@tonbo/cli 0.0.7 → 0.1.1

package/dist/bin/tonbo.js

@@ -5,7 +5,7 @@ import { Command } from "commander";
 import { readFileSync } from "node:fs";
 
 // src/api.ts
-import { createHash, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 
 // src/http.ts
 var HttpError = class extends Error {
@@ -33,41 +33,51 @@ async function requestJson(fetcher, url, init = {}) {
 }
 
 // src/api.ts
-function stableJson(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-  const object = value;
-  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableJson(object[key])}`).join(",")}}`;
-}
-function digest(value) {
-  return createHash("sha256").update(stableJson(value)).digest("hex");
-}
 var TonboApi = class {
   constructor(fetcher, accountOrigin = "https://tonbo.dev", managementOrigin = "https://api.tonbo.dev") {
     this.fetcher = fetcher;
     this.accountOrigin = accountOrigin;
     this.managementOrigin = managementOrigin;
   }
+  machineRequest(oauthToken, path6 = "", method = "GET", body) {
+    return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/machines${path6}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${oauthToken}`,
+        ...body === void 0 ? {} : { "content-type": "application/json" }
+      },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
+    });
+  }
   listProjects(oauthToken) {
     return requestJson(
       this.fetcher,
-      `${this.accountOrigin}/api/cli/projects`,
+      `${this.accountOrigin}/api/cli/agents`,
       {
         headers: { authorization: `Bearer ${oauthToken}` }
       }
     ).then((body) => body.projects);
   }
-  createProject(oauthToken, slug, name) {
+  listOrganizations(oauthToken) {
     return requestJson(
       this.fetcher,
-      `${this.accountOrigin}/api/cli/projects`,
+      `${this.accountOrigin}/api/cli/accounts`,
+      {
+        headers: { authorization: `Bearer ${oauthToken}` }
+      }
+    ).then((body) => body.organizations);
+  }
+  createProject(oauthToken, name, organizationId) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/agents`,
       {
         method: "POST",
         headers: {
           authorization: `Bearer ${oauthToken}`,
           "content-type": "application/json"
         },
-        body: JSON.stringify({ slug, ...name ? { name } : {} })
+        body: JSON.stringify(organizationId ? { name, orgId: organizationId } : { name })
       }
     ).then((body) => body.project);
   }
@@ -106,7 +116,7 @@ var TonboApi = class {
   exchangeManagementToken(oauthToken, projectId) {
     return requestJson(
       this.fetcher,
-      `${this.accountOrigin}/api/cli/projects/${projectId}/token`,
+      `${this.accountOrigin}/api/cli/agents/${projectId}/token`,
       {
         method: "POST",
         headers: { authorization: `Bearer ${oauthToken}` }
@@ -115,7 +125,9 @@ var TonboApi = class {
   }
   async deploy({
     bundle,
+    origin,
     projectId,
+    promote,
     spec,
     token
   }) {
@@ -124,8 +136,7 @@ var TonboApi = class {
       sha256: bundle.sha256,
       size_bytes: bundle.size_bytes
     };
-    const projectPath = `/v1/projects/${projectId}`;
-    const bundlesPath = `${projectPath}/source-bundles`;
+    const bundlesPath = `/v1/agents/${projectId}/source-bundles`;
     const prepared = await this.management("PUT", `${bundlesPath}/${bundle.sha256}`, token, {
       format: descriptor.format,
       size_bytes: descriptor.size_bytes
@@ -155,28 +166,69 @@ var TonboApi = class {
         throw error;
       }
     }
-    const revisionsPath = `${projectPath}/revisions`;
-    const revisionDigest = digest(spec);
-    const revisions = await this.managementList(revisionsPath, token);
-    let revision = revisions.find((candidate) => candidate.spec_sha256 === revisionDigest);
-    if (!revision) {
-      revision = (await this.management("POST", revisionsPath, token, { spec })).data;
+    let deployment = await this.createDeployment(projectId, { spec, origin }, token);
+    const previous = await this.getProduction(projectId, token);
+    const previousDeployment = previous ? await this.getDeployment(projectId, previous.deployment_id, token) : null;
+    const unchanged = previousDeployment?.spec_sha256 === deployment.spec_sha256;
+    let production = previous;
+    if (promote) {
+      production = await this.putProduction(
+        projectId,
+        {
+          deployment_id: deployment.id,
+          desired_state: "running",
+          expected_generation: previous ? previous.generation : null
+        },
+        token
+      );
+      deployment = await this.getDeployment(projectId, deployment.id, token);
     }
-    const deploymentPath = `${projectPath}/deployment`;
-    const current = await this.management(
+    return { deployment, production, unchanged };
+  }
+  createDeployment(projectId, body, token) {
+    return this.management(
+      "POST",
+      `/v1/agents/${projectId}/deployments`,
+      token,
+      body
+    ).then((response) => response.data);
+  }
+  listDeployments(projectId, token) {
+    return this.managementList(`/v1/agents/${projectId}/deployments`, token);
+  }
+  getDeployment(projectId, deploymentId, token) {
+    return this.management(
       "GET",
-      deploymentPath,
+      `/v1/agents/${projectId}/deployments/${deploymentId}`,
       token
-    ).catch((error) => {
-      if (error.status === 404) return null;
-      throw error;
-    });
-    const deployment = (await this.management("PUT", deploymentPath, token, {
-      desired_revision_id: revision.id,
-      desired_state: "running",
-      expected_generation: current ? Number(current.data.generation) : null
-    })).data;
-    return { deployment, revision };
+    ).then((response) => response.data);
+  }
+  getProduction(projectId, token) {
+    return this.management(
+      "GET",
+      `/v1/agents/${projectId}/production`,
+      token
+    ).then(
+      (response) => response.data,
+      (error) => {
+        if (error.status === 404) return null;
+        throw error;
+      }
+    );
+  }
+  putProduction(projectId, body, token) {
+    return this.management(
+      "PUT",
+      `/v1/agents/${projectId}/production`,
+      token,
+      body
+    ).then((response) => response.data);
+  }
+  listRollouts(projectId, token) {
+    return this.managementList(
+      `/v1/agents/${projectId}/production/rollouts`,
+      token
+    );
   }
   async run({
     projectId,
@@ -185,15 +237,19 @@ var TonboApi = class {
     token,
     turnId = randomUUID()
   }) {
-    const projectPath = `/v1/projects/${projectId}`;
-    const deployment = (await this.management("GET", `${projectPath}/deployment`, token)).data;
-    if (deployment.observed_state !== "running")
-      throw new Error(`Project Agent is ${deployment.observed_state}; wait for it to be running.`);
+    const projectPath = `/v1/agents/${projectId}`;
+    const production = await this.getProduction(projectId, token);
+    if (!production)
+      throw new Error("Agent has no Production Deployment; run `tonbo deploy` first.");
+    if (production.observed_state !== "running")
+      throw new Error(
+        `Production is ${production.observed_state}${production.last_error ? ` (${production.last_error})` : ""}; wait for it to be running.`
+      );
     const session = sessionId ? { id: sessionId } : (await this.management(
       "POST",
       `${projectPath}/sessions`,
       token,
-      { revision_id: deployment.desired_revision_id }
+      { deployment_id: production.deployment_id }
     )).data;
     const turn = (await this.management(
       "POST",
@@ -202,7 +258,7 @@ var TonboApi = class {
       { prompt },
       turnId
     )).data;
-    return { deployment, session, turn };
+    return { production, session, turn };
   }
   turnEvents({
     after = 0,
@@ -213,21 +269,21 @@ var TonboApi = class {
   }) {
     return this.management(
       "GET",
-      `/v1/projects/${projectId}/sessions/${sessionId}/turns/${turnId}/events?after=${after}`,
+      `/v1/agents/${projectId}/sessions/${sessionId}/turns/${turnId}/events?after=${after}`,
       token
     );
   }
   listProjectSecrets(projectId, token) {
     return this.management(
       "GET",
-      `/v1/projects/${projectId}/secrets`,
+      `/v1/agents/${projectId}/secrets`,
       token
     ).then((body) => body.data);
   }
   setProjectSecret(projectId, name, value, token) {
     return this.management(
       "PUT",
-      `/v1/projects/${projectId}/secrets/${encodeURIComponent(name)}`,
+      `/v1/agents/${projectId}/secrets/${encodeURIComponent(name)}`,
       token,
       { value }
     );
@@ -235,12 +291,12 @@ var TonboApi = class {
   deleteProjectSecret(projectId, name, token) {
     return this.management(
       "DELETE",
-      `/v1/projects/${projectId}/secrets/${encodeURIComponent(name)}`,
+      `/v1/agents/${projectId}/secrets/${encodeURIComponent(name)}`,
       token
     );
   }
-  management(method, path7, token, body, idempotencyKey) {
-    return requestJson(this.fetcher, `${this.managementOrigin}${path7}`, {
+  management(method, path6, token, body, idempotencyKey) {
+    return requestJson(this.fetcher, `${this.managementOrigin}${path6}`, {
       method,
       headers: {
         authorization: `Bearer ${token}`,
@@ -252,14 +308,14 @@ var TonboApi = class {
       ...body === void 0 ? {} : { body: JSON.stringify(body) }
     });
   }
-  async managementList(path7, token) {
+  async managementList(path6, token) {
     const values = [];
     let cursor = null;
     do {
-      const separator = path7.includes("?") ? "&" : "?";
+      const separator = path6.includes("?") ? "&" : "?";
       const page = await this.management(
         "GET",
-        `${path7}${separator}limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`,
+        `${path6}${separator}limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`,
         token
       );
       values.push(...page.data);
@@ -289,10 +345,10 @@ var supportedExecutionTargets = [
   { driver: "command", harness: "pi" }
 ];
 var AgentSourceInspectionError = class extends Error {
-  constructor(code, path7, message, options) {
+  constructor(code, path6, message, options) {
     super(message, options);
     this.code = code;
-    this.path = path7;
+    this.path = path6;
     this.name = "AgentSourceInspectionError";
   }
 };
@@ -395,7 +451,7 @@ function inspectLocalAgentSource(root) {
 }
 
 // src/auth.ts
-import { createHash as createHash2, randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -585,7 +641,7 @@ var AuthClient = class {
     if (config.redirect_uri !== LOOPBACK_REDIRECT)
       throw new Error(`Unsupported OAuth redirect URI: ${config.redirect_uri}`);
     const verifier = base64url(randomBytes(48));
-    const challenge = createHash2("sha256").update(verifier).digest("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
     const state = base64url(randomBytes(24));
     const authorization = new URL(config.authorization_endpoint);
     authorization.search = new URLSearchParams({
@@ -751,12 +807,6 @@ async function runBuildCommand(root, command) {
   });
 }
 
-// src/declaration.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { lstat as lstat2, open, readFile as readFile2, rename, rm } from "node:fs/promises";
-import path2 from "node:path";
-import { parse, stringify } from "smol-toml";
-
 // src/contracts.ts
 import { Ajv2020 } from "ajv/dist/2020.js";
 
@@ -883,20 +933,17 @@ var kubernetesProfilesSchema = {
 };
 var declarationSchema = {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://contracts.tonbo.dev/agents/tonbo-declaration-v1.schema.json",
-  "title": "Tonbo Project Agent declaration v1",
+  "$id": "https://contracts.tonbo.dev/agents/tonbo-declaration-v2.schema.json",
+  "title": "Tonbo Agent declaration v2",
   "type": "object",
   "additionalProperties": false,
   "required": [
     "version",
-    "agent"
+    "harness"
   ],
   "properties": {
     "version": {
-      "const": 1
-    },
-    "agent": {
-      "$ref": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json"
+      "const": 2
     },
     "inference": {
       "type": "object",
@@ -936,13 +983,19 @@ var declarationSchema = {
     },
     "service": {
       "$ref": "https://contracts.tonbo.dev/agents/project-service-v1.schema.json"
+    },
+    "agent": {
+      "$ref": "https://contracts.tonbo.dev/agents/project-name-v1.json#/$defs/publicHostname"
+    },
+    "harness": {
+      "$ref": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json"
     }
   }
 };
-var revisionSchema = {
+var deploymentSchema = {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://contracts.tonbo.dev/agents/managed-revision-v1.schema.json",
-  "title": "Managed Project revision v1",
+  "$id": "https://contracts.tonbo.dev/agents/managed-deployment-v1.schema.json",
+  "title": "Managed Project Deployment v1",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -1020,15 +1073,66 @@ var piSessionContract = {
     "session-preflight"
   ]
 };
+var projectNameContract = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/project-name-v1.json",
+  "x-tonbo-version": 1,
+  "x-tonbo-public-hostname-apex": "tonbo.sh",
+  "x-tonbo-public-hostname-template": "<project>-<organization>.tonbo.sh",
+  "$defs": {
+    "name": {
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 40,
+      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",
+      "not": {
+        "enum": [
+          "api",
+          "artifacts",
+          "auth",
+          "inference",
+          "network-health",
+          "sandbox-control",
+          "status",
+          "streams",
+          "www"
+        ]
+      }
+    },
+    "publicHostname": {
+      "type": "string",
+      "minLength": 16,
+      "maxLength": 72,
+      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)+\\.tonbo\\.sh$",
+      "not": {
+        "enum": [
+          "api.tonbo.sh",
+          "artifacts.tonbo.sh",
+          "auth.tonbo.sh",
+          "inference.tonbo.sh",
+          "network-health.tonbo.sh",
+          "sandbox-control.tonbo.sh",
+          "status.tonbo.sh",
+          "streams.tonbo.sh",
+          "www.tonbo.sh"
+        ]
+      }
+    }
+  }
+};
 
 // src/contracts.ts
 var ajv = new Ajv2020({ allErrors: true, useDefaults: true });
 ajv.addKeyword({ keyword: "x-tonbo-profiles" });
+ajv.addKeyword({ keyword: "x-tonbo-version" });
+ajv.addKeyword({ keyword: "x-tonbo-public-hostname-apex" });
+ajv.addKeyword({ keyword: "x-tonbo-public-hostname-template" });
 ajv.addSchema(kubernetesProfilesSchema);
 ajv.addSchema(piAgentSchema);
+ajv.addSchema(projectNameContract);
 ajv.addSchema(projectServiceSchema);
 var validateDeclaration = ajv.compile(declarationSchema);
-var validateRevision = ajv.compile(revisionSchema);
+var validateDeploymentSpec = ajv.compile(deploymentSchema);
 function validationMessage(label, errors) {
   const detail = errors?.map((error) => `${error.instancePath || "/"} ${error.message}`).join("; ");
   return `${label} is invalid${detail ? `: ${detail}` : "."}`;
@@ -1040,27 +1144,39 @@ function parseDeclaration(value) {
   }
   return candidate;
 }
-function assertManagedRevision(value) {
-  if (!validateRevision(value)) {
-    throw new Error(validationMessage("Managed revision", validateRevision.errors));
+function assertManagedDeploymentSpec(value) {
+  if (!validateDeploymentSpec(value)) {
+    throw new Error(validationMessage("Managed Deployment spec", validateDeploymentSpec.errors));
   }
 }
 
 // src/declaration.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { lstat as lstat2, open, readFile as readFile2, rename, rm } from "node:fs/promises";
+import path2 from "node:path";
+import { parse, stringify } from "smol-toml";
 var DECLARATION_FILENAME = ".tonbo";
 var DEFAULT_INFERENCE_MODEL = "claude-sonnet-4-5";
-function createDeclaration(model = DEFAULT_INFERENCE_MODEL, driver = { kind: "native" }, buildCommand) {
+function createDeclaration(model = DEFAULT_INFERENCE_MODEL, driver = { kind: "native" }, buildCommand, projectHostname) {
   return parseDeclaration({
-    version: 1,
-    agent: { runtime: "pi", driver },
+    version: 2,
+    ...projectHostname ? { agent: projectHostname } : {},
+    harness: { runtime: "pi", driver },
     inference: { model: model.trim() },
     ...buildCommand ? { build: { command: buildCommand } } : {}
   });
 }
 function renderDeclaration(declaration) {
-  return `# Tonbo Project Agent configuration.
+  return `# Tonbo Agent configuration.
+# Edit this file directly or run \`tonbo init\` to reconfigure.
 ${stringify(declaration)}`;
 }
+async function bindDeclarationProject(root, projectHostname) {
+  const declaration = await loadDeclaration(root);
+  const bound = parseDeclaration({ ...declaration, agent: projectHostname });
+  await saveDeclaration(root, bound, true);
+  return bound;
+}
 async function declarationExists(root) {
   const filename = path2.join(root, DECLARATION_FILENAME);
   try {
@@ -1120,10 +1236,10 @@ async function loadDeclaration(declarationRoot) {
   }
   return parseDeclaration(parsed);
 }
-function buildRevision(declaration, source) {
+function buildDeploymentSpec(declaration, source) {
   const spec = {
     version: 1,
-    agent: declaration.agent,
+    agent: declaration.harness,
     source: {
       format: source.format,
       sha256: source.sha256,
@@ -1132,12 +1248,12 @@ function buildRevision(declaration, source) {
     inference: declaration.inference,
     ...declaration.service ? { service: declaration.service } : {}
   };
-  assertManagedRevision(spec);
+  assertManagedDeploymentSpec(spec);
   return spec;
 }
 
 // src/source.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { lstat as lstat3, readFile as readFile3, readdir } from "node:fs/promises";
 import path3 from "node:path";
 import ignore from "ignore";
@@ -1199,7 +1315,7 @@ async function validatePackageSource(root, source) {
       throw error;
     }
     if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
-      throw new Error(`Local PI package ${source} must resolve to a real project directory.`);
+      throw new Error(`Local PI package ${source} must resolve to a real agent directory.`);
     }
     return;
   }
@@ -1339,13 +1455,13 @@ async function buildSourceBundle(root) {
     bytes,
     format: sourceBundleContract.format,
     root: resolvedRoot,
-    sha256: createHash3("sha256").update(bytes).digest("hex"),
+    sha256: createHash2("sha256").update(bytes).digest("hex"),
     size_bytes: bytes.length
   };
 }
 
 // src/ssh-key.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { readFile as readFile4 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, join } from "node:path";
@@ -1360,13 +1476,13 @@ function parseOpenSshPublicKey(value, label) {
     throw new Error("SSH public key is not canonical base64.");
   return {
     algorithm: fields[0],
-    fingerprint: `SHA256:${createHash4("sha256").update(blob).digest("base64").replace(/=$/, "")}`,
+    fingerprint: `SHA256:${createHash3("sha256").update(blob).digest("base64").replace(/=$/, "")}`,
     keyBase64: fields[1],
     label
   };
 }
-async function readSshPublicKey(path7) {
-  return parseOpenSshPublicKey(await readFile4(path7, "utf8"), basename(path7, ".pub"));
+async function readSshPublicKey(path6) {
+  return parseOpenSshPublicKey(await readFile4(path6, "utf8"), basename(path6, ".pub"));
 }
 async function readDefaultSshPublicKeys(sshDirectory = join(homedir(), ".ssh")) {
   const keys = [];
@@ -1382,140 +1498,362 @@ async function readDefaultSshPublicKeys(sshDirectory = join(homedir(), ".ssh"))
   return keys;
 }
 
-// src/ssh.ts
-import { spawn as spawn2 } from "node:child_process";
-var PROJECT_SSH_HOST = "tonbo.sh";
-function projectSshDestination(projectSlug) {
-  return `${projectSlug}@${PROJECT_SSH_HOST}`;
+// src/project-name.ts
+var PROJECT_NAME_RULE = projectNameContract.$defs.name;
+var PROJECT_NAME_PATTERN = new RegExp(PROJECT_NAME_RULE.pattern);
+var RESERVED_PROJECT_NAMES = new Set(PROJECT_NAME_RULE.not.enum);
+function validateProjectName(name) {
+  const valid = name.length >= PROJECT_NAME_RULE.minLength && name.length <= PROJECT_NAME_RULE.maxLength && PROJECT_NAME_PATTERN.test(name) && !RESERVED_PROJECT_NAMES.has(name);
+  if (!valid) {
+    throw new Error(
+      `Agent name must be ${PROJECT_NAME_RULE.minLength}-${PROJECT_NAME_RULE.maxLength} lowercase letters, digits, or single hyphens, start with a letter, and not be reserved.`
+    );
+  }
 }
-async function launchProjectSsh(projectSlug) {
-  return new Promise((resolve, reject) => {
-    const child = spawn2("ssh", [projectSshDestination(projectSlug)], {
-      stdio: "inherit"
-    });
-    child.once("error", reject);
-    child.once("exit", (code, signal) => {
-      if (signal) reject(new Error(`ssh was terminated by ${signal}`));
-      else resolve(code ?? 1);
-    });
-  });
+function projectNameSuggestion(value) {
+  let name = value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").replace(/-+/g, "-");
+  if (!/^[a-z]/.test(name)) name = `agent-${name}`;
+  name = name.slice(0, PROJECT_NAME_RULE.maxLength).replace(/-+$/g, "");
+  if (name.length < PROJECT_NAME_RULE.minLength) {
+    name = `${name || "agent"}-agent`.slice(0, PROJECT_NAME_RULE.maxLength);
+  }
+  if (RESERVED_PROJECT_NAMES.has(name)) name = `${name}-agent`;
+  return name;
 }
 
 // src/commands.ts
-async function resolveProject(deps, selector) {
-  const oauthToken = await deps.auth.accessToken();
-  if (selector) {
-    const normalized = selector.endsWith(".tonbo.sh") ? selector.slice(0, -".tonbo.sh".length) : selector;
-    return {
-      oauthToken,
-      project: selectProject(await deps.api.listProjects(oauthToken), normalized)
-    };
-  }
+async function resolveProject(deps) {
   const root = await findDeclarationRoot(deps.cwd());
-  const binding = await deps.config.getBinding(root);
-  if (!binding) throw new Error("No Project selected. Run `tonbo project use <project>` first.");
+  const declaration = await loadDeclaration(root);
+  if (!declaration.agent) {
+    throw new Error("No Agent is configured in .tonbo. Run `tonbo agent use <agent>` first.");
+  }
+  const oauthToken = await deps.auth.accessToken();
   return {
+    declaration,
     oauthToken,
-    project: {
-      id: binding.projectId,
-      slug: binding.projectSlug,
-      status: "active"
-    }
+    project: selectProject(await deps.api.listProjects(oauthToken), declaration.agent),
+    root
   };
 }
 function selectProject(projects, selector) {
+  const normalized = selector.toLowerCase();
   const matches = projects.filter(
-    (project) => project.id === selector || project.slug === selector
+    (project) => project.id === selector || project.name === normalized || project.publicHostname === normalized
   );
-  if (matches.length === 0) throw new Error(`Project ${selector} was not found in your account.`);
-  if (matches.length > 1) throw new Error(`Project slug ${selector} is ambiguous; use its ID.`);
-  if (matches[0].status !== "active") throw new Error(`Project ${selector} is not active.`);
+  if (matches.length === 0) throw new Error(`Agent ${selector} was not found in your account.`);
+  if (matches.length > 1)
+    throw new Error(`Agent name ${selector} is ambiguous; use its full hostname or ID.`);
+  if (matches[0].status !== "active") throw new Error(`Agent ${selector} is not active.`);
   return matches[0];
 }
 async function initCommand(deps, options) {
   const root = deps.cwd();
   const exists = await declarationExists(root);
-  let overwrite = options.force === true;
-  if (exists && !overwrite) {
-    if (!deps.interactive())
-      throw new Error(`${DECLARATION_FILENAME} already exists. Pass --force to replace it.`);
-    const answer = (await deps.prompt(`Replace existing ${DECLARATION_FILENAME}? [y/N] `)).trim().toLowerCase();
-    if (answer !== "y" && answer !== "yes") {
-      deps.output({ message: `Kept existing ${DECLARATION_FILENAME}.` });
-      return;
-    }
-    overwrite = true;
+  let existingDeclaration;
+  if (exists) {
+    existingDeclaration = await loadDeclaration(root).catch(() => void 0);
   }
+  const interactive = deps.interactive();
+  const overwrite = options.force === true || exists && interactive;
+  if (exists && !overwrite)
+    throw new Error(`${DECLARATION_FILENAME} already exists. Pass --force to replace it.`);
   const inspection = await deps.inspectSource(root);
-  let harness = options.harness;
+  let harness = options.harness ?? (existingDeclaration ? "pi" : void 0);
   if (harness !== void 0 && harness !== "pi") {
     throw new Error("--harness must name a supported Harness: pi.");
   }
-  let driver = options.driver;
+  let driver = options.driver ?? existingDeclaration?.harness.driver.kind;
   if (driver !== void 0 && driver !== "native" && driver !== "command") {
     throw new Error("--driver must be native or command.");
   }
-  if (!harness && !driver && deps.interactive() && inspection.harness.state === "selection_required") {
-    const target = await deps.select("How should Tonbo run this project?", piTargetChoices(false));
-    harness = "pi";
-    driver = target;
-  }
   if (!harness) {
     if (inspection.harness.state === "identified") harness = inspection.harness.id;
-    else if (!deps.interactive()) {
+    else if (!interactive) {
       throw new Error("No Harness-specific configuration found. Pass --harness pi.");
     } else {
-      harness = await deps.select("Which supported Harness should Tonbo use?", [
-        {
-          description: "Run this project with the pi command.",
-          name: "PI (`pi`)",
-          value: "pi"
-        }
-      ]);
+      deps.output({
+        message: "No Harness-specific configuration was found in this project."
+      });
+      harness = await selectHarness(deps);
     }
   }
-  if (harness !== "pi") throw new Error(`Harness ${harness} is not supported.`);
   if (!driver) {
-    if (!deps.interactive()) {
+    if (!interactive) {
       throw new Error("PI execution mode is required. Pass --driver native or --driver command.");
     }
     if (inspection.pi.settingsFound) {
       const packageSummary = inspection.pi.packageCount === 0 ? "Found PI configuration at .pi/settings.json." : `Found PI configuration at .pi/settings.json with ${inspection.pi.packageCount} package${inspection.pi.packageCount === 1 ? "" : "s"}.`;
       deps.output({ message: packageSummary });
     }
-    driver = await deps.select(
-      "How should Tonbo start PI?",
-      piTargetChoices(inspection.pi.settingsFound)
-    );
+    driver = "native";
   }
   if (driver === "native" && (options.agentEntry || options.buildCommand)) {
     throw new Error("--agent-entry and --build-command require --driver command.");
   }
-  let entry = options.agentEntry?.trim();
-  if (driver === "command" && !entry && deps.interactive()) {
+  const existingEntry = existingDeclaration?.harness.driver.kind === "command" && existingDeclaration.harness.driver.command[0] === "node" ? existingDeclaration.harness.driver.command[1] : void 0;
+  let entry = options.agentEntry?.trim() || existingEntry;
+  if (driver === "command" && !entry && interactive) {
     entry = (await deps.prompt("PI SDK entry file [dist/agent.mjs]: ")).trim();
   }
   entry ||= "dist/agent.mjs";
-  const model = options.model?.trim() || DEFAULT_INFERENCE_MODEL;
-  const buildCommand = driver === "command" ? options.buildCommand ?? ["npm", "run", "build"] : void 0;
-  const declaration = createDeclaration(
+  let model = options.model?.trim() || existingDeclaration?.inference.model || DEFAULT_INFERENCE_MODEL;
+  let buildCommand = driver === "command" ? options.buildCommand ?? existingDeclaration?.build?.command ?? ["npm", "run", "build"] : void 0;
+  let projectPlan = existingDeclaration?.agent ? {
+    kind: "existing",
+    publicHostname: existingDeclaration.agent
+  } : { kind: "later" };
+  if (interactive && !existingDeclaration?.agent) {
+    projectPlan = await selectInitProject(deps, root);
+  }
+  if (interactive) {
+    while (true) {
+      deps.output({
+        message: renderInitSummary(projectPlan, harness, driver, model, entry, buildCommand)
+      });
+      const saveLabel = initSaveLabel(exists, projectPlan);
+      const action = await deps.select(`${saveLabel} with this configuration?`, [
+        {
+          name: saveLabel,
+          value: "save"
+        },
+        {
+          description: "Change the agent, Harness, execution mode, model, or SDK entrypoint.",
+          name: "Edit configuration",
+          value: "edit"
+        },
+        { name: "Cancel", value: "cancel" }
+      ]);
+      if (action === "cancel") {
+        deps.output({
+          message: exists ? `Cancelled. Kept existing ${DECLARATION_FILENAME}.` : `Cancelled. Did not create ${DECLARATION_FILENAME}.`
+        });
+        return;
+      }
+      if (action === "save") break;
+      const setting = await deps.select("What would you like to change?", [
+        {
+          description: initProjectSummary(projectPlan),
+          name: "Project",
+          value: "project"
+        },
+        { description: harnessName(harness), name: "Harness", value: "harness" },
+        {
+          description: driver === "native" ? "PI CLI (`pi`)" : "PI SDK app",
+          name: "Execution mode",
+          value: "driver"
+        },
+        { description: model, name: "Inference model", value: "model" },
+        ...driver === "command" ? [{ description: entry, name: "PI SDK entry file", value: "entry" }] : [],
+        { name: "Back to review", value: "back" }
+      ]);
+      if (setting === "project") projectPlan = await selectInitProject(deps, root);
+      if (setting === "harness") harness = await selectHarness(deps);
+      if (setting === "driver") {
+        driver = await deps.select(
+          "How should Tonbo start PI?",
+          piTargetChoices(inspection.pi.settingsFound)
+        );
+        if (driver === "command") {
+          const answer = (await deps.prompt(`PI SDK entry file [${entry}]: `)).trim();
+          if (answer) entry = answer;
+          buildCommand = options.buildCommand ?? ["npm", "run", "build"];
+        } else {
+          buildCommand = void 0;
+        }
+      }
+      if (setting === "model") {
+        const answer = (await deps.prompt(`Inference model [${model}]: `)).trim();
+        if (answer) model = answer;
+      }
+      if (setting === "entry") {
+        const answer = (await deps.prompt(`PI SDK entry file [${entry}]: `)).trim();
+        if (answer) entry = answer;
+      }
+    }
+  }
+  let projectHostname = projectPlan.kind === "existing" ? projectPlan.publicHostname : void 0;
+  let createdProject;
+  if (projectPlan.kind === "create") {
+    const oauthToken = await deps.auth.accessToken();
+    createdProject = await deps.api.createProject(
+      oauthToken,
+      projectPlan.name,
+      projectPlan.organizationId
+    );
+    projectHostname = createdProject.publicHostname;
+  }
+  const configuredDeclaration = createDeclaration(
     model,
     driver === "native" ? { kind: "native" } : { kind: "command", protocol: "pi-rpc-v1", command: ["node", entry] },
-    buildCommand
+    buildCommand,
+    projectHostname
   );
-  await saveDeclaration(root, declaration, overwrite);
+  const declaration = parseDeclaration({
+    ...configuredDeclaration,
+    harness: {
+      ...configuredDeclaration.harness,
+      ...existingDeclaration?.harness.secrets ? { secrets: existingDeclaration.harness.secrets } : {}
+    },
+    ...existingDeclaration?.service ? { service: existingDeclaration.service } : {}
+  });
+  try {
+    await saveDeclaration(root, declaration, overwrite);
+  } catch (error) {
+    if (createdProject) {
+      throw new Error(
+        `Created agent ${createdProject.name}, but could not write ${DECLARATION_FILENAME}. Fix the file and run \`tonbo agent use ${createdProject.publicHostname}\`.`,
+        { cause: error }
+      );
+    }
+    throw error;
+  }
   const driverSummary = driver === "command" ? `PI SDK app
 Build: ${buildCommand?.join(" ")}
 Entrypoint: node ${entry}` : inspection.pi.packageCount > 0 ? `PI CLI with ${inspection.pi.packageCount} package${inspection.pi.packageCount === 1 ? "" : "s"}` : "PI CLI";
+  const projectSummary = createdProject ? `Agent: ${createdProject.name} (${createdProject.publicHostname})
+Organization: ${createdProject.organizationName}
+Application: https://${createdProject.publicHostname}
+SSH after deploy: ssh ${createdProject.sshDestination}` : projectPlan.kind === "existing" ? `Agent: ${projectPlan.name ? `${projectPlan.name} (${projectPlan.publicHostname})` : projectPlan.publicHostname}${projectPlan.organizationName ? `
+Organization: ${projectPlan.organizationName}` : ""}${projectPlan.sshDestination ? `
+SSH after deploy: ssh ${projectPlan.sshDestination}` : ""}` : "Next: tonbo agent create <name>";
   deps.output({
-    message: `${exists ? "Updated" : "Created"} ${DECLARATION_FILENAME}.
+    message: `${createdProject ? `Created agent ${createdProject.name} and` : exists ? "Updated" : "Created"} ${DECLARATION_FILENAME}.
+${projectSummary}
 Harness: PI
-Mode: ${driverSummary}
-Next: tonbo project create <slug>`,
+Mode: ${driverSummary}${projectPlan.kind === "later" ? "" : "\nNext: tonbo deploy"}`,
     declaration,
     path: path4.join(root, DECLARATION_FILENAME)
   });
 }
+function initSaveLabel(exists, project) {
+  if (project.kind === "create") {
+    return exists ? `Create agent and replace ${DECLARATION_FILENAME}` : `Create agent and ${DECLARATION_FILENAME}`;
+  }
+  return exists ? `Replace ${DECLARATION_FILENAME}` : `Create ${DECLARATION_FILENAME}`;
+}
+async function selectInitProject(deps, root) {
+  for (; ; ) {
+    const action = await deps.select("How should this Agent connect to Tonbo?", [
+      {
+        description: "Create it only after you confirm the complete configuration.",
+        name: "Create a new agent",
+        value: "create"
+      },
+      {
+        description: "Bind this source tree to one agent you can access.",
+        name: "Use an existing agent",
+        value: "existing"
+      },
+      {
+        description: "Write an unbound declaration and configure its agent later.",
+        name: "Set up later",
+        value: "later"
+      }
+    ]);
+    if (action === "later") return { kind: "later" };
+    if (action === "create") {
+      const organization = await selectInitOrganization(deps);
+      const defaultName = projectNameSuggestion(path4.basename(root)) || "tonbo-agent";
+      for (; ; ) {
+        const answer = (await deps.prompt(`Agent name [${defaultName}]: `)).trim().toLowerCase();
+        const name = answer || defaultName;
+        try {
+          validateProjectName(name);
+          return {
+            kind: "create",
+            name,
+            organizationId: organization?.id,
+            organizationName: organization?.name
+          };
+        } catch (error) {
+          deps.output({
+            message: error instanceof Error ? error.message : "Agent name is invalid."
+          });
+        }
+      }
+    }
+    const oauthToken = await deps.auth.accessToken();
+    const projects = (await deps.api.listProjects(oauthToken)).filter(
+      (project2) => project2.status === "active"
+    );
+    if (projects.length === 0) {
+      deps.output({ message: "No active agents are available. Create a new agent instead." });
+      continue;
+    }
+    const id = await deps.select(
+      "Which agent should this Agent use?",
+      projects.map((project2) => ({
+        name: project2.name,
+        description: `Organization: ${project2.organizationName} \xB7 ${project2.publicHostname} \xB7 ${project2.id}`,
+        value: project2.id
+      }))
+    );
+    const project = selectProject(projects, id);
+    return {
+      kind: "existing",
+      name: project.name,
+      organizationName: project.organizationName,
+      publicHostname: project.publicHostname,
+      sshDestination: project.sshDestination
+    };
+  }
+}
+function initProjectSummary(project) {
+  if (project.kind === "create")
+    return `Create ${project.name}${project.organizationName ? ` in ${project.organizationName}` : ""} (permanent address assigned after creation)`;
+  if (project.kind === "existing") {
+    return project.name ? `${project.name}${project.organizationName ? ` in ${project.organizationName}` : ""} (${project.publicHostname})` : `Keep ${project.publicHostname}`;
+  }
+  return "Set up later";
+}
+async function selectInitOrganization(deps) {
+  const oauthToken = await deps.auth.accessToken();
+  const organizations = (await deps.api.listOrganizations(oauthToken)).filter(
+    (organization) => organization.role !== "member"
+  );
+  if (organizations.length === 0)
+    throw new Error("No organization lets you create a project. Ask an admin or owner.");
+  if (organizations.length === 1) return organizations[0];
+  const id = await deps.select(
+    "Which organization should own the new agent?",
+    organizations.map((organization) => ({
+      description: organization.role,
+      name: organization.name,
+      value: organization.id
+    }))
+  );
+  return organizations.find((organization) => organization.id === id) ?? organizations[0];
+}
+async function selectHarness(deps) {
+  return await deps.select(
+    "Which supported Harness should Tonbo use?",
+    supportedHarnesses.map((supported) => ({
+      description: `Run this agent with the ${supported.command} command.`,
+      name: `${supported.name} (\`${supported.command}\`)`,
+      value: supported.id
+    }))
+  );
+}
+function harnessName(harness) {
+  const supported = supportedHarnesses.find((candidate) => candidate.id === harness);
+  return supported?.name ?? harness;
+}
+function renderInitSummary(project, harness, driver, model, entry, buildCommand) {
+  const lines = [
+    "",
+    "Tonbo Agent configuration:",
+    `  Agent:       ${initProjectSummary(project)}`,
+    `  Harness:       ${harnessName(harness)}`,
+    `  Execution:     ${driver === "native" ? "PI CLI (`pi`)" : "PI SDK app"}`,
+    `  Model:         ${model}`
+  ];
+  if (driver === "command") {
+    lines.push(`  Build:         ${buildCommand?.join(" ") ?? "none"}`);
+    lines.push(`  Entrypoint:    node ${entry}`);
+  }
+  return lines.join("\n");
+}
 function piTargetChoices(settingsFound) {
   const choices = {
     command: {
@@ -1579,8 +1917,8 @@ function reportLoginProgress(progress, event) {
   if (event.status === "started") progress.start(messages.started);
   else progress.succeed(messages.completed);
 }
-async function sshKeyAddCommand(deps, path7) {
-  const key = await readSshPublicKey(path7);
+async function sshKeyAddCommand(deps, path6) {
+  const key = await readSshPublicKey(path6);
   const oauthToken = await deps.auth.accessToken();
   await deps.api.registerSshKey(oauthToken, key);
   deps.output({ message: `Registered SSH key ${key.fingerprint}.`, key });
@@ -1590,166 +1928,361 @@ async function sshKeyRemoveCommand(deps, fingerprint) {
   const key = await deps.api.revokeSshKey(oauthToken, fingerprint);
   deps.output({ message: `Revoked SSH key ${key.fingerprint}.`, key });
 }
-async function projectUseCommand(deps, selector) {
+async function projectUseCommand(deps, selector, force = false) {
   const root = await findDeclarationRoot(deps.cwd());
+  const declaration = await loadDeclaration(root);
   const oauthToken = await deps.auth.accessToken();
-  const project = selectProject(await deps.api.listProjects(oauthToken), selector);
-  await deps.config.setBinding(root, {
-    projectId: project.id,
-    projectSlug: project.slug
-  });
-  deps.output({ message: `Using Project ${project.slug}.`, project });
+  const projects = await deps.api.listProjects(oauthToken);
+  const project = selectProject(projects, selector);
+  if (declaration.agent === project.publicHostname) {
+    deps.output({ message: `.tonbo already uses agent ${project.publicHostname}.`, project });
+    return;
+  }
+  if (declaration.agent && !force) {
+    const current = projects.find((candidate) => candidate.publicHostname === declaration.agent);
+    const currentLabel = current?.publicHostname ?? declaration.agent;
+    if (!deps.interactive()) {
+      throw new Error(
+        `.tonbo already uses agent ${currentLabel}. Pass --force to rebind it to ${project.publicHostname}.`
+      );
+    }
+    const action = await deps.select(
+      `Rebind .tonbo from ${currentLabel} to ${project.publicHostname}?`,
+      [
+        { name: `Rebind to ${project.publicHostname}`, value: "rebind" },
+        { name: "Cancel", value: "cancel" }
+      ]
+    );
+    if (action !== "rebind") {
+      deps.output({ message: `Cancelled. .tonbo still uses agent ${currentLabel}.` });
+      return;
+    }
+  }
+  await bindDeclarationProject(root, project.publicHostname);
+  deps.output({ message: `Bound .tonbo to agent ${project.publicHostname}.`, project });
 }
-async function projectCreateCommand(deps, slug, name) {
+async function projectCreateCommand(deps, name) {
   const root = await findDeclarationRoot(deps.cwd());
+  const declaration = await loadDeclaration(root);
+  if (declaration.agent) {
+    throw new Error(
+      `.tonbo is already bound to agent ${declaration.agent}. Run \`tonbo agent use <agent>\` to review a rebind.`
+    );
+  }
   const oauthToken = await deps.auth.accessToken();
-  const project = await deps.api.createProject(oauthToken, slug, name);
-  await deps.config.setBinding(root, {
-    projectId: project.id,
-    projectSlug: project.slug
-  });
-  deps.output({ message: `Created and selected Project ${project.slug}.`, project });
+  validateProjectName(name);
+  const project = await deps.api.createProject(oauthToken, name);
+  try {
+    await bindDeclarationProject(root, project.publicHostname);
+  } catch (error) {
+    throw new Error(
+      `Created agent ${project.name}, but could not bind ${DECLARATION_FILENAME}. Fix the file and run \`tonbo agent use ${project.publicHostname}\`.`,
+      { cause: error }
+    );
+  }
+  deps.output({ message: `Created agent ${project.name} and bound it in .tonbo.`, project });
 }
-async function deployCommand(deps, selector) {
-  const root = await findDeclarationRoot(deps.cwd());
-  const declaration = await loadDeclaration(root);
+async function deployCommand(deps, options = { promote: true }) {
+  const { declaration, oauthToken, project, root } = await resolveProject(deps);
   if (declaration.build) await runBuildCommand(root, declaration.build.command);
   const source = await buildSourceBundle(root);
-  const oauthToken = await deps.auth.accessToken();
-  let binding = await deps.config.getBinding(root);
-  if (selector) {
-    const project = selectProject(await deps.api.listProjects(oauthToken), selector);
-    binding = { projectId: project.id, projectSlug: project.slug };
-  }
-  if (!binding) throw new Error("No Project selected. Run `tonbo project use <project>` first.");
-  const managementToken = await deps.api.exchangeManagementToken(oauthToken, binding.projectId);
+  const origin = { actor: "cli", git: await deps.gitProvenance(root) };
+  const managementToken = await deps.api.exchangeManagementToken(oauthToken, project.id);
   const result = await deps.api.deploy({
     bundle: source,
-    projectId: binding.projectId,
-    spec: buildRevision(declaration, source),
+    origin,
+    projectId: project.id,
+    promote: options.promote,
+    spec: buildDeploymentSpec(declaration, source),
     token: managementToken
   });
-  deps.output({
-    message: `Deployed Project ${binding.projectSlug}.`,
-    project: binding,
-    ...result
-  });
+  const { deployment } = result;
+  const shortId = shortDeploymentId(deployment.id);
+  const lines = [
+    options.promote ? `Deployed agent ${project.name}.` : `Created Deployment ${deploymentName(deployment)} (${shortId}) for agent ${project.name} without promoting it.`,
+    `Organization: ${project.organizationName}`,
+    `Deployment: ${deploymentName(deployment)} (${shortId})`,
+    `Source: ${deploymentSourceLabel(deployment)}`,
+    `Production: ${options.promote ? productionStateLabel(deployment) : `not promoted; run \`tonbo deployments promote ${shortId}\` to move Production here`}`,
+    `Application: https://${project.publicHostname}`
+  ];
+  if (result.unchanged) {
+    lines.push(
+      `Contents are identical to the ${options.promote ? "previous" : "current"} Production Deployment; the running Agent does not change.`
+    );
+  }
+  if (options.promote) {
+    lines.push(
+      "",
+      "Agent process: starts with the first turn and stays warm while the runtime is active.",
+      "",
+      "Start the Agent:",
+      '  tonbo run "<prompt>"',
+      "",
+      "Connect with SSH:",
+      `  ssh ${project.sshDestination}`
+    );
+  }
+  deps.output({ message: lines.join("\n"), project, ...result });
 }
 async function runCommand(deps, prompt, options) {
-  const root = await findDeclarationRoot(deps.cwd());
-  const oauthToken = await deps.auth.accessToken();
-  let binding = await deps.config.getBinding(root);
-  if (options.project) {
-    const project = selectProject(await deps.api.listProjects(oauthToken), options.project);
-    binding = { projectId: project.id, projectSlug: project.slug };
-  }
-  if (!binding) throw new Error("No Project selected. Run `tonbo project use <project>` first.");
-  const managementToken = await deps.api.exchangeManagementToken(oauthToken, binding.projectId);
+  const { oauthToken, project } = await resolveProject(deps);
+  const managementToken = await deps.api.exchangeManagementToken(oauthToken, project.id);
   const result = await deps.api.run({
-    projectId: binding.projectId,
+    projectId: project.id,
     prompt,
     sessionId: options.session,
     token: managementToken
   });
   deps.output({
     message: result.turn.assistant_text,
-    project: binding,
+    project,
+    ...result
+  });
+}
+async function projectShowCommand(deps) {
+  const { project, token } = await projectManagement(deps);
+  const production = await deps.api.getProduction(project.id, token);
+  const deployment = production ? await deps.api.getDeployment(project.id, production.deployment_id, token) : null;
+  const lines = [
+    `agent: ${project.name}`,
+    `Organization: ${project.organizationName}`,
+    `application: https://${project.publicHostname}`,
+    `ssh: ssh ${project.sshDestination}`
+  ];
+  if (deployment) {
+    lines.push(
+      `production: ${deploymentName(deployment)} (${shortDeploymentId(deployment.id)}) ${productionStateLabel(deployment)}`
+    );
+  }
+  deps.output({ message: lines.join("\n"), project, production, deployment });
+}
+function shortDeploymentId(id) {
+  return id.replace(/-/g, "").slice(0, 8);
+}
+function deploymentName(deployment) {
+  const subject = deployment.origin.git?.subject?.trim();
+  return subject ? subject : shortDeploymentId(deployment.id);
+}
+function deploymentSourceLabel(deployment) {
+  const git = deployment.origin.git;
+  if (!git) return "tonbo deploy";
+  const sha = git.commit_sha.slice(0, 7);
+  return git.ref ? `${sha} \xB7 ${git.ref}` : sha;
+}
+function productionStateLabel(deployment) {
+  const { generation, state } = deployment.production;
+  return generation === null ? state : `${state} (generation ${generation})`;
+}
+function selectDeployment(deployments, prefix) {
+  const normalized = prefix.trim().toLowerCase().replace(/-/g, "");
+  if (!/^[0-9a-f]+$/.test(normalized)) {
+    throw new Error(`Deployment id ${prefix} must be a hexadecimal id prefix.`);
+  }
+  const matches = deployments.filter(
+    (deployment) => deployment.id.replace(/-/g, "").startsWith(normalized)
+  );
+  if (matches.length === 0) throw new Error(`Deployment ${prefix} was not found in this project.`);
+  if (matches.length > 1) {
+    throw new Error(
+      `Deployment id ${prefix} is ambiguous; it matches ${matches.map((deployment) => shortDeploymentId(deployment.id)).join(", ")}. Use more characters.`
+    );
+  }
+  return matches[0];
+}
+function renderTable(headers, rows) {
+  const widths = headers.map(
+    (header, column) => Math.max(header.length, ...rows.map((row) => row[column].length))
+  );
+  const render = (row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column])).join("  ").trimEnd();
+  return [render(headers), ...rows.map(render)].join("\n");
+}
+function formatTimestamp(value) {
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return value;
+  return `${date.toISOString().slice(0, 16)}Z`;
+}
+function productionMarker(state) {
+  if (state === "current") return "\u25CF";
+  if (state === "previous") return "\u25CB";
+  return "";
+}
+async function deploymentsListCommand(deps) {
+  const { project, token } = await projectManagement(deps);
+  const [deployments, production] = await Promise.all([
+    deps.api.listDeployments(project.id, token),
+    deps.api.getProduction(project.id, token)
+  ]);
+  const message = deployments.length ? renderTable(
+    ["ID", "NAME", "STATUS", "PRODUCTION", "SOURCE", "CREATED", "BY"],
+    deployments.map((deployment) => [
+      shortDeploymentId(deployment.id),
+      deploymentName(deployment),
+      deployment.production.state,
+      productionMarker(deployment.production.state),
+      deploymentSourceLabel(deployment),
+      formatTimestamp(deployment.created_at),
+      deployment.created_by_user_id ? shortDeploymentId(deployment.created_by_user_id) : ""
+    ])
+  ) : `No Deployments exist for agent ${project.name}. Run \`tonbo deploy\` to create one.`;
+  deps.output({ message, project, production, deployments });
+}
+async function deploymentsShowCommand(deps, prefix) {
+  const { project, token } = await projectManagement(deps);
+  const deployment = selectDeployment(await deps.api.listDeployments(project.id, token), prefix);
+  const rollouts = (await deps.api.listRollouts(project.id, token)).filter(
+    (rollout) => rollout.deployment_id === deployment.id || rollout.previous_deployment_id === deployment.id
+  );
+  deps.output({
+    message: renderDeploymentDetail(deployment, rollouts),
+    project,
+    deployment,
+    rollouts
+  });
+}
+function renderDeploymentDetail(deployment, rollouts) {
+  const git = deployment.origin.git;
+  const source = deployment.spec.source;
+  const bundleLabel = typeof source?.sha256 === "string" ? [
+    typeof source.format === "string" ? source.format : "",
+    source.sha256,
+    typeof source.size_bytes === "number" ? `(${source.size_bytes} bytes)` : ""
+  ].filter(Boolean).join(" ") : null;
+  const inference = deployment.spec.inference;
+  const rows = [
+    ["Deployment", `${deploymentName(deployment)} (${shortDeploymentId(deployment.id)})`],
+    ["ID", deployment.id],
+    ["Status", productionStateLabel(deployment)],
+    ["Source", `${deploymentSourceLabel(deployment)}${git?.dirty ? " (dirty)" : ""}`]
+  ];
+  if (git) rows.push(["Commit", git.commit_sha], ["Author", git.author ?? ""]);
+  rows.push(
+    ["Created", formatTimestamp(deployment.created_at)],
+    ["Created by", deployment.created_by_user_id ?? ""],
+    ["Spec sha256", deployment.spec_sha256]
+  );
+  if (typeof inference?.model === "string") rows.push(["Model", inference.model]);
+  if (bundleLabel) rows.push(["Bundle", bundleLabel]);
+  const label = Math.max(...rows.map(([name]) => name.length)) + 1;
+  const lines = rows.map(([name, value]) => `${`${name}:`.padEnd(label)} ${value}`.trimEnd());
+  lines.push("", "Rollouts:");
+  if (rollouts.length === 0) lines.push("  none");
+  for (const rollout of rollouts) {
+    const direction = rollout.deployment_id === deployment.id ? `${rollout.kind} to this Deployment${rollout.previous_deployment_id ? ` from ${shortDeploymentId(rollout.previous_deployment_id)}` : ""}` : `${rollout.kind} away to ${shortDeploymentId(rollout.deployment_id)}`;
+    lines.push(
+      `  generation ${rollout.generation}  ${formatTimestamp(rollout.created_at)}  ${direction}${rollout.created_by_user_id ? `  by ${shortDeploymentId(rollout.created_by_user_id)}` : ""}`
+    );
+  }
+  return lines.join("\n");
+}
+async function deploymentsPromoteCommand(deps, prefix) {
+  const { project, token } = await projectManagement(deps);
+  const target = selectDeployment(await deps.api.listDeployments(project.id, token), prefix);
+  const result = await moveProduction(deps, project.id, target, token);
+  deps.output({
+    message: describeProductionMove(project, result, "Promoted"),
+    project,
+    ...result
+  });
+}
+async function deploymentsRollbackCommand(deps, prefix) {
+  const { project, token } = await projectManagement(deps);
+  let target;
+  if (prefix !== void 0) {
+    target = selectDeployment(await deps.api.listDeployments(project.id, token), prefix);
+  } else {
+    const rollouts = await deps.api.listRollouts(project.id, token);
+    const previousId = rollouts.find(
+      (rollout) => rollout.previous_deployment_id !== null
+    )?.previous_deployment_id;
+    if (!previousId) {
+      throw new Error(
+        `Agent ${project.name} has no previous Production Deployment to roll back to. Name one with \`tonbo deployments rollback <id>\`.`
+      );
+    }
+    target = await deps.api.getDeployment(project.id, previousId, token);
+  }
+  const result = await moveProduction(deps, project.id, target, token);
+  deps.output({
+    message: describeProductionMove(project, result, "Rolled back"),
+    project,
     ...result
   });
 }
-async function sshCommand(deps, selector) {
-  const { project } = await resolveProject(deps, selector);
-  const code = await launchProjectSsh(project.slug);
-  if (code !== 0) throw new Error(`ssh exited with status ${code}`);
+async function moveProduction(deps, projectId, target, token) {
+  const previous = await deps.api.getProduction(projectId, token);
+  const production = await deps.api.putProduction(
+    projectId,
+    {
+      deployment_id: target.id,
+      desired_state: "running",
+      expected_generation: previous ? previous.generation : null
+    },
+    token
+  );
+  return {
+    deployment: await deps.api.getDeployment(projectId, target.id, token),
+    previous,
+    production
+  };
 }
-async function projectManagement(deps, selector) {
-  const { oauthToken, project } = await resolveProject(deps, selector);
+function describeProductionMove(project, move, verb) {
+  const { deployment, previous } = move;
+  const name = `${deploymentName(deployment)} (${shortDeploymentId(deployment.id)})`;
+  const headline = previous?.deployment_id === deployment.id ? `Deployment ${name} is already Production for agent ${project.name}; requested it to be running.` : `${verb} ${name} to Production for agent ${project.name}${previous ? ` (from ${shortDeploymentId(previous.deployment_id)})` : ""}.`;
+  return `${headline}
+Production: ${productionStateLabel(deployment)}
+Application: https://${project.publicHostname}`;
+}
+async function projectManagement(deps) {
+  const { oauthToken, project } = await resolveProject(deps);
   return {
     project,
     token: await deps.api.exchangeManagementToken(oauthToken, project.id)
   };
 }
-async function secretListCommand(deps, selector) {
-  const { project, token } = await projectManagement(deps, selector);
+async function secretListCommand(deps) {
+  const { project, token } = await projectManagement(deps);
   const secrets = await deps.api.listProjectSecrets(project.id, token);
   deps.output({
-    message: secrets.length ? secrets.map((secret) => secret.name).join("\n") : "No Project secrets are configured.",
+    message: secrets.length ? secrets.map((secret) => secret.name).join("\n") : "No agent secrets are configured.",
     project,
     secrets
   });
 }
 async function secretSetCommand(deps, name, options) {
   const value = await deps.secretValue(name, options.fromEnv);
-  const { project, token } = await projectManagement(deps, options.project);
+  const { project, token } = await projectManagement(deps);
   const secret = await deps.api.setProjectSecret(project.id, name, value, token);
   deps.output({
-    message: `Set Project secret ${secret.name}. Redeploy to replace the active runtime with this value.`,
+    message: `Set agent secret ${secret.name}. Redeploy to replace the active runtime with this value.`,
     project,
     secret
   });
 }
-async function secretRemoveCommand(deps, name, selector) {
-  const { project, token } = await projectManagement(deps, selector);
+async function secretRemoveCommand(deps, name) {
+  const { project, token } = await projectManagement(deps);
   await deps.api.deleteProjectSecret(project.id, name, token);
-  deps.output({ message: `Removed Project secret ${name}.`, project, name });
+  deps.output({ message: `Removed agent secret ${name}.`, project, name });
 }
 
-// src/config.ts
-import { mkdir, readFile as readFile5, writeFile } from "node:fs/promises";
+// src/credentials.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { chmod, lstat as lstat4, mkdir, open as open2, readFile as readFile5, rename as rename2, rm as rm2 } from "node:fs/promises";
 import os from "node:os";
 import path5 from "node:path";
-var FileConfigStore = class {
-  constructor(filename = defaultConfigPath()) {
-    this.filename = filename;
-  }
-  async getBinding(declarationRoot) {
-    const config = await this.read();
-    return config.bindings[path5.resolve(declarationRoot)] ?? null;
-  }
-  async setBinding(declarationRoot, binding) {
-    const config = await this.read();
-    config.bindings[path5.resolve(declarationRoot)] = binding;
-    await mkdir(path5.dirname(this.filename), { recursive: true, mode: 448 });
-    await writeFile(this.filename, `${JSON.stringify(config, null, 2)}
-`, {
-      mode: 384
-    });
-  }
-  async read() {
-    try {
-      const value = JSON.parse(await readFile5(this.filename, "utf8"));
-      if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error();
-      const bindings = value.bindings;
-      if (!bindings || typeof bindings !== "object" || Array.isArray(bindings)) throw new Error();
-      return { bindings };
-    } catch (error) {
-      if (error.code === "ENOENT") return { bindings: {} };
-      throw new Error(`Could not read Tonbo config at ${this.filename}.`, {
-        cause: error
-      });
-    }
-  }
-};
-function defaultConfigPath() {
-  return path5.join(defaultConfigDirectory(), "config.json");
-}
 function defaultConfigDirectory() {
   const base = process.env.XDG_CONFIG_HOME || path5.join(os.homedir(), ".config");
   return path5.join(base, "tonbo");
 }
-
-// src/credentials.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { chmod, lstat as lstat4, mkdir as mkdir2, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "node:fs/promises";
-import path6 from "node:path";
 var FileCredentialStore = class {
-  constructor(filename = path6.join(defaultConfigDirectory(), "credentials.json")) {
+  constructor(filename = path5.join(defaultConfigDirectory(), "credentials.json")) {
     this.filename = filename;
   }
   async load() {
     try {
       await assertPrivateRegularFile(this.filename);
-      const parsed = JSON.parse(await readFile6(this.filename, "utf8"));
+      const parsed = JSON.parse(await readFile5(this.filename, "utf8"));
       if (!isOAuthTokenSet(parsed)) throw new Error("invalid token set");
       return parsed;
     } catch (error) {
@@ -1759,13 +2292,13 @@ var FileCredentialStore = class {
   }
   async save(tokens) {
     if (!isOAuthTokenSet(tokens)) throw new Error("Refusing to store a malformed Tonbo token set.");
-    const directory = path6.dirname(this.filename);
-    await mkdir2(directory, { mode: 448, recursive: true });
+    const directory = path5.dirname(this.filename);
+    await mkdir(directory, { mode: 448, recursive: true });
     await preparePrivateDirectory(directory);
     await assertExistingDestinationIsSafe(this.filename);
-    const temporary = path6.join(
+    const temporary = path5.join(
       directory,
-      `.${path6.basename(this.filename)}.${process.pid}.${randomUUID3()}.tmp`
+      `.${path5.basename(this.filename)}.${process.pid}.${randomUUID3()}.tmp`
     );
     let handle = null;
     try {
@@ -1812,6 +2345,60 @@ async function assertPrivateRegularFile(filename) {
     throw new Error("Tonbo credential file must have mode 0600.");
 }
 
+// src/git.ts
+import { execFile as execFile2 } from "node:child_process";
+var defaultGitRunner = (args, cwd) => new Promise((resolve, reject) => {
+  execFile2(
+    "git",
+    args,
+    {
+      cwd,
+      encoding: "utf8",
+      // Never take the index lock for a read: a concurrent editor or IDE
+      // must not turn provenance collection into a failure.
+      env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+      windowsHide: true
+    },
+    (error, stdout) => error ? reject(new Error(`git ${args.join(" ")} failed.`, { cause: error })) : resolve(stdout)
+  );
+});
+var COMMIT_SHA = /^[0-9a-f]{40}$/;
+var REF_MAX_LENGTH = 255;
+var SUBJECT_MAX_LENGTH = 512;
+var AUTHOR_MAX_LENGTH = 255;
+async function collectGitProvenance(root, run = defaultGitRunner) {
+  const commitSha = await read(run, ["rev-parse", "HEAD"], root);
+  if (!commitSha || !COMMIT_SHA.test(commitSha)) return null;
+  const [ref, subject, author, status] = await Promise.all([
+    read(run, ["rev-parse", "--abbrev-ref", "HEAD"], root),
+    read(run, ["log", "-1", "--format=%s"], root),
+    read(run, ["log", "-1", "--format=%an"], root),
+    // Only the deployed tree matters: changes elsewhere in the repository do
+    // not alter the uploaded bundle.
+    read(run, ["status", "--porcelain", "--", "."], root)
+  ]);
+  return {
+    commit_sha: commitSha,
+    ref: ref === "HEAD" ? null : clamp(ref, REF_MAX_LENGTH),
+    subject: clamp(subject, SUBJECT_MAX_LENGTH),
+    author: clamp(author, AUTHOR_MAX_LENGTH),
+    // When the status cannot be read the tree cannot be shown to match the
+    // commit, so the Deployment is recorded as dirty rather than clean.
+    dirty: status === null || status.length > 0
+  };
+}
+async function read(run, args, cwd) {
+  try {
+    return (await run(args, cwd)).trim();
+  } catch {
+    return null;
+  }
+}
+function clamp(value, maxLength) {
+  if (!value) return null;
+  return value.length > maxLength ? value.slice(0, maxLength) : value;
+}
+
 // src/progress.ts
 var FRAMES = ["|", "/", "-", "\\"];
 var TerminalProgress = class {
@@ -1909,9 +2496,9 @@ function createDependencies(json = false) {
   return {
     api: new TonboApi(fetch, accountOrigin, managementOrigin),
     auth: new AuthClient(new FileCredentialStore(), fetch, accountOrigin),
-    config: new FileConfigStore(),
     cwd: () => process.cwd(),
     defaultSshPublicKeys: readDefaultSshPublicKeys,
+    gitProvenance: collectGitProvenance,
     interactive: () => !json && process.stdin.isTTY === true && process.stderr.isTTY === true,
     inspectSource: inspectLocalAgentSource,
     output: (value) => {
@@ -1921,54 +2508,115 @@ function createDependencies(json = false) {
     progress: json ? silentProgress : new TerminalProgress(process.stderr),
     prompt: terminalPrompt,
     select: terminalSelect,
-    secretValue: async (name, fromEnvironment) => {
+    secretValue: (name, fromEnvironment) => {
       const environmentName = fromEnvironment ?? name;
       const value = process.env[environmentName];
       if (!value)
         throw new Error(
           `Environment variable ${environmentName} is empty. Set it before running tonbo secret set.`
         );
-      return value;
+      return Promise.resolve(value);
     }
   };
 }
+function jsonOutput(program) {
+  return program.opts().json === true;
+}
 function createProgram(dependencies = createDependencies) {
-  const program = new Command().name("tonbo").description("Deploy a persistent Project Agent to Tonbo.").version(packageVersion.version).option("--json", "print machine-readable JSON");
+  const program = new Command().name("tonbo").description("Deploy a persistent Agent Agent to Tonbo.").version(packageVersion.version).option("--json", "print machine-readable JSON");
   program.command("init").description("interactively create a Tonbo Agent declaration in this directory").option("--harness <harness>", "Agent Harness (currently pi)").option("--model <model>", "inference model").option("--driver <driver>", "PI driver: native or command").option("--agent-entry <file>", "Node entry file for the command driver").option("--build-command <argv...>", "build command argv for the command driver").option("--force", `replace an existing ${DECLARATION_FILENAME}`).action(
-    async (options) => initCommand(dependencies(program.opts().json), options)
+    async (options) => initCommand(dependencies(jsonOutput(program)), options)
   );
-  program.command("login").description("sign in through the browser and store the session in the user config").action(async () => loginCommand(dependencies(program.opts().json)));
-  const project = program.command("project").description("manage the Project bound to this Agent directory");
-  project.command("create <slug>").description("create and bind a Project to this Agent directory").option("--name <name>", "display name for the Project").action(
-    async (slug, options) => projectCreateCommand(dependencies(program.opts().json), slug, options.name)
-  );
-  const sshKey = program.command("ssh-key").description("manage public keys used by native Project SSH");
-  sshKey.command("add <public-key>").description("register an OpenSSH public key with the current Tonbo account").action(async (path7) => sshKeyAddCommand(dependencies(program.opts().json), path7));
+  program.command("login").description("sign in through the browser and store the session in the user config").action(async () => loginCommand(dependencies(jsonOutput(program))));
+  const machine = program.command("machine").description("manage independent account-owned Machines");
+  machine.command("list").option("--account <account>", "account UUID").action(async (options) => {
+    const deps = dependencies(jsonOutput(program));
+    deps.output(
+      await deps.api.machineRequest(
+        await deps.auth.accessToken(),
+        options.account ? `?account=${encodeURIComponent(options.account)}` : ""
+      )
+    );
+  });
+  machine.command("allocate").requiredOption("--account <account>", "owning account UUID").requiredOption("--region <region>", "compute region (currently us-east-1)").action(async (options) => {
+    const deps = dependencies(jsonOutput(program));
+    deps.output(
+      await deps.api.machineRequest(await deps.auth.accessToken(), "", "POST", {
+        accountId: options.account,
+        region: options.region
+      })
+    );
+  });
+  for (const operation of ["show", "metrics", "release"]) {
+    machine.command(`${operation} <machine>`).action(async (id) => {
+      const deps = dependencies(jsonOutput(program));
+      const result = await deps.api.machineRequest(
+        await deps.auth.accessToken(),
+        `/${encodeURIComponent(id)}`,
+        operation === "release" ? "DELETE" : "GET"
+      );
+      deps.output(operation === "metrics" ? result.metrics : result);
+    });
+  }
+  machine.command("bind <machine>").requiredOption("--agent <agent>", "Agent UUID").action(async (id, options) => {
+    const deps = dependencies(jsonOutput(program));
+    deps.output(
+      await deps.api.machineRequest(
+        await deps.auth.accessToken(),
+        `/${encodeURIComponent(id)}/binding`,
+        "POST",
+        { agentId: options.agent }
+      )
+    );
+  });
+  machine.command("unbind <machine>").description("detach Agent and reset system disk; retain Agent Workspace and Sessions").action(async (id) => {
+    const deps = dependencies(jsonOutput(program));
+    const token = await deps.auth.accessToken();
+    const path6 = `/${encodeURIComponent(id)}`;
+    const current = await deps.api.machineRequest(token, path6);
+    if (!current.binding) throw new Error("Machine is not bound to an Agent.");
+    deps.output(
+      await deps.api.machineRequest(token, `${path6}/binding`, "DELETE", {
+        agentId: current.binding.agent_id,
+        bindingId: current.binding.id,
+        generation: current.binding.generation
+      })
+    );
+  });
+  const project = program.command("agent").description("manage the agent bound to this Agent directory");
+  project.command("create <name>").description("create and bind a agent to this Agent directory").action(async (name) => projectCreateCommand(dependencies(jsonOutput(program)), name));
+  const sshKey = program.command("ssh-key").description("manage public keys used by native agent SSH");
+  sshKey.command("add <public-key>").description("register an OpenSSH public key with the current Tonbo account").action(async (path6) => sshKeyAddCommand(dependencies(jsonOutput(program)), path6));
   sshKey.command("remove <fingerprint>").description("revoke an SSH public key from the current Tonbo account").action(
-    async (fingerprint) => sshKeyRemoveCommand(dependencies(program.opts().json), fingerprint)
+    async (fingerprint) => sshKeyRemoveCommand(dependencies(jsonOutput(program)), fingerprint)
   );
-  project.command("use <project>").description("bind this .tonbo directory to a Project slug or ID").action(
-    async (selector) => projectUseCommand(dependencies(program.opts().json), selector)
+  project.command("use <agent>").description("write a agent ID into this Agent's .tonbo declaration").option("--force", "replace an existing agent binding without confirmation").action(
+    async (selector, options) => projectUseCommand(dependencies(jsonOutput(program)), selector, options.force === true)
   );
-  program.command("deploy").description("upload this directory as the selected Project deployment").option("--project <project>", "override the bound Project for this deploy").action(
-    async (options) => deployCommand(dependencies(program.opts().json), options.project)
+  project.command("show").description("show the agent bound to this Agent directory and its connection addresses").action(async () => projectShowCommand(dependencies(jsonOutput(program))));
+  program.command("deploy").description("upload this directory as a new Deployment and promote it to Production").option("--no-promote", "create the Deployment without moving Production").action(
+    async (options) => deployCommand(dependencies(jsonOutput(program)), { promote: options.promote })
   );
-  program.command("run <prompt>").description("run one prompt in a durable Project session").option("--project <project>", "override the bound Project for this turn").option("--session <session>", "resume an existing Agent Session UUID").action(
-    async (prompt, options) => runCommand(dependencies(program.opts().json), prompt, options)
+  const deployments = program.command("deployments").description("list and move between the immutable Deployments of the bound agent");
+  deployments.command("list", { isDefault: true }).description("list Deployments, newest first").action(async () => deploymentsListCommand(dependencies(jsonOutput(program))));
+  deployments.command("show <deployment>").description("show one Deployment and its Rollouts by id prefix").action(
+    async (prefix) => deploymentsShowCommand(dependencies(jsonOutput(program)), prefix)
   );
-  program.command("ssh").description("open the selected Project's singleton runtime over SSH").option("--project <project>", "override the bound Project").action(
-    async (options) => sshCommand(dependencies(program.opts().json), options.project)
+  deployments.command("promote <deployment>").description("move Production to a Deployment by id prefix").action(
+    async (prefix) => deploymentsPromoteCommand(dependencies(jsonOutput(program)), prefix)
   );
-  const secret = program.command("secret").description("manage encrypted environment secrets for the Project service");
-  secret.command("list").option("--project <project>", "override the bound Project").action(
-    async (options) => secretListCommand(dependencies(program.opts().json), options.project)
+  deployments.command("rollback [deployment]").description("move Production back to the previous Production Deployment, or to a named one").action(
+    async (prefix) => deploymentsRollbackCommand(dependencies(jsonOutput(program)), prefix)
   );
-  secret.command("set <name>").description("set a secret from an environment variable (the same name by default)").option("--from-env <name>", "read the value from another environment variable").option("--project <project>", "override the bound Project").action(
-    async (name, options) => secretSetCommand(dependencies(program.opts().json), name, options)
+  program.command("run <prompt>").description("run one prompt in a durable agent session").option("--session <session>", "resume an existing Agent Session UUID").action(
+    async (prompt, options) => runCommand(dependencies(jsonOutput(program)), prompt, options)
   );
-  secret.command("remove <name>").option("--project <project>", "override the bound Project").action(
-    async (name, options) => secretRemoveCommand(dependencies(program.opts().json), name, options.project)
+  const secret = program.command("secret").description("manage encrypted environment secrets for the agent service");
+  secret.command("list").action(async () => secretListCommand(dependencies(jsonOutput(program))));
+  secret.command("set <name>").description("set a secret from an environment variable (the same name by default)").option("--from-env <name>", "read the value from another environment variable").action(
+    async (name, options) => secretSetCommand(dependencies(jsonOutput(program)), name, options)
   );
+  secret.command("remove <name>").action(async (name) => secretRemoveCommand(dependencies(jsonOutput(program)), name));
   return program;
 }