available|unavailable|invalid)|invalid value.{0,80}--model|not logged in|unauthenticated|authentication|command not found|enoent/i.test(combined));\n\tconst allowanceFailure = result.code !== 0 && /rate.?limit|usage.?limit|quota|allowance|credit(?:s)? exhausted|insufficient credit/i.test(combined);\n\tconst discoveryRefresh = availabilityFailure ? await refreshDiscovery(result.timedOut ? \"execution-timeout\" : \"execution-availability-failure\") : undefined;\n\tconst allowanceRefresh = allowanceFailure ? (await allowances(discovery, true)).cache : undefined;\n\tlet feedbackWarning: string | undefined;\n\ttry {\n\t\tawait api(\"/v1/agent-feedback\", {\n\t\t\tmethod: \"POST\",\n\t\t\tbody: JSON.stringify({\n\t\t\t\tschemaVersion: AGENT_ROUTER_SCHEMA_VERSION,\n\t\t\t\trouteId: route.routeId,\n\t\t\t\tfeedbackToken: route.feedbackToken,\n\t\t\t\tidempotencyKey: randomUUID(),\n\t\t\t\tstatus: result.code === 0 ? \"completed\" : \"failed\",\n\t\t\t\tconfirmedTargetId: target.model.id,\n\t\t\t\tidentityConfirmed: true,\n\t\t\t\tchecksPassed: 0,\n\t\t\t\tchecksFailed: 0,\n\t\t\t\tretries: 0,\n\t\t\t\tusage: { contextTokensEstimated: route.expected.contextTokens, source: \"estimated\" },\n\t\t\t\ttimings: { totalMs: elapsed, routingMs: 0, executionMs: elapsed, verificationMs: 0 },\n\t\t\t\t...(result.code === 0 ? {} : { failureCode: result.timedOut ? \"EXECUTION_TIMEOUT\" : \"EXECUTION_FAILED\" }),\n\t\t\t}),\n\t\t});\n\t} catch (error) { feedbackWarning = error instanceof Error ? error.message : String(error); }\n\treturn { target: target.model.id, code: result.code, timedOut: result.timedOut, worktree, stdout: result.stdout, stderr: result.stderr, feedbackWarning, cacheUsed: cache, discoveryRefresh, allowanceRefresh };\n}\n\nasync function login(): Promise<void> {\n\tconst state = randomUUID();\n\tlet completed = false;\n\tconst server = createServer((request, response) => {\n\t\tif (request.method === \"OPTIONS\" && request.url === `/callback/${state}`) {\n\t\t\tresponse.writeHead(204, { \"access-control-allow-origin\": \"https://tokensize.dev\", \"access-control-allow-methods\": \"POST\", \"access-control-allow-headers\": \"content-type\" }).end();\n\t\t\treturn;\n\t\t}\n\t\tif (request.method !== \"POST\" || request.url !== `/callback/${state}`) { response.writeHead(404).end(); return; }\n\t\tlet body = \"\";\n\t\trequest.on(\"data\", (chunk) => { body += chunk; });\n\t\trequest.on(\"end\", async () => {\n\t\t\ttry {\n\t\t\t\tconst payload = JSON.parse(body) as { state?: string; apiKey?: string };\n\t\t\t\tif (payload.state !== state || typeof payload.apiKey !== \"string\" || payload.apiKey.length < 20 || /\\s/.test(payload.apiKey)) throw new Error(\"invalid callback\");\n\t\t\t\tawait saveApiKey(payload.apiKey);\n\t\t\t\tcompleted = true;\n\t\t\t\tresponse.writeHead(200, { \"content-type\": \"text/plain\", \"access-control-allow-origin\": \"https://tokensize.dev\" }).end(\"TokenSize connected. You can close this window.\\n\");\n\t\t\t\tsetTimeout(() => server.close(), 100);\n\t\t\t} catch { response.writeHead(400, { \"access-control-allow-origin\": \"https://tokensize.dev\" }).end(\"Invalid TokenSize callback.\\n\"); }\n\t\t});\n\t});\n\tawait new Promise<void>((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n\tconst address = server.address();\n\tif (!address || typeof address === \"string\") fail(\"could not start local callback\");\n\tconst callback = `http://127.0.0.1:${address.port}/callback/${state}`;\n\tconst url = `https://tokensize.dev/authorize?callback=${encodeURIComponent(callback)}&state=${encodeURIComponent(state)}`;\n\tprocess.stdout.write(`Opening TokenSize authorization…\\n${url}\\n`);\n\texecFile(process.platform === \"darwin\" ? \"open\" : process.platform === \"win32\" ? \"cmd\" : \"xdg-open\", process.platform === \"win32\" ? [\"/c\", \"start\", url] : [url]);\n\tconst timeout = setTimeout(() => server.close(), 10 * 60 * 1_000);\n\tawait new Promise<void>((resolve) => server.on(\"close\", resolve));\n\tclearTimeout(timeout);\n\tif (!completed) fail(\"browser authorization timed out or was cancelled\");\n\tprocess.stdout.write(`Saved credentials to ${path.join(home(), \"credentials.json\")}\\n`);\n}\n\nasync function main(): Promise<void> {\n\tconst command = process.argv[2] ?? \"help\";\n\tif (command === \"auth\") {\n\t\tif (process.argv[3] !== \"login\") fail(\"use: tokensize auth login\");\n\t\tawait login();\n\t\treturn;\n\t}\n\tif (command === \"doctor\" || command === \"allowance\") {\n\t\tconst [key, discovered] = await Promise.all([apiKey(false), discoverHarnessesCached({ forceRefresh: has(\"--refresh\"), reason: has(\"--refresh\") ? \"manual\" : undefined })]);\n\t\tconst [catalog, allowanceSnapshot] = await Promise.all([\n\t\t\tkey ? api(\"/v1/agent-catalog\").catch((error) => ({ warning: error instanceof Error ? error.message : String(error) })) : null,\n\t\t\tallowances(discovered.harnesses, has(\"--refresh\")),\n\t\t]);\n\t\tconst available = applyAllowances(discovered.harnesses, allowanceSnapshot);\n\t\tif (command === \"allowance\") {\n\t\t\toutput({ format: \"json\", privacy: \"only normalized allowance metadata is cached locally; raw account output is discarded\", cache: allowanceSnapshot.cache, harnesses: allowanceReport(available, allowanceSnapshot) });\n\t\t\treturn;\n\t\t}\n\t\toutput({\n\t\t\tservice: { url: apiUrl(), authenticated: Boolean(key), catalog },\n\t\t\tinstallationId: await installationId(),\n\t\t\tprivacy: \"credentials, raw account output, and prompts remain local unless prompt sharing is explicit\",\n\t\t\tcache: { discovery: discovered.cache, allowance: allowanceSnapshot.cache },\n\t\t\tharnesses: publicDiscovery(available),\n\t\t});\n\t\treturn;\n\t}\n\tif (command === \"feedback\") {\n\t\tconst rating = Number(value(\"--rating\"));\n\t\tconst modelChoice = value(\"--model-choice\");\n\t\tconst wouldUseAgain = value(\"--would-use-again\");\n\t\tif (!Number.isInteger(rating) || rating < 1 || rating > 5) fail(\"--rating must be an integer from 1 to 5\");\n\t\tif (!modelChoice || ![\"right\", \"acceptable\", \"wrong\"].includes(modelChoice)) fail(\"--model-choice must be right, acceptable, or wrong\");\n\t\tif (!wouldUseAgain || ![\"yes\", \"no\"].includes(wouldUseAgain)) fail(\"--would-use-again must be yes or no\");\n\t\tlet receipt: Awaited<ReturnType<typeof readLastRoute>>;\n\t\ttry { receipt = await readLastRoute(); } catch { fail(\"no valid local route receipt found; delegate a task first\"); }\n\t\tif (Date.parse(receipt.expiresAt) < Date.now()) fail(\"the last route has expired; delegate another task first\");\n\t\tconst response = await api<Record<string, unknown>>(\"/v1/agent-feedback\", {\n\t\t\tmethod: \"POST\",\n\t\t\tbody: JSON.stringify({\n\t\t\t\tschemaVersion: AGENT_ROUTER_SCHEMA_VERSION,\n\t\t\t\trouteId: receipt.routeId,\n\t\t\t\tfeedbackToken: receipt.feedbackToken,\n\t\t\t\tidempotencyKey: randomUUID(),\n\t\t\t\tstatus: modelChoice === \"wrong\" ? \"failed\" : \"verified\",\n\t\t\t\tconfirmedTargetId: receipt.targetId,\n\t\t\t\tidentityConfirmed: true,\n\t\t\t\tchecksPassed: modelChoice === \"right\" ? 1 : 0,\n\t\t\t\tchecksFailed: modelChoice === \"wrong\" ? 1 : 0,\n\t\t\t\tretries: 0,\n\t\t\t\tusage: { contextTokensEstimated: 0, source: \"unknown\" },\n\t\t\t\ttimings: { totalMs: 0, routingMs: 0, executionMs: 0, verificationMs: 0 },\n\t\t\t}),\n\t\t});\n\t\toutput({ ...response, routeId: receipt.routeId, privacy: \"feedback excludes prompts, repository contents, model output, and credentials\" });\n\t\treturn;\n\t}\n\tif (command === \"route\" || command === \"delegate\") {\n\t\tconst task = value(\"--task\");\n\t\tif (!task) fail(\"--task is required\");\n\t\tconst prepared = await prepare(task);\n\t\tconst { route: selected, runId } = await requestRoute(prepared.body);\n\t\tawait saveLastRoute({ routeId: selected.routeId, ...(runId ? { runId } : {}), feedbackToken: selected.feedbackToken, expiresAt: selected.expiresAt, targetId: selected.plan.targetId });\n\t\tif (command === \"route\" || !has(\"--execute\")) {\n\t\t\toutput({ dryRun: true, ...(runId ? { runId, run: dashboardUrl(runId) } : {}), route: presented(selected), cache: prepared.cache, harnesses: publicDiscovery(prepared.discovery) });\n\t\t\treturn;\n\t\t}\n\t\tconst execution = await execute(task, selected, prepared.discovery, prepared.cache, runId);\n\t\toutput({ dryRun: false, ...(runId ? { runId, run: dashboardUrl(runId) } : {}), route: presented(selected), execution });\n\t\tif (execution.code !== 0) process.exitCode = 1;\n\t\treturn;\n\t}\n\tif (command === \"runs\") {\n\t\tconst sub = process.argv[3];\n\t\tif (sub === \"watch\") {\n\t\t\tconst runId = process.argv[4] ?? (await readLastRoute().catch(() => null))?.runId;\n\t\t\tif (!runId) fail(\"use: tokensize runs watch <runId>\");\n\t\t\tconst deadline = Date.now() + Number(value(\"--timeout-ms\") ?? 900_000);\n\t\t\tlet printed = 0;\n\t\t\tfor (;;) {\n\t\t\t\tconst doc = await api<{ status: string; events: Array<Record<string, unknown>> }>(`/v1/runs/${runId}`);\n\t\t\t\tfor (const event of doc.events.slice(printed)) output(event);\n\t\t\t\tprinted = doc.events.length;\n\t\t\t\tif ([\"completed\", \"failed\", \"cancelled\", \"expired\"].includes(doc.status)) {\n\t\t\t\t\toutput({ runId, status: doc.status, run: dashboardUrl(runId) });\n\t\t\t\t\tif (doc.status !== \"completed\") process.exitCode = 1;\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (Date.now() > deadline) fail(\"watch timed out; the run is still live on the dashboard\");\n\t\t\t\tawait new Promise((resolve) => setTimeout(resolve, 2_000));\n\t\t\t}\n\t\t}\n\t\tconst limit = Number(value(\"--limit\") ?? 25);\n\t\toutput(await api(`/v1/runs?limit=${Number.isInteger(limit) && limit > 0 ? Math.min(limit, 100) : 25}`));\n\t\treturn;\n\t}\n\tif (command === \"approve\" || command === \"cancel\") {\n\t\tconst runId = process.argv[3] ?? (await readLastRoute().catch(() => null))?.runId;\n\t\tif (!runId) fail(`use: tokensize ${command} <runId>`);\n\t\tconst event = command === \"approve\"\n\t\t\t? { seq: 0, at: new Date().toISOString(), actor: \"human\", type: \"approval-granted\", data: { kind: value(\"--kind\") ?? \"subscription-use\", grantedBy: \"local-cli\" } }\n\t\t\t: { seq: 0, at: new Date().toISOString(), actor: \"human\", type: \"cancelled\", data: { by: \"human\" } };\n\t\tconst result = await api(`/v1/runs/${runId}/events`, { method: \"POST\", body: JSON.stringify({ autoSeq: true, event }) });\n\t\toutput({ ...(result as Record<string, unknown>), run: dashboardUrl(runId) });\n\t\treturn;\n\t}\n\tif (command === \"open\") {\n\t\tconst runId = process.argv[3] ?? (await readLastRoute().catch(() => null))?.runId;\n\t\tif (!runId) fail(\"use: tokensize open <runId>\");\n\t\tconst url = dashboardUrl(runId);\n\t\tprocess.stdout.write(`${url}\\n`);\n\t\texecFile(process.platform === \"darwin\" ? \"open\" : process.platform === \"win32\" ? \"cmd\" : \"xdg-open\", process.platform === \"win32\" ? [\"/c\", \"start\", url] : [url]);\n\t\treturn;\n\t}\n\tif (command === \"policy\") {\n\t\tif (process.argv[3] === \"set\") {\n\t\t\tconst patch: Partial<LocalPolicy> = {};\n\t\t\tconst objective = value(\"--objective\");\n\t\t\tconst ceiling = value(\"--permission-ceiling\");\n\t\t\tconst rootHarness = value(\"--root-harness\");\n\t\t\tconst depth = value(\"--max-delegation-depth\");\n\t\t\tconst share = value(\"--share-prompt\");\n\t\t\tconst approve = value(\"--approve-subscription\");\n\t\t\tconst revoke = value(\"--revoke-subscription\");\n\t\t\tif (objective) patch.objective = objective as LocalPolicy[\"objective\"];\n\t\t\tif (ceiling) patch.permissionCeiling = ceiling as LocalPolicy[\"permissionCeiling\"];\n\t\t\tif (rootHarness) patch.rootHarness = rootHarness;\n\t\t\tif (depth) patch.maxDelegationDepth = Number(depth);\n\t\t\tif (share) patch.sharePromptDefault = share === \"true\";\n\t\t\tif (approve || revoke) {\n\t\t\t\tconst current = (await readLocalPolicy()).subscriptionHarnesses ?? [];\n\t\t\t\tconst next = new Set(current);\n\t\t\t\tif (approve) next.add(approve);\n\t\t\t\tif (revoke) next.delete(revoke);\n\t\t\t\tpatch.subscriptionHarnesses = [...next];\n\t\t\t}\n\t\t\tif (Object.keys(patch).length === 0) fail(\"nothing to set; see tokensize help\");\n\t\t\toutput({ policy: await saveLocalPolicy(patch), file: path.join(home(), \"policy.json\") });\n\t\t\treturn;\n\t\t}\n\t\toutput({ policy: await readLocalPolicy(), file: path.join(home(), \"policy.json\"), note: \"local ceilings always win; the hosted service can only narrow them\" });\n\t\treturn;\n\t}\n\tprocess.stdout.write(\"TokenSize CLI\\n\\n  auth login\\n  doctor [--refresh] [--verbose] [--json]\\n  allowance [--refresh] [--json]\\n  route --task TEXT [--role inspect|plan|implement|review|test] [--permission inspect|edit|test] [--refresh] [--verbose]\\n  delegate --task TEXT [same options] [--execute]\\n  runs [--limit N] | runs watch [runId] [--timeout-ms N]\\n  approve [runId] [--kind subscription-use|execute|share-prompt]\\n  cancel [runId]\\n  open [runId]\\n  policy [get] | policy set [--objective X] [--permission-ceiling X] [--root-harness X] [--max-delegation-depth N] [--share-prompt true|false] [--approve-subscription HARNESS] [--revoke-subscription HARNESS]\\n  feedback --rating 1..5 --model-choice right|acceptable|wrong --would-use-again yes|no\\n\");\n}\n\nmain().catch((error) => fail(error instanceof Error ? error.message : String(error)));\n"],"mappings":";;;AAAA,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,QAAQ,aAAa;AAC9B,SAAS,oBAAoB;AAC7B,OAAO,UAAU;AACjB;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,OAGM;AACP;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIM;AAEP,IAAM,QAAQ,CAAC,WAAW,QAAQ,aAAa,UAAU,MAAM;AAC/D,IAAM,cAAc,CAAC,WAAW,QAAQ,QAAQ,SAAS;AAEzD,SAAS,MAAM,MAAkC;AAChD,QAAM,QAAQ,QAAQ,KAAK,QAAQ,IAAI;AACvC,SAAO,QAAQ,IAAI,SAAY,QAAQ,KAAK,QAAQ,CAAC;AACtD;AAEA,SAAS,IAAI,MAAuB;AAAE,SAAO,QAAQ,KAAK,SAAS,IAAI;AAAG;AAC1E,SAAS,OAAO,MAAqB;AAAE,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,CAAI;AAAG;AACnG,SAAS,KAAK,SAAwB;AACrC,UAAQ,OAAO,MAAM,cAAc,OAAO;AAAA,CAAI;AAC9C,UAAQ,KAAK,CAAC;AACf;AACA,SAAS,SAAiB;AAAE,UAAQ,QAAQ,IAAI,qBAAqB,6BAA6B,QAAQ,OAAO,EAAE;AAAG;AACtH,SAAS,UAAU,OAA+C;AACjE,SAAO,IAAI,0BAA0B,IAAI,QAAQ,EAAE,GAAG,OAAO,eAAe,aAAa;AAC1F;AAEA,eAAe,OAAO,WAAW,MAA8B;AAC9D,QAAM,MAAM,QAAQ,IAAI,qBAAqB,MAAM,WAAW;AAC9D,MAAI,CAAC,OAAO,SAAU,MAAK,kEAAkE;AAC7F,SAAO;AACR;AAEA,eAAe,IAAO,UAAkB,UAAuB,CAAC,GAAe;AAC9E,QAAM,MAAM,MAAM,OAAO;AACzB,QAAM,WAAW,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,QAAQ,IAAI;AAAA,IACtD,GAAG;AAAA,IACH,SAAS;AAAA,MACR,eAAe,UAAU,GAAG;AAAA,MAC5B,GAAI,QAAQ,OAAO,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;AAAA,MAC7D,GAAG,QAAQ;AAAA,IACZ;AAAA,EACD,CAAC;AACD,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI;AACJ,MAAI;AAAE,WAAO,KAAK,MAAM,IAAI;AAAA,EAAG,QAAQ;AAAE,WAAO,EAAE,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE;AAAA,EAAG;AACjF,MAAI,CAAC,SAAS,IAAI;AACjB,UAAM,SAAS;AACf,UAAM,IAAI,MAAM,oBAAoB,SAAS,MAAM,KAAK,OAAO,OAAO,WAAW,OAAO,WAAW,gBAAgB,EAAE;AAAA,EACtH;AACA,SAAO;AACR;AAEA,SAAS,gBAAgB,WAA0C;AAClE,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,SAAO,UAAU,IAAI,CAAC,UAAU;AAAA,IAC/B,SAAS,KAAK;AAAA,IACd,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,SAAS,KAAK;AAAA,IACd,YAAY,KAAK,OAAO;AAAA,IACxB,iBAAiB,0BAA0B,IAAI;AAAA,IAC/C,UAAU,KAAK;AAAA,EAChB,EAAE;AACH;AAEA,eAAe,QAAQ,MAIpB;AACF,QAAM,OAAQ,MAAM,QAAQ,KAAK;AACjC,QAAM,aAAc,MAAM,cAAc,KAAK;AAC7C,MAAI,CAAC,MAAM,SAAS,IAAI,EAAG,MAAK,gBAAgB;AAChD,MAAI,CAAC,YAAY,SAAS,UAAU,EAAG,MAAK,sBAAsB;AAClE,QAAM,aAAa,MAAM,wBAAwB,EAAE,cAAc,IAAI,WAAW,GAAG,QAAQ,IAAI,WAAW,IAAI,WAAW,OAAU,CAAC;AACpI,QAAM,oBAAoB,MAAM,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC;AACjF,QAAM,YAAY,gBAAgB,WAAW,WAAW,iBAAiB;AACzE,QAAM,cAAe,QAAQ,IAAI,0BAA0B;AAC3D,QAAM,aAAa,QAAQ,IAAI,0BAA0B;AACzD,QAAM,OAA0B;AAAA,IAC/B,eAAe;AAAA,IACf,QAAQ;AAAA,MACP,SAAU,QAAQ,IAAI,4BAA4B;AAAA,MAClD,SAAS,QAAQ,IAAI,4BAA4B;AAAA,IAClD;AAAA,IACA,WAAW,WAAW;AAAA,IACtB,gBAAgB,MAAM,eAAe;AAAA,IACrC,YAAY,IAAI,gBAAgB,IAAI,oBAAoB;AAAA,IACxD,MAAM,mBAAmB,EAAE,MAAM,MAAM,mBAAmB,WAAW,CAAC;AAAA,IACtE,GAAI,IAAI,gBAAgB,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,IAChD,YAAY,cAAc,SAAS;AAAA,IACnC,MAAM;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,cAAc,OAAO,QAAQ,IAAI,gCAAgC,IAAI;AAAA,MACrE,WAAW,cAAc,aAAa,iBAAiB;AAAA,IACxD;AAAA,IACA,QAAQ;AAAA,MACP,WAAY,MAAM,aAAa,KAAK;AAAA,MACpC,oBAAoB;AAAA,MACpB,iBAAiB,OAAO,QAAQ,IAAI,8BAA8B,CAAC;AAAA,MACnE,mBAAmB;AAAA,MACnB,kBAAkB,OAAO,MAAM,cAAc,KAAK,GAAO;AAAA,IAC1D;AAAA,EACD;AACA,SAAO,EAAE,MAAM,WAAW,OAAO,EAAE,WAAW,WAAW,OAAO,WAAW,kBAAkB,MAAM,EAAE;AACtG;AAEA,eAAe,aAAa,MAAiF;AAC5G,QAAM,WAAW,MAAM,IAAa,oBAAoB,EAAE,QAAQ,QAAQ,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC;AACtG,QAAM,SAAS,yBAAyB,UAAU,QAAQ;AAC1D,MAAI,CAAC,OAAO,QAAS,MAAK,0CAA0C;AACpE,QAAM,QAAQ,OAAQ,SAAiC,UAAU,WAAY,SAA+B,QAAQ;AACpH,SAAO,EAAE,OAAO,OAAO,MAAM,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG;AAC1D;AAEA,SAAS,aAAa,OAAuB;AAC5C,SAAO,8BAA8B,KAAK;AAC3C;AAGA,eAAe,eAAe,OAA2B,cAAsB,OAAe,MAAc,MAA8C;AACzJ,MAAI,CAAC,MAAO;AACZ,MAAI;AACH,UAAM,IAAI,YAAY,KAAK,WAAW;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU,EAAE,cAAc,SAAS,MAAM,OAAO,EAAE,KAAK,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,MAAM,KAAK,EAAE,CAAC;AAAA,IACzH,CAAC;AAAA,EACF,QAAQ;AAAA,EAA0E;AACnF;AAEA,eAAe,iBAAiB,QAAiD;AAChF,UAAQ,MAAM,wBAAwB,EAAE,cAAc,MAAM,OAAO,CAAC,GAAG;AACxE;AAEA,eAAe,QACd,MACA,OACA,WACA,OACA,OACC;AACD,MAAI,CAAC,MAAM,KAAK,SAAU,MAAK,6BAA6B,MAAM,YAAY,KAAK,IAAI,CAAC,GAAG;AAC3F,MAAI,MAAM,KAAK,sBAAsB,UAAW,MAAK,qCAAqC;AAC1F,QAAM,SAAS,UAAU,QAAQ,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,MAAM,MAAM,OAAO,MAAM,KAAK,QAAQ;AAC9I,MAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,OAAO,KAAK,eAAe;AAC3D,UAAM,iBAAiB,6BAA6B;AACpD,SAAK,yEAAyE;AAAA,EAC/E;AACA,MAAI;AAAE,UAAM,OAAO,OAAO,KAAK,UAAU;AAAA,EAAG,QAAQ;AACnD,UAAM,iBAAiB,6BAA6B;AACpD,SAAK,+EAA+E;AAAA,EACrF;AACA,MAAI,CAAC,CAAC,SAAS,UAAU,UAAU,UAAU,EAAE,SAAS,OAAO,MAAM,OAAO,EAAG,MAAK,GAAG,OAAO,MAAM,OAAO,mCAAmC;AAC9I,MAAI,CAAC,UAAU,UAAU,EAAE,SAAS,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,sBAAsB,UAAW,MAAK,GAAG,OAAO,MAAM,YAAY,WAAW,WAAW,UAAU,4BAA4B;AAEtM,MAAI,MAAM,QAAQ,IAAI;AACtB,MAAI,WAA0B;AAC9B,MAAI,MAAM,KAAK,kBAAkB;AAChC,UAAM,WAAW,MAAM,IAAI,OAAO,CAAC,aAAa,iBAAiB,GAAG,EAAE,KAAK,WAAW,KAAO,CAAC;AAC9F,QAAI,SAAS,SAAS,EAAG,MAAK,gDAAgD;AAC9E,eAAW,KAAK,KAAK,KAAK,GAAG,aAAa,MAAM,OAAO;AACvD,UAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACpE,UAAM,SAAS,aAAa,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC;AACrD,UAAM,UAAU,MAAM,IAAI,OAAO,CAAC,YAAY,OAAO,MAAM,QAAQ,UAAU,MAAM,GAAG,EAAE,KAAK,WAAW,IAAO,CAAC;AAChH,QAAI,QAAQ,SAAS,EAAG,MAAK,uCAAuC,QAAQ,OAAO,KAAK,CAAC,EAAE;AAC3F,UAAM;AAAA,EACP;AAEA,QAAM,eAAe,OAAO,MAAM,eAAe,YAAY,qBAAqB;AAAA,IACjF,UAAU,OAAO,MAAM;AAAA,IACvB,mBAAmB,MAAM,KAAK;AAAA,IAC9B,UAAU,aAAa;AAAA,EACxB,CAAC;AACD,QAAM,UAAU,KAAK,IAAI;AACzB,QAAM,SAAS,MAAM,IAAI,OAAO,KAAK,YAAY,cAAc,OAAO,MAAM,SAAS,OAAO,MAAM,eAAe,MAAM,KAAK,mBAAmB,GAAG,GAAG;AAAA,IACpJ;AAAA,IACA,OAAO;AAAA,IACP,WAAW,MAAM,KAAK;AAAA,IACtB,KAAK;AAAA,MACJ,GAAG,QAAQ;AAAA,MACX,wBAAwB,OAAO,MAAM;AAAA,MACrC,uBAAuB;AAAA,MACvB,4BAA4B,OAAO,OAAO,QAAQ,IAAI,8BAA8B,CAAC,IAAI,CAAC;AAAA,MAC1F,0BAA0B;AAAA,IAC3B;AAAA,EACD,CAAC;AACD,QAAM,UAAU,KAAK,IAAI,IAAI;AAC7B,QAAM,eAAe,OAAO,MAAM,eAAe,YAAY,sBAAsB;AAAA,IAClF,SAAS,OAAO,WAAW,YAAY,OAAO,SAAS,IAAI,YAAY;AAAA,IACvE,GAAI,OAAO,SAAS,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,EAAE,aAAa,OAAO,WAAW,sBAAsB,mBAAmB;AAAA,IAC3H,WAAW;AAAA,IACX,OAAO,EAAE,wBAAwB,MAAM,SAAS,eAAe,QAAQ,YAAY;AAAA,EACpF,CAAC;AACD,QAAM,WAAW,GAAG,OAAO,MAAM;AAAA,EAAK,OAAO,MAAM;AACnD,QAAM,sBAAsB,OAAO,YAAa,OAAO,SAAS,KAAK,6KAA6K,KAAK,QAAQ;AAC/P,QAAM,mBAAmB,OAAO,SAAS,KAAK,uFAAuF,KAAK,QAAQ;AAClJ,QAAM,mBAAmB,sBAAsB,MAAM,iBAAiB,OAAO,WAAW,sBAAsB,gCAAgC,IAAI;AAClJ,QAAM,mBAAmB,oBAAoB,MAAM,WAAW,WAAW,IAAI,GAAG,QAAQ;AACxF,MAAI;AACJ,MAAI;AACH,UAAM,IAAI,sBAAsB;AAAA,MAC/B,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,QACpB,eAAe;AAAA,QACf,SAAS,MAAM;AAAA,QACf,eAAe,MAAM;AAAA,QACrB,gBAAgB,WAAW;AAAA,QAC3B,QAAQ,OAAO,SAAS,IAAI,cAAc;AAAA,QAC1C,mBAAmB,OAAO,MAAM;AAAA,QAChC,mBAAmB;AAAA,QACnB,cAAc;AAAA,QACd,cAAc;AAAA,QACd,SAAS;AAAA,QACT,OAAO,EAAE,wBAAwB,MAAM,SAAS,eAAe,QAAQ,YAAY;AAAA,QACnF,SAAS,EAAE,SAAS,SAAS,WAAW,GAAG,aAAa,SAAS,gBAAgB,EAAE;AAAA,QACnF,GAAI,OAAO,SAAS,IAAI,CAAC,IAAI,EAAE,aAAa,OAAO,WAAW,sBAAsB,mBAAmB;AAAA,MACxG,CAAC;AAAA,IACF,CAAC;AAAA,EACF,SAAS,OAAO;AAAE,sBAAkB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EAAG;AAC5F,SAAO,EAAE,QAAQ,OAAO,MAAM,IAAI,MAAM,OAAO,MAAM,UAAU,OAAO,UAAU,UAAU,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,iBAAiB,WAAW,OAAO,kBAAkB,iBAAiB;AAC/M;AAEA,eAAe,QAAuB;AACrC,QAAM,QAAQ,WAAW;AACzB,MAAI,YAAY;AAChB,QAAM,SAAS,aAAa,CAAC,SAAS,aAAa;AAClD,QAAI,QAAQ,WAAW,aAAa,QAAQ,QAAQ,aAAa,KAAK,IAAI;AACzE,eAAS,UAAU,KAAK,EAAE,+BAA+B,yBAAyB,gCAAgC,QAAQ,gCAAgC,eAAe,CAAC,EAAE,IAAI;AAChL;AAAA,IACD;AACA,QAAI,QAAQ,WAAW,UAAU,QAAQ,QAAQ,aAAa,KAAK,IAAI;AAAE,eAAS,UAAU,GAAG,EAAE,IAAI;AAAG;AAAA,IAAQ;AAChH,QAAI,OAAO;AACX,YAAQ,GAAG,QAAQ,CAAC,UAAU;AAAE,cAAQ;AAAA,IAAO,CAAC;AAChD,YAAQ,GAAG,OAAO,YAAY;AAC7B,UAAI;AACH,cAAM,UAAU,KAAK,MAAM,IAAI;AAC/B,YAAI,QAAQ,UAAU,SAAS,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,MAAM,KAAK,KAAK,QAAQ,MAAM,EAAG,OAAM,IAAI,MAAM,kBAAkB;AAChK,cAAM,WAAW,QAAQ,MAAM;AAC/B,oBAAY;AACZ,iBAAS,UAAU,KAAK,EAAE,gBAAgB,cAAc,+BAA+B,wBAAwB,CAAC,EAAE,IAAI,mDAAmD;AACzK,mBAAW,MAAM,OAAO,MAAM,GAAG,GAAG;AAAA,MACrC,QAAQ;AAAE,iBAAS,UAAU,KAAK,EAAE,+BAA+B,wBAAwB,CAAC,EAAE,IAAI,+BAA+B;AAAA,MAAG;AAAA,IACrI,CAAC;AAAA,EACF,CAAC;AACD,QAAM,IAAI,QAAc,CAAC,YAAY,OAAO,OAAO,GAAG,aAAa,OAAO,CAAC;AAC3E,QAAM,UAAU,OAAO,QAAQ;AAC/B,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,MAAK,gCAAgC;AAClF,QAAM,WAAW,oBAAoB,QAAQ,IAAI,aAAa,KAAK;AACnE,QAAM,MAAM,4CAA4C,mBAAmB,QAAQ,CAAC,UAAU,mBAAmB,KAAK,CAAC;AACvH,UAAQ,OAAO,MAAM;AAAA,EAAqC,GAAG;AAAA,CAAI;AACjE,WAAS,QAAQ,aAAa,WAAW,SAAS,QAAQ,aAAa,UAAU,QAAQ,YAAY,QAAQ,aAAa,UAAU,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;AAChK,QAAM,UAAU,WAAW,MAAM,OAAO,MAAM,GAAG,KAAK,KAAK,GAAK;AAChE,QAAM,IAAI,QAAc,CAAC,YAAY,OAAO,GAAG,SAAS,OAAO,CAAC;AAChE,eAAa,OAAO;AACpB,MAAI,CAAC,UAAW,MAAK,kDAAkD;AACvE,UAAQ,OAAO,MAAM,wBAAwB,KAAK,KAAK,KAAK,GAAG,kBAAkB,CAAC;AAAA,CAAI;AACvF;AAEA,eAAe,OAAsB;AACpC,QAAM,UAAU,QAAQ,KAAK,CAAC,KAAK;AACnC,MAAI,YAAY,QAAQ;AACvB,QAAI,QAAQ,KAAK,CAAC,MAAM,QAAS,MAAK,2BAA2B;AACjE,UAAM,MAAM;AACZ;AAAA,EACD;AACA,MAAI,YAAY,YAAY,YAAY,aAAa;AACpD,UAAM,CAAC,KAAK,UAAU,IAAI,MAAM,QAAQ,IAAI,CAAC,OAAO,KAAK,GAAG,wBAAwB,EAAE,cAAc,IAAI,WAAW,GAAG,QAAQ,IAAI,WAAW,IAAI,WAAW,OAAU,CAAC,CAAC,CAAC;AACzK,UAAM,CAAC,SAAS,iBAAiB,IAAI,MAAM,QAAQ,IAAI;AAAA,MACtD,MAAM,IAAI,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,EAAE,IAAI;AAAA,MACzH,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC;AAAA,IAClD,CAAC;AACD,UAAM,YAAY,gBAAgB,WAAW,WAAW,iBAAiB;AACzE,QAAI,YAAY,aAAa;AAC5B,aAAO,EAAE,QAAQ,QAAQ,SAAS,yFAAyF,OAAO,kBAAkB,OAAO,WAAW,gBAAgB,WAAW,iBAAiB,EAAE,CAAC;AACrN;AAAA,IACD;AACA,WAAO;AAAA,MACN,SAAS,EAAE,KAAK,OAAO,GAAG,eAAe,QAAQ,GAAG,GAAG,QAAQ;AAAA,MAC/D,gBAAgB,MAAM,eAAe;AAAA,MACrC,SAAS;AAAA,MACT,OAAO,EAAE,WAAW,WAAW,OAAO,WAAW,kBAAkB,MAAM;AAAA,MACzE,WAAW,gBAAgB,SAAS;AAAA,IACrC,CAAC;AACD;AAAA,EACD;AACA,MAAI,YAAY,YAAY;AAC3B,UAAM,SAAS,OAAO,MAAM,UAAU,CAAC;AACvC,UAAM,cAAc,MAAM,gBAAgB;AAC1C,UAAM,gBAAgB,MAAM,mBAAmB;AAC/C,QAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,EAAG,MAAK,yCAAyC;AACzG,QAAI,CAAC,eAAe,CAAC,CAAC,SAAS,cAAc,OAAO,EAAE,SAAS,WAAW,EAAG,MAAK,oDAAoD;AACtI,QAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,IAAI,EAAE,SAAS,aAAa,EAAG,MAAK,qCAAqC;AACxG,QAAI;AACJ,QAAI;AAAE,gBAAU,MAAM,cAAc;AAAA,IAAG,QAAQ;AAAE,WAAK,2DAA2D;AAAA,IAAG;AACpH,QAAI,KAAK,MAAM,QAAQ,SAAS,IAAI,KAAK,IAAI,EAAG,MAAK,yDAAyD;AAC9G,UAAM,WAAW,MAAM,IAA6B,sBAAsB;AAAA,MACzE,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,QACpB,eAAe;AAAA,QACf,SAAS,QAAQ;AAAA,QACjB,eAAe,QAAQ;AAAA,QACvB,gBAAgB,WAAW;AAAA,QAC3B,QAAQ,gBAAgB,UAAU,WAAW;AAAA,QAC7C,mBAAmB,QAAQ;AAAA,QAC3B,mBAAmB;AAAA,QACnB,cAAc,gBAAgB,UAAU,IAAI;AAAA,QAC5C,cAAc,gBAAgB,UAAU,IAAI;AAAA,QAC5C,SAAS;AAAA,QACT,OAAO,EAAE,wBAAwB,GAAG,QAAQ,UAAU;AAAA,QACtD,SAAS,EAAE,SAAS,GAAG,WAAW,GAAG,aAAa,GAAG,gBAAgB,EAAE;AAAA,MACxE,CAAC;AAAA,IACF,CAAC;AACD,WAAO,EAAE,GAAG,UAAU,SAAS,QAAQ,SAAS,SAAS,gFAAgF,CAAC;AAC1I;AAAA,EACD;AACA,MAAI,YAAY,WAAW,YAAY,YAAY;AAClD,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,MAAK,oBAAoB;AACpC,UAAM,WAAW,MAAM,QAAQ,IAAI;AACnC,UAAM,EAAE,OAAO,UAAU,MAAM,IAAI,MAAM,aAAa,SAAS,IAAI;AACnE,UAAM,cAAc,EAAE,SAAS,SAAS,SAAS,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAI,eAAe,SAAS,eAAe,WAAW,SAAS,WAAW,UAAU,SAAS,KAAK,SAAS,CAAC;AACtL,QAAI,YAAY,WAAW,CAAC,IAAI,WAAW,GAAG;AAC7C,aAAO,EAAE,QAAQ,MAAM,GAAI,QAAQ,EAAE,OAAO,KAAK,aAAa,KAAK,EAAE,IAAI,CAAC,GAAI,OAAO,UAAU,QAAQ,GAAG,OAAO,SAAS,OAAO,WAAW,gBAAgB,SAAS,SAAS,EAAE,CAAC;AACjL;AAAA,IACD;AACA,UAAM,YAAY,MAAM,QAAQ,MAAM,UAAU,SAAS,WAAW,SAAS,OAAO,KAAK;AACzF,WAAO,EAAE,QAAQ,OAAO,GAAI,QAAQ,EAAE,OAAO,KAAK,aAAa,KAAK,EAAE,IAAI,CAAC,GAAI,OAAO,UAAU,QAAQ,GAAG,UAAU,CAAC;AACtH,QAAI,UAAU,SAAS,EAAG,SAAQ,WAAW;AAC7C;AAAA,EACD;AACA,MAAI,YAAY,QAAQ;AACvB,UAAM,MAAM,QAAQ,KAAK,CAAC;AAC1B,QAAI,QAAQ,SAAS;AACpB,YAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,MAAM,cAAc,EAAE,MAAM,MAAM,IAAI,IAAI;AAC5E,UAAI,CAAC,MAAO,MAAK,mCAAmC;AACpD,YAAM,WAAW,KAAK,IAAI,IAAI,OAAO,MAAM,cAAc,KAAK,GAAO;AACrE,UAAI,UAAU;AACd,iBAAS;AACR,cAAM,MAAM,MAAM,IAAgE,YAAY,KAAK,EAAE;AACrG,mBAAW,SAAS,IAAI,OAAO,MAAM,OAAO,EAAG,QAAO,KAAK;AAC3D,kBAAU,IAAI,OAAO;AACrB,YAAI,CAAC,aAAa,UAAU,aAAa,SAAS,EAAE,SAAS,IAAI,MAAM,GAAG;AACzE,iBAAO,EAAE,OAAO,QAAQ,IAAI,QAAQ,KAAK,aAAa,KAAK,EAAE,CAAC;AAC9D,cAAI,IAAI,WAAW,YAAa,SAAQ,WAAW;AACnD;AAAA,QACD;AACA,YAAI,KAAK,IAAI,IAAI,SAAU,MAAK,yDAAyD;AACzF,cAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAK,CAAC;AAAA,MAC1D;AAAA,IACD;AACA,UAAM,QAAQ,OAAO,MAAM,SAAS,KAAK,EAAE;AAC3C,WAAO,MAAM,IAAI,kBAAkB,OAAO,UAAU,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,GAAG,IAAI,EAAE,EAAE,CAAC;AACtG;AAAA,EACD;AACA,MAAI,YAAY,aAAa,YAAY,UAAU;AAClD,UAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,MAAM,cAAc,EAAE,MAAM,MAAM,IAAI,IAAI;AAC5E,QAAI,CAAC,MAAO,MAAK,kBAAkB,OAAO,UAAU;AACpD,UAAM,QAAQ,YAAY,YACvB,EAAE,KAAK,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,SAAS,MAAM,oBAAoB,MAAM,EAAE,MAAM,MAAM,QAAQ,KAAK,oBAAoB,WAAW,YAAY,EAAE,IAChK,EAAE,KAAK,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,SAAS,MAAM,aAAa,MAAM,EAAE,IAAI,QAAQ,EAAE;AACpG,UAAM,SAAS,MAAM,IAAI,YAAY,KAAK,WAAW,EAAE,QAAQ,QAAQ,MAAM,KAAK,UAAU,EAAE,SAAS,MAAM,MAAM,CAAC,EAAE,CAAC;AACvH,WAAO,EAAE,GAAI,QAAoC,KAAK,aAAa,KAAK,EAAE,CAAC;AAC3E;AAAA,EACD;AACA,MAAI,YAAY,QAAQ;AACvB,UAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,MAAM,cAAc,EAAE,MAAM,MAAM,IAAI,IAAI;AAC5E,QAAI,CAAC,MAAO,MAAK,6BAA6B;AAC9C,UAAM,MAAM,aAAa,KAAK;AAC9B,YAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,CAAI;AAC/B,aAAS,QAAQ,aAAa,WAAW,SAAS,QAAQ,aAAa,UAAU,QAAQ,YAAY,QAAQ,aAAa,UAAU,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;AAChK;AAAA,EACD;AACA,MAAI,YAAY,UAAU;AACzB,QAAI,QAAQ,KAAK,CAAC,MAAM,OAAO;AAC9B,YAAM,QAA8B,CAAC;AACrC,YAAM,YAAY,MAAM,aAAa;AACrC,YAAM,UAAU,MAAM,sBAAsB;AAC5C,YAAM,cAAc,MAAM,gBAAgB;AAC1C,YAAM,QAAQ,MAAM,wBAAwB;AAC5C,YAAM,QAAQ,MAAM,gBAAgB;AACpC,YAAM,UAAU,MAAM,wBAAwB;AAC9C,YAAM,SAAS,MAAM,uBAAuB;AAC5C,UAAI,UAAW,OAAM,YAAY;AACjC,UAAI,QAAS,OAAM,oBAAoB;AACvC,UAAI,YAAa,OAAM,cAAc;AACrC,UAAI,MAAO,OAAM,qBAAqB,OAAO,KAAK;AAClD,UAAI,MAAO,OAAM,qBAAqB,UAAU;AAChD,UAAI,WAAW,QAAQ;AACtB,cAAM,WAAW,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACpE,cAAM,OAAO,IAAI,IAAI,OAAO;AAC5B,YAAI,QAAS,MAAK,IAAI,OAAO;AAC7B,YAAI,OAAQ,MAAK,OAAO,MAAM;AAC9B,cAAM,wBAAwB,CAAC,GAAG,IAAI;AAAA,MACvC;AACA,UAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,MAAK,oCAAoC;AAC9E,aAAO,EAAE,QAAQ,MAAM,gBAAgB,KAAK,GAAG,MAAM,KAAK,KAAK,KAAK,GAAG,aAAa,EAAE,CAAC;AACvF;AAAA,IACD;AACA,WAAO,EAAE,QAAQ,MAAM,gBAAgB,GAAG,MAAM,KAAK,KAAK,KAAK,GAAG,aAAa,GAAG,MAAM,qEAAqE,CAAC;AAC9J;AAAA,EACD;AACA,UAAQ,OAAO,MAAM,muBAAmuB;AACzvB;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,CAAC;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export * from '@tokensize/agent-client';

package/dist/index.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+// src/index.ts
+export * from "@tokensize/agent-client";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Compatibility surface: the implementation lives in @tokensize/agent-client.\n// The CLI package re-exports it so existing `@tokensize/cli` imports keep\n// working while the dependency direction stays adapters → agent-client.\nexport * from \"@tokensize/agent-client\";\n"],"mappings":";;;AAGA,cAAc;","names":[]}

package/package.json

@@ -0,0 +1,21 @@
+{
+	"name": "@tokensize/cli",
+	"version": "0.3.0-beta.0",
+	"description": "Discover and safely delegate work to local coding harnesses using TokenSize routing",
+	"type": "module",
+	"bin": { "tokensize": "dist/cli.js" },
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"exports": { ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" } },
+	"files": ["dist", "README.md", "LICENSE"],
+	"repository": { "type": "git", "url": "git+https://github.com/tokensize/tokensize.git", "directory": "packages/cli" },
+	"homepage": "https://tokensize.dev",
+	"bugs": { "url": "https://github.com/tokensize/tokensize/issues" },
+	"keywords": ["ai", "agents", "cli", "delegation", "routing"],
+	"publishConfig": { "access": "public", "provenance": true, "tag": "beta" },
+	"engines": { "node": ">=20" },
+	"scripts": { "prebuild": "npm --prefix ../.. run build --workspace @tokensize/agent-client", "build": "tsup", "pretypecheck": "npm --prefix ../.. run build --workspace @tokensize/agent-client", "typecheck": "tsc --noEmit", "test": "vitest run", "prepack": "npm run build", "prepublishOnly": "npm run typecheck && npm test" },
+	"dependencies": { "@tokensize/agent-client": "0.3.0-beta.0", "@tokensize/agent-router": "0.3.0-beta.0" },
+	"devDependencies": { "@types/node": "^26.1.1", "tsup": "^8.5.0", "typescript": "^5.5.2", "vitest": "^4.1.10" },
+	"license": "MIT"
+}