@tryarcanist/cli 0.1.380 → 0.1.381

package/dist/index.js

@@ -3773,7 +3773,7 @@ ${pointer}
 var require_resolve_props = __commonJS({
   "../../node_modules/yaml/dist/compose/resolve-props.js"(exports) {
     "use strict";
-    function resolveProps(tokens2, { flow, indicator, next, offset, onError, parentIndent, startOnNewline }) {
+    function resolveProps(tokens, { flow, indicator, next, offset, onError, parentIndent, startOnNewline }) {
       let spaceBefore = false;
       let atNewline = startOnNewline;
       let hasSpace = startOnNewline;
@@ -3788,7 +3788,7 @@ var require_resolve_props = __commonJS({
       let comma = null;
       let found = null;
       let start = null;
-      for (const token of tokens2) {
+      for (const token of tokens) {
         if (reqSpace) {
           if (token.type !== "space" && token.type !== "newline" && token.type !== "comma")
             onError(token.offset, "MISSING_CHAR", "Tags and anchors must be separated from the next token by white space");
@@ -3879,7 +3879,7 @@ var require_resolve_props = __commonJS({
             hasSpace = false;
         }
       }
-      const last = tokens2[tokens2.length - 1];
+      const last = tokens[tokens.length - 1];
       const end = last ? last.offset + last.source.length : offset;
       if (reqSpace && next && next.type !== "space" && next.type !== "newline" && next.type !== "comma" && (next.type !== "scalar" || next.source !== "")) {
         onError(next.offset, "MISSING_CHAR", "Tags and anchors must be separated from the next token by white space");
@@ -5218,8 +5218,8 @@ ${cb}` : comment;
        * @param forceDoc - If the stream contains no document, still emit a final document including any comments and directives that would be applied to a subsequent document.
        * @param endOffset - Should be set if `forceDoc` is also set, to set the document range end and to indicate errors correctly.
        */
-      *compose(tokens2, forceDoc = false, endOffset = -1) {
-        for (const token of tokens2)
+      *compose(tokens, forceDoc = false, endOffset = -1) {
+        for (const token of tokens)
           yield* this.next(token);
         yield* this.end(forceDoc, endOffset);
       }
@@ -7409,8 +7409,8 @@ function isTerminalPhase(phase, _sessionKind) {
 // package.json
 var package_default = {
   name: "@tryarcanist/cli",
-  version: "0.1.380",
-  description: "Command-line interface for Arcanist: inspect sessions, prepare Zeus environments, and trigger reviews",
+  version: "0.1.381",
+  description: "Command-line interface for Arcanist: inspect sessions, prepare Arcanist environments, and trigger reviews",
   type: "module",
   bin: {
     arcanist: "dist/index.js"
@@ -7423,9 +7423,8 @@ var package_default = {
   ],
   scripts: {
     build: "tsup",
-    typecheck: "tsc --noEmit",
-    prepublishOnly: "npm run build",
-    "bundle:sandbox": "tsup --config tsup.sandbox.config.ts"
+    typecheck: "node ../../node_modules/typescript-7/bin/tsc --noEmit",
+    prepublishOnly: "npm run build"
   },
   publishConfig: {
     access: "public"
@@ -7513,20 +7512,6 @@ function parseApiErrorBody(body) {
     return null;
   }
 }
-function parseConflictBody(err) {
-  if (!(err instanceof ApiError) || err.status !== 409) return null;
-  try {
-    const parsed = JSON.parse(err.body);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const body = parsed;
-    return {
-      ...typeof body.error === "string" ? { error: body.error } : {},
-      ...typeof body.reason === "string" ? { reason: body.reason } : {}
-    };
-  } catch {
-    return null;
-  }
-}
 
 // src/errors.ts
 var EXIT_CODE_INTERRUPTED = 130;
@@ -7600,7 +7585,6 @@ function messageForApiError(status, body, parsed = parseApiErrorBody(body)) {
 function hintForHttpStatus(status, resourceNoun, parsed) {
   if (status === 401 || status === 403) return "Run `arcanist auth login` or set `ARCANIST_TOKEN`.";
   if (status === 404) {
-    if (resourceNoun === "token") return "List tokens with `arcanist tokens list`.";
     if (resourceNoun === "repo") return "Check accessible repositories with `arcanist repos list`.";
     return "List sessions with `arcanist sessions list`.";
   }
@@ -7701,7 +7685,6 @@ async function apiRequest(connection, path, init, read) {
   }
 }
 function resourceNounForPath(path) {
-  if (path.startsWith("/api/cli-tokens")) return "token";
   if (path.startsWith("/api/repos")) return "repo";
   if (path.startsWith("/api/sessions")) return "session";
   return void 0;
@@ -7709,9 +7692,6 @@ function resourceNounForPath(path) {
 async function apiFetch(config2, path, init) {
   return apiRequest(config2, path, init, (res) => res.json());
 }
-async function publicApiFetch(apiUrl, path, init) {
-  return apiRequest({ apiUrl }, path, init, (res) => res.json());
-}
 async function apiFetchText(config2, path, init) {
   return apiRequest(config2, path, init, (res) => res.text());
 }
@@ -7733,8 +7713,6 @@ var CONFIG_DIR = join(homedir(), ".arcanist");
 var CONFIG_FILE = join(CONFIG_DIR, "config.json");
 var PROJECT_CONFIG_FILE = ".arcanist-cli.json";
 var DEFAULT_API_URL = "https://app.tryarcanist.com";
-var SANDBOX_CLI_AUTH_WAIT_TIMEOUT_MS = 1e4;
-var SANDBOX_CLI_AUTH_WAIT_INTERVAL_MS = 100;
 function loadFileConfig() {
   try {
     return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
@@ -7747,7 +7725,7 @@ function loadConfig(overrides = {}) {
   if (completeEnvOrFlagConfig) return validateAndNormalizeConfig(completeEnvOrFlagConfig);
   const projectConfig = loadProjectConfig();
   const envOrFlagConfig = resolveEnvOrFlagConfig(overrides, projectConfig !== null);
-  const fileConfig = !projectConfig && shouldWaitForSandboxCliAuth() ? waitForSandboxCliAuthConfig() : loadFileConfig();
+  const fileConfig = loadFileConfig();
   const apiUrl = envOrFlagConfig?.apiUrl ?? projectConfig?.apiUrl ?? fileConfig?.apiUrl;
   const token = envOrFlagConfig?.token ?? projectConfig?.token ?? fileConfig?.token;
   if (!apiUrl || !token) return null;
@@ -7834,24 +7812,6 @@ function validateAndNormalizeConfig(config2) {
   if (urlError) throw new CliError("user", urlError);
   return { apiUrl: normalizeBaseUrl(config2.apiUrl), token: config2.token };
 }
-function shouldWaitForSandboxCliAuth() {
-  const pendingPath = process.env.ARCANIST_CLI_AUTH_PENDING_PATH;
-  return Boolean(pendingPath && existsSync(pendingPath));
-}
-function waitForSandboxCliAuthConfig() {
-  const readyPath = process.env.ARCANIST_CLI_AUTH_READY_PATH;
-  const failedPath = process.env.ARCANIST_CLI_AUTH_FAILED_PATH;
-  const deadline = Date.now() + SANDBOX_CLI_AUTH_WAIT_TIMEOUT_MS;
-  while (Date.now() <= deadline) {
-    if (readyPath && existsSync(readyPath)) return loadFileConfig();
-    if (failedPath && existsSync(failedPath)) return null;
-    sleepSync(SANDBOX_CLI_AUTH_WAIT_INTERVAL_MS);
-  }
-  return readyPath && existsSync(readyPath) ? loadFileConfig() : null;
-}
-function sleepSync(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
 function findGitRoot(cwd) {
   let current = cwd;
   while (true) {
@@ -7917,7 +7877,6 @@ function isLoopbackHost(parsed) {
 
 // src/runtime.ts
 import { randomUUID } from "crypto";
-import { createInterface } from "readline/promises";
 function getRuntimeOptions(command, options = {}) {
   const globals = command?.optsWithGlobals?.();
   const merged = { ...globals, ...options };
@@ -7951,20 +7910,6 @@ async function readStdin() {
 async function readStdinTrimmed() {
   return (await readStdin()).trim();
 }
-async function confirmOrThrow(message) {
-  if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    throw new CliError("user", "Confirmation required. Re-run with --yes in non-interactive environments.");
-  }
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = (await rl.question(`${message} [y/N] `)).trim().toLowerCase();
-    if (answer !== "y" && answer !== "yes") {
-      throw new CliError("user", "Aborted.");
-    }
-  } finally {
-    rl.close();
-  }
-}
 function applyColorEnvironment(options) {
   if (options.noColor === true || !process.stdout.isTTY) {
     process.env.NO_COLOR = "1";
@@ -7973,17 +7918,6 @@ function applyColorEnvironment(options) {
 function randomIdempotencyKey() {
   return randomUUID();
 }
-function assertArcanistSessionMutationAllowed(subcommand) {
-  const role = process.env.ARCANIST_AGENT_ROLE?.trim();
-  if (role !== "verification" && role !== "review") return;
-  throw new CliError(
-    "user",
-    `\`arcanist ${subcommand}\` is disabled inside ${role} sessions because nested Arcanist work is not observable to read-only agents.`,
-    {
-      hint: "Use direct local/sandbox evidence instead, or report a verification gap rather than spawning another Arcanist session."
-    }
-  );
-}
 
 // src/utils/terminal-text.ts
 function sanitizeTerminalText(value) {
@@ -27026,7 +26960,6 @@ var INTEGRATION_REGISTRY = {
 };
 
 // ../../shared/constants/onboarding.ts
-var MAX_ENVIRONMENT_SETUP_REPOSITORIES = 20;
 var CREDENTIAL_VALIDATION_STATUS = {
   VALIDATED: "validated",
   SAVED_UNVERIFIED: "saved_unverified",
@@ -27275,191 +27208,11 @@ async function codexStatusCommand(options, command) {
     if (status) console.log(`Status: ${status}`);
   });
 }
-async function codexLogoutCommand(options, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  await setCodexSubscriptionEnabled(config2, false).catch(() => {
-  });
-  const payload = parseCodexResponse(
-    codexSubscriptionCredentialStateSchema,
-    await apiFetch(config2, CODEX_SUBSCRIPTION_AUTH_JSON_PATH, { method: "DELETE" })
-  );
-  emit(command, options, payload, () => console.log("Codex subscription auth deactivated and cleared."));
-}
-
-// src/commands/egress.ts
-import { readFileSync as readFileSync2 } from "fs";
-
-// ../../shared/types/business-egress-policy.ts
-var MAX_BUSINESS_EGRESS_DOMAINS = 100;
-var MAX_DOMAIN_LENGTH = 253;
-function normalizeEgressDomains(entries, key = "egressAllowlist") {
-  const unique = [...new Set(entries.map((entry) => entry.trim().toLowerCase()).filter(Boolean))].sort();
-  if (unique.length > MAX_BUSINESS_EGRESS_DOMAINS) {
-    throw new Error(`${key} must contain at most ${MAX_BUSINESS_EGRESS_DOMAINS} domain names`);
-  }
-  for (const entry of unique) {
-    assertValidEgressDomain(entry, key);
-  }
-  return unique;
-}
-function assertValidEgressDomain(value, key = "egressAllowlist") {
-  if (value.includes("*") || value.startsWith(".") || value.endsWith(".") || value.includes("/") || value.includes(":")) {
-    throw new Error(`${key} entries must be exact domain names`);
-  }
-  if (value.length > MAX_DOMAIN_LENGTH) {
-    throw new Error(`${key} entries must be exact domain names`);
-  }
-  const labels = value.split(".");
-  if (labels.length === 4 && labels.every((label) => /^\d+$/.test(label) && Number(label) >= 0 && Number(label) <= 255)) {
-    throw new Error(`${key} entries must be exact domain names`);
-  }
-  if (labels.length < 2 || labels.some(
-    (label) => label.length < 1 || label.length > 63 || !/^[a-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-")
-  )) {
-    throw new Error(`${key} entries must be exact domain names`);
-  }
-}
-
-// ../../shared/egress-allowlist/parser.ts
-var EGRESS_ALLOWLIST_SOURCE_PATH = ".arcanist/egress-allowlist.txt";
-function parseEgressAllowlistSourceFile(content, key = EGRESS_ALLOWLIST_SOURCE_PATH) {
-  const domains = content.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-  return normalizeEgressDomains(domains, key);
-}
-
-// ../../shared/github/repo-url.ts
-var REPO_SEGMENT_PATTERN = /^[A-Za-z0-9_.][A-Za-z0-9_.-]*$/;
-var MAX_REPO_SEGMENT_LENGTH = 100;
-function isValidGithubRepoSegment(value) {
-  if (typeof value !== "string") return false;
-  if (!value || value.length > MAX_REPO_SEGMENT_LENGTH) return false;
-  if (value === "." || value === "..") return false;
-  return REPO_SEGMENT_PATTERN.test(value);
-}
-function parseGithubRepoCoordinate(owner, repo) {
-  return isValidGithubRepoSegment(owner) && isValidGithubRepoSegment(repo) ? { owner, repo } : null;
-}
-function parseGithubRepoFullName(value) {
-  const match = value.match(/^([a-zA-Z0-9_.-]+)\/([a-zA-Z0-9_.-]+)$/) ?? value.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/) ?? value.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
-  return match ? parseGithubRepoCoordinate(match[1], match[2]) : null;
-}
-
-// src/git.ts
-import { execFileSync } from "child_process";
-function git(args) {
-  try {
-    return execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-  } catch (err) {
-    throw new CliError("user", `git ${args.join(" ")} failed: ${stringifyError(err)}`);
-  }
-}
-function currentRepo() {
-  const parsed = parseGithubRepoFullName(git(["remote", "get-url", "origin"]));
-  if (!parsed) throw new CliError("user", "origin remote must point at a GitHub repository");
-  return { owner: parsed.owner, repo: parsed.repo };
-}
-
-// src/utils/repo-arg.ts
-function parseRepoArg(value, argName = "repo") {
-  const parsed = parseGithubRepoFullName(value);
-  if (!parsed) throw new CliError("user", `${argName} must be owner/name or a GitHub URL`);
-  return { owner: parsed.owner, repo: parsed.repo.replace(/\.git$/, "") };
-}
-function parseRepoArgOrCurrent(value, argName = "repo") {
-  if (value === void 0) return currentRepo();
-  return parseRepoArg(value, argName);
-}
-
-// src/commands/egress.ts
-async function egressSourceSetCommand(sourceRepoArg, options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  const source = parseRepoArg(sourceRepoArg);
-  const payload = await apiFetch(config2, `/api/businesses/${encodeURIComponent(businessId)}/egress-allowlist/source`, {
-    method: "PUT",
-    body: JSON.stringify({ sourceRepoOwner: source.owner, sourceRepoName: source.repo })
-  });
-  emit(
-    command,
-    options,
-    payload,
-    () => console.log(`Set egress allowlist source to ${source.owner}/${source.repo}:${EGRESS_ALLOWLIST_SOURCE_PATH}.`)
-  );
-}
-async function egressSourceGetCommand(options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  const payload = await apiFetch(
-    config2,
-    `/api/businesses/${encodeURIComponent(businessId)}/egress-allowlist/source`
-  );
-  emit(command, options, payload, (sourcePayload) => {
-    if (!sourcePayload.source) {
-      console.log("No egress allowlist source configured.");
-      return;
-    }
-    console.log(
-      `${sourcePayload.source.sourceRepoOwner}/${sourcePayload.source.sourceRepoName}:${sourcePayload.path} (${sourcePayload.defaultBranch ?? "default branch"})`
-    );
-    console.log(`${sourcePayload.domains.length} ${sourcePayload.domains.length === 1 ? "domain" : "domains"}.`);
-  });
-}
-async function egressAddCommand(domains, options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  const normalized = normalizeEgressDomains(domains, "domains");
-  const payload = await apiFetch(
-    config2,
-    `/api/businesses/${encodeURIComponent(businessId)}/egress-allowlist/pull-request`,
-    {
-      method: "POST",
-      body: JSON.stringify({ domains: normalized, ...options.reason ? { reason: options.reason } : {} })
-    }
-  );
-  emit(command, options, payload, (addPayload) => {
-    if (addPayload.status === "unchanged") {
-      console.log("All requested domains are already present in the source file.");
-      return;
-    }
-    console.log(`Egress allowlist PR ${addPayload.status}: ${addPayload.prUrl}`);
-    console.log(`Added: ${addPayload.addedDomains.join(", ")}`);
-  });
-}
-async function egressSyncCommand(options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  const payload = await apiFetch(
-    config2,
-    `/api/businesses/${encodeURIComponent(businessId)}/egress-allowlist/sync`,
-    { method: "POST" }
-  );
-  emit(
-    command,
-    options,
-    payload,
-    (syncPayload) => console.log(
-      `Applied ${syncPayload.egressAllowlist.length} egress allowlist domains from ${syncPayload.source.sourceRepoOwner}/${syncPayload.source.sourceRepoName}:${syncPayload.path}.`
-    )
-  );
-}
-async function egressValidateCommand(path = EGRESS_ALLOWLIST_SOURCE_PATH, options = {}, command) {
-  const content = readFileSync2(path, "utf8");
-  const domains = parseEgressAllowlistSourceFile(content, path);
-  emit(command, options, { ok: true, path, domains }, (payload) => {
-    console.log(`Valid egress allowlist: ${payload.path}`);
-    console.log(`${payload.domains.length} ${payload.domains.length === 1 ? "domain" : "domains"}.`);
-  });
-}
 
 // ../../shared/utils/type-guards.ts
 function isRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
-function asNonEmptyString(value) {
-  if (typeof value !== "string") return void 0;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
 
 // ../../shared/browser-state/storage-state.ts
 var MAX_BROWSER_STATE_BYTES = 1024 * 1024;
@@ -27709,7 +27462,7 @@ async function captureBrowserLogin(opts) {
 }
 
 // src/utils/prompt-line.ts
-import { createInterface as createInterface2 } from "readline/promises";
+import { createInterface } from "readline/promises";
 async function promptLine(question, options = {}) {
   if (!process.stdin.isTTY || !process.stderr.isTTY) {
     throw new CliError(
@@ -27719,7 +27472,7 @@ async function promptLine(question, options = {}) {
   }
   const { signal } = options;
   if (signal?.aborted) throw new CliError("user", "Cancelled.");
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
   const onAbort = () => rl.close();
   signal?.addEventListener("abort", onAbort, { once: true });
   try {
@@ -27734,6 +27487,49 @@ async function promptLine(question, options = {}) {
   }
 }
 
+// ../../shared/github/repo-url.ts
+var REPO_SEGMENT_PATTERN = /^[A-Za-z0-9_.][A-Za-z0-9_.-]*$/;
+var MAX_REPO_SEGMENT_LENGTH = 100;
+function isValidGithubRepoSegment(value) {
+  if (typeof value !== "string") return false;
+  if (!value || value.length > MAX_REPO_SEGMENT_LENGTH) return false;
+  if (value === "." || value === "..") return false;
+  return REPO_SEGMENT_PATTERN.test(value);
+}
+function parseGithubRepoCoordinate(owner, repo) {
+  return isValidGithubRepoSegment(owner) && isValidGithubRepoSegment(repo) ? { owner, repo } : null;
+}
+function parseGithubRepoFullName(value) {
+  const match = value.match(/^([a-zA-Z0-9_.-]+)\/([a-zA-Z0-9_.-]+)$/) ?? value.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/) ?? value.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
+  return match ? parseGithubRepoCoordinate(match[1], match[2]) : null;
+}
+
+// src/git.ts
+import { execFileSync } from "child_process";
+function git(args) {
+  try {
+    return execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  } catch (err) {
+    throw new CliError("user", `git ${args.join(" ")} failed: ${stringifyError(err)}`);
+  }
+}
+function currentRepo() {
+  const parsed = parseGithubRepoFullName(git(["remote", "get-url", "origin"]));
+  if (!parsed) throw new CliError("user", "origin remote must point at a GitHub repository");
+  return { owner: parsed.owner, repo: parsed.repo };
+}
+
+// src/utils/repo-arg.ts
+function parseRepoArg(value, argName = "repo") {
+  const parsed = parseGithubRepoFullName(value);
+  if (!parsed) throw new CliError("user", `${argName} must be owner/name or a GitHub URL`);
+  return { owner: parsed.owner, repo: parsed.repo.replace(/\.git$/, "") };
+}
+function parseRepoArgOrCurrent(value, argName = "repo") {
+  if (value === void 0) return currentRepo();
+  return parseRepoArg(value, argName);
+}
+
 // src/commands/environment-login.ts
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function resolveEnvironment(config2, target) {
@@ -27954,11 +27750,6 @@ async function pollUntilSettled(opts) {
   }
   throw new CliError("server", opts.timeoutMessage);
 }
-function assertSameAttempt(triggeredSessionId, settledSessionId, label) {
-  if (triggeredSessionId && settledSessionId !== triggeredSessionId) {
-    throw new CliError("conflict", `${label} completed for a different attempt; retry the command.`);
-  }
-}
 
 // src/constants/watch.ts
 var MIN_WATCH_POLL_INTERVAL_MS = 250;
@@ -28156,8 +27947,6 @@ async function environmentRetryCommand(repoArg, options = {}, command) {
 }
 
 // src/commands/login.ts
-var DEVICE_AUTH_START_PATH = "/api/auth/cli/device";
-var DEVICE_AUTH_TOKEN_PATH = "/api/auth/cli/device/token";
 async function loginCommand(options, command) {
   const runtime = getRuntimeOptions(command, options);
   const apiUrl = resolveLoginApiUrl(runtime.apiUrl);
@@ -28167,11 +27956,11 @@ async function loginCommand(options, command) {
     token = await readStdinTrimmed();
   } else if (envOrFlag?.token) {
     token = envOrFlag.token;
-  } else {
-    token = await loginWithDeviceAuthorization(apiUrl, runtime);
   }
   if (!token) {
-    throw new CliError("user", "No token provided.");
+    throw new CliError("user", "No token provided.", {
+      hint: "Pass --token-stdin or set ARCANIST_TOKEN. Mint a token in Settings > CLI."
+    });
   }
   if (!token.startsWith("arc_")) {
     throw new CliError("user", "Invalid token format. Token must start with 'arc_'.");
@@ -28194,640 +27983,90 @@ async function loginCommand(options, command) {
     throw err;
   }
 }
-async function loginWithDeviceAuthorization(apiUrl, runtime) {
-  const authorization = await publicApiFetch(apiUrl, DEVICE_AUTH_START_PATH, {
-    method: "POST",
-    body: "{}"
+
+// src/commands/repos.ts
+async function reposListCommand(options = {}, command) {
+  const { config: config2 } = resolveBusinessContext(command, options);
+  const payload = await apiFetch(config2, "/api/repos");
+  emit(command, options, { repos: payload.repos, ssoOrgs: payload.ssoOrgs }, (data) => {
+    for (const repo of data.repos) {
+      console.log(`${String(repo.fullName ?? repo.name ?? repo.repo ?? "")}	${String(repo.defaultBranch ?? "")}`);
+    }
+    if (data.ssoOrgs.length > 0) console.log(`SSO withheld orgs: ${data.ssoOrgs.length}`);
   });
-  emitAction(runtime, { url: authorization.verificationUrl, userCode: authorization.userCode });
-  if (!runtime.json && !runtime.quiet) console.error("Waiting for approval...");
-  const deadline = Date.now() + authorization.expiresIn * 1e3;
-  const pollIntervalMs = Math.max(1, authorization.pollInterval) * 1e3;
-  while (Date.now() < deadline) {
-    const response = await publicApiFetch(apiUrl, DEVICE_AUTH_TOKEN_PATH, {
-      method: "POST",
-      body: JSON.stringify({ deviceCode: authorization.deviceCode })
-    });
-    if ("accessToken" in response) return response.accessToken;
-    await sleep(pollIntervalMs);
+}
+
+// src/commands/review.ts
+var PR_REVIEW_POLL_INTERVAL_MS = 1e4;
+var PR_REVIEW_WAIT_TIMEOUT_MS = 30 * 60 * 1e3;
+var SANDBOX_RUNTIME_BACKENDS = {
+  e2b: "e2b_cloud",
+  modal: "modal_cloud"
+};
+function isSandboxRuntimeOption(runtime) {
+  return Object.hasOwn(SANDBOX_RUNTIME_BACKENDS, runtime);
+}
+function resolveSandboxRuntimeBackend(runtime) {
+  if (runtime === void 0) return null;
+  if (!isSandboxRuntimeOption(runtime)) {
+    throw new CliError("user", "Sandbox runtime must be modal or e2b.");
   }
-  throw new CliError("auth", "CLI authorization expired.", { hint: "Run `arcanist auth login` again." });
+  return SANDBOX_RUNTIME_BACKENDS[runtime];
 }
-function emitAction(runtime, action) {
-  if (runtime.json) {
-    process.stderr.write(
-      `${JSON.stringify({ type: "action_required", action: { kind: "authorize_cli", ...action } })}
-`
-    );
+async function reviewCommand(prUrl, options = {}, command) {
+  const sandboxRuntimeBackend = resolveSandboxRuntimeBackend(options.sandboxRuntime);
+  const pollIntervalMs = options.wait ? parsePollInterval(options.pollInterval, { defaultMs: PR_REVIEW_POLL_INTERVAL_MS, maxMs: null }) : null;
+  const { config: config2 } = resolveBusinessContext(command, options);
+  const trigger = await apiFetch(config2, "/api/pr-reviews", {
+    method: "POST",
+    body: JSON.stringify({
+      prUrl,
+      ...sandboxRuntimeBackend !== null ? { sandboxRuntimeBackend } : {}
+    })
+  });
+  if (!options.wait || trigger.cached) {
+    emit(command, options, trigger, (payload) => {
+      if (payload.cached) console.log(`Arcanist review already completed: ${payload.verdict ?? "unknown"}.`);
+      else console.log(`Started Arcanist review${payload.requestId ? ` (${payload.requestId})` : ""}.`);
+    });
     return;
   }
-  process.stderr.write(`Authorize Arcanist in your browser:
-${action.url}
-Code: ${action.userCode}
-`);
-}
-
-// ../../shared/agent/agent-runtime-backend.ts
-var CODEX_AGENT_RUNTIME_BACKEND = "codex";
-var AGENT_RUNTIME_BACKENDS = [CODEX_AGENT_RUNTIME_BACKEND];
-
-// ../../shared/constants/models.ts
-var OpenAIModel = {
-  GPT6Astra: "gpt-6-astra",
-  GPT56: "gpt-5.6",
-  GPT56Sol: "gpt-5.6-sol",
-  GPT56Terra: "gpt-5.6-terra",
-  GPT56Luna: "gpt-5.6-luna",
-  GPT55: "gpt-5.5",
-  GPT54: "gpt-5.4",
-  GPT54Pro: "gpt-5.4-pro",
-  GPT54Mini: "gpt-5.4-mini",
-  GPT54Nano: "gpt-5.4-nano",
-  GPT53CodexSpark: "gpt-5.3-codex-spark",
-  GPT53Codex: "gpt-5.3-codex",
-  GPT52: "gpt-5.2",
-  GPT52ChatLatest: "gpt-5.2-chat-latest",
-  GPT52Codex: "gpt-5.2-codex"
-};
-var MODEL_PROVIDERS_SET = /* @__PURE__ */ new Set(["openai", "anthropic"]);
-var BACKEND_DESKTOP_IMAGE_FEEDBACK_CONFIGS = {
-  [CODEX_AGENT_RUNTIME_BACKEND]: {
-    backend: CODEX_AGENT_RUNTIME_BACKEND,
-    fixture: "known_image_fixture",
-    // Codex 0.146.1 code mode flattens tool-result images to text, so the bridge steers the image
-    // into the active turn as a user message; DEFAULT_CODEX_IMAGE_FEEDBACK_CAPABILITY mirrors this.
-    deliveryPath: "steer_image_message",
-    verifiedAt: "2026-09-14"
+  const requestId = trigger.requestId?.trim() ?? "";
+  if (requestId.length === 0) {
+    throw new CliError("server", "Arcanist review start did not return a requestId.");
   }
-};
-var MODEL_REGISTRY = [
-  {
-    id: OpenAIModel.GPT54,
-    name: "GPT-5.4",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 1e6,
-    // Default codex model after the gpt-5.5 downgrade; carries gpt-5.5's prior
-    // "medium" default so default sessions keep the same reasoning effort.
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh"], default: "medium" },
-    // No cacheWritePerMillion: the pricing page shows a dash in the cache-writes
-    // column for gpt-5.4 and gpt-5.5, so the absence is deliberate, not an
-    // oversight (checked 2026-07-30). The 5.6 family does publish that rate.
-    pricing: {
-      inputPerMillion: 2.5,
-      outputPerMillion: 15,
-      cacheReadPerMillion: 0.25,
-      flex: { inputPerMillion: 1.25, outputPerMillion: 7.5, cacheReadPerMillion: 0.13 },
-      longContext: {
-        thresholdTokens: 272e3,
-        flex: { inputPerMillion: 2.5, outputPerMillion: 11.25, cacheReadPerMillion: 0.25 },
-        inputPerMillion: 5,
-        outputPerMillion: 22.5,
-        cacheReadPerMillion: 0.5
-      }
-    },
-    sessionStart: { eligible: true, isDefault: true }
-  },
-  {
-    id: OpenAIModel.GPT6Astra,
-    name: "GPT-6 Astra",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 105e4,
-    reasoning: { efforts: ["low", "medium", "high", "xhigh", "max"], default: "medium" },
-    // Standard and Flex rates: https://developers.openai.com/api/docs/models/gpt-6-astra (2026-09-15).
-    pricing: {
-      inputPerMillion: 10,
-      outputPerMillion: 50,
-      cacheReadPerMillion: 1,
-      cacheWritePerMillion: 12.5,
-      flex: { inputPerMillion: 5, outputPerMillion: 25, cacheReadPerMillion: 0.5, cacheWritePerMillion: 6.25 },
-      longContext: {
-        thresholdTokens: 272e3,
-        inputPerMillion: 20,
-        outputPerMillion: 75,
-        cacheReadPerMillion: 2,
-        cacheWritePerMillion: 25,
-        flex: { inputPerMillion: 10, outputPerMillion: 37.5, cacheReadPerMillion: 1, cacheWritePerMillion: 12.5 }
-      }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: OpenAIModel.GPT56,
-    name: "GPT-5.6",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 105e4,
-    // Verified 2026-07-09 against OpenAI's GPT-5.6 migration guide and model
-    // catalog: the alias routes to gpt-5.6-sol and supports max effort. Pricing
-    // mirrors gpt-5.6-sol since the alias resolves to it. Cache-write rates
-    // verified 2026-07-30 against the Standard tier at
-    // developers.openai.com/api/docs/pricing.
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh", "max"], default: "medium" },
-    pricing: {
-      inputPerMillion: 5,
-      outputPerMillion: 30,
-      cacheReadPerMillion: 0.5,
-      cacheWritePerMillion: 6.25,
-      flex: { inputPerMillion: 2, outputPerMillion: 10, cacheReadPerMillion: 0.2, cacheWritePerMillion: 2.5 },
-      longContext: {
-        thresholdTokens: 272e3,
-        flex: { inputPerMillion: 4, outputPerMillion: 15, cacheReadPerMillion: 0.4, cacheWritePerMillion: 5 },
-        inputPerMillion: 10,
-        outputPerMillion: 45,
-        cacheReadPerMillion: 1,
-        cacheWritePerMillion: 12.5
+  const result = await pollUntilSettled({
+    pollIntervalMs: pollIntervalMs ?? PR_REVIEW_POLL_INTERVAL_MS,
+    timeoutMs: PR_REVIEW_WAIT_TIMEOUT_MS,
+    timeoutMessage: "Timed out waiting for Arcanist review results.",
+    fetchStatus: async () => {
+      const status = await apiFetch(
+        config2,
+        `/api/pr-reviews/requests/${encodeURIComponent(requestId)}`
+      );
+      if (status.status === "cancelled") {
+        throw new CliError(
+          "conflict",
+          status.terminalReason ? `Arcanist review was cancelled: ${status.terminalReason}` : "Arcanist review was cancelled."
+        );
       }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: OpenAIModel.GPT56Sol,
-    name: "GPT-5.6 Sol",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 105e4,
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh", "max"], default: "medium" },
-    // Cache-write rates verified 2026-07-30 against the Standard tier at
-    // developers.openai.com/api/docs/pricing.
-    pricing: {
-      inputPerMillion: 5,
-      outputPerMillion: 30,
-      cacheReadPerMillion: 0.5,
-      cacheWritePerMillion: 6.25,
-      flex: { inputPerMillion: 2, outputPerMillion: 10, cacheReadPerMillion: 0.2, cacheWritePerMillion: 2.5 },
-      longContext: {
-        thresholdTokens: 272e3,
-        flex: { inputPerMillion: 4, outputPerMillion: 15, cacheReadPerMillion: 0.4, cacheWritePerMillion: 5 },
-        inputPerMillion: 10,
-        outputPerMillion: 45,
-        cacheReadPerMillion: 1,
-        cacheWritePerMillion: 12.5
-      }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: OpenAIModel.GPT56Terra,
-    name: "GPT-5.6 Terra",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 105e4,
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh", "max"], default: "medium" },
-    // Verified 2026-07-30 against the Standard tier at
-    // developers.openai.com/api/docs/pricing: short and long context input,
-    // cached input, cache writes, and output.
-    pricing: {
-      inputPerMillion: 2,
-      outputPerMillion: 12,
-      cacheReadPerMillion: 0.2,
-      cacheWritePerMillion: 2.5,
-      flex: { inputPerMillion: 1, outputPerMillion: 6, cacheReadPerMillion: 0.1, cacheWritePerMillion: 1.25 },
-      longContext: {
-        thresholdTokens: 272e3,
-        flex: { inputPerMillion: 2, outputPerMillion: 9, cacheReadPerMillion: 0.2, cacheWritePerMillion: 2.5 },
-        inputPerMillion: 4,
-        outputPerMillion: 18,
-        cacheReadPerMillion: 0.4,
-        cacheWritePerMillion: 5
-      }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: OpenAIModel.GPT56Luna,
-    name: "GPT-5.6 Luna",
-    provider: "openai",
-    overloadFallback: OpenAIModel.GPT56Terra,
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 105e4,
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh", "max"], default: "medium" },
-    // Verified 2026-07-30 against the Standard tier at
-    // developers.openai.com/api/docs/pricing: short and long context input,
-    // cached input, cache writes, and output.
-    pricing: {
-      inputPerMillion: 0.2,
-      outputPerMillion: 1.2,
-      cacheReadPerMillion: 0.02,
-      cacheWritePerMillion: 0.25,
-      flex: { inputPerMillion: 0.1, outputPerMillion: 0.6, cacheReadPerMillion: 0.01, cacheWritePerMillion: 0.125 },
-      longContext: {
-        thresholdTokens: 272e3,
-        flex: { inputPerMillion: 0.2, outputPerMillion: 0.9, cacheReadPerMillion: 0.02, cacheWritePerMillion: 0.25 },
-        inputPerMillion: 0.4,
-        outputPerMillion: 1.8,
-        cacheReadPerMillion: 0.04,
-        cacheWritePerMillion: 0.5
-      }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: OpenAIModel.GPT55,
-    name: "GPT-5.5",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 1e6,
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh"], default: "medium" },
-    pricing: {
-      inputPerMillion: 5,
-      outputPerMillion: 30,
-      cacheReadPerMillion: 0.5,
-      flex: { inputPerMillion: 2.5, outputPerMillion: 15, cacheReadPerMillion: 0.25 },
-      longContext: {
-        thresholdTokens: 272e3,
-        flex: { inputPerMillion: 5, outputPerMillion: 22.5, cacheReadPerMillion: 0.5 },
-        inputPerMillion: 10,
-        outputPerMillion: 45,
-        cacheReadPerMillion: 1
-      }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: OpenAIModel.GPT54Mini,
-    name: "GPT-5.4 Mini",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 4e5,
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh"], default: void 0 },
-    pricing: {
-      inputPerMillion: 0.75,
-      outputPerMillion: 4.5,
-      cacheReadPerMillion: 0.075,
-      // Flex bills at Batch rates: a flat 50% off standard across input,
-      // cached input, and output (verified against the OpenAI pricing page,
-      // June 2026). Bridge cost estimates deliberately strip this gateway-only
-      // axis when deriving MODEL_PRICING.
-      flex: { inputPerMillion: 0.375, outputPerMillion: 2.25, cacheReadPerMillion: 0.0375 }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: OpenAIModel.GPT54Nano,
-    name: "GPT-5.4 Nano",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: false },
-    contextWindow: 4e5,
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh"], default: void 0 },
-    pricing: { inputPerMillion: 0.2, outputPerMillion: 1.25, cacheReadPerMillion: 0.02 },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: OpenAIModel.GPT53CodexSpark,
-    name: "GPT-5.3 Codex Spark",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 128e3,
-    reasoning: { efforts: ["low", "medium", "high", "xhigh"], default: "high" },
-    costTracked: false,
-    requiresCodexSubscriptionAuth: true,
-    sessionStart: { eligible: true },
-    visibility: "internal_probe"
-  },
-  {
-    id: OpenAIModel.GPT53Codex,
-    name: "GPT-5.3 Codex",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 4e5,
-    reasoning: { efforts: ["low", "medium", "high", "xhigh"], default: "high" },
-    pricing: { inputPerMillion: 1.75, outputPerMillion: 14, cacheReadPerMillion: 0.175 }
-  },
-  {
-    id: OpenAIModel.GPT52,
-    name: "GPT-5.2",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 4e5,
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh"], default: void 0 },
-    pricing: {
-      inputPerMillion: 1.75,
-      outputPerMillion: 14,
-      cacheReadPerMillion: 0.175,
-      flex: { inputPerMillion: 0.875, outputPerMillion: 7, cacheReadPerMillion: 0.0875 }
-    }
-  },
-  {
-    id: OpenAIModel.GPT52ChatLatest,
-    name: "GPT-5.2 Chat",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 128e3,
-    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh"], default: void 0 },
-    pricing: { inputPerMillion: 1.75, outputPerMillion: 14, cacheReadPerMillion: 0.175 }
-  },
-  {
-    id: OpenAIModel.GPT52Codex,
-    name: "GPT-5.2 Codex",
-    provider: "openai",
-    backends: [CODEX_AGENT_RUNTIME_BACKEND],
-    codexProviderRoute: "openai",
-    capabilities: { codexToolSearch: true },
-    contextWindow: 4e5,
-    reasoning: { efforts: ["low", "medium", "high", "xhigh"], default: "high" },
-    pricing: { inputPerMillion: 1.75, outputPerMillion: 14, cacheReadPerMillion: 0.175 }
-  }
-];
-var MODEL_PROVIDER_NAMES = {
-  openai: "OpenAI",
-  anthropic: "Anthropic"
-};
-function buildSessionStartModelIdsByBackend() {
-  const byBackend = Object.fromEntries(AGENT_RUNTIME_BACKENDS.map((backend) => [backend, []]));
-  for (const model of MODEL_REGISTRY) {
-    if (!model.sessionStart?.eligible) continue;
-    for (const backend of model.backends) {
-      if (!modelSupportsRequiredSessionStartCapabilities(model, backend)) continue;
-      byBackend[backend].push(model.id);
-    }
-  }
-  return byBackend;
-}
-function modelSupportsRequiredSessionStartCapabilities(model, backend) {
-  if (backend !== CODEX_AGENT_RUNTIME_BACKEND) return true;
-  return model.capabilities?.codexToolSearch === true;
-}
-function buildDefaultSessionStartModelIdByBackend() {
-  const defaults = {};
-  for (const backend of AGENT_RUNTIME_BACKENDS) {
-    const backendDefaults = MODEL_REGISTRY.filter(
-      (model) => model.sessionStart?.eligible && model.sessionStart.isDefault === true && model.backends.includes(backend)
-    );
-    if (backendDefaults.length !== 1) {
-      throw new Error(`Expected exactly one default session-start model for ${backend}, got ${backendDefaults.length}`);
-    }
-    defaults[backend] = backendDefaults[0].id;
-  }
-  return defaults;
-}
-var SESSION_START_MODEL_IDS_BY_BACKEND = buildSessionStartModelIdsByBackend();
-var DEFAULT_SESSION_START_MODEL_ID_BY_BACKEND = buildDefaultSessionStartModelIdByBackend();
-var DEFAULT_SESSION_START_MODEL_ID = DEFAULT_SESSION_START_MODEL_ID_BY_BACKEND[CODEX_AGENT_RUNTIME_BACKEND];
-var VALID_MODEL_IDS = new Set(MODEL_REGISTRY.map((model) => model.id));
-var VALID_SESSION_START_MODEL_IDS_BY_BACKEND = {
-  [CODEX_AGENT_RUNTIME_BACKEND]: new Set(SESSION_START_MODEL_IDS_BY_BACKEND[CODEX_AGENT_RUNTIME_BACKEND])
-};
-var MODEL_CONTEXT_WINDOWS = {
-  ...Object.fromEntries(
-    MODEL_REGISTRY.flatMap((model) => model.contextWindow === void 0 ? [] : [[model.id, model.contextWindow]])
-  )
-};
-var MODEL_PROVIDERS = {
-  ...Object.fromEntries(MODEL_REGISTRY.map((model) => [model.id, model.provider]))
-};
-var MODEL_REASONING_CONFIG = Object.fromEntries(
-  MODEL_REGISTRY.flatMap((model) => model.reasoning ? [[model.id, model.reasoning]] : [])
-);
-var MODEL_DEFINITIONS_BY_ID = Object.fromEntries(MODEL_REGISTRY.map((model) => [model.id, model]));
-function splitModelIdentifier(value) {
-  let hasSeparator = false;
-  for (const separator of [":", "/"]) {
-    const index = value.indexOf(separator);
-    if (index <= 0 || index >= value.length - 1) continue;
-    hasSeparator = true;
-    const providerID = value.slice(0, index);
-    const modelID = value.slice(index + 1);
-    if (MODEL_PROVIDERS_SET.has(providerID) && modelID.length > 0) {
-      return { providerID, modelID };
-    }
-  }
-  if (hasSeparator) return void 0;
-  return value.length > 0 ? { modelID: value } : void 0;
-}
-function getRawModelValue(raw) {
-  if (typeof raw === "string") return asNonEmptyString(raw);
-  if (!isRecord(raw)) return void 0;
-  return asNonEmptyString(raw.modelID) ?? asNonEmptyString(raw.modelId) ?? asNonEmptyString(raw.id);
-}
-function getExplicitProvider(raw) {
-  if (isRecord(raw)) {
-    const providerID = asNonEmptyString(raw.providerID) ?? asNonEmptyString(raw.providerId);
-    if (providerID && MODEL_PROVIDERS_SET.has(providerID)) {
-      return providerID;
-    }
-  }
-  const modelValue = getRawModelValue(raw);
-  if (!modelValue) return void 0;
-  return splitModelIdentifier(modelValue)?.providerID;
-}
-function extractModelId(raw) {
-  const value = getRawModelValue(raw);
-  if (!value) return void 0;
-  return splitModelIdentifier(value)?.modelID;
-}
-function getProviderForModel(modelId) {
-  return MODEL_PROVIDERS[modelId] ?? "openai";
-}
-function toModelSelection(raw) {
-  const modelID = extractModelId(raw);
-  if (!modelID) return void 0;
-  return {
-    providerID: getExplicitProvider(raw) ?? getProviderForModel(modelID),
-    modelID
-  };
-}
-function getModelDefinition(raw) {
-  const modelID = extractModelId(raw);
-  if (!modelID) return void 0;
-  return MODEL_DEFINITIONS_BY_ID[modelID];
-}
-function formatModelLabel(raw, options = {}) {
-  const includeProvider = options.includeProvider ?? false;
-  const definition = getModelDefinition(raw);
-  if (definition) {
-    return includeProvider ? `${MODEL_PROVIDER_NAMES[definition.provider]} / ${definition.name}` : definition.name;
-  }
-  const selection = toModelSelection(raw);
-  if (!selection) return void 0;
-  const providerName = MODEL_PROVIDER_NAMES[selection.providerID];
-  return includeProvider ? `${providerName} / ${selection.modelID}` : selection.modelID;
-}
-function buildModelProviderGroups(models2) {
-  const groups = /* @__PURE__ */ new Map();
-  for (const model of models2) {
-    let group = groups.get(model.provider);
-    if (!group) {
-      group = { id: model.provider, name: MODEL_PROVIDER_NAMES[model.provider], models: [] };
-      groups.set(model.provider, group);
-    }
-    group.models.push({
-      id: model.id,
-      name: model.name,
-      label: formatModelLabel(model, { includeProvider: true }) ?? model.name,
-      backends: model.backends,
-      reasoning: model.reasoning
-    });
-  }
-  const defaultModelIds = new Set(
-    models2.filter((model) => model.sessionStart?.isDefault === true).map((model) => model.id)
-  );
-  for (const group of groups.values()) {
-    group.models.sort((a, b) => Number(defaultModelIds.has(b.id)) - Number(defaultModelIds.has(a.id)));
-  }
-  return [...groups.values()];
-}
-var SESSION_START_MODEL_ID_SET_ANY_BACKEND = new Set(
-  AGENT_RUNTIME_BACKENDS.flatMap((backend) => [...SESSION_START_MODEL_IDS_BY_BACKEND[backend]])
-);
-var PUBLIC_SESSION_START_MODEL_PROVIDER_GROUPS = buildModelProviderGroups(
-  MODEL_REGISTRY.filter(
-    (model) => SESSION_START_MODEL_ID_SET_ANY_BACKEND.has(model.id) && model.visibility !== "internal_probe"
-  )
-);
-var CODEX_SUBSCRIPTION_SESSION_START_MODEL_PROVIDER_GROUPS = buildModelProviderGroups(
-  MODEL_REGISTRY.filter(
-    (model) => SESSION_START_MODEL_ID_SET_ANY_BACKEND.has(model.id) && (model.visibility !== "internal_probe" || model.requiresCodexSubscriptionAuth === true)
-  )
-);
-
-// src/commands/models.ts
-async function modelsListCommand(options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const groups = await apiFetch(config2, "/api/models");
-  const models2 = groups.flatMap(
-    (group) => group.models.map((model) => {
-      const backends = model.backends ?? [group.id];
-      return {
-        ...model,
-        backend: group.id,
-        provider: group.id,
-        backends,
-        default: backends.some(
-          (backend) => DEFAULT_SESSION_START_MODEL_ID_BY_BACKEND[backend] === model.id
-        )
-      };
-    })
-  );
-  emit(command, options, { models: models2 }, (payload) => {
-    for (const model of payload.models) {
-      console.log(`${String(model.id)}	${String(model.backend)}${model.default ? "	default" : ""}`);
-    }
-  });
-}
-
-// src/commands/repos.ts
-async function reposListCommand(options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const payload = await apiFetch(config2, "/api/repos");
-  emit(command, options, { repos: payload.repos, ssoOrgs: payload.ssoOrgs }, (data) => {
-    for (const repo of data.repos) {
-      console.log(`${String(repo.fullName ?? repo.name ?? repo.repo ?? "")}	${String(repo.defaultBranch ?? "")}`);
-    }
-    if (data.ssoOrgs.length > 0) console.log(`SSO withheld orgs: ${data.ssoOrgs.length}`);
-  });
-}
-async function repoBranchesCommand(repoArg, options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const repo = parseRepoArgOrCurrent(repoArg);
-  const payload = await apiFetch(
-    config2,
-    `/api/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.repo)}/branches`
-  );
-  emit(command, options, payload, (data) => {
-    for (const branch of data.branches) console.log(String(branch.name ?? branch.branch ?? ""));
-  });
-}
-
-// src/commands/review.ts
-var PR_REVIEW_POLL_INTERVAL_MS = 1e4;
-var PR_REVIEW_WAIT_TIMEOUT_MS = 30 * 60 * 1e3;
-var SANDBOX_RUNTIME_BACKENDS = {
-  e2b: "e2b_cloud",
-  modal: "modal_cloud",
-  sailbox: "sail_cloud"
-};
-function isSandboxRuntimeOption(runtime) {
-  return Object.hasOwn(SANDBOX_RUNTIME_BACKENDS, runtime);
-}
-function resolveSandboxRuntimeBackend(runtime) {
-  if (runtime === void 0) return null;
-  if (!isSandboxRuntimeOption(runtime)) {
-    throw new CliError("user", "Sandbox runtime must be modal, e2b, or sailbox.");
-  }
-  return SANDBOX_RUNTIME_BACKENDS[runtime];
-}
-async function reviewCommand(prUrl, options = {}, command) {
-  assertArcanistSessionMutationAllowed("review");
-  const sandboxRuntimeBackend = resolveSandboxRuntimeBackend(options.sandboxRuntime);
-  const pollIntervalMs = options.wait ? parsePollInterval(options.pollInterval, { defaultMs: PR_REVIEW_POLL_INTERVAL_MS, maxMs: null }) : null;
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const trigger = await apiFetch(config2, "/api/pr-reviews", {
-    method: "POST",
-    body: JSON.stringify({
-      prUrl,
-      ...sandboxRuntimeBackend !== null ? { sandboxRuntimeBackend } : {}
-    })
-  });
-  if (!options.wait || trigger.cached) {
-    emit(command, options, trigger, (payload) => {
-      if (payload.cached) console.log(`Zeus review already completed: ${payload.verdict ?? "unknown"}.`);
-      else console.log(`Started Zeus review${payload.sessionId ? ` (${payload.sessionId})` : ""}.`);
-    });
-    return;
-  }
-  const triggeredSessionId = trigger.sessionId ?? null;
-  const result = await pollUntilSettled({
-    pollIntervalMs: pollIntervalMs ?? PR_REVIEW_POLL_INTERVAL_MS,
-    timeoutMs: PR_REVIEW_WAIT_TIMEOUT_MS,
-    timeoutMessage: "Timed out waiting for Zeus review results.",
-    fetchStatus: async () => {
-      const status = await apiFetch(
-        config2,
-        `/api/pr-reviews/status?prUrl=${encodeURIComponent(prUrl)}`
-      );
-      if (status.status === "cancelled" || status.status === "admission_rejected") {
-        assertSameAttempt(triggeredSessionId, status.sessionId, "PR review");
-        if (status.status === "cancelled") {
-          throw new CliError(
-            "conflict",
-            status.terminalReason ? `Zeus review was cancelled: ${status.terminalReason}` : "Zeus review was cancelled."
-          );
-        }
-        throw new CliError(
-          "user",
-          status.terminalReason ? `Zeus review was rejected at admission: ${status.terminalReason}` : "Zeus review was rejected at admission."
-        );
+      if (status.status === "admission_rejected") {
+        throw new CliError(
+          "user",
+          status.terminalReason ? `Arcanist review was rejected at admission: ${status.terminalReason}` : "Arcanist review was rejected at admission."
+        );
       }
       if (status.status !== "completed") return null;
-      assertSameAttempt(triggeredSessionId, status.sessionId, "PR review");
       return {
         ...status,
         status: "completed",
-        sessionId: status.sessionId ?? triggeredSessionId,
+        sessionId: status.sessionId ?? trigger.sessionId ?? null,
         verdict: status.verdict ?? "unknown"
       };
     }
   });
   emit(command, options, result, (payload) => {
-    console.log(`Zeus review: ${sanitizeTerminalText(payload.verdict)}. ${payload.findings.length} finding(s).`);
+    console.log(`Arcanist review: ${sanitizeTerminalText(payload.verdict)}. ${payload.findings.length} finding(s).`);
     for (const finding of payload.findings) {
       console.log(
         `${sanitizeTerminalText(finding.severity)} ${sanitizeTerminalText(finding.file)}:${finding.line} - ${sanitizeTerminalText(finding.title)}`
@@ -28837,7 +28076,7 @@ async function reviewCommand(prUrl, options = {}, command) {
 }
 
 // src/commands/sandbox.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname2 } from "path";
 
 // ../../shared/sandbox-layer/parser.ts
@@ -29179,7 +28418,7 @@ function splitLogicalInstructions(path, text) {
   return result;
 }
 function splitEnvTokens(path, body, startLine) {
-  const tokens2 = [];
+  const tokens = [];
   let current = "";
   let quote = null;
   for (const char of body) {
@@ -29195,7 +28434,7 @@ function splitEnvTokens(path, body, startLine) {
     }
     if (/\s/.test(char)) {
       if (current) {
-        tokens2.push(current);
+        tokens.push(current);
         current = "";
       }
       continue;
@@ -29203,16 +28442,16 @@ function splitEnvTokens(path, body, startLine) {
     current += char;
   }
   if (quote) throw new SandboxLayerValidationError(path, "ENV contains an unterminated quote", startLine);
-  if (current) tokens2.push(current);
-  return tokens2;
+  if (current) tokens.push(current);
+  return tokens;
 }
 function parseEnvValues(path, body, startLine) {
   const values = {};
-  const tokens2 = splitEnvTokens(path, body, startLine);
-  if (tokens2.length > MAX_ENV_VARS) {
+  const tokens = splitEnvTokens(path, body, startLine);
+  if (tokens.length > MAX_ENV_VARS) {
     throw new SandboxLayerValidationError(path, `ENV may set at most ${MAX_ENV_VARS} variables`, startLine);
   }
-  for (const token of tokens2) {
+  for (const token of tokens) {
     const separator = token.indexOf("=");
     if (separator <= 0) {
       throw new SandboxLayerValidationError(path, "ENV entries must use KEY=value form", startLine);
@@ -29441,19 +28680,11 @@ var sandboxLayerBuildLogsResponseSchema = external_exports.object({
   logs: external_exports.array(sandboxLayerBuildLogSchema)
 });
 var sandboxLayerCliBuildRequestSchema = sandboxLayerBuildRequestSchema.partial().required({ id: true, status: true }).extend({ createdBy: sandboxLayerBuildActorSchema.nullable().optional() });
-var sandboxLayerCliBuildHistoryItemSchema = sandboxLayerBuildHistoryItemSchema.extend({
-  startedAt: external_exports.number().nullable().optional(),
-  failureSummary: sandboxLayerFailureSummarySchema.nullable().optional()
-});
 var sandboxLayerCliBuildLogSchema = sandboxLayerBuildLogSchema.partial().required({ sequence: true, message: true }).extend({ created_at: external_exports.union([external_exports.string(), external_exports.number()]).optional() });
 var sandboxLayerCliBuildRequestResponseSchema = external_exports.object({
   ok: external_exports.boolean(),
   buildRequest: sandboxLayerCliBuildRequestSchema
 });
-var sandboxLayerCliBuildHistoryResponseSchema = external_exports.object({
-  ok: external_exports.boolean(),
-  builds: external_exports.array(sandboxLayerCliBuildHistoryItemSchema)
-});
 var sandboxLayerCliBuildLogsResponseSchema = external_exports.object({
   ok: external_exports.boolean(),
   logs: external_exports.array(sandboxLayerCliBuildLogSchema)
@@ -29547,52 +28778,6 @@ function printTerminalBuildSummary(buildRequest) {
   if (failure?.stderrPreview) console.log(`Stderr: ${failure.stderrPreview}`);
   printActiveTemplateStatus(buildRequest);
 }
-function printBuildHistory(builds) {
-  if (builds.length === 0) {
-    console.log("No sandbox builds found.");
-    return;
-  }
-  for (const build of builds) {
-    console.log(
-      [
-        `Build ${build.id} is ${build.status}.`,
-        `source=${build.sourceRepo}`,
-        `commit=${build.commitSha}`,
-        `profile=${build.resourceProfileKey}`,
-        build.templateId ? `template=${build.templateId}` : null,
-        `base=${build.baseTemplateRef}@${build.baseVersion}`,
-        `builtBy=${buildActorLabel(build.createdBy)}`
-      ].filter(Boolean).join(" ")
-    );
-  }
-}
-function selectionTierLabel(tier) {
-  if (tier === "repo_local") return "repo-local";
-  if (tier === "repo_assignment") return "assigned";
-  return "workspace default";
-}
-function printSandboxStatus(payload) {
-  if (payload.selection) {
-    console.log(`Using ${selectionTierLabel(payload.selection.tier)} sandbox.`);
-    console.log(`Template: ${payload.selection.templateId}`);
-    console.log(`Source: ${payload.selection.sourceRepo}`);
-    console.log(`Commit: ${payload.selection.commitSha}`);
-    console.log(`Profile: ${payload.selection.resourceProfileKey}`);
-    console.log(`Built from: ${payload.selection.baseTemplateRef} @ ${payload.selection.baseVersion}`);
-    console.log(`Base status: ${payload.selection.baseStatus}`);
-    console.log(`Built by: ${buildActorLabel(payload.selection.createdBy)}`);
-    return;
-  }
-  console.log("Using Arcanist default sandbox.");
-  if (payload.fallback?.templateId) console.log(`Template: ${payload.fallback.templateId}`);
-  if (payload.latestRepoBuild) {
-    console.log(`Latest custom build: ${payload.latestRepoBuild.status}`);
-    console.log(`Commit: ${payload.latestRepoBuild.commitSha}`);
-    console.log(`Profile: ${payload.latestRepoBuild.resourceProfileKey}`);
-    console.log(`Built from: ${payload.latestRepoBuild.baseTemplateRef} @ ${payload.latestRepoBuild.baseVersion}`);
-    console.log(`Built by: ${buildActorLabel(payload.latestRepoBuild.createdBy)}`);
-  }
-}
 function printLogs(logs) {
   for (const log of logs) {
     console.log(log.message);
@@ -29692,13 +28877,6 @@ function handleValidationError(err, options, command) {
   }
   throw err;
 }
-function sourceBody(sourceRepo, manifestPath) {
-  return {
-    sourceRepoOwner: sourceRepo.owner,
-    sourceRepoName: sourceRepo.repo,
-    manifestPath
-  };
-}
 async function sandboxInitCommand(options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   if (existsSync3(DEFAULT_MANIFEST_PATH)) throw new CliError("conflict", `${DEFAULT_MANIFEST_PATH} already exists`);
@@ -29734,12 +28912,12 @@ async function sandboxInitCommand(options = {}, command) {
 async function sandboxValidateCommand(options = {}, command) {
   const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
   assertManifestExists(manifestPath);
-  const manifestText = readFileSync3(manifestPath, "utf8");
+  const manifestText = readFileSync2(manifestPath, "utf8");
   let layerPath;
   try {
     layerPath = parseSandboxLayerManifest(manifestPath, manifestText).layer.dockerfile;
     assertManifestExists(layerPath);
-    const layerText = readFileSync3(layerPath, "utf8");
+    const layerText = readFileSync2(layerPath, "utf8");
     const parsed = await parseSandboxLayerSource({ manifestPath, manifestText, layerPath, layerText });
     const payload = formatValidationPayload({ manifestPath, layerPath, parsed });
     emit(command, options, payload, (validationPayload) => {
@@ -29815,206 +28993,518 @@ async function sandboxBuildCommand(sourceRepoArg, options = {}, command) {
     process.exitCode = 1;
   }
 }
-async function sandboxStatusCommand(repoArg, options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  const repo = parseRepoArgOrCurrent(repoArg);
-  const payload = await apiFetch(
-    config2,
-    `/api/businesses/${encodeURIComponent(businessId)}/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(
-      repo.repo
-    )}/sandbox-layer/resolution`
-  );
-  emit(command, options, payload, printSandboxStatus);
-}
-async function sandboxHistoryCommand(sourceRepoArg, options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  const sourceRepo = parseRepoArgOrCurrent(sourceRepoArg);
-  const params = new URLSearchParams({ sourceRepo: repoPath(sourceRepo) });
-  if (options.targetRepo) params.set("targetRepo", repoPath(parseRepoArgOrCurrent(options.targetRepo)));
-  if (options.status) params.set("status", options.status);
-  if (options.limit) {
-    const limit = Number(options.limit);
-    if (!Number.isInteger(limit) || limit < 1) {
-      throw new CliError("user", "--limit must be a positive integer.");
-    }
-    params.set("limit", String(limit));
-  }
-  const payload = sandboxLayerCliBuildHistoryResponseSchema.parse(
-    await apiFetch(
-      config2,
-      `/api/businesses/${encodeURIComponent(businessId)}/sandbox-layer/build-requests?${params.toString()}`
-    )
-  );
-  emit(command, options, payload, (historyPayload) => printBuildHistory(historyPayload.builds));
-}
-async function sandboxRebuildStaleCommand(options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  if (!options.dryRun && !options.yes) {
-    throw new CliError("user", "Use --dry-run to preview or --yes to start a rebuild campaign.");
-  }
-  if (options.all && options.business) {
-    throw new CliError("user", "Use either --all or --business, not both.");
+
+// ../../shared/constants/observability.ts
+var ZEUS_SCOUT_HEALTH_PUBLISH_OUTCOMES = ["published", "publish_failed", "gate_rejected"];
+var ZEUS_SCOUT_HEALTHS = ["not_applicable", "never_ran", "all_empty", "completed_empty", "yielded"];
+
+// ../../shared/constants/agent-runtime-evidence.ts
+var PR_REVIEW_CAPTURE_ID_PATTERN = /^cap-[0-9a-f]{8}$/;
+var PR_REVIEW_CAPTURE_LABEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 ._-]{0,79}$/;
+var PR_REVIEW_CAPTURE_ALT_MAX_CHARS = 200;
+var PR_REVIEW_APP_REQUEST_ID_PATTERN = /^req-[0-9a-f]{8}$/;
+var PR_REVIEW_VIDEO_MAX_DURATION_MS = 9e4;
+
+// ../../shared/types/doc-lookup.ts
+var DOC_LOOKUP_QUERY_MAX_CHARS = 300;
+var DOC_LOOKUP_URL_MAX_CHARS = 500;
+var DOC_LOOKUP_SEARCH_RESULTS = 3;
+var DOC_LOOKUP_TEXT_MAX_CHARS = 6e3;
+var DOC_LOOKUP_ID_PATTERN = /^dl-[0-9a-f]{8}$/;
+var DOC_LOOKUP_BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "localhost.localdomain",
+  "metadata",
+  "metadata.google.internal",
+  "instance-data",
+  "instance-data.ec2.internal"
+]);
+function isBlockedIpLiteral(host) {
+  const ipv43 = host.split(".");
+  if (ipv43.length === 4 && ipv43.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255)) {
+    const [a, b] = ipv43.map(Number);
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    if (a === 198 && (b === 18 || b === 19)) return true;
+    return false;
   }
-  const businessId = options.all ? null : await resolveBusinessId(config2, options);
-  let payload = await apiFetch(config2, "/api/admin/sandbox-layer/rebuild-campaigns", {
-    method: "POST",
-    body: JSON.stringify({
-      scope: options.all ? "all" : "business",
-      ...businessId ? { businessId } : {},
-      reason: "base_update",
-      dryRun: Boolean(options.dryRun)
-    })
-  }).catch((error61) => {
-    if (error61 instanceof ApiError && error61.status === 403) {
-      throw new CliError("auth", "Only Arcanist internal admins can rebuild stale sandbox layers.");
+  if (host.includes(":")) {
+    const lower = host.toLowerCase();
+    if (lower === "::" || lower === "::1") return true;
+    if (/^fe[89ab]/.test(lower)) return true;
+    if (/^f[cd]/.test(lower)) return true;
+    if (lower.startsWith("::ffff:")) {
+      const tail = lower.slice("::ffff:".length);
+      const hexWords = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+      if (hexWords) {
+        const hi = Number.parseInt(hexWords[1], 16);
+        const lo = Number.parseInt(hexWords[2], 16);
+        return isBlockedIpLiteral(`${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`);
+      }
+      return isBlockedIpLiteral(tail);
     }
-    throw error61;
-  });
-  if (options.follow && !options.dryRun) {
-    payload = await followRebuildCampaign(config2, payload.campaign.id);
+    return false;
   }
-  emit(command, options, payload, printRebuildCampaign);
+  return false;
 }
-async function followRebuildCampaign(config2, campaignId) {
-  for (; ; ) {
-    const payload = await apiFetch(
-      config2,
-      `/api/admin/sandbox-layer/rebuild-campaigns/${encodeURIComponent(campaignId)}`
-    );
-    if (isCampaignTerminal(payload.campaign.status)) return payload;
-    await sleep(DEFAULT_POLL_INTERVAL_MS);
-  }
-}
-function isCampaignTerminal(status) {
-  return status === "completed" || status === "completed_with_failures" || status === "failed";
-}
-function printRebuildCampaign(payload) {
-  console.log(`Campaign: ${payload.campaign.id}`);
-  console.log(`Status: ${payload.campaign.status}`);
-  console.log(`Active artifacts scanned: ${payload.campaign.summary.activeArtifactsScanned}`);
-  console.log(`Stale artifacts found: ${payload.campaign.summary.staleArtifactsFound}`);
-  console.log(`Current artifacts skipped: ${payload.campaign.summary.currentArtifactsSkipped}`);
-  console.log(`Missing installation skips: ${payload.campaign.summary.missingInstallationSkips}`);
-  console.log(`Source unavailable skips: ${payload.campaign.summary.sourceUnavailableSkips}`);
-  console.log(`Unversioned base skips: ${payload.campaign.summary.unversionedBaseSkips}`);
-  console.log(`Active changed skips: ${payload.campaign.summary.activeChangedSkips}`);
-  console.log(`Failed items: ${payload.campaign.summary.failedItems}`);
-  console.log(`Promoted items: ${payload.campaign.summary.promotedItems}`);
-  console.log(`Builds queued: ${payload.campaign.summary.buildsQueued}`);
-  if (payload.campaign.status === "completed_with_failures" || payload.campaign.status === "failed") {
-    console.log("Previous active templates remain active for failed or skipped rebuild items.");
-  }
-}
-async function sandboxLogsCommand(buildId, options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  let afterSequence = options.afterSequence == null ? void 0 : Number(options.afterSequence);
-  if (afterSequence != null && (!Number.isInteger(afterSequence) || afterSequence < 0)) {
-    throw new CliError("user", "--after-sequence must be a non-negative integer.");
-  }
-  const limit = options.limit == null ? void 0 : Number(options.limit);
-  if (limit != null && (!Number.isInteger(limit) || limit < 1)) {
-    throw new CliError("user", "--limit must be a positive integer.");
-  }
-  const json2 = isJson(command, options);
-  if (options.follow) {
-    const finalBuild = await waitForBuild(config2, businessId, buildId, {
-      follow: true,
-      pollIntervalMs: parsePollInterval(options.pollInterval, {
-        defaultMs: DEFAULT_POLL_INTERVAL_MS,
-        minMs: MIN_POLL_INTERVAL_MS,
-        maxMs: null
-      }),
-      json: json2,
-      afterSequence,
-      limit
-    });
-    if (json2) writeJson({ type: "build", buildRequest: finalBuild });
-    else printTerminalBuildSummary(finalBuild);
-    if (finalBuild.status !== "completed") process.exitCode = 1;
-    return;
+function isPlainHttpUrl(value) {
+  try {
+    const parsed = new URL(value);
+    const host = parsed.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.username === "" && parsed.password === "" && !DOC_LOOKUP_BLOCKED_HOSTNAMES.has(host) && !isBlockedIpLiteral(host);
+  } catch {
+    return false;
   }
-  const payload = sandboxLayerCliBuildLogsResponseSchema.parse(
-    await apiFetch(config2, buildLogsPath(businessId, buildId, { afterSequence, limit }))
-  );
-  if (json2) writeJson(payload);
-  else printLogs(payload.logs);
 }
-async function sandboxAssignDefaultCommand(sourceRepoArg, options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  const sourceRepo = parseRepoArgOrCurrent(sourceRepoArg);
-  const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
-  const payload = await apiFetch(
-    config2,
-    `/api/businesses/${encodeURIComponent(businessId)}/sandbox-layer/default-source`,
-    { method: "PUT", body: JSON.stringify(sourceBody(sourceRepo, manifestPath)) }
-  );
-  emit(command, options, payload, () => {
-    console.log(`Set default sandbox layer source to ${repoPath(sourceRepo)}.`);
-    console.log(
-      `Build missing target coverage with: arcanist sandbox build ${repoPath(sourceRepo)} --business ${businessId}`
-    );
-  });
-}
-async function sandboxAssignRepoCommand(targetRepoArg, sourceRepoArg, options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  const targetRepo = parseRepoArgOrCurrent(targetRepoArg);
-  const sourceRepo = parseRepoArgOrCurrent(sourceRepoArg);
-  const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
-  const payload = await apiFetch(
-    config2,
-    `/api/businesses/${encodeURIComponent(businessId)}/repos/${encodeURIComponent(targetRepo.owner)}/${encodeURIComponent(
-      targetRepo.repo
-    )}/sandbox-layer/assignment`,
-    { method: "PUT", body: JSON.stringify(sourceBody(sourceRepo, manifestPath)) }
-  );
-  emit(command, options, payload, () => {
-    console.log(`Assigned ${repoPath(sourceRepo)} as sandbox layer source for ${repoPath(targetRepo)}.`);
-    console.log(
-      `Build target coverage with: arcanist sandbox build ${repoPath(sourceRepo)} --target-repo ${repoPath(
-        targetRepo
-      )} --business ${businessId}`
-    );
+var DocLookupRequestSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({
+    kind: external_exports.literal("search"),
+    query: external_exports.string().trim().min(3).max(DOC_LOOKUP_QUERY_MAX_CHARS)
+  }).strict(),
+  external_exports.object({
+    kind: external_exports.literal("fetch"),
+    url: external_exports.string().url().max(DOC_LOOKUP_URL_MAX_CHARS).refine(isPlainHttpUrl, { message: "url must be http(s) without credentials" })
+  }).strict()
+]);
+var DocLookupResultSchema = external_exports.object({
+  url: external_exports.string().max(DOC_LOOKUP_URL_MAX_CHARS),
+  title: external_exports.string().max(300).nullable(),
+  publishedDate: external_exports.string().max(40).nullable(),
+  text: external_exports.string().max(DOC_LOOKUP_TEXT_MAX_CHARS)
+}).strict();
+var DocLookupResponseSchema = external_exports.object({
+  results: external_exports.array(DocLookupResultSchema).max(DOC_LOOKUP_SEARCH_RESULTS)
+}).strict();
+
+// ../../shared/constants/durations.ts
+var SECOND = 1e3;
+var DATADOG_POST_TIMEOUT_MS = 2 * SECOND;
+var MINUTE = 60 * SECOND;
+var PROVIDER_RETRY_ATTEMPT_TIMEOUT_MS = 10 * MINUTE;
+var HOUR = 60 * MINUTE;
+var SANDBOX_TELEMETRY_CAPABILITY_TTL_MS = 2 * HOUR;
+var SANDBOX_TELEMETRY_RATE_LIMIT_WINDOW_MS = 1 * MINUTE;
+var WORKER_VERSION_HANDOFF_CLOSE_WINDOW_MS = 2 * MINUTE;
+var ZEUS_TELEMETRY_MAX_DURATION_MS = 24 * HOUR;
+var D1_READ_ATTEMPT_TIMEOUT_MS = 5 * SECOND;
+var DAY = 24 * HOUR;
+var ENVIRONMENT_IMAGE_AGE_THRESHOLD_MS = 7 * DAY;
+var INTERNAL_ZEUS_COHORT_MAX_WINDOW_MS = 31 * DAY;
+var ZEUS_REVIEW_TELEMETRY_DETAIL_RETENTION_MS = 30 * DAY;
+var PR_CHAT_TIMEOUT_MS = 45 * SECOND;
+var SLACK_API_TIMEOUT_MS = 20 * SECOND;
+var EXA_REQUEST_TIMEOUT_MS = 15 * SECOND;
+var ONBOARDING_SETUP_SCRIPT_DURATION_TARGET_MS = 5 * MINUTE;
+var AUTHORED_RUNTIME_ABI_READ_TIMEOUT_MS = 10 * SECOND;
+var GIGAFLOW_SEND_TIMEOUT_MS = 5 * SECOND;
+var GITHUB_REQUEST_SLEEP_BUDGET_MS = 20 * SECOND;
+var GITHUB_REQUEST_ATTEMPT_TIMEOUT_MS = 5 * SECOND;
+var GITHUB_REQUEST_WAIT_UNTIL_SLEEP_BUDGET_MS = 8 * SECOND;
+var PR_REVIEW_DELIVERY_LEASE_MS = 50 * SECOND;
+var PR_REVIEW_DETACHED_TRIGGER_LEASE_MS = 50 * SECOND;
+var PR_REVIEW_REQUEST_LEASE_MS = 5 * MINUTE;
+var ZEUS_FINDING_FIX_JUDGE_TIMEOUT_MS = 20 * SECOND;
+var ZEUS_FINDING_FIX_JEV_TIMEOUT_MS = 10 * SECOND;
+var ZEUS_FINDING_REPLY_JEV_TIMEOUT_MS = 5 * SECOND;
+var ZEUS_FINDING_EVIDENCE_JEV_TIMEOUT_MS = 5 * SECOND;
+var ZEUS_PRIOR_FINDING_MATCH_JEV_TIMEOUT_MS = 5 * SECOND;
+var PR_MENTION_INTENT_TIMEOUT_MS = 5 * SECOND;
+var PR_BROWSER_QA_INTENT_TIMEOUT_MS = 10 * SECOND;
+var ANUBIS_LANDMARK_FALLBACK_TIMEOUT_MS = 8 * SECOND;
+var ANUBIS_FIELD_TEXT_TIMEOUT_MS = 20 * SECOND;
+var ZEUS_FINDING_FIX_JUDGE_PR_BUDGET_MS = 25 * SECOND;
+var ZEUS_FINDING_FIX_JUDGE_TURTLE_BUDGET_MS = 5 * MINUTE;
+var ZEUS_FINDING_FIX_JUDGE_SWEEP_LOOKBACK_MS = 14 * DAY;
+var PR_REVIEW_STORED_SHAPE_SUPPORT_MS = 14 * DAY;
+var PR_REVIEW_DELIVERY_AMBIGUITY_MS = 60 * SECOND;
+var PR_REVIEW_SUMMARY_REFRESH_MS = 5 * MINUTE;
+var PR_REVIEW_SUMMARY_WRITER_LEASE_MS = 2 * MINUTE;
+var PR_REVIEW_GENERATION_RETRY_MS = 5 * MINUTE;
+var PR_REVIEW_ATTACHED_GENERATION_PROBE_MS = 20 * MINUTE;
+var PR_REVIEW_GENERATION_FAST_RETRY_MS = 10 * SECOND;
+var PR_REVIEW_GENERATION_FAST_FAIL_MAX_MS = 60 * SECOND;
+var PR_REVIEW_DELIVERY_RETRY_MS = 5 * MINUTE;
+var SESSION_INTERVENTION_TTL_MS = 7 * 24 * HOUR;
+var BROWSER_STATE_RELOGIN_INTERVENTION_TTL_MS = 30 * DAY;
+var REVIEW_SCREENSHOT_PUBLIC_URL_TTL_MS = 30 * DAY;
+var ENVIRONMENT_FINDING_COLLECTION_WINDOW_MS = 4 * HOUR;
+var ENVIRONMENT_LIMITATION_TRIAGE_JEV_TIMEOUT_MS = 5 * SECOND;
+var ENVIRONMENT_RECENT_REVIEW_WINDOW_MS = 7 * 24 * HOUR;
+var WARM_DEMAND_WEEK_MS = 7 * DAY;
+var WARM_POOL_CLAIM_LEASE_MS = 5 * MINUTE;
+var WARM_POOL_MAX_CLOCK_SKEW_MS = 60 * SECOND;
+var WARM_POOL_PREPARE_LEASE_MS = 20 * MINUTE;
+var WARM_POOL_REPLACE_AFTER_MS = 90 * MINUTE;
+var WARM_POOL_MAX_AGE_MS = 2 * HOUR;
+var WARM_POOL_PREPARE_BUDGET_MS = 8 * MINUTE;
+var WARM_POOL_MARKER_WRITE_TIMEOUT_MS = 10 * SECOND;
+var WARM_POOL_PREFLIGHT_TIMEOUT_MS = 90 * SECOND;
+var WARM_POOL_CLAIM_BUDGET_MS = 30 * SECOND;
+var WARM_POOL_BRIDGE_CONNECT_TIMEOUT_MS = 45 * SECOND;
+var ENVIRONMENT_JOB_LOCK_WAIT_MS = 10 * MINUTE;
+var ENVIRONMENT_JOB_LOCK_RENEWAL_MS = 30 * SECOND;
+var ENVIRONMENT_JOB_LOCK_TTL_MS = 90 * SECOND;
+var TURTLE_SANDBOX_TIMEOUT_MS = 20 * MINUTE;
+var TURTLE_COMMAND_TIMEOUT_MS = 30 * SECOND;
+var TURTLE_INSTALL_TIMEOUT_MS = 2 * MINUTE;
+var TURTLE_MODEL_TIMEOUT_MS = 8 * MINUTE;
+var TURTLE_PR_METADATA_TIMEOUT_MS = 90 * SECOND;
+var TURTLE_TRANSCRIPT_FLUSH_MS = 2 * SECOND;
+var TURTLE_CI_REPAIR_LEASE_MS = 3 * MINUTE;
+var TURTLE_CI_REPAIR_LOST_MESSAGE_BUDGET_MS = 30 * MINUTE;
+var TURTLE_CI_REPAIR_PUSH_BUDGET_MS = 24 * HOUR;
+var TURTLE_CI_REPAIR_AWAITING_PR_BUDGET_MS = 30 * MINUTE;
+var TURTLE_ZEUS_REPAIR_LEASE_MS = 3 * MINUTE;
+var TURTLE_ZEUS_REPAIR_LOST_MESSAGE_BUDGET_MS = 30 * MINUTE;
+var TURTLE_ZEUS_REPAIR_PUSH_BUDGET_MS = 24 * HOUR;
+var TURTLE_ZEUS_REPAIR_WAIT_CI_BUDGET_MS = TURTLE_CI_REPAIR_PUSH_BUDGET_MS + HOUR;
+var ANUBIS_READINESS_TIMEOUT_MAX_MS = 10 * MINUTE;
+
+// ../../shared/constants/prompt-budgets.ts
+var PROMPT_BUDGET_NODES = {
+  // The lifecycle deadline is a root because callers may override it per session.
+  PROMPT_STARTUP: { ms: 24e4, parent: null },
+  // Dispatch begins after startup and has a separate lifecycle override surface.
+  PROMPT_DISPATCH: { ms: 18e4, parent: null },
+  // Transport liveness is phase-independent and does not sit inside prompt startup.
+  SANDBOX_LIVENESS: { ms: 6e4, parent: null },
+  CODEX_STARTUP: { ms: 3e4, parent: "PROMPT_STARTUP" },
+  PR_HEAD_CHECKOUT: { ms: 24e4, parent: "PROMPT_STARTUP" },
+  WORKSPACE_SETUP_WAIT: { ms: 6e5, parent: "PROMPT_STARTUP" },
+  APP_RUNTIME_READY: { ms: 93e4, parent: "PROMPT_STARTUP" },
+  // Review preflight is background work; no wall budget is declared today.
+  REVIEW_PREFLIGHT: { ms: null, parent: "PROMPT_STARTUP" }
+};
+var ZEUS_SCOUT_TIMEOUT_MS = 10 * 6e4;
+var ZEUS_REVIEWER_LANE_TIMEOUT_MS = 10 * 6e4;
+var ZEUS_PROMPT_STARTUP_TIMEOUT_MS = PROMPT_BUDGET_NODES.PROMPT_STARTUP.ms + ZEUS_SCOUT_TIMEOUT_MS;
+var ANUBIS_QA_PLANNING_DEADLINE_MS = 3e5;
+var ANUBIS_QA_INVESTIGATION_DEADLINE_MS = 15 * 6e4;
+var ANUBIS_QA_SETTLEMENT_WALL_MS = 5 * 6e4;
+var ANUBIS_QA_PROMPT_WALL_MS = ANUBIS_READINESS_TIMEOUT_MAX_MS + ANUBIS_QA_PLANNING_DEADLINE_MS + ANUBIS_QA_INVESTIGATION_DEADLINE_MS + ANUBIS_QA_SETTLEMENT_WALL_MS;
+var ZEUS_SCOUT_MAX_CANDIDATES_PER_SCOUT = 8;
+var ZEUS_SCOUT_EXCERPT_MAX_FILE_BYTES = 256 * 1024;
+var ZEUS_REVIEW_INVESTIGATION_DEADLINE_MS = 15.5 * 6e4;
+var ZEUS_SCOUT_TARGETED_MAX_QUESTIONS = 7;
+var ZEUS_SCOUT_DISCOVERY_MAX_SHARDS = 4;
+var ZEUS_SCOUT_TARGETED_MAX_FLEET = ZEUS_SCOUT_TARGETED_MAX_QUESTIONS + ZEUS_SCOUT_DISCOVERY_MAX_SHARDS + 1;
+var ZEUS_SCOUT_TARGETED_INPUT_MAX_BYTES = 64 * 1024;
+var ZEUS_SCOUT_TARGETED_OUTPUT_MAX_BYTES = 64 * 1024;
+
+// ../../shared/types/zeus-review-investigation.ts
+var ZEUS_SCOUT_MAX_CANDIDATES = ZEUS_SCOUT_MAX_CANDIDATES_PER_SCOUT * ZEUS_SCOUT_TARGETED_MAX_FLEET;
+var prose = external_exports.string().trim().min(1).max(4e3);
+var ZeusReviewWorkItemBaseSchema = external_exports.object({
+  id: external_exports.string().regex(/^[a-zA-Z0-9._:-]+$/).max(80).describe("Stable id you choose for this work item; reuse it to update the item."),
+  changedPath: prose.describe("Changed file path from the admitted diff."),
+  producer: prose.describe("Code that produces the changed value or behavior."),
+  consumer: prose.describe("Actual code that consumes it."),
+  inputState: prose.describe("Concrete input or state that reaches the consumer."),
+  status: external_exports.enum(["pending", "settled", "refuted", "below_bar", "external", "environment", "budget_exhausted"]).describe("pending while open; any other status closes the item and needs reason."),
+  evidence: external_exports.array(prose).max(ZEUS_SCOUT_MAX_CANDIDATES).describe("Source or probe references. Required for settled, refuted, below_bar."),
+  reason: prose.describe("Why the item has this status. Optional only while pending."),
+  candidateIds: external_exports.array(external_exports.string().min(1).max(80)).max(ZEUS_SCOUT_MAX_CANDIDATES).describe("Delivered scout candidate ids this item covers."),
+  findingIds: external_exports.array(external_exports.string().min(1).max(80)).max(ZEUS_SCOUT_MAX_CANDIDATES).describe("Ids of findings this item supports.")
+}).strict();
+var ZeusReviewWorkItemSchema = ZeusReviewWorkItemBaseSchema.refine(
+  (item) => !["settled", "refuted", "below_bar"].includes(item.status) || item.evidence.length > 0,
+  {
+    message: "A settled decision needs source or probe evidence."
+  }
+);
+var ZEUS_REVIEW_PENDING_REASON = "Pending: not yet investigated.";
+var CANDIDATE_REFERENCE_PREFIX = "candidate:";
+var ZeusReviewWorkItemInputSchema = ZeusReviewWorkItemBaseSchema.extend({
+  status: ZeusReviewWorkItemBaseSchema.shape.status.default("pending"),
+  evidence: ZeusReviewWorkItemBaseSchema.shape.evidence.default([]),
+  // Accepts the `candidate:<id>` evidence reference form; the prefix is stripped before the id length cap applies.
+  candidateIds: external_exports.array(
+    external_exports.string().min(1).max(CANDIDATE_REFERENCE_PREFIX.length + 80).transform(
+      (id) => id.startsWith(CANDIDATE_REFERENCE_PREFIX) ? id.slice(CANDIDATE_REFERENCE_PREFIX.length) : id
+    )
+  ).max(ZEUS_SCOUT_MAX_CANDIDATES).describe(ZeusReviewWorkItemBaseSchema.shape.candidateIds.description).optional(),
+  findingIds: ZeusReviewWorkItemBaseSchema.shape.findingIds.optional(),
+  reason: ZeusReviewWorkItemBaseSchema.shape.reason.optional()
+}).transform((item, ctx) => {
+  if (item.reason === void 0 && item.status !== "pending") {
+    ctx.addIssue({ code: "custom", path: ["reason"], message: `reason is required when status is ${item.status}` });
+    return external_exports.NEVER;
+  }
+  const parsed = ZeusReviewWorkItemSchema.safeParse({
+    ...item,
+    candidateIds: item.candidateIds ?? [],
+    findingIds: item.findingIds ?? [],
+    reason: item.reason ?? ZEUS_REVIEW_PENDING_REASON
   });
-}
-async function sandboxUnassignDefaultCommand(options = {}, command) {
-  if (isJson(command, options) && options.yes !== true) {
-    throw new CliError("user", "`sandbox unassign default --json` requires --yes.");
+  if (!parsed.success) {
+    for (const issue3 of parsed.error.issues) ctx.addIssue({ code: "custom", path: issue3.path, message: issue3.message });
+    return external_exports.NEVER;
   }
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  if (!options.yes) await confirmOrThrow("Clear the business default sandbox layer source?");
-  const payload = await apiFetch(
-    config2,
-    `/api/businesses/${encodeURIComponent(businessId)}/sandbox-layer/default-source`,
-    { method: "DELETE" }
-  );
-  emit(command, options, payload, () => console.log("Cleared default sandbox layer source."));
-}
-async function sandboxUnassignRepoCommand(targetRepoArg, options = {}, command) {
-  if (isJson(command, options) && options.yes !== true) {
-    throw new CliError("user", "`sandbox unassign repo --json` requires --yes.");
+  const { candidateIds, findingIds, ...normalized } = parsed.data;
+  return {
+    ...normalized,
+    ...item.candidateIds === void 0 ? {} : { candidateIds },
+    ...item.findingIds === void 0 ? {} : { findingIds }
+  };
+});
+var ZeusScoutInvestigationIdSchema = external_exports.string().regex(/^q-[1-9][0-9]*$/).max(16);
+var ZeusReviewInvestigationSchema = external_exports.object({
+  baseSha: external_exports.string().nullable(),
+  headSha: external_exports.string().nullable(),
+  items: external_exports.array(ZeusReviewWorkItemSchema),
+  unreadRanges: external_exports.array(external_exports.object({ path: external_exports.string(), start: external_exports.number().int(), end: external_exports.number().int() })),
+  reconciliationUsed: external_exports.boolean(),
+  budgetExhausted: external_exports.boolean(),
+  pendingPaths: external_exports.array(external_exports.string()),
+  omittedRangeCount: external_exports.number().int().nonnegative(),
+  omittedPendingPathCount: external_exports.number().int().nonnegative()
+}).refine(
+  (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= ZEUS_SCOUT_TARGETED_INPUT_MAX_BYTES,
+  {
+    message: "Investigation ledger exceeds the transport budget."
   }
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const businessId = await resolveBusinessId(config2, options);
-  const targetRepo = parseRepoArgOrCurrent(targetRepoArg);
-  if (!options.yes) await confirmOrThrow(`Clear sandbox layer assignment for ${repoPath(targetRepo)}?`);
-  const payload = await apiFetch(
-    config2,
-    `/api/businesses/${encodeURIComponent(businessId)}/repos/${encodeURIComponent(targetRepo.owner)}/${encodeURIComponent(
-      targetRepo.repo
-    )}/sandbox-layer/assignment`,
-    { method: "DELETE" }
-  );
-  emit(command, options, payload, () => console.log(`Cleared sandbox layer assignment for ${repoPath(targetRepo)}.`));
-}
+);
+
+// ../../shared/types/agent-runtime-evidence.ts
+var captureIdSchema = external_exports.string().regex(PR_REVIEW_CAPTURE_ID_PATTERN);
+var PrReviewCaptureKindSchema = external_exports.enum(["screenshot", "video"]);
+var PrReviewCaptureSchema = external_exports.object({
+  captureId: captureIdSchema,
+  label: external_exports.string().regex(PR_REVIEW_CAPTURE_LABEL_PATTERN),
+  artifactId: external_exports.string().min(1).max(80),
+  url: external_exports.string().url().max(2e3),
+  kind: PrReviewCaptureKindSchema.default("screenshot"),
+  /** Video length in milliseconds; absent on a screenshot. */
+  durationMs: external_exports.number().int().min(0).max(PR_REVIEW_VIDEO_MAX_DURATION_MS).optional(),
+  /** The uncropped frame behind a cropped screenshot; the published image links to it. */
+  fullUrl: external_exports.string().url().max(2e3).optional(),
+  /** A still the published comment shows in place of a video, linking to the clip. */
+  posterUrl: external_exports.string().url().max(2e3).optional(),
+  /** One sentence saying what the image shows; it is all that remains once the signed URL expires. */
+  alt: external_exports.string().min(1).max(PR_REVIEW_CAPTURE_ALT_MAX_CHARS).optional()
+}).strict();
+var PrReviewSessionCaptureSchema = PrReviewCaptureSchema.extend({
+  finalPath: external_exports.string().max(500).optional()
+}).strict();
+var ZeusSessionFlywheelAppRequestSchema = external_exports.object({
+  requestId: external_exports.string().regex(PR_REVIEW_APP_REQUEST_ID_PATTERN),
+  method: external_exports.enum(["GET", "HEAD"]),
+  /** Path plus query as the model asked for it, on the app origin. */
+  path: external_exports.string().min(1).max(2e3),
+  status: external_exports.number().int().min(100).max(599).nullable(),
+  authenticated: external_exports.boolean(),
+  redirected: external_exports.object({ location: external_exports.string().max(2e3) }).strict().nullable(),
+  contentType: external_exports.string().max(200).nullable(),
+  bodySha256: external_exports.string().regex(/^[0-9a-f]{64}$/i).nullable(),
+  bodyExcerpt: external_exports.string().max(2e3).nullable(),
+  promptId: external_exports.string().min(1),
+  bodyOmitted: external_exports.enum(["binary", "too_large", "unreadable"]).optional()
+}).strict();
+var DOC_LOOKUP_STATUSES = [
+  "ok",
+  "empty",
+  "rate_limited",
+  "upstream_error",
+  "invalid_input",
+  "budget_exhausted",
+  "page_unavailable",
+  "unavailable"
+];
+var ZeusSessionFlywheelDocLookupSchema = external_exports.object({
+  lookupId: external_exports.string().regex(DOC_LOOKUP_ID_PATTERN),
+  kind: external_exports.enum(["search", "fetch"]),
+  /** Model-authored query or URL, verbatim after redact(). This is the audit record; keep it. */
+  input: external_exports.string().min(1).max(DOC_LOOKUP_URL_MAX_CHARS),
+  status: external_exports.enum(DOC_LOOKUP_STATUSES),
+  resultUrls: external_exports.array(external_exports.string().max(DOC_LOOKUP_URL_MAX_CHARS)).max(DOC_LOOKUP_SEARCH_RESULTS),
+  durationMs: external_exports.number().int().nonnegative(),
+  promptId: external_exports.string().min(1),
+  thread: external_exports.enum(["primary", "scout"]),
+  investigationId: ZeusScoutInvestigationIdSchema.optional()
+}).strict();
+
+// ../../shared/zeus/candidate-ledger-conservation.ts
+var ZEUS_CANDIDATE_LEDGER_STAGES = ["bundle", "ledger", "disposition", "lineage"];
 
 // ../../shared/events/bridge.ts
 var ZEUS_TELEMETRY_EVENT_TYPE = "zeus_telemetry";
+var ZEUS_TELEMETRY_PROJECTED_FIELDS = {
+  "zeus.verification_observed": {
+    observedCount: "number",
+    hasObservedCommand: "boolean",
+    matchedNoTestsCount: "number",
+    runnerMismatchCount: "number",
+    runnerResolved: "boolean",
+    resolvedPackageManager: { kind: "string_enum", values: ["npm", "pnpm", "yarn", "bun"] }
+  },
+  "zeus.publish_rejected": {
+    reason: "string",
+    checkCount: "number",
+    findingCount: "number",
+    verdict: "string",
+    firstAttempt: "boolean",
+    attemptOrdinal: "number",
+    contractVersion: "string",
+    schemaPath: "string",
+    schemaIssue: "string",
+    schemaValue: "string"
+  },
+  // Not a scout counter, but the same transit contract: no metric anywhere derives a redaction
+  // count from the publication, so the event stream is the only place it can be observed at all.
+  // Over-masking is a reader-facing defect, so a per-publish count is the signal that catches it.
+  "zeus.publish_secret_value_redacted": { count: "number" },
+  "zeus.publish_note_pipeline_state": {
+    attemptOrdinal: "number",
+    droppedCount: "number",
+    contractVersion: "string"
+  },
+  "zeus.publish_notes_unverified": {
+    attemptOrdinal: "number",
+    findingCount: "number",
+    contractVersion: "string"
+  },
+  "zeus.publish_empty_review_unattested": {
+    attemptOrdinal: "number",
+    noteCount: "number",
+    contractVersion: "string"
+  },
+  // Record-only base-control audit, one per review with blockers. `detail` is the post-deploy
+  // signal: a high `no_base_run` share means the base-checkout teaching is not landing.
+  "zeus.publish_blocking_downgraded": {
+    detail: { kind: "string_enum", values: ["no_base_run", "no_matched_pair"] },
+    blockingCount: "number",
+    attemptOrdinal: "number"
+  },
+  // One per publish that found stray files. The only channel that shows whether
+  // stale-main branches and sandbox-written paths keep reaching reviewed diffs.
+  "zeus.diff_hygiene": {
+    alreadyOnBaseCount: "number",
+    sandboxGeneratedCount: "number",
+    truncated: "boolean"
+  },
+  "zeus.scout.health": {
+    health: { kind: "string_enum", values: ZEUS_SCOUT_HEALTHS },
+    dispatch_mode: { kind: "string_enum", values: ["targeted", "broad"] },
+    unresolvedInvestigationCount: "number",
+    // Declared as an enum, not a free string: the blackout monitor filters on this value, and an
+    // undeclared or misspelled outcome would silently drop every session out of the alert rather
+    // than into it.
+    publishOutcome: { kind: "string_enum", values: ZEUS_SCOUT_HEALTH_PUBLISH_OUTCOMES },
+    candidateTotal: "number",
+    expectedScoutCount: "number",
+    observedScoutCount: "number",
+    statuses: "string_array"
+  },
+  "zeus.scout.agreement": {
+    candidateCount: "number",
+    publishedCandidateCount: "number",
+    examinedRejectedCount: "number",
+    notExaminedCount: "number",
+    notExaminedEnvironmentCount: "number",
+    notExaminedExternalCount: "number",
+    notExaminedNoneCount: "number",
+    unrunPublishedCount: "number",
+    unrunRemovedCount: "number",
+    notDeliveredCount: "number",
+    notSelectedCount: "number"
+  },
+  // One per publish. `conserved:false` is a bridge defect in `violationStage`; the enum keeps a
+  // misspelled stage out of the alarm instead of silently accepting it.
+  "zeus.candidate_ledger": {
+    conserved: "boolean",
+    candidateCount: "number",
+    droppedCount: "number",
+    publishedCandidateCount: "number",
+    rejectedCount: "number",
+    notDeliveredCount: "number",
+    notSelectedCount: "number",
+    violationStage: { kind: "string_enum", values: ["none", ...ZEUS_CANDIDATE_LEDGER_STAGES] }
+  },
+  "zeus.judge.withheld_defects": { count: "number" },
+  "zeus.judge.intent_claims": {
+    count: "number",
+    verified: "number",
+    contradicted: "number",
+    notChecked: "number",
+    uncitedContradicted: "number",
+    danglingContradicted: "number",
+    unmatched: "number",
+    overflow: "number"
+  },
+  "zeus.scout.completion": {
+    role: "string",
+    status: "string",
+    durationMs: "number",
+    inputTokens: "number",
+    outputTokens: "number",
+    candidateCount: "number"
+  },
+  // One per reader lane per review. The only production evidence of each reader's outcome,
+  // whether its lead delegated to zeus-specialist subagents, and — via `runtime`/`model` —
+  // which lane produced it; the --by-reader ledger split grades on those fields.
+  "zeus.reviewer_lane.completed": {
+    status: "string",
+    error: "string",
+    durationMs: "number",
+    finishedAfterScouts: "boolean",
+    readerFinishMinusScoutMs: "number",
+    scoutJoinWaitMs: "number",
+    candidateCount: "number",
+    droppedCount: "number",
+    subagentDispatched: "boolean",
+    modelRequestCount: "number",
+    readToolCalls: "number",
+    grepToolCalls: "number",
+    globToolCalls: "number",
+    otherToolCalls: "number",
+    readerModel: "string",
+    runtime: "string",
+    model: "string"
+  },
+  "zeus.scout.bundle_omitted": { omittedCandidateCount: "number", droppedExcerptCount: "number" },
+  "zeus.scout.patch_truncated": {
+    role: "string",
+    sampleIndex: "number",
+    investigationId: "string",
+    ownedFileCount: "number",
+    truncatedFileCount: "number",
+    omittedFileCount: "number",
+    withheldChars: "number"
+  },
+  "zeus.scout.patch_unavailable": {
+    role: "string",
+    sampleIndex: "number",
+    reason: "string",
+    ownedFileCount: "number",
+    patchedFileCount: "number"
+  },
+  // One per brokered doc lookup; the only channel tying a lookup's outcome and
+  // broker result count back to its scout investigation.
+  "zeus.doc_lookup": {
+    kind: { kind: "string_enum", values: ["search", "fetch"] },
+    status: { kind: "string_enum", values: DOC_LOOKUP_STATUSES },
+    thread: { kind: "string_enum", values: ["primary", "scout"] },
+    investigationId: "string",
+    durationMs: "number",
+    resultCount: "number"
+  },
+  "zeus.review.prompt_budget_truncated": {
+    excessChars: "number",
+    reviewContextPacketTruncated: "boolean",
+    droppedSectionNames: "string_array",
+    truncatedSectionNames: "string_array",
+    beforeChars: "number",
+    afterChars: "number"
+  },
+  "zeus.review.prompt_budget_externalized": {
+    beforeChars: "number",
+    afterChars: "number",
+    externalizedSectionNames: "string_array"
+  }
+};
 
 // ../../shared/onboarding/events.ts
 var ONBOARDING_STAGES = [
@@ -31130,6 +30620,9 @@ var ERROR_CODES = [
   // Review preflight could not read a changed file at the PR head. Deterministic for a
   // given head, so the control plane must not spend its retry budget on it.
   "review_preflight_input_rejected",
+  // The PR checkout (token, fetch, import, or reset) failed before review dispatch. Retryable:
+  // the durable review request owns the replacement generation.
+  "review_checkout_failed",
   "unknown"
 ];
 var ERROR_CODE_SET = new Set(ERROR_CODES);
@@ -31178,6 +30671,7 @@ var ERROR_CODE_LABELS = {
   question_delivery_failed: "Answer could not be delivered to the agent",
   malformed_search_command: "A search command with invalid syntax was blocked",
   review_preflight_input_rejected: "The review could not read a changed file at the PR head",
+  review_checkout_failed: "The PR checkout could not be prepared",
   unknown: "Unknown failure"
 };
 var LEGACY_ERROR_CODE_LABELS = {
@@ -31842,11 +31336,11 @@ async function getSessionCommand(sessionId, options, command) {
   if (resultLine) console.log(resultLine);
 }
 async function sessionEventsCommand(sessionId, options, command) {
-  const afterSequence = resolveSequenceOption(options.afterSequence, options.after, "--after-sequence", "--after");
-  const beforeSequence = resolveSequenceOption(options.beforeSequence, options.before, "--before-sequence", "--before");
+  const afterSequence = options.afterSequence;
+  const beforeSequence = options.beforeSequence;
   if (options.follow) {
     if (beforeSequence) {
-      throw new CliError("user", "--before-sequence/--before cannot be used with --follow.");
+      throw new CliError("user", "--before-sequence cannot be used with --follow.");
     }
     if (options.promptId) {
       throw new CliError(
@@ -31901,519 +31395,6 @@ async function sessionEventsCommand(sessionId, options, command) {
   }
   if (textOpen) process.stdout.write("\n");
 }
-function resolveSequenceOption(canonicalValue, aliasValue, canonicalFlag, aliasFlag) {
-  if (canonicalValue !== void 0 && aliasValue !== void 0) {
-    throw new CliError("user", `${aliasFlag} cannot be combined with ${canonicalFlag}.`);
-  }
-  return canonicalValue ?? aliasValue;
-}
-async function usageCommand(sessionId, options, command) {
-  const runtime = getRuntimeOptions(command, options);
-  const config2 = requireConfig(runtime);
-  const payload = await apiFetch(config2, `/api/sessions/${sessionId}/usage`);
-  if (isJson(command, options)) {
-    writeJson(payload);
-    return;
-  }
-  const usage = payload.usage && typeof payload.usage === "object" && !Array.isArray(payload.usage) ? payload.usage : payload;
-  console.log(`Input tokens: ${String(usage.inputTokens ?? 0)}`);
-  console.log(`Output tokens: ${String(usage.outputTokens ?? 0)}`);
-  console.log(`Total tokens: ${String(usage.totalTokens ?? 0)}`);
-  if (usage.totalCostUsd !== void 0) console.log(`Cost: ${String(usage.totalCostUsd)}`);
-}
-
-// ../../shared/utils/shell.ts
-var SHELL_ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
-// ../../shared/types/sandbox.ts
-var APP_RUNTIME_ENTRY_TYPE = {
-  Compose: "compose",
-  /**
-   * Contract-only: the control plane synthesizes a command entry from a profile's `bootScript`.
-   * Profiles no longer store command entries (see the App Runtime schema in repo-runtime.ts).
-   */
-  Command: "command"
-};
-
-// ../../shared/types/repo-runtime.ts
-var ENVIRONMENT_REPOS_MAX = 8;
-var RENDERED_PATH_PREFIXES_MAX = 64;
-var SANDBOX_PATH_PATTERN = /^\/workspace\/(?!\.+$)(?!.*\.\.)[A-Za-z0-9._-]+$/;
-var EnvironmentRepoSchema = external_exports.object({
-  repoOwner: external_exports.string().trim().min(1, "repoOwner is required"),
-  repoName: external_exports.string().trim().min(1, "repoName is required"),
-  sandboxPath: external_exports.string().regex(SANDBOX_PATH_PATTERN, "sandboxPath must be a single path segment under /workspace").optional()
-}).strict();
-function environmentRepoSandboxPath(repo) {
-  return repo.sandboxPath ?? `/workspace/${repo.repoName}`;
-}
-var EnvironmentReposSchema = external_exports.array(EnvironmentRepoSchema).min(1, "at least one repo is required").max(ENVIRONMENT_REPOS_MAX, `at most ${ENVIRONMENT_REPOS_MAX} repos are allowed`).superRefine((repos2, ctx) => {
-  if (repos2.length === 0) return;
-  const primaryOwner = repos2[0].repoOwner.toLowerCase();
-  if (repos2[0].sandboxPath !== void 0) {
-    ctx.addIssue({
-      code: "custom",
-      path: [0, "sandboxPath"],
-      message: `the primary repo is always cloned to /workspace/${repos2[0].repoName}`
-    });
-  }
-  const seenRepos = /* @__PURE__ */ new Set();
-  const seenPaths = /* @__PURE__ */ new Set();
-  repos2.forEach((repo, index) => {
-    if (repo.repoOwner.toLowerCase() !== primaryOwner) {
-      ctx.addIssue({
-        code: "custom",
-        path: [index, "repoOwner"],
-        message: "all repos must share the primary repo's owner"
-      });
-    }
-    const repoKey = `${repo.repoOwner}/${repo.repoName}`.toLowerCase();
-    if (seenRepos.has(repoKey)) {
-      ctx.addIssue({ code: "custom", path: [index], message: `duplicate repo ${repo.repoOwner}/${repo.repoName}` });
-    }
-    seenRepos.add(repoKey);
-    const path = environmentRepoSandboxPath(repo);
-    if (!SANDBOX_PATH_PATTERN.test(path)) {
-      ctx.addIssue({
-        code: "custom",
-        path: [index],
-        message: `repo name ${repo.repoName} needs an explicit sandboxPath`
-      });
-      return;
-    }
-    if (seenPaths.has(path)) {
-      ctx.addIssue({ code: "custom", path: [index], message: `sandbox path ${path} is already taken` });
-    }
-    seenPaths.add(path);
-  });
-});
-var CredentialDeclarationSchema = external_exports.object({
-  name: external_exports.string(),
-  envVar: external_exports.string(),
-  source: external_exports.enum(["business_openai_key", "business_anthropic_key"]).optional()
-});
-var StringRecordSchema = external_exports.record(
-  external_exports.string().regex(SHELL_ENV_KEY_PATTERN, "must be a POSIX-style environment variable name"),
-  external_exports.string()
-);
-var ComposeAppRuntimeEntrySchema = external_exports.object({
-  type: external_exports.enum([APP_RUNTIME_ENTRY_TYPE.Compose]),
-  files: external_exports.array(external_exports.string()).optional(),
-  service: external_exports.string().optional(),
-  profiles: external_exports.array(external_exports.string()).optional()
-}).strict();
-var AppRuntimeProfileConfigSchema = external_exports.object({
-  cwd: external_exports.string().optional(),
-  bootScript: external_exports.string().max(65536).describe(
-    "Optional bash bringup script. When set it overrides the entry: arcanist-app start runs it on the sandbox host from cwd with runtimeVariables plus HOST and PORT, and waits on ready.path. The app must listen on url.hostPort. Leave unset to boot from the entry."
-  ).optional(),
-  kind: external_exports.string().optional(),
-  runner: external_exports.string().optional(),
-  entry: ComposeAppRuntimeEntrySchema.optional(),
-  url: external_exports.object({ hostPort: external_exports.number().int().optional(), path: external_exports.string().optional() }).strict().optional(),
-  portMapping: external_exports.object({ containerPort: external_exports.number().int().optional() }).strict().optional(),
-  additionalPorts: external_exports.array(
-    external_exports.object({
-      service: external_exports.string().optional(),
-      hostPort: external_exports.number().int().optional(),
-      containerPort: external_exports.number().int().optional()
-    }).strict()
-  ).optional(),
-  runtimeVariables: StringRecordSchema.optional(),
-  composeEnv: StringRecordSchema.optional(),
-  generatedComposeEnv: external_exports.record(
-    external_exports.string(),
-    external_exports.union([
-      external_exports.object({ type: external_exports.literal("alphanumeric"), length: external_exports.number().int() }).strict(),
-      external_exports.object({ type: external_exports.literal("hex"), bytes: external_exports.number().int() }).strict()
-    ])
-  ).optional(),
-  env: StringRecordSchema.optional(),
-  ready: external_exports.object({
-    path: external_exports.string().optional(),
-    nonEmptyPath: external_exports.string().optional(),
-    timeoutSeconds: external_exports.number().int().optional()
-  }).strict().optional(),
-  open: external_exports.object({ path: external_exports.string().optional() }).strict().optional(),
-  renderedPathPrefixes: external_exports.array(external_exports.string().max(512)).max(RENDERED_PATH_PREFIXES_MAX).describe(
-    "Repo-relative directories the booted app is built from. When set, a review boots the app only when the diff touches a non-test file under one of them; when unset, the file-extension heuristic decides."
-  ).optional(),
-  auth: external_exports.object({
-    command: external_exports.string().optional(),
-    validatePath: external_exports.string().optional(),
-    browserStateEnvVar: external_exports.string().optional(),
-    credentials: external_exports.array(CredentialDeclarationSchema).optional()
-  }).strict().optional(),
-  e2e: external_exports.object({
-    testCommand: external_exports.string(),
-    seedCommand: external_exports.string().optional(),
-    resetCommand: external_exports.string().optional(),
-    credentials: external_exports.array(CredentialDeclarationSchema).optional()
-  }).strict().optional()
-}).strict();
-var LEGACY_DOCKERFILE_ENTRY_TYPE = "dockerfile";
-var LegacyAppRuntimeEntrySchema = external_exports.union([
-  external_exports.object({ type: external_exports.literal(APP_RUNTIME_ENTRY_TYPE.Command), command: external_exports.string().optional() }).passthrough(),
-  external_exports.object({
-    type: external_exports.literal(LEGACY_DOCKERFILE_ENTRY_TYPE),
-    context: external_exports.string().optional(),
-    dockerfile: external_exports.string().optional(),
-    service: external_exports.string().optional()
-  }).passthrough()
-]);
-var AppRuntimeProfileConfigReadSchema = AppRuntimeProfileConfigSchema.extend({
-  entry: external_exports.union([ComposeAppRuntimeEntrySchema, LegacyAppRuntimeEntrySchema]).optional()
-});
-var EnvironmentProvisioningConfigSchema = external_exports.object({
-  sandbox: external_exports.object({ appRuntime: AppRuntimeProfileConfigSchema.optional() }).strict().optional()
-}).strict();
-var EnvironmentProvisioningConfigReadSchema = external_exports.object({
-  sandbox: external_exports.object({ appRuntime: AppRuntimeProfileConfigReadSchema.optional() }).strict().optional()
-}).strict();
-
-// src/commands/setup.ts
-var INSTALL_POLL_INTERVAL_MS = 5e3;
-var INSTALL_WAIT_TIMEOUT_MS = 20 * 60 * 1e3;
-var ONBOARDING_REPOS_PATH = "/api/onboarding/repos";
-async function setupCommand(repoArgs = [], options = {}, command) {
-  if (repoArgs.length > MAX_ENVIRONMENT_SETUP_REPOSITORIES) {
-    throw new CliError("user", `At most ${MAX_ENVIRONMENT_SETUP_REPOSITORIES} repositories can be prepared at once.`);
-  }
-  if (options.workspace && repoArgs.length === 1) {
-    throw new CliError("user", "A multi-repository workspace requires at least two repositories.");
-  }
-  if (options.workspace && repoArgs.length > ENVIRONMENT_REPOS_MAX) {
-    throw new CliError("user", `A workspace supports at most ${ENVIRONMENT_REPOS_MAX} repositories.`);
-  }
-  const runtime = getRuntimeOptions(command, options);
-  let config2 = loadConfig(runtime);
-  if (!config2) {
-    const envOrFlag = resolveEnvOrFlagConfig(runtime, false);
-    if ((process.stdin.isTTY !== true || process.stdout.isTTY !== true) && !envOrFlag?.token) {
-      throw new CliError("auth", "Not logged in.", { hint: "Run `arcanist auth login` or set `ARCANIST_TOKEN`." });
-    }
-    config2 = await loginCommand({ ...runtime, emitResult: false }, command);
-  }
-  const requested = repoArgs.map((value) => {
-    const repo = parseRepoArg(value);
-    return `${repo.owner}/${repo.repo}`;
-  });
-  const inventory = await ensureGitHubRepositories({ config: config2, requested, runtime });
-  if (!inventory) return;
-  const eligible = eligibleRepositoryNames(inventory.repos);
-  const selected = selectRepositories({ eligible, requested, runtime });
-  if (!selected) return;
-  const repositories = await prepareEnvironments(config2, {
-    repositories: selected.map((value) => parseRepoArg(value)),
-    workspace: options.workspace
-  });
-  const rejected = repositories.filter((result) => result.status === "forbidden" || result.status === "failed");
-  const accepted = repositories.filter((result) => result.status !== "forbidden" && result.status !== "failed");
-  if (accepted.length === 0) {
-    throw new CliError(
-      rejected.some((result) => result.status === "forbidden") ? "auth" : "server",
-      `Environment setup was rejected for: ${rejected.map((result) => result.fullName).join(", ")}.`
-    );
-  }
-  const queued = accepted.filter((result) => result.status !== "already_ready");
-  const tracking = trackingCommands(queued.map((result) => result.fullName));
-  const payload = {
-    status: rejected.length > 0 ? "partial" : queued.length > 0 ? "queued" : "ready",
-    repositories,
-    workspace: options.workspace === true,
-    tracking
-  };
-  emit(void 0, runtime, payload, () => {
-    console.log(
-      queued.length > 0 ? `Environment preparation started for ${queued.length} ${queued.length === 1 ? "repository" : "repositories"}.` : "The selected environments are ready."
-    );
-    if (rejected.length > 0) {
-      console.log(`Could not start: ${rejected.map((result) => sanitizeTerminalText(result.fullName)).join(", ")}.`);
-    }
-    for (const line of tracking) console.log(line);
-  });
-}
-function eligibleRepositoryNames(repos2) {
-  return repos2.filter((repo) => {
-    return typeof repo.fullName === "string" && repo.canReview === true;
-  }).map((repo) => repo.fullName).sort((a, b) => a.localeCompare(b));
-}
-function selectRepositories(options) {
-  const { eligible, requested, runtime } = options;
-  if (requested.length === 0) {
-    emit(
-      void 0,
-      runtime,
-      {
-        status: "selection_required",
-        repositories: eligible,
-        next: "Rerun with one or more owner/repo arguments."
-      },
-      () => {
-        console.log("Repositories available to prepare:");
-        for (const repository of eligible) console.log(`  ${sanitizeTerminalText(repository)}`);
-        console.log("Rerun with one or more owner/repo arguments.");
-      }
-    );
-    return null;
-  }
-  const eligibleNames = new Map(eligible.map((repository) => [repository.toLowerCase(), repository]));
-  const selected = [
-    ...new Map(
-      requested.map((repository) => [
-        repository.toLowerCase(),
-        eligibleNames.get(repository.toLowerCase()) ?? repository
-      ])
-    ).values()
-  ];
-  const unavailable = selected.filter((repository) => !eligibleNames.has(repository.toLowerCase()));
-  if (unavailable.length > 0) {
-    throw new CliError("auth", `Repositories are unavailable or lack write access: ${unavailable.join(", ")}.`);
-  }
-  return selected;
-}
-async function ensureGitHubRepositories(options) {
-  const { config: config2, requested, runtime } = options;
-  let inventory = await apiFetch(config2, `${ONBOARDING_REPOS_PATH}?refresh=1`);
-  const readOnly = new Set(
-    inventory.repos.filter((repo) => repo.canReview !== true && typeof repo.fullName === "string").map((repo) => String(repo.fullName).toLowerCase())
-  );
-  const inaccessible = requested.filter((repository) => readOnly.has(repository.toLowerCase()));
-  if (inaccessible.length > 0) {
-    throw new CliError("auth", `Repositories lack write access: ${inaccessible.join(", ")}.`);
-  }
-  if (inventorySatisfiesRequest(inventory, requested)) return inventory;
-  if (inventory.ssoOrgs.length > 0) return emitSsoRequirement({ apiUrl: config2.apiUrl, inventory, runtime });
-  const install = await apiFetch(config2, "/api/github/install-url");
-  emitSetupAction(runtime, { kind: "install_github", url: install.url });
-  if (!runtime.json && !runtime.quiet) console.error("Waiting for GitHub repository access...");
-  const deadline = Date.now() + INSTALL_WAIT_TIMEOUT_MS;
-  while (Date.now() < deadline) {
-    await sleep(INSTALL_POLL_INTERVAL_MS);
-    inventory = await apiFetch(config2, ONBOARDING_REPOS_PATH);
-    if (inventorySatisfiesRequest(inventory, requested)) return inventory;
-    if (inventory.ssoOrgs.length > 0) return emitSsoRequirement({ apiUrl: config2.apiUrl, inventory, runtime });
-  }
-  throw new CliError("server", "Timed out waiting for GitHub repository access.", {
-    hint: `Finish repository selection at ${install.url}, then rerun \`arcanist setup\`.`
-  });
-}
-function inventorySatisfiesRequest(inventory, requested) {
-  const eligible = new Set(eligibleRepositoryNames(inventory.repos).map((repository) => repository.toLowerCase()));
-  if (requested.length > 0) return requested.every((repository) => eligible.has(repository.toLowerCase()));
-  return inventory.complete === true && eligible.size > 0;
-}
-function emitSsoRequirement(options) {
-  const { apiUrl, inventory, runtime } = options;
-  for (const org of inventory.ssoOrgs) {
-    if (typeof org.authorizeUrl !== "string") continue;
-    const url2 = org.authorizeUrl.startsWith("/") ? `${apiUrl}${org.authorizeUrl}` : org.authorizeUrl;
-    emitSetupAction(runtime, {
-      kind: "authorize_github_sso",
-      url: url2,
-      organization: org.login ?? org.orgId
-    });
-  }
-  emit(
-    void 0,
-    runtime,
-    {
-      status: "action_required",
-      action: "authorize_github_sso",
-      repositories: eligibleRepositoryNames(inventory.repos),
-      ssoOrgs: inventory.ssoOrgs,
-      next: "Authorize GitHub SSO, then rerun arcanist setup."
-    },
-    () => console.log("Authorize GitHub SSO, then rerun arcanist setup.")
-  );
-  return null;
-}
-function emitSetupAction(runtime, action) {
-  if (runtime.json) process.stderr.write(`${JSON.stringify({ type: "action_required", action })}
-`);
-  else process.stderr.write(`Action required: ${action.url}
-`);
-}
-function trackingCommands(repositories) {
-  return repositories.map((repository) => `Track later: ${commandForNextAction("wait", repository)}`);
-}
-
-// src/commands/stop.ts
-async function stopCommand(sessionId, options = {}, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  let status;
-  try {
-    const response = await apiFetch(config2, `/api/sessions/${sessionId}/stop`, {
-      method: "POST"
-    });
-    status = response.status ?? "stopping";
-  } catch (err) {
-    const parsed = parseStopBlocked(err);
-    if (!parsed) throw err;
-    status = parsed.reason;
-  }
-  emit(command, options, { sessionId, status }, (payload) => {
-    if (payload.status === "already_stopped") {
-      console.log(`Session ${payload.sessionId} is already stopped.`);
-    } else if (payload.status === "stopping" || payload.status === "stopped") {
-      console.log(`Stop requested for session ${payload.sessionId}.`);
-    } else {
-      console.log(`Session ${payload.sessionId} cannot be stopped from phase=${payload.status}.`);
-    }
-  });
-}
-function parseStopBlocked(err) {
-  const body = parseConflictBody(err);
-  if (!body || body.error !== "session_not_stoppable") return null;
-  return { reason: typeof body.reason === "string" ? body.reason : "not_stoppable" };
-}
-
-// src/commands/test-creds.ts
-import { readFileSync as readFileSync4 } from "fs";
-function basePath(businessId, repo) {
-  return `/api/businesses/${encodeURIComponent(businessId)}/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.repo)}/test-credentials`;
-}
-function readValue(options) {
-  const sources = [options.value, options.valueFile, options.valueStdin].filter((v) => v !== void 0 && v !== false);
-  if (sources.length !== 1) {
-    throw new CliError("user", "Provide exactly one of --value, --value-file, or --value-stdin.");
-  }
-  if (options.value !== void 0) return options.value;
-  const raw = options.valueFile ? readFileSync4(options.valueFile, "utf8") : readFileSync4(0, "utf8");
-  return raw.replace(/\r?\n$/, "");
-}
-async function listTestCredentialsCommand(repo, options, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const repoArg = parseRepoArg(repo);
-  const payload = await apiFetch(config2, basePath(options.business, repoArg));
-  emit(command, options, payload, (listPayload) => {
-    if (listPayload.credentials.length === 0) {
-      console.log(`No test credentials configured for ${repoArg.owner}/${repoArg.repo}.`);
-      return;
-    }
-    for (const cred of listPayload.credentials) {
-      const ts = new Date(cred.updatedAt).toISOString();
-      console.log(`${cred.name}	${ts}	${cred.rotatedByUserId ?? "-"}`);
-    }
-  });
-}
-async function setTestCredentialCommand(repo, name, options, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const repoArg = parseRepoArg(repo);
-  const value = readValue(options);
-  const payload = await apiFetch(
-    config2,
-    `${basePath(options.business, repoArg)}/${encodeURIComponent(name)}`,
-    { method: "PUT", body: JSON.stringify({ value }) }
-  );
-  emit(
-    command,
-    options,
-    payload,
-    () => console.log(`Set test credential '${name}' for ${repoArg.owner}/${repoArg.repo}.`)
-  );
-}
-async function deleteTestCredentialCommand(repo, name, options, command) {
-  if (isJson(command, options) && options.yes !== true) {
-    throw new CliError("user", "`test-creds delete --json` requires --yes.");
-  }
-  if (options.yes !== true) {
-    const repoArg2 = parseRepoArg(repo);
-    await confirmOrThrow(`Delete test credential '${name}' for ${repoArg2.owner}/${repoArg2.repo}?`);
-  }
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const repoArg = parseRepoArg(repo);
-  const payload = await apiFetch(
-    config2,
-    `${basePath(options.business, repoArg)}/${encodeURIComponent(name)}`,
-    { method: "DELETE" }
-  );
-  emit(
-    command,
-    options,
-    payload,
-    () => console.log(`Deleted test credential '${name}' for ${repoArg.owner}/${repoArg.repo}.`)
-  );
-}
-
-// src/commands/tokens.ts
-async function listTokensCommand(options, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const { items: data, nextCursor } = await fetchPages(
-    "tokens list --all",
-    options.all === true,
-    options.cursor,
-    async (cursor) => {
-      const query = new URLSearchParams();
-      if (options.limit) query.set("limit", options.limit);
-      if (cursor) query.set("cursor", cursor);
-      const payload2 = await apiFetch(
-        config2,
-        `/api/cli-tokens${query.size ? `?${query.toString()}` : ""}`
-      );
-      return { items: payload2.data, nextCursor: payload2.nextCursor };
-    }
-  );
-  const payload = { data, nextCursor };
-  emit(command, options, payload, (listPayload) => {
-    if (listPayload.data.length === 0) {
-      console.log("No CLI tokens found.");
-      return;
-    }
-    for (const token of listPayload.data) {
-      console.log(
-        `${String(token.id)}	${String(token.scope)}	${String(token.tokenPrefix)}	${String(token.revokedAt ? "revoked" : "active")}`
-      );
-    }
-    if (listPayload.nextCursor) console.log(`Next cursor: ${listPayload.nextCursor}`);
-  });
-}
-async function createTokenCommand(options, command) {
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const expiresInDays = options.expiresInDays === void 0 ? void 0 : Number(options.expiresInDays);
-  if (expiresInDays !== void 0 && (!Number.isInteger(expiresInDays) || expiresInDays <= 0)) {
-    throw new CliError("user", "expiresInDays must be a positive integer.");
-  }
-  let payload;
-  try {
-    payload = await apiFetch(config2, "/api/cli-tokens", {
-      method: "POST",
-      headers: { "Idempotency-Key": options.idempotencyKey ?? randomIdempotencyKey() },
-      body: JSON.stringify({
-        scope: options.scope ?? "read",
-        ...expiresInDays !== void 0 ? { expiresInDays } : {}
-      })
-    });
-  } catch (err) {
-    if (err instanceof ApiError && err.status === 409 && err.data?.serverCode === "duplicate_request") {
-      throw new CliError(err.code, err.message, {
-        exitCode: err.exitCode,
-        requestId: err.requestId,
-        data: err.data,
-        hint: "Use a new --idempotency-key for a new token, or retry the original command only if the first result was lost."
-      });
-    }
-    throw err;
-  }
-  emit(command, options, payload, (tokenPayload) => {
-    console.log(`Token: ${String(tokenPayload.token)}`);
-    console.log(`ID: ${String(tokenPayload.id)}`);
-    console.log(`Scope: ${String(tokenPayload.scope)}`);
-  });
-}
-async function revokeTokenCommand(tokenId, options, command) {
-  if (isJson(command, options) && options.yes !== true) {
-    throw new CliError("user", "`tokens revoke --json` requires --yes.");
-  }
-  if (options.yes !== true) {
-    await confirmOrThrow(`Revoke CLI token ${tokenId}?`);
-  }
-  const { config: config2 } = resolveBusinessContext(command, options);
-  const payload = await apiFetch(config2, `/api/cli-tokens/${tokenId}/revoke`, {
-    method: "POST"
-  });
-  emit(command, options, payload, () => console.log(`Revoked token ${tokenId}.`));
-}
 
 // src/commands/transcript.ts
 async function transcriptCommand(sessionId, options, command) {
@@ -32488,11 +31469,10 @@ program.hook("preAction", (_thisCommand, actionCommand) => {
   applyColorEnvironment(getRuntimeOptions(actionCommand));
 });
 var auth = program.command("auth").description("Authentication commands");
-auth.command("login").description("Authenticate through your browser").option("--token-stdin", "Read token from stdin instead of interactive prompt").addHelpText(
+auth.command("login").description("Store a CLI token minted in Settings > CLI").option("--token-stdin", "Read token from stdin").addHelpText(
   "after",
   `
 Examples:
-  arcanist auth login
   printf "arc_..." | arcanist auth login --token-stdin
   ARCANIST_TOKEN=arc_... arcanist auth whoami --json
 `
@@ -32507,21 +31487,6 @@ Examples:
   ARCANIST_TOKEN=arc_... arcanist auth whoami --json
 `
 ).action((options, command) => whoamiCommand(options, command));
-program.command("setup").description("Connect GitHub repositories and prepare their Zeus environments").argument("[repos...]", "Repositories in owner/name form").option("--workspace", "Prepare the repositories as one multi-repository workspace").addHelpText(
-  "after",
-  `
-Examples:
-  arcanist setup
-  arcanist setup acme/web
-  arcanist setup acme/web acme/api --json
-  arcanist setup acme/web acme/api --workspace
-
-With no repositories, the command returns the eligible repositories. Rerun with the
-repositories to prepare. By default each repository gets its own environment; use
---workspace to prepare them together. Builds continue after the command exits; use
-the emitted environment status commands to track them.
-`
-).action((repos2, options, command) => setupCommand(repos2, options, command));
 var codex = program.command("codex").description("Codex subscription (bring-your-own-subscription) commands");
 codex.command("login").description("Authenticate a Codex/ChatGPT subscription and store it for your Codex sessions").option("--codex-path <path>", "Path to the codex executable (default: codex on PATH, or ARCANIST_CODEX_BIN)").addHelpText(
   "after",
@@ -32537,32 +31502,19 @@ Examples:
 ).action((options, command) => codexLoginCommand(options, command));
 codex.command("use <state>").description("Turn using your saved Codex subscription auth for OpenAI sessions on or off (state: on|off)").action((state, options, command) => codexUseCommand(state, options, command));
 codex.command("status").description("Show Codex subscription availability and whether auth is saved").action((options, command) => codexStatusCommand(options, command));
-codex.command("logout").description("Deactivate the selector and remove the stored Codex subscription auth for your user").action((options, command) => codexLogoutCommand(options, command));
 var sessions = program.command("sessions").description("Session commands");
-program.command("review <pr-url>").description("Run a Zeus review for a GitHub pull request").option("--sandbox-runtime <runtime>", "Force the sandbox runtime (Arcanist members only): modal, e2b, or sailbox").option("--wait", "Wait until the review is published, cancelled, or admission-rejected").option("--poll-interval <ms>", "Polling interval in milliseconds while waiting (default 10000)").addHelpText(
+program.command("review <pr-url>").description("Run an Arcanist review for a GitHub pull request").option("--sandbox-runtime <runtime>", "Force the sandbox runtime (Arcanist members only): modal or e2b").option("--wait", "Wait until the review is published, cancelled, or admission-rejected").option("--poll-interval <ms>", "Polling interval in milliseconds while waiting (default 10000)").addHelpText(
   "after",
   `
 Examples:
   arcanist review https://github.com/org/repo/pull/123 --wait --json
-  arcanist review https://github.com/org/repo/pull/123 --sandbox-runtime sailbox --wait
+  arcanist review https://github.com/org/repo/pull/123 --sandbox-runtime modal --wait
 
 --wait returns when the review is published, cancelled, or admission-rejected. The 30-minute timeout applies only while status is in_flight.
-Zeus always uses the pinned Codex reviewer.
-Zeus review is currently available to Arcanist members only.
+Arcanist always uses the pinned Codex reviewer.
+Arcanist review is currently available to Arcanist members only.
 `
 ).action((prUrl, options, command) => reviewCommand(prUrl, options, command));
-sessions.command("stop").description("Stop the active run for a session").argument("<session-id>", "Session ID").addHelpText(
-  "after",
-  `
-Examples:
-  arcanist sessions stop <session-id>
-  arcanist sessions stop <session-id> --json
-
-JSON:
-JSON mode returns {sessionId, status}
-  status is the server stop status or 409 stop-block reason. Known values include stopping, stopped, already_stopped, not_stoppable, and lifecycle phase names.
-`
-).action((sessionId, options, command) => stopCommand(sessionId, options, command));
 sessions.command("get").description("Get session details").argument("<session-id>", "Session ID").addHelpText(
   "after",
   `
@@ -32587,13 +31539,12 @@ JSON:
 JSON mode returns {sessions, nextCursor}. --all follows cursors until nextCursor is null.
 `
 ).action((options, command) => listSessionsCommand(options, command));
-sessions.command("events").description("Read or follow session replay events").argument("<session-id>", "Session ID").option("--after-sequence <n>", "Return events after this sequence").option("--after <n>", "Alias for --after-sequence").option("--before-sequence <n>", "Return events before this sequence").option("--before <n>", "Alias for --before-sequence").option("--prompt-id <id>", "Filter events by prompt ID").option("--limit <n>", "Maximum events to return").option("--follow", "Follow events until a terminal phase").option("--poll-interval <ms>", "Polling interval in milliseconds", String(DEFAULT_WATCH_POLL_INTERVAL_MS)).option("--timeout <ms>", "Stop following after this many milliseconds; 0 or omitted means unbounded").addHelpText(
+sessions.command("events").description("Read or follow session replay events").argument("<session-id>", "Session ID").option("--after-sequence <n>", "Return events after this sequence").option("--before-sequence <n>", "Return events before this sequence").option("--prompt-id <id>", "Filter events by prompt ID").option("--limit <n>", "Maximum events to return").option("--follow", "Follow events until a terminal phase").option("--poll-interval <ms>", "Polling interval in milliseconds", String(DEFAULT_WATCH_POLL_INTERVAL_MS)).option("--timeout <ms>", "Stop following after this many milliseconds; 0 or omitted means unbounded").addHelpText(
   "after",
   `
 Examples:
   arcanist sessions events <session-id> --json
   arcanist sessions events <session-id> --after-sequence 540 --limit 250 --json
-  arcanist sessions events <session-id> --after 540 --limit 250 --json
   arcanist sessions events <session-id> --follow --json
   arcanist sessions events <session-id> --follow --timeout 60000 --json
 
@@ -32613,14 +31564,6 @@ Examples:
   arcanist sessions transcript <session-id> --last 20
 `
 ).action((sessionId, options, command) => transcriptCommand(sessionId, options, command));
-sessions.command("usage").description("Get token usage for a session").argument("<session-id>", "Session ID").addHelpText(
-  "after",
-  `
-Examples:
-  arcanist sessions usage <session-id>
-  arcanist sessions usage <session-id> --json
-`
-).action((sessionId, options, command) => usageCommand(sessionId, options, command));
 var artifacts = sessions.command("artifacts").description("List or download session artifacts (screenshots, videos)").argument("<session-id>", "Session ID").option("-o, --output <dir>", "Directory to write downloads into; defaults to the current directory").option("--all", "Download every artifact for the session instead of listing them").addHelpText(
   "after",
   `
@@ -32652,15 +31595,8 @@ JSON:
 JSON mode returns {repos, ssoOrgs}
 `
 ).action((options, command) => reposListCommand(options, command));
-repos.command("branches").description("List repository branches").argument("[repo]", "Repository owner/name; defaults to current git remote").addHelpText(
-  "after",
-  `
-JSON:
-JSON mode returns {branches}
-`
-).action((repo, options, command) => repoBranchesCommand(repo, options, command));
-var environments = program.command("environments").alias("env").description("Zeus environment setup commands");
-environments.command("prepare").description("Prepare a repository for Zeus reviews").argument("[repo]", "Repository owner/name; defaults to current git remote").option("--wait", "Wait until setup is ready or needs attention").option("--poll-interval <ms>", "Polling interval while waiting (default 5000)").addHelpText(
+var environments = program.command("environments").alias("env").description("Arcanist environment setup commands");
+environments.command("prepare").description("Prepare a repository for Arcanist reviews").argument("[repo]", "Repository owner/name; defaults to current git remote").option("--wait", "Wait until setup is ready or needs attention").option("--poll-interval <ms>", "Polling interval while waiting (default 5000)").addHelpText(
   "after",
   `
 Examples:
@@ -32680,7 +31616,7 @@ The stable status values are not_started, pending, running, escalated, succeeded
 `
 ).action((repo, options, command) => environmentStatusCommand(repo, options, command));
 environments.command("retry").description("Retry a failed repository environment setup").argument("[repo]", "Repository owner/name; defaults to current git remote").option("--wait", "Wait until setup is ready or needs attention").option("--poll-interval <ms>", "Polling interval while waiting (default 5000)").action((repo, options, command) => environmentRetryCommand(repo, options, command));
-environments.command("login").description("Log into your app once in a local browser and save the login for Zeus sessions").argument("[environment]", "Environment id or repository owner/name; defaults to current git remote").option("--url <url>", "Page to open first instead of the app runtime URL").option("--validate-path <path>", "Signed-in-only page Arcanist opens to verify the login, e.g. /dashboard").option("--yes", "Add captured provider hosts to trusted domains without asking").option("--no-network-policy", "Do not touch the environment's trusted domains").option("--clear", "Remove the saved browser login").addHelpText(
+environments.command("login").description("Log into your app once in a local browser and save the login for Arcanist sessions").argument("[environment]", "Environment id or repository owner/name; defaults to current git remote").option("--url <url>", "Page to open first instead of the app runtime URL").option("--validate-path <path>", "Signed-in-only page Arcanist opens to verify the login, e.g. /dashboard").option("--yes", "Add captured provider hosts to trusted domains without asking").option("--no-network-policy", "Do not touch the environment's trusted domains").option("--clear", "Remove the saved browser login").addHelpText(
   "after",
   `
 Examples:
@@ -32693,14 +31629,6 @@ JSON mode returns {environmentId, version, counts: {cookieDomainCount, storageOr
 With --clear it returns {environmentId, deleted}. Instructions and prompts go to stderr; the capture path needs an interactive terminal (pass --yes --validate-path to skip the other prompts).
 `
 ).action((environment, options, command) => environmentLoginCommand(environment, options, command));
-var models = program.command("models").description("Model discovery commands");
-models.command("list").description("List session-start models").addHelpText(
-  "after",
-  `
-JSON:
-JSON mode returns {models}
-`
-).action((options, command) => modelsListCommand(options, command));
 var sandbox = program.command("sandbox").description("Sandbox layer commands");
 sandbox.command("init").description("Create sandbox layer source files").action((options, command) => sandboxInitCommand(options, command));
 sandbox.command("validate").description("Validate local sandbox layer source files").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").action((options, command) => sandboxValidateCommand(options, command));
@@ -32715,61 +31643,6 @@ JSON:
     {type:"build", buildRequest:{...}}
 `
 ).action((sourceRepo, options, command) => sandboxBuildCommand(sourceRepo, options, command));
-sandbox.command("status").description("Show sandbox layer status").argument("[repo]", "Repository owner/name; defaults to current git remote").option("--business <id>", "Business ID; defaults to authenticated user's business").action((repo, options, command) => sandboxStatusCommand(repo, options, command));
-sandbox.command("history").description("Show sandbox layer build history").argument("[source-repo]", "Source repository owner/name; defaults to current git remote").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--target-repo <repo>", "Target repository owner/name for resource-profile coverage").option("--status <status>", "Filter by build status").option("--limit <n>", "Maximum builds to return").action((sourceRepo, options, command) => sandboxHistoryCommand(sourceRepo, options, command));
-sandbox.command("logs").description("Print sandbox layer build logs").argument("<build-id>", "Build ID").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--follow", "Follow logs").option("--after-sequence <n>", "Return logs after this sequence").option("--limit <n>", "Maximum log chunks to return").option("--poll-interval <ms>", "Polling interval in milliseconds").addHelpText(
-  "after",
-  `
-JSON:
-  Without --follow, --json prints one object: {ok, logs}
-  With --follow, --json emits {type:"logs"} lines, then a terminal {type:"build"} line, and exits.
-`
-).action((buildId, options, command) => sandboxLogsCommand(buildId, options, command));
-sandbox.command("rebuild-stale").description("Create stale sandbox template rebuild campaigns").option("--business <id>", "Business ID to scan; defaults to authenticated user's business").option("--all", "Scan all businesses").option("--dry-run", "Preview stale rebuilds without queueing provider builds").option("--yes", "Start a rebuild campaign").option("--follow", "Follow campaign progress").action((options, command) => sandboxRebuildStaleCommand(options, command));
-var sandboxAssign = sandbox.command("assign").description("Assign sandbox layer sources");
-sandboxAssign.command("default").description("Set the business default sandbox layer source").argument("<source-repo>", "Source repository owner/name").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").option("--business <id>", "Business ID; defaults to authenticated user's business").action((sourceRepo, options, command) => sandboxAssignDefaultCommand(sourceRepo, options, command));
-sandboxAssign.command("repo").description("Assign a sandbox layer source to one target repo").argument("<target-repo>", "Target repository owner/name").argument("<source-repo>", "Source repository owner/name").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").option("--business <id>", "Business ID; defaults to authenticated user's business").action(
-  (targetRepo, sourceRepo, options, command) => sandboxAssignRepoCommand(targetRepo, sourceRepo, options, command)
-);
-var sandboxUnassign = sandbox.command("unassign").description("Remove sandbox layer source assignments");
-sandboxUnassign.command("default").description("Clear the business default sandbox layer source").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--yes", "Skip confirmation").action((options, command) => sandboxUnassignDefaultCommand(options, command));
-sandboxUnassign.command("repo").description("Clear a target repo sandbox layer assignment").argument("<target-repo>", "Target repository owner/name").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--yes", "Skip confirmation").action((targetRepo, options, command) => sandboxUnassignRepoCommand(targetRepo, options, command));
-var egress = program.command("egress").description("Workspace egress allowlist commands");
-var egressSource = egress.command("source").description("Manage the workspace egress allowlist source repo");
-egressSource.command("set").description("Set the source repo for .arcanist/egress-allowlist.txt").argument("<source-repo>", "Source repository owner/name").option("--business <id>", "Business ID; defaults to authenticated user's business").action((sourceRepo, options, command) => egressSourceSetCommand(sourceRepo, options, command));
-egressSource.command("get").description("Show the configured egress allowlist source").option("--business <id>", "Business ID; defaults to authenticated user's business").action((options, command) => egressSourceGetCommand(options, command));
-egress.command("add").description("Open or update a PR adding domains to the egress allowlist source file").argument("<domains...>", "Exact domain names to add").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--reason <text>", "Reason to include in the PR body").action((domains, options, command) => egressAddCommand(domains, options, command));
-egress.command("sync").description("Apply the merged egress allowlist source file to the runtime business policy").option("--business <id>", "Business ID; defaults to authenticated user's business").action((options, command) => egressSyncCommand(options, command));
-egress.command("validate").description("Validate a local egress allowlist source file").argument("[path]", "Path to validate", ".arcanist/egress-allowlist.txt").action((path, options, command) => egressValidateCommand(path, options, command));
-var tokens = program.command("tokens").description("CLI token commands");
-tokens.command("list").description("List CLI tokens").option("--limit <n>", "Maximum tokens to return").option("--cursor <cursor>", "Pagination cursor").option("--all", "Fetch all pages").action((options, command) => listTokensCommand(options, command));
-tokens.command("create").description("Create a CLI token and print it once").option("--scope <scope>", "Token scope: read or write", "read").option("--expires-in-days <days>", "Token expiry in days").option("--idempotency-key <uuid>", "Request idempotency key for safe manual retries").addHelpText(
-  "after",
-  `
-Examples:
-  arcanist tokens create --scope read
-  arcanist tokens create --scope read --json
-`
-).action((options, command) => createTokenCommand(options, command));
-tokens.command("revoke").description("Revoke a CLI token").argument("<id>", "Token ID").option("--yes", "Confirm revocation without prompting").addHelpText(
-  "after",
-  `
-Examples:
-  arcanist tokens revoke 42
-  arcanist tokens revoke 42 --yes --json
-`
-).action((id, options, command) => revokeTokenCommand(id, options, command));
-var testCreds = program.command("test-creds").description("Manage repo-scoped test credentials referenced by the Environment App Runtime Profile");
-testCreds.command("list").description("List test credentials configured for a repo").argument("<repo>", "Repository in 'owner/name' form").requiredOption("--business <id>", "Business ID that owns the repo").action((repo, options, command) => listTestCredentialsCommand(repo, options, command));
-testCreds.command("set").description("Set or rotate a test credential value").argument("<repo>", "Repository in 'owner/name' form").argument("<name>", "Credential name (must match the Environment profile's credentials[].name)").requiredOption("--business <id>", "Business ID that owns the repo").option("--value <value>", "Credential value (insecure on shared shells; prefer --value-stdin)").option("--value-file <path>", "Read value from a file").option("--value-stdin", "Read value from stdin").addHelpText(
-  "after",
-  `
-Examples:
-  echo "$E2E_PASS" | arcanist test-creds set tryarcanist/arcanist test_user_password --business biz-1 --value-stdin
-  arcanist test-creds set tryarcanist/arcanist test_user_email --business biz-1 --value-file ./email.txt
-`
-).action((repo, name, options, command) => setTestCredentialCommand(repo, name, options, command));
-testCreds.command("delete").description("Delete a test credential").argument("<repo>", "Repository in 'owner/name' form").argument("<name>", "Credential name").requiredOption("--business <id>", "Business ID that owns the repo").option("--yes", "Confirm deletion without prompting").action((repo, name, options, command) => deleteTestCredentialCommand(repo, name, options, command));
 program.command("help").description("display help for command").argument("[path...]", "Command path to explain").action((path) => {
   commandForHelpPath(program, path).help({ error: false });
 });