agenttwin 0.2.0 → 0.2.2

package/dist/cli.js

@@ -53,22 +53,13 @@ var init_answers = __esm({
 
 // src/cli.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname4, join as join17 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { parseArgs } from "util";
 
-// src/commands/prepare.ts
-import { mkdir as mkdir2, mkdtemp as mkdtemp2, readFile as readFile4, writeFile as writeFile2, rm as rm2 } from "fs/promises";
-import { join as join4, resolve as resolve2, dirname as dirname2 } from "path";
-import { tmpdir as tmpdir2 } from "os";
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
-
-// src/commands/run.ts
-import { mkdtemp, mkdir, readFile as readFile3, writeFile, realpath, lstat, rm, copyFile } from "fs/promises";
-import { tmpdir } from "os";
-import { dirname, isAbsolute, join as join3, relative, resolve, sep } from "path";
-import { fileURLToPath } from "url";
-import { createHash, randomUUID } from "crypto";
+// src/commands/sync.ts
+import { readFile as readFile4 } from "fs/promises";
+import { join as join4 } from "path";
 
 // src/runtime/remote.ts
 import { readFile } from "fs/promises";
@@ -172,19 +163,206 @@ async function executeRemote(stage, spec, log) {
   throw new CliError(`Timed out waiting for hosted run ${job.id}; inspect this run in the API before retrying`);
 }
 
+// src/commands/session.ts
+import { spawn, spawnSync } from "child_process";
+import { writeFile as writeFile2, readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
+
+// src/inventory/dashboard-transfer.ts
+function discoveryTransfer(value) {
+  const input = value;
+  if (!input || input.schema !== "company-inventory/v1" || typeof input.name !== "string" || !Array.isArray(input.tools) || !Array.isArray(input.workflows) || input.tools.length > 1e3 || input.workflows.length > 5e3) throw new Error("Invalid discovery metadata");
+  const text = (v, limit = 240) => {
+    if (typeof v !== "string" || v.length > limit || /[\x00-\x1f]/.test(v)) throw new Error("Invalid discovery string");
+    return v;
+  };
+  const strings = (v) => {
+    if (!Array.isArray(v) || v.length > 1e3) throw new Error("Invalid discovery list");
+    return v.map((s) => text(s));
+  };
+  const entrypoint = (v) => {
+    const path = text(v, 500);
+    if (path.startsWith("/") || path.includes("\\") || /(^|[\/])\.\.([\/#]|$)/.test(path) || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(path)) throw new Error("Entrypoint must be relative to the project");
+    return path;
+  };
+  const tools = input.tools.map((raw) => {
+    const t = raw;
+    return { id: text(t.id), title: text(t.title), kind: text(t.kind), category: text(t.category), confidence: text(t.confidence), interface: text(t.interface) };
+  });
+  const workflows = input.workflows.map((raw) => {
+    const w = raw;
+    if (!Array.isArray(w.steps) || w.steps.length > 1e3) throw new Error("Invalid workflow steps");
+    return { id: text(w.id), title: text(w.title), confidence: text(w.confidence), supported: w.supported === true, verified: false, tools: strings(w.tools), steps: w.steps.map((rawStep) => {
+      const step = rawStep;
+      return { tool: text(step.tool), operations: strings(step.operations) };
+    }), ...w.entrypoint ? { entrypoint: entrypoint(w.entrypoint) } : {} };
+  });
+  if (new Set(tools.map((t) => t.id)).size !== tools.length || new Set(workflows.map((w) => w.id)).size !== workflows.length) throw new Error("Duplicate discovery IDs");
+  const ids = new Set(tools.map((t) => t.id));
+  if (workflows.some((w) => w.tools.some((id) => !ids.has(id)) || w.steps.some((s) => !ids.has(s.tool)))) throw new Error("Unknown workflow tool");
+  const result = { schema: "company-inventory/v1", name: text(input.name), generatedAt: input.generatedAt ? text(input.generatedAt) : "", tools, workflows };
+  if (Buffer.byteLength(JSON.stringify(result)) > 2 * 1024 * 1024) throw new Error("Discovery exceeds 2 MiB");
+  return result;
+}
+
+// src/commands/dashboard.ts
+import { cp, mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import { basename, join as join2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/inspect/sanitize.ts
+var URL_CREDENTIALS = /(https?:\/\/)([^/@\s:]+)(:[^/@\s]+)?@/gi;
+var TOKENISH = /\b(sk|rk|pk|ghp|gho|ghs|glpat|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
+var EMAIL = /([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g;
+function stripUrlCredentials(value) {
+  return value.replace(URL_CREDENTIALS, "$1");
+}
+function sanitizeOutput(value) {
+  return stripUrlCredentials(value).replace(TOKENISH, (m) => `${m.slice(0, 4)}***`).replace(EMAIL, "$1***$2");
+}
+function excerpt(value, max = 200) {
+  const clean = sanitizeOutput(value).replace(/\s+/g, " ").trim();
+  return clean.length > max ? `${clean.slice(0, max)}\u2026` : clean;
+}
+
+// src/commands/dashboard.ts
+function dashboardInventory(cwd, inventory) {
+  return JSON.parse(sanitizeOutput(JSON.stringify({
+    schema: "company-inventory/v1",
+    generatedAt: inventory.generatedAt,
+    name: basename(cwd),
+    tools: inventory.tools.map((t) => ({
+      id: t.id,
+      title: t.title,
+      kind: t.kind,
+      category: t.category,
+      confidence: t.confidence ?? "low",
+      interface: t.kind === "runtime" ? "terminal" : "api"
+    })),
+    workflows: inventory.workflows.map((w) => ({ id: w.id, title: w.title ?? w.id, confidence: w.confidence ?? "low", supported: w.supported, verified: false, ...w.entrypoint ? { entrypoint: w.entrypoint } : {}, tools: w.tools, steps: w.steps.map((s) => ({ tool: s.tool, operations: s.operations })) }))
+  })));
+}
+async function writeDashboard(cwd, inventory) {
+  const directory = join2(cwd, ".agenttwin", "dashboard");
+  let bundle = fileURLToPath(new URL("./dashboard/", import.meta.url));
+  try {
+    await readFile2(join2(bundle, "index.html"));
+  } catch {
+    bundle = fileURLToPath(new URL("../../../../site/", import.meta.url));
+  }
+  await mkdir(join2(directory, "assets", "dashboard"), { recursive: true });
+  const html = await readFile2(join2(bundle, bundle.endsWith("/site/") ? "dashboard.html" : "index.html"), "utf8");
+  for (const folder of ["dashboard", "icons", "logo", "fonts"]) {
+    await cp(join2(bundle, "assets", folder), join2(directory, "assets", folder), { recursive: true });
+  }
+  await cp(join2(bundle, "assets", "brand.css"), join2(directory, "assets", "brand.css"));
+  const data = await loadDashboardDiscovery(cwd, inventory);
+  const payload = JSON.stringify(data).replace(/</g, "\\u003c");
+  const page2 = html.replace('type="module"', "defer").replace('<script src="assets/dashboard/dashboard.js', `<script id="agenttwin-discovery" type="application/json">${payload}</script><script src="assets/dashboard/dashboard.js`).replace(/href="index.html"/g, 'href="../report.html"').replace(/href="docs\/"/g, 'href="../report.html"').replace("Docs \u2197", "Discovery report \u2197").replace("Runtime documentation \u2197", "Coverage report \u2197").replace("Back to website \u2197", "Discovery report \u2197");
+  await writeFile(join2(directory, "index.html"), page2, "utf8");
+  await writeFile(join2(directory, "assets", "dashboard", "inventory.json"), JSON.stringify(data), "utf8");
+  await writeFile(join2(directory, "assets", "dashboard", "runs.json"), '{"runs":[]}', "utf8");
+  return join2(directory, "index.html");
+}
+
+// src/commands/session.ts
+function sessionTask() {
+  return `# Prepare this repository for AgentTwin
+
+Read project instructions and .agenttwin/inventory.json first. Inspect tracked application source and configuration; skip secrets, .env values, private data, dependencies and build outputs. Use your configured coding-agent provider and normal permission controls.
+
+Find distinct business workflows across the repository, including routes, queues, schedules, agent tools and exported functions. Do not cap discovery at a handful of examples. Trace callers and side effects across files. For each candidate record its real relative entrypoint, intent, inputs, dependency operations, expected observable outcome and plausible production failures. Distinguish observed code from hypotheses. Do not claim discovery is exhaustive; report skipped files and unresolved dynamic paths.
+
+Write a human-readable .agenttwin/WORKFLOWS.md. For dashboard handoff, write .agenttwin/agent-discovery.json using the metadata-only company-inventory/v1 schema below. Start with the tools in .agenttwin/dashboard/assets/dashboard/inventory.json and retain their IDs; add candidates to workflows. Include no source bodies, credentials, PII or absolute paths. Never mark a candidate verified or executable merely because it was discovered.
+
+Example shape (replace these descriptive placeholders with evidence from this repo):
+{"schema":"company-inventory/v1","name":"project","tools":[],"workflows":[{"id":"agent:unique_workflow","title":"Workflow intent","entrypoint":"src/path.ts#function","confidence":"medium","supported":false,"verified":false,"tools":[],"steps":[]}]}
+Each tool must have id, title, kind, category, confidence, interface. Each step must have tool (an existing tool ID) and operations (string array).
+
+Before execution, ask the user for missing input, expected outcomes and any required synthetic fixtures. Prepare one real workflow at a time: an executable Node entrypoint plus its required application files, reviewed dependency mappings, synthetic starting state, assertions and an explicit fault when appropriate. Read agenttwin prepare --help and the existing preparation schema rather than guessing fields. The current hosted runtime supports Node, PostgreSQL, Redis, bounded Slack operations and explicit custom JSON collections. Unsupported vendor SDKs, browser and desktop interactions are blockers; never represent generic JSON endpoints as full vendor twins.
+
+Do not run application workflows, Docker or containers locally. Do not access production accounts or copy production data. Do not print credentials. Execute reviewed workflows only through npx agenttwin run in a fresh hosted sandbox with AgentTwin account credentials or E2B credentials. Upload application files only after the user reviews the bundle. When a run fails, use the actual run receipt, logs, failed assertions and source digests to propose a fix. Explain uncertainty, edit the approved code, rebuild the bundle and retest in a new sandbox; never report success without passing evidence.
+
+After review, npx agenttwin sync sends discovery metadata to the account dashboard using AGENTTWIN_TOKEN (and optional AGENTTWIN_API_URL). It does not upload application source. The dashboard will list all candidate workflows and populate the environment map from these findings.
+`;
+}
+function installedOpenCode() {
+  return spawnSync("opencode", ["--version"], { stdio: "ignore", timeout: 5e3 }).status === 0;
+}
+async function writeSessionTask(cwd) {
+  const path = join3(cwd, ".agenttwin/AGENT-TASK.md");
+  await writeFile2(path, sessionTask(), "utf8");
+  return path;
+}
+async function launchSession(cwd) {
+  if (!installedOpenCode()) throw new Error("OpenCode is not installed. Open .agenttwin/AGENT-TASK.md with your coding agent, or install OpenCode and retry init --agent opencode.");
+  const prompt = "Read .agenttwin/AGENT-TASK.md and follow it to discover and prepare this project for AgentTwin. Start by analyzing the repository and presenting workflow findings and missing execution requirements.";
+  await new Promise((resolve5, reject) => {
+    const child = spawn("opencode", ["--prompt", prompt], { cwd, stdio: "inherit", shell: false });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => code === 0 ? resolve5() : reject(new Error(`Coding session ended ${signal || `with exit code ${code}`}. Discovery files remain available.`)));
+  });
+}
+async function loadDashboardDiscovery(cwd, inventory) {
+  const base = discoveryTransfer(dashboardInventory(cwd, inventory));
+  let raw;
+  try {
+    raw = await readFile3(join3(cwd, ".agenttwin/agent-discovery.json"), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return base;
+    throw error;
+  }
+  if (Buffer.byteLength(raw) > 2 * 1024 * 1024) throw new Error("Agent discovery exceeds 2 MiB");
+  const extra = discoveryTransfer(JSON.parse(raw));
+  const tools = new Map(base.tools.map((t) => [t.id, t]));
+  for (const tool of extra.tools) if (!tools.has(tool.id)) tools.set(tool.id, tool);
+  const workflows = new Map(base.workflows.map((w) => [w.id, w]));
+  for (const workflow of extra.workflows) if (!workflows.has(workflow.id)) workflows.set(workflow.id, { ...workflow, supported: false, verified: false });
+  const result = discoveryTransfer({ ...base, tools: [...tools.values()], workflows: [...workflows.values()] });
+  const ids = new Set(result.tools.map((t) => t.id));
+  if (result.workflows.some((w) => w.tools.some((id) => !ids.has(id)) || w.steps.some((s) => !ids.has(s.tool)))) throw new Error("Agent discovery references unknown tools. Correct .agenttwin/agent-discovery.json before syncing.");
+  return result;
+}
+
+// src/commands/sync.ts
+async function runSync(cwd) {
+  const token = process.env.AGENTTWIN_TOKEN;
+  if (!token || !/^at_user_[a-f0-9]{64}$/.test(token)) throw new Error("Set AGENTTWIN_TOKEN to your individual account token.");
+  const base = apiBase(process.env.AGENTTWIN_API_URL || "https://agenttwin-api.212.56.40.125.sslip.io");
+  const inventory = JSON.parse(await readFile4(join4(cwd, ".agenttwin/inventory.json"), "utf8"));
+  const payload = await loadDashboardDiscovery(cwd, inventory);
+  const response = await fetch(base + "/v1/discovery", { method: "POST", headers: { authorization: "Bearer " + token, "content-type": "application/json" }, body: JSON.stringify(payload), redirect: "error", signal: AbortSignal.timeout(2e4) });
+  const result = await response.json();
+  if (!response.ok) throw new Error(result.error || "Discovery sync failed: " + response.status);
+  return { synced: true, tools: payload.tools.length, workflows: payload.workflows.length, dashboard: "https://agenttwin.212.56.40.125.sslip.io/site/dashboard.html", uploaded: "discovery metadata only; no source files or credentials" };
+}
+
+// src/commands/prepare.ts
+import { mkdir as mkdir3, mkdtemp as mkdtemp2, readFile as readFile7, writeFile as writeFile4, rm as rm2 } from "fs/promises";
+import { join as join7, resolve as resolve2, dirname as dirname2 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+
+// src/commands/run.ts
+import { mkdtemp, mkdir as mkdir2, readFile as readFile6, writeFile as writeFile3, realpath, lstat, rm, copyFile } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname, isAbsolute, join as join6, relative, resolve, sep } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { createHash, randomUUID } from "crypto";
+
 // src/runtime/e2b.ts
 import { Sandbox } from "e2b";
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile5 } from "fs/promises";
 import { randomBytes } from "crypto";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join as join5 } from "path";
 async function executeE2B(stage, spec, log, signal) {
   signal?.throwIfAborted();
   const apiKey = process.env.E2B_API_KEY;
   if (!apiKey) throw new CliError("E2B_API_KEY is not configured", { code: EXIT.BLOCKED, action: "Set E2B_API_KEY in your shell. It remains on the host and is never passed to the application." });
   let saved = {};
   try {
-    saved = JSON.parse(await readFile2(join2(homedir(), ".agenttwin/runtime.json"), "utf8"));
+    saved = JSON.parse(await readFile5(join5(homedir(), ".agenttwin/runtime.json"), "utf8"));
   } catch {
   }
   const template = process.env.E2B_TEMPLATE_ID ?? saved.templateId;
@@ -203,7 +381,7 @@ async function executeE2B(stage, spec, log, signal) {
     signal?.throwIfAborted();
     await sandbox.commands.run("mkdir -p /input/app && chmod 755 /input /input/app", { user: "root" });
     for (const file of ["world.json", "worker.js", ...spec.files.map((f) => `app/${f}`)]) {
-      await sandbox.files.write(`/input/${file}`, new Uint8Array(await readFile2(join2(stage, file))).buffer, { user: "root" });
+      await sandbox.files.write(`/input/${file}`, new Uint8Array(await readFile5(join5(stage, file))).buffer, { user: "root" });
     }
     await sandbox.commands.run("chmod -R a+rX /input", { user: "root" });
     const runtimeEnv = {};
@@ -326,12 +504,12 @@ async function stageApplication(root, files, destination) {
     const source = await realpath(resolve(canonicalRoot, file));
     const rel = relative(canonicalRoot, source);
     if (rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute(rel) || source !== resolve(canonicalRoot, file) || !(await lstat(source)).isFile()) throw new CliError(`Files must be regular files within the project, without symlinks: ${file}`, { code: EXIT.USAGE });
-    const contents = await readFile3(source);
+    const contents = await readFile6(source);
     bytes += contents.length;
     if (bytes > 20 * 1024 * 1024) throw new CliError("Application files exceed 20 MiB; supply a smaller built bundle", { code: EXIT.USAGE });
-    const target = join3(destination, file);
-    await mkdir(dirname(target), { recursive: true });
-    await writeFile(target, contents, { mode: 420 });
+    const target = join6(destination, file);
+    await mkdir2(dirname(target), { recursive: true });
+    await writeFile3(target, contents, { mode: 420 });
     digests[file] = createHash("sha256").update(contents).digest("hex");
   }
   return digests;
@@ -340,14 +518,14 @@ async function runWorld(cwd, opts) {
   const file = resolve(cwd, opts.file ?? "agenttwin.world.json");
   let spec;
   try {
-    spec = parseWorld(JSON.parse(await readFile3(file, "utf8")));
+    spec = parseWorld(JSON.parse(await readFile6(file, "utf8")));
   } catch (error) {
     throw new CliError(String(error), { code: EXIT.USAGE, action: "Create agenttwin.world.json; run agenttwin example --out ./agenttwin-example for a working example." });
   }
   if (spec.workflowId) {
     let inventory;
     try {
-      inventory = JSON.parse(await readFile3(join3(cwd, ".agenttwin/inventory.json"), "utf8"));
+      inventory = JSON.parse(await readFile6(join6(cwd, ".agenttwin/inventory.json"), "utf8"));
     } catch {
       throw new CliError("Linked workflow needs discovery inventory; run init first", { code: EXIT.BLOCKED });
     }
@@ -356,12 +534,12 @@ async function runWorld(cwd, opts) {
   const runtime = opts.runtime ?? (process.env.AGENTTWIN_API_URL ? "hosted" : "e2b");
   if (!["e2b", "hosted"].includes(runtime)) throw new CliError("runtime must be hosted or e2b; no local application execution", { code: EXIT.USAGE });
   if (runtime === "e2b" && !process.env.E2B_API_KEY) throw new CliError("E2B_API_KEY is not configured", { code: EXIT.BLOCKED, action: "Configure your E2B key in the shell; it will not be uploaded." });
-  const stage = await mkdtemp(join3(tmpdir(), "agenttwin-world-"));
+  const stage = await mkdtemp(join6(tmpdir(), "agenttwin-world-"));
   try {
-    const sourceDigests = await stageApplication(dirname(file), spec.files, join3(stage, "app"));
-    await writeFile(join3(stage, "world.json"), JSON.stringify(spec), { mode: 420 });
-    const worker = join3(dirname(fileURLToPath(import.meta.url)), "worker.js");
-    await copyFile(worker, join3(stage, "worker.js"));
+    const sourceDigests = await stageApplication(dirname(file), spec.files, join6(stage, "app"));
+    await writeFile3(join6(stage, "world.json"), JSON.stringify(spec), { mode: 420 });
+    const worker = join6(dirname(fileURLToPath2(import.meta.url)), "worker.js");
+    await copyFile(worker, join6(stage, "worker.js"));
     if (runtime === "hosted") {
       const receipt2 = await executeRemote(stage, spec, opts.log);
       if (receipt2.schema !== "agenttwin/run-v1" || typeof receipt2.runId !== "string" || !/^[a-f0-9-]{36}$/.test(receipt2.runId) || !["passed", "failed", "error", "incomplete"].includes(String(receipt2.status))) throw new CliError("Invalid hosted receipt");
@@ -369,11 +547,11 @@ async function runWorld(cwd, opts) {
       const reportedSources = receipt2.sourceDigests;
       if (receipt2.specDigest !== expectedSpec || !reportedSources || Object.keys(reportedSources).length !== Object.keys(sourceDigests).length || Object.entries(sourceDigests).some(([path, digest]) => reportedSources[path] !== digest)) throw new CliError("Hosted receipt does not match the submitted source/specification");
       const out2 = resolve(cwd, opts.out ?? `.agenttwin/runs/${receipt2.runId}`);
-      await mkdir(out2, { recursive: true });
-      const evidencePath = join3(out2, "run.json");
-      const reportPath = join3(out2, "report.md");
-      await writeFile(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
-      await writeFile(reportPath, `# ${spec.name}: ${receipt2.status}
+      await mkdir2(out2, { recursive: true });
+      const evidencePath = join6(out2, "run.json");
+      const reportPath = join6(out2, "report.md");
+      await writeFile3(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
+      await writeFile3(reportPath, `# ${spec.name}: ${receipt2.status}
 
 Run: ${receipt2.runId}
 
@@ -405,12 +583,12 @@ See run.json for assertions, service state, application output and isolation met
       isolation
     };
     const out = resolve(cwd, opts.out ?? `.agenttwin/runs/${runId}`);
-    await mkdir(out, { recursive: true });
-    await writeFile(join3(out, "run.json"), JSON.stringify(receipt, null, 2) + "\n", { mode: 384 });
-    await writeFile(join3(out, "world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
+    await mkdir2(out, { recursive: true });
+    await writeFile3(join6(out, "run.json"), JSON.stringify(receipt, null, 2) + "\n", { mode: 384 });
+    await writeFile3(join6(out, "world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
     const summary = [`# ${spec.name}: ${report.status}`, "", `Run: ${runId}`, `Image: ${image}`, "", "## Assertions", "", ...report.assertions.map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}${a.path}: expected ${a.count}, observed ${a.actual}`), "", "## Infrastructure assertions", "", ...(report.infrastructureAssertions ?? []).map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}: ${JSON.stringify(a.actual)}`), "", "## Coverage", "", report.coverage, "", "External networking disabled. Only explicitly listed source files were uploaded. New state and tokens are created for each run.", "", "See run.json for application output, faults, events, and initial/final state.", ""].join("\n");
-    await writeFile(join3(out, "report.md"), summary);
-    return { ...receipt, reportPath: join3(out, "report.md"), evidencePath: join3(out, "run.json") };
+    await writeFile3(join6(out, "report.md"), summary);
+    return { ...receipt, reportPath: join6(out, "report.md"), evidencePath: join6(out, "run.json") };
   } finally {
     await rm(stage, { recursive: true, force: true });
   }
@@ -463,30 +641,36 @@ function reviewPreparation(inventory, input) {
 async function runPrepare(cwd, opts) {
   if (!opts.file) throw new CliError("prepare requires --file preparation.json", { code: EXIT.USAGE });
   const file = resolve2(cwd, opts.file);
-  const inventory = JSON.parse(await readFile4(join4(cwd, ".agenttwin/inventory.json"), "utf8"));
-  const { spec, workflow, mappings } = reviewPreparation(inventory, JSON.parse(await readFile4(file, "utf8")));
+  const inventory = JSON.parse(await readFile7(join7(cwd, ".agenttwin/inventory.json"), "utf8"));
+  const discovered = await loadDashboardDiscovery(cwd, inventory);
+  const known = new Set(inventory.workflows.map((w) => w.id));
+  for (const w of discovered.workflows) if (!known.has(w.id)) {
+    inventory.workflows.push({ ...w, confidence: "low", apps: [], sharedEntities: [], evidence: [{ source: "agent-analysis", ref: ".agenttwin/agent-discovery.json" }], steps: w.steps.map((s) => ({ ...s, app: "", evidence: [] })), risk: "high", rank: 0, supported: false, hypothesis: true, linkingSignals: ["Coding-agent analysis requires user review"], scopeUncertain: true, verified: false });
+  }
+  for (const t of discovered.tools) if (!inventory.tools.some((tool) => tool.id === t.id)) throw new Error("Agent-discovered dependencies must be classified in init before preparation. Review the additional tool, then rerun init.");
+  const { spec, workflow, mappings } = reviewPreparation(inventory, JSON.parse(await readFile7(file, "utf8")));
   const directory = resolve2(cwd, opts.out ?? `.agenttwin/prepared/${spec.name}-${randomUUID2().slice(0, 8)}`);
-  const stage = await mkdtemp2(join4(tmpdir2(), "agenttwin-prepare-"));
+  const stage = await mkdtemp2(join7(tmpdir2(), "agenttwin-prepare-"));
   try {
     const sourceDigests = await stageApplication(dirname2(file), spec.files, stage);
     const files = /* @__PURE__ */ Object.create(null);
-    for (const name of spec.files) files[name] = (await readFile4(join4(stage, name))).toString("base64");
+    for (const name of spec.files) files[name] = (await readFile7(join7(stage, name))).toString("base64");
     const manifest = { schema: "agenttwin/prepared-v1", workflowId: workflow.id, invocation: spec.command, sourceDigests, specDigest: createHash2("sha256").update(JSON.stringify(spec)).digest("hex"), mappings, provenance: "user-reviewed invocation and operation contracts; discovery does not verify runtime fidelity", createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-    await writeFile2(join4(stage, "agenttwin.world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
-    await writeFile2(join4(stage, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
-    await writeFile2(join4(stage, "agenttwin.bundle.json"), JSON.stringify({ schema: "agenttwin/upload-v1", spec, files, manifest }, null, 2) + "\n", { mode: 384 });
-    await mkdir2(join4(stage, ".agenttwin"), { recursive: true });
-    await writeFile2(join4(stage, ".agenttwin/inventory.json"), JSON.stringify({ workflows: [{ id: workflow.id }] }), { mode: 384 });
-    await mkdir2(dirname2(directory), { recursive: true });
-    await mkdir2(directory, { mode: 448 });
+    await writeFile4(join7(stage, "agenttwin.world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
+    await writeFile4(join7(stage, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
+    await writeFile4(join7(stage, "agenttwin.bundle.json"), JSON.stringify({ schema: "agenttwin/upload-v1", spec, files, manifest }, null, 2) + "\n", { mode: 384 });
+    await mkdir3(join7(stage, ".agenttwin"), { recursive: true });
+    await writeFile4(join7(stage, ".agenttwin/inventory.json"), JSON.stringify({ workflows: [{ id: workflow.id }] }), { mode: 384 });
+    await mkdir3(dirname2(directory), { recursive: true });
+    await mkdir3(directory, { mode: 448 });
     try {
       const { cp: cp2, readdir: readdir2 } = await import("fs/promises");
-      for (const entry of await readdir2(stage)) await cp2(join4(stage, entry), join4(directory, entry), { recursive: true, force: false, errorOnExist: true });
+      for (const entry of await readdir2(stage)) await cp2(join7(stage, entry), join7(directory, entry), { recursive: true, force: false, errorOnExist: true });
     } catch (error) {
       await rm2(directory, { recursive: true, force: true });
       throw error;
     }
-    return { directory, worldPath: join4(directory, "agenttwin.world.json"), bundlePath: join4(directory, "agenttwin.bundle.json"), manifest };
+    return { directory, worldPath: join7(directory, "agenttwin.world.json"), bundlePath: join7(directory, "agenttwin.bundle.json"), manifest };
   } finally {
     await rm2(stage, { recursive: true, force: true });
   }
@@ -494,9 +678,9 @@ async function runPrepare(cwd, opts) {
 
 // src/commands/setup.ts
 import { Template } from "e2b";
-import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir4, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { join as join8 } from "path";
 async function runSetup(log) {
   if (!process.env.E2B_API_KEY) throw new CliError("Set E2B_API_KEY before creating your hosted runtime template", { code: EXIT.BLOCKED });
   log("Building the AgentTwin template on E2B (Node 22, PostgreSQL 15, Redis). No local containers are used.");
@@ -504,16 +688,16 @@ async function runSetup(log) {
   const result = await Template.build(template, "agenttwin-node-v2", { apiKey: process.env.E2B_API_KEY, cpuCount: 2, memoryMB: 2048, onBuildLogs: (entry) => {
     if (!entry.message.includes("[stdout]") && !entry.message.includes("[stderr]")) log(entry.message);
   } });
-  const directory = join5(homedir2(), ".agenttwin");
-  await mkdir3(directory, { recursive: true, mode: 448 });
-  const path = join5(directory, "runtime.json");
-  await writeFile3(path, JSON.stringify({ provider: "e2b", templateId: result.templateId, buildId: result.buildId }, null, 2) + "\n", { mode: 384 });
+  const directory = join8(homedir2(), ".agenttwin");
+  await mkdir4(directory, { recursive: true, mode: 448 });
+  const path = join8(directory, "runtime.json");
+  await writeFile5(path, JSON.stringify({ provider: "e2b", templateId: result.templateId, buildId: result.buildId }, null, 2) + "\n", { mode: 384 });
   return { provider: "e2b", templateId: result.templateId, buildId: result.buildId, configPath: path };
 }
 
 // src/commands/example.ts
-import { mkdir as mkdir4, writeFile as writeFile4, stat } from "fs/promises";
-import { resolve as resolve3, join as join6 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile6, stat } from "fs/promises";
+import { resolve as resolve3, join as join9 } from "path";
 var exampleSource = `// Replace this file with your own bundled Node workflow.
 const safe = process.argv.includes('--safe');
 const crm = process.env.AGENTTWIN_CRM_URL;
@@ -557,27 +741,27 @@ function exampleWorld(safe = false) {
 async function runExample(cwd, out) {
   const directory = resolve3(cwd, out ?? "agenttwin-example");
   if (await stat(directory).then(() => true, () => false)) throw new CliError(`Destination exists: ${directory}`, { code: EXIT.USAGE, action: "Choose a new --out directory." });
-  await mkdir4(directory, { recursive: true });
-  await writeFile4(join6(directory, "workflow.mjs"), exampleSource);
-  await writeFile4(join6(directory, "agenttwin.world.json"), JSON.stringify(exampleWorld(), null, 2) + "\n");
-  await writeFile4(join6(directory, "safe.world.json"), JSON.stringify(exampleWorld(true), null, 2) + "\n");
-  await writeFile4(join6(directory, "README.md"), `# Support workflow
+  await mkdir5(directory, { recursive: true });
+  await writeFile6(join9(directory, "workflow.mjs"), exampleSource);
+  await writeFile6(join9(directory, "agenttwin.world.json"), JSON.stringify(exampleWorld(), null, 2) + "\n");
+  await writeFile6(join9(directory, "safe.world.json"), JSON.stringify(exampleWorld(true), null, 2) + "\n");
+  await writeFile6(join9(directory, "README.md"), `# Support workflow
 
 Run with agenttwin run --file agenttwin.world.json (expected FAIL), then --file safe.world.json (expected PASS). Requires AGENTTWIN_API_URL and AGENTTWIN_TOKEN, or your own E2B_API_KEY plus a template from agenttwin setup. Each run creates a fresh hosted sandbox and deletes it afterward.
 
 This is actual application code using a synthetic custom ticket API plus the supported Slack JSON subset. It is not a clone of a CRM vendor. Replace workflow.mjs with your own built code and edit the explicit file list, endpoints, seed records and assertions. No npm install runs in the sandbox; dependencies must be bundled into your application.
 `);
-  return { directory, worldPath: join6(directory, "agenttwin.world.json") };
+  return { directory, worldPath: join9(directory, "agenttwin.world.json") };
 }
 
 // src/commands/init.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { writeFile as writeFile9 } from "fs/promises";
-import { join as join14 } from "path";
+import { writeFile as writeFile10 } from "fs/promises";
+import { join as join16 } from "path";
 
 // src/lib/files.ts
-import { readdir, readFile as readFile5, stat as stat2 } from "fs/promises";
-import { join as join7, relative as relative2, sep as sep2 } from "path";
+import { readdir, readFile as readFile8, stat as stat2 } from "fs/promises";
+import { join as join10, relative as relative2, sep as sep2 } from "path";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".agenttwin",
@@ -635,7 +819,7 @@ async function walkDir(root, maxFiles, budgetMs) {
     }
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const full = join7(dir, entry.name);
+      const full = join10(dir, entry.name);
       if (entry.isDirectory()) {
         if (!shouldIgnoreDir(entry.name)) stack.push(full);
       } else if (entry.isFile()) {
@@ -669,7 +853,7 @@ var RepoFileIndex = class {
   }
   async exists(path) {
     try {
-      await stat2(join7(this.cwd, path));
+      await stat2(join10(this.cwd, path));
       return true;
     } catch {
       return false;
@@ -678,7 +862,7 @@ var RepoFileIndex = class {
   async read(path, maxBytes = MAX_BYTES) {
     const cached = this.cache.contents.get(path);
     if (cached !== void 0) return cached;
-    const full = join7(this.cwd, path);
+    const full = join10(this.cwd, path);
     try {
       const info2 = await stat2(full);
       if (!info2.isFile()) return void 0;
@@ -686,7 +870,7 @@ var RepoFileIndex = class {
         this.cache.limits.push(`File excluded by size limit (${maxBytes} bytes): ${path}`);
         return void 0;
       }
-      const text = await readFile5(full, "utf8");
+      const text = await readFile8(full, "utf8");
       this.cache.contents.set(path, text);
       return text;
     } catch {
@@ -1546,13 +1730,13 @@ var containerDetector = {
 // src/discovery/detectors/cloud-creds.ts
 import { stat as stat3 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join8 } from "path";
+import { join as join11 } from "path";
 var CREDENTIALS = [
-  { path: join8(homedir3(), ".aws", "config"), subject: "aws", title: "AWS" },
-  { path: join8(homedir3(), ".aws", "credentials"), subject: "aws", title: "AWS" },
-  { path: join8(homedir3(), ".config", "gcloud"), subject: "gcp", title: "Google Cloud" },
-  { path: join8(homedir3(), ".azure"), subject: "azure", title: "Azure" },
-  { path: join8(homedir3(), ".kube", "config"), subject: "kubernetes", title: "Kubernetes" }
+  { path: join11(homedir3(), ".aws", "config"), subject: "aws", title: "AWS" },
+  { path: join11(homedir3(), ".aws", "credentials"), subject: "aws", title: "AWS" },
+  { path: join11(homedir3(), ".config", "gcloud"), subject: "gcp", title: "Google Cloud" },
+  { path: join11(homedir3(), ".azure"), subject: "azure", title: "Azure" },
+  { path: join11(homedir3(), ".kube", "config"), subject: "kubernetes", title: "Kubernetes" }
 ];
 async function exists(path) {
   try {
@@ -1603,13 +1787,13 @@ function registerDetectors() {
 }
 
 // src/discovery/masking.ts
-var EMAIL = /([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g;
-var TOKENISH = /\b(sk|rk|pk|ghp|gho|ghs|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
+var EMAIL2 = /([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g;
+var TOKENISH2 = /\b(sk|rk|pk|ghp|gho|ghs|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
 function maskSecret(value) {
-  return value.replace(TOKENISH, (match) => `${match.slice(0, 4)}***`);
+  return value.replace(TOKENISH2, (match) => `${match.slice(0, 4)}***`);
 }
 function maskEmail(value) {
-  return value.replace(EMAIL, "$1***$2");
+  return value.replace(EMAIL2, "$1***$2");
 }
 function maskUrl(value) {
   try {
@@ -2111,12 +2295,12 @@ var SimpleDetectorRegistry = class {
 };
 
 // src/discovery/passes/runtime.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { createServer } from "http";
 import { connect } from "net";
 import { readFileSync, rmSync, writeFileSync } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join9 } from "path";
+import { join as join12 } from "path";
 var EGRESS_HOOK = `
 const fs = require('fs');
 const dns = require('dns');
@@ -2186,8 +2370,8 @@ function startProxy(onHost) {
 async function observeEgress(opts) {
   const hosts = /* @__PURE__ */ new Set();
   const { server, url } = await startProxy((host) => hosts.add(host));
-  const logFile = join9(tmpdir3(), `agenttwin-egress-${process.pid}.log`);
-  const hookFile = join9(tmpdir3(), `agenttwin-egress-hook-${process.pid}.cjs`);
+  const logFile = join12(tmpdir3(), `agenttwin-egress-${process.pid}.log`);
+  const hookFile = join12(tmpdir3(), `agenttwin-egress-hook-${process.pid}.cjs`);
   try {
     writeFileSync(hookFile, EGRESS_HOOK, "utf8");
     writeFileSync(logFile, "", "utf8");
@@ -2196,7 +2380,7 @@ async function observeEgress(opts) {
   let child;
   if (opts.run) {
     opts.log(`Observing egress: spawning \`${opts.run}\` through ${url}`);
-    child = spawn(opts.run, {
+    child = spawn2(opts.run, {
       shell: true,
       env: {
         ...process.env,
@@ -2654,6 +2838,32 @@ function singularize(word) {
   return word;
 }
 
+// src/inventory/relationships.ts
+import { createHash as createHash4 } from "crypto";
+
+// src/inventory/entrypoints.ts
+function codeOnly(source) {
+  return source.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|`(?:\\.|[^`\\])*`/g, (part) => part.replace(/[^\n]/g, " "));
+}
+function exportedEntrypoints(source) {
+  const code = codeOnly(source);
+  const pattern = /\bexport\s+(?:default\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)[^{;]*\{|\bexport\s+(?:const|let)\s+(\w+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::[^=;]+)?=>\s*\{/g;
+  const result = [];
+  let match;
+  while (match = pattern.exec(code)) {
+    let depth = 1, end = pattern.lastIndex;
+    while (end < code.length && depth) {
+      if (code[end] === "{") depth++;
+      if (code[end] === "}") depth--;
+      end++;
+    }
+    if (depth) continue;
+    result.push({ name: match[1] || match[2], startLine: code.slice(0, match.index).split("\n").length, endLine: code.slice(0, end).split("\n").length });
+    pattern.lastIndex = end;
+  }
+  return result;
+}
+
 // src/inventory/operations.ts
 var WRITE_VERBS = /* @__PURE__ */ new Set([
   "create",
@@ -2708,7 +2918,7 @@ function scanOperations(text, path) {
     seen.add(key);
     out.push({ receiver, resource, verb, kind, ref: `${path}:${line}` });
   }
-  return out.slice(0, 40);
+  return out;
 }
 
 // src/inventory/relationships.ts
@@ -2888,9 +3098,12 @@ async function buildRelationships(apps, tools, files, decisions) {
   const roles = /* @__PURE__ */ new Map();
   const fileEntities = /* @__PURE__ */ new Map();
   const uncertainOperations = [];
+  const entrypointCalls = [];
+  const sourceText = /* @__PURE__ */ new Map();
   for (const path of sourceFiles) {
     const text = await files.read(path, 2e5);
     if (!text) continue;
+    sourceText.set(path, text);
     const app = appForPath(apps, path);
     const role = roles.get(app.id) ?? { produced: /* @__PURE__ */ new Set(), consumed: /* @__PURE__ */ new Set() };
     collect(PRODUCE, text, role.produced);
@@ -2923,6 +3136,7 @@ async function buildRelationships(apps, tools, files, decisions) {
         evidence: []
       };
       const label = `${op.resource}.${op.verb}`;
+      entrypointCalls.push({ path, line: Number(op.ref.slice(path.length + 1)), providerId, toolId: tool.id, kind: op.kind, label, resource: op.resource, ref: op.ref });
       if (!record2.operations.includes(label)) record2.operations.push(label);
       if (!record2.resources.includes(op.resource)) record2.resources.push(op.resource);
       if (!record2.evidence.some((e) => e.ref === op.ref)) record2.evidence.push({ source: "static", ref: op.ref });
@@ -3066,6 +3280,34 @@ async function buildRelationships(apps, tools, files, decisions) {
       verified: false
     });
   }
+  for (const [path, text] of sourceText) {
+    const app = appForPath(apps, path);
+    for (const entry of exportedEntrypoints(text)) {
+      const calls = entrypointCalls.filter((call) => call.path === path && call.line >= entry.startLine && call.line <= entry.endLine && decidedRecords.some((record2) => record2.toolId === call.toolId && record2.kind === call.kind && record2.evidence.some((e) => e.ref === call.ref)));
+      if (!calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
+      const dependencies = [...new Set(calls.map((call) => call.toolId))];
+      const evidence = [...new Set(calls.map((call) => call.ref))].map((ref) => ({ source: "static", ref }));
+      workflows.push({
+        id: "entry:" + createHash4("sha256").update(path + ":" + entry.name).digest("hex").slice(0, 20),
+        title: entry.name,
+        entrypoint: path + "#" + entry.name,
+        apps: [app.id],
+        tools: dependencies,
+        steps: dependencies.map((tool) => ({ app: app.id, tool, operations: [...new Set(calls.filter((c) => c.toolId === tool).map((c) => c.label))], evidence })),
+        sharedEntities: [...new Set(calls.map((call) => singularize(call.resource)))],
+        evidence,
+        confidence: "medium",
+        risk: "high",
+        rank: 0,
+        supported: false,
+        hypothesis: true,
+        linkingSignals: ["exported function containing binding-resolved side effects; invocation and correctness require review"],
+        scopeUncertain: true,
+        verified: false
+      });
+    }
+  }
+  if (sourceFiles.length === MAX_FILES3) gaps.push("Source scan is limited to 2500 files; split large repositories into explicit roots. Not every workflow can be proven by static discovery.");
   const finalWorkflows = workflows.filter((w) => !rejected.has(w.id)).map(
     (w) => confirmed.has(w.id) ? { ...w, supported: true, hypothesis: false, linkingSignals: [...w.linkingSignals, "confirmed by decision"] } : w
   );
@@ -3379,8 +3621,8 @@ async function buildInventory({
 }
 
 // src/inventory/store.ts
-import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
-import { join as join10 } from "path";
+import { mkdir as mkdir6, readFile as readFile9, writeFile as writeFile7 } from "fs/promises";
+import { join as join13 } from "path";
 var STORE_DIR = ".agenttwin";
 var STORE_GITIGNORE = [
   "inventory.json",
@@ -3396,24 +3638,24 @@ var STORE_GITIGNORE = [
   ""
 ].join("\n");
 function storeDir(cwd) {
-  return join10(cwd, STORE_DIR);
+  return join13(cwd, STORE_DIR);
 }
 function storePath(cwd, name) {
-  return join10(storeDir(cwd), name);
+  return join13(storeDir(cwd), name);
 }
 async function ensureStore(cwd) {
-  await mkdir5(storeDir(cwd), { recursive: true });
-  await writeFile5(storePath(cwd, ".gitignore"), STORE_GITIGNORE, "utf8");
+  await mkdir6(storeDir(cwd), { recursive: true });
+  await writeFile7(storePath(cwd, ".gitignore"), STORE_GITIGNORE, "utf8");
 }
 async function readJson(path) {
   try {
-    return JSON.parse(await readFile6(path, "utf8"));
+    return JSON.parse(await readFile9(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 async function writeJson(path, value) {
-  await writeFile5(path, `${JSON.stringify(value, null, 2)}
+  await writeFile7(path, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
 var readInventory = (cwd) => readJson(storePath(cwd, "inventory.json"));
@@ -3616,30 +3858,13 @@ var REGISTRY = [
 ];
 
 // src/inspect/runner.ts
-import { spawn as spawn2 } from "child_process";
-
-// src/inspect/sanitize.ts
-var URL_CREDENTIALS = /(https?:\/\/)([^/@\s:]+)(:[^/@\s]+)?@/gi;
-var TOKENISH2 = /\b(sk|rk|pk|ghp|gho|ghs|glpat|xox[baprs]|AKIA|AIza)[A-Za-z0-9_-]{6,}\b/g;
-var EMAIL2 = /([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g;
-function stripUrlCredentials(value) {
-  return value.replace(URL_CREDENTIALS, "$1");
-}
-function sanitizeOutput(value) {
-  return stripUrlCredentials(value).replace(TOKENISH2, (m) => `${m.slice(0, 4)}***`).replace(EMAIL2, "$1***$2");
-}
-function excerpt(value, max = 200) {
-  const clean = sanitizeOutput(value).replace(/\s+/g, " ").trim();
-  return clean.length > max ? `${clean.slice(0, max)}\u2026` : clean;
-}
-
-// src/inspect/runner.ts
+import { spawn as spawn3 } from "child_process";
 function runCommand(spec, cwd, signal) {
   return new Promise((resolve5) => {
     if (signal.aborted) {
       return resolve5({ code: null, stdout: "", stderr: "", missing: false, timedOut: false, cancelled: true });
     }
-    const child = spawn2(spec.cmd, spec.args, {
+    const child = spawn3(spec.cmd, spec.args, {
       cwd,
       stdio: ["ignore", "pipe", "pipe"],
       env: process.env
@@ -4177,12 +4402,12 @@ async function runExport(opts) {
   const plan = await readPlan(opts.cwd);
   const bundle = { schema: "export/v1", inventory, plan: plan ?? null };
   if (opts.out) {
-    const { mkdir: mkdir8, writeFile: writeFile10 } = await import("fs/promises");
-    const { join: join16 } = await import("path");
+    const { mkdir: mkdir8, writeFile: writeFile11 } = await import("fs/promises");
+    const { join: join18 } = await import("path");
     await mkdir8(opts.out, { recursive: true });
-    await writeFile10(join16(opts.out, "inventory.json"), `${JSON.stringify(inventory, null, 2)}
+    await writeFile11(join18(opts.out, "inventory.json"), `${JSON.stringify(inventory, null, 2)}
 `, "utf8");
-    if (plan) await writeFile10(join16(opts.out, "plan.json"), `${JSON.stringify(plan, null, 2)}
+    if (plan) await writeFile11(join18(opts.out, "plan.json"), `${JSON.stringify(plan, null, 2)}
 `, "utf8");
     return { schema: "export/v1", out: opts.out, wrote: ["inventory.json", ...plan ? ["plan.json"] : []] };
   }
@@ -4582,16 +4807,16 @@ async function askQuestions(questions) {
 init_answers();
 
 // src/lib/config.ts
-import { readFile as readFile7, writeFile as writeFile6 } from "fs/promises";
-import { join as join11 } from "path";
+import { readFile as readFile10, writeFile as writeFile8 } from "fs/promises";
+import { join as join14 } from "path";
 var CONFIG_FILENAME = "agenttwin.config.json";
 var CONFIG_VERSION = 2;
 function configPath(cwd) {
-  return join11(cwd, CONFIG_FILENAME);
+  return join14(cwd, CONFIG_FILENAME);
 }
 async function readConfig(cwd) {
   try {
-    const text = await readFile7(configPath(cwd), "utf8");
+    const text = await readFile10(configPath(cwd), "utf8");
     return JSON.parse(text);
   } catch {
     return void 0;
@@ -4627,57 +4852,14 @@ function buildConfigFromInventory(inventory, existing) {
 }
 async function writeConfig(cwd, config, _options = {}) {
   const path = configPath(cwd);
-  await writeFile6(path, `${JSON.stringify(config, null, 2)}
+  await writeFile8(path, `${JSON.stringify(config, null, 2)}
 `, "utf8");
   return { path };
 }
 
-// src/commands/dashboard.ts
-import { cp, mkdir as mkdir6, readFile as readFile8, writeFile as writeFile7 } from "fs/promises";
-import { basename, join as join12 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function dashboardInventory(cwd, inventory) {
-  return JSON.parse(sanitizeOutput(JSON.stringify({
-    schema: "company-inventory/v1",
-    generatedAt: inventory.generatedAt,
-    name: basename(cwd),
-    tools: inventory.tools.map((t) => ({
-      id: t.id,
-      title: t.title,
-      kind: t.kind,
-      category: t.category,
-      confidence: t.confidence,
-      interface: t.kind === "runtime" ? "terminal" : "api"
-    })),
-    workflows: inventory.workflows.map((w) => ({ id: w.id, title: w.title, confidence: w.confidence, supported: w.supported, verified: false, tools: w.tools, steps: w.steps.map((s) => ({ tool: s.tool, operations: s.operations })) }))
-  })));
-}
-async function writeDashboard(cwd, inventory) {
-  const directory = join12(cwd, ".agenttwin", "dashboard");
-  let bundle = fileURLToPath2(new URL("./dashboard/", import.meta.url));
-  try {
-    await readFile8(join12(bundle, "index.html"));
-  } catch {
-    bundle = fileURLToPath2(new URL("../../../../site/", import.meta.url));
-  }
-  await mkdir6(join12(directory, "assets", "dashboard"), { recursive: true });
-  const html = await readFile8(join12(bundle, bundle.endsWith("/site/") ? "dashboard.html" : "index.html"), "utf8");
-  for (const folder of ["dashboard", "icons", "logo", "fonts"]) {
-    await cp(join12(bundle, "assets", folder), join12(directory, "assets", folder), { recursive: true });
-  }
-  await cp(join12(bundle, "assets", "brand.css"), join12(directory, "assets", "brand.css"));
-  const data = dashboardInventory(cwd, inventory);
-  const payload = JSON.stringify(data).replace(/</g, "\\u003c");
-  const page2 = html.replace('type="module"', "defer").replace('<script src="assets/dashboard/dashboard.js"', `<script id="agenttwin-discovery" type="application/json">${payload}</script><script src="assets/dashboard/dashboard.js"`).replace(/href="index.html"/g, 'href="../report.html"').replace(/href="docs\/"/g, 'href="../report.html"').replace("Docs \u2197", "Discovery report \u2197").replace("Runtime documentation \u2197", "Coverage report \u2197").replace("Back to website \u2197", "Discovery report \u2197");
-  await writeFile7(join12(directory, "index.html"), page2, "utf8");
-  await writeFile7(join12(directory, "assets", "dashboard", "inventory.json"), JSON.stringify(data), "utf8");
-  await writeFile7(join12(directory, "assets", "dashboard", "runs.json"), '{"runs":[]}', "utf8");
-  return join12(directory, "index.html");
-}
-
 // src/commands/preview.ts
-import { mkdir as mkdir7, readFile as readFile9, writeFile as writeFile8 } from "fs/promises";
-import { dirname as dirname3, join as join13, resolve as resolve4 } from "path";
+import { mkdir as mkdir7, readFile as readFile11, writeFile as writeFile9 } from "fs/promises";
+import { dirname as dirname3, join as join15, resolve as resolve4 } from "path";
 
 // src/preview/html.ts
 import { randomBytes as randomBytes2 } from "crypto";
@@ -4743,7 +4925,7 @@ async function writeBrowserReport(cwd, inventory, plan, out) {
   await mkdir7(dirname3(path), { recursive: true });
   const cleanInventory = JSON.parse(sanitizeOutput(JSON.stringify(inventory)));
   const cleanPlan = JSON.parse(sanitizeOutput(JSON.stringify(plan)));
-  await writeFile8(path, renderBrowserReport(cleanInventory, cleanPlan), "utf8");
+  await writeFile9(path, renderBrowserReport(cleanInventory, cleanPlan), "utf8");
   return path;
 }
 async function runReport(cwd, out) {
@@ -4758,13 +4940,13 @@ async function runFeedback(cwd, note) {
   const path = storePath(cwd, "feedback.json");
   let entries = [];
   try {
-    const existing = JSON.parse(await readFile9(path, "utf8"));
+    const existing = JSON.parse(await readFile11(path, "utf8"));
     entries = Array.isArray(existing.items) ? existing.items : [];
   } catch (error) {
     if (error.code !== "ENOENT") throw new CliError("Existing feedback could not be read; it was not overwritten");
   }
   entries.push({ createdAt: (/* @__PURE__ */ new Date()).toISOString(), note: sanitizeOutput(note.trim()) });
-  await writeFile8(path, `${JSON.stringify({ schema: "preview-feedback/v1", items: entries }, null, 2)}
+  await writeFile9(path, `${JSON.stringify({ schema: "preview-feedback/v1", items: entries }, null, 2)}
 `, "utf8");
   return { schema: "feedback-result/v1", saved: true, uploaded: false, path, notes: entries.length };
 }
@@ -4853,6 +5035,8 @@ function mergeDecisions(existing, incoming) {
   return [...byId.values()].sort((a, b) => a.id.localeCompare(b.id));
 }
 async function runInit(opts) {
+  if (opts.agent && opts.agent !== "opencode") throw new Error("Supported launcher: --agent opencode. Use .agenttwin/AGENT-TASK.md with any other coding agent.");
+  if (opts.agent && (opts.dryRun || opts.json)) throw new Error("A coding session requires a writing, interactive init (omit --dry-run and --json).");
   setQuiet(opts.json);
   const interactive = !opts.json && !opts.yes && !opts.dryRun && (opts.interactive === true || !opts.json && process.stdin.isTTY === true && process.stdout.isTTY === true);
   const log = (message) => {
@@ -4915,8 +5099,8 @@ async function runInit(opts) {
     await writeInventory(opts.cwd, finalInventory);
     await writePlan(opts.cwd, plan);
     await writeConfig(opts.cwd, config, { force: opts.force });
-    await writeFile9(join14(opts.cwd, "ENVIRONMENT.md"), renderEnvironment(finalInventory), "utf8");
-    await writeFile9(join14(opts.cwd, "REPLICATION.md"), renderReplication(finalInventory, plan), "utf8");
+    await writeFile10(join16(opts.cwd, "ENVIRONMENT.md"), renderEnvironment(finalInventory), "utf8");
+    await writeFile10(join16(opts.cwd, "REPLICATION.md"), renderReplication(finalInventory, plan), "utf8");
     reportPath = await writeBrowserReport(opts.cwd, finalInventory, plan);
     dashboardPath = await writeDashboard(opts.cwd, finalInventory);
     wrote = true;
@@ -4960,6 +5144,19 @@ async function runInit(opts) {
     if (dashboardPath) info(`Open ${dashboardPath} to review detected connectors and workflows.`);
     if (reportPath) info(`Open ${reportPath} in your browser. To save review notes: ${bold('agenttwin feedback --note "..."')}`);
   }
+  if (!opts.dryRun) {
+    const taskPath = await writeSessionTask(opts.cwd);
+    if (!opts.json) info(`Coding-agent task: ${taskPath}`);
+    const launch = opts.agent === "opencode" || interactive && installedOpenCode() && await confirm("Start OpenCode with your configured provider to analyze workflows? Repository context may be sent to that provider.", false);
+    if (launch) {
+      await launchSession(opts.cwd);
+      await writeDashboard(opts.cwd, finalInventory);
+    }
+    if (opts.sync) {
+      const synced = await runSync(opts.cwd);
+      if (!opts.json) ok(`Synced ${synced.workflows} candidates: ${synced.dashboard}`);
+    } else if (!opts.json) info("Send reviewed discovery to your account: npx agenttwin sync (requires AGENTTWIN_TOKEN).");
+  }
   process.exitCode = result.exitCode;
 }
 
@@ -4967,7 +5164,7 @@ async function runInit(opts) {
 function readVersion() {
   const here = dirname4(fileURLToPath3(import.meta.url));
   const pkg = JSON.parse(
-    readFileSync3(join15(here, "..", "package.json"), "utf8")
+    readFileSync3(join17(here, "..", "package.json"), "utf8")
   );
   return pkg.version ?? "0.0.0";
 }
@@ -4977,12 +5174,14 @@ function helpText() {
     "",
     bold("Usage"),
     "  $ npx agenttwin <command> [options]",
+    "  $ npx agenttwin init --agent opencode [--sync]",
     "",
     bold("Commands"),
     `  ${"setup".padEnd(12)}Build your hosted E2B runtime template (once per account)`,
     `  ${"prepare".padEnd(12)}Bundle a reviewed discovered workflow (--file preparation.json)`,
     `  ${"run".padEnd(12)}Execute your Node workflow in a hosted E2B sandbox (--file world.json)`,
     `  ${"example".padEnd(12)}Write an editable multi-service workflow (--out directory)`,
+    `  ${"sync".padEnd(12)}Send discovery metadata to your account dashboard`,
     `  ${"init".padEnd(12)}Discover and write agenttwin.config.json + reports`,
     `  ${"discover".padEnd(12)}Build the company inventory (writes .agenttwin/inventory.json)`,
     `  ${"decide".padEnd(12)}Apply structured decisions (--file or --stdin)`,
@@ -5029,6 +5228,8 @@ async function main() {
         answers: { type: "string" },
         "max-questions": { type: "string" },
         interactive: { type: "boolean" },
+        agent: { type: "string" },
+        sync: { type: "boolean" },
         "non-interactive": { type: "boolean" },
         note: { type: "string" },
         incremental: { type: "boolean" },
@@ -5115,6 +5316,13 @@ Evidence: ${result.evidencePath}`);
 Run: agenttwin run --file "${result.worldPath}"`);
         return;
       }
+      case "sync": {
+        const result = await runSync(cwd);
+        printResult(result, `Synced ${result.tools} resources and ${result.workflows} workflow candidates.
+${result.dashboard}
+${result.uploaded}`);
+        return;
+      }
       case "init":
         await runInit({
           cwd,
@@ -5127,7 +5335,9 @@ Run: agenttwin run --file "${result.worldPath}"`);
           observeRun: str("observe-run"),
           answers: str("answers"),
           maxQuestions: Number(str("max-questions") ?? 8) || 8,
-          interactive: flag("interactive")
+          interactive: flag("interactive"),
+          agent: str("agent"),
+          sync: flag("sync")
         });
         return;
       case "discover": {
@@ -5147,7 +5357,7 @@ Run: agenttwin run --file "${result.worldPath}"`);
           result,
           [
             `Discovered ${counts.tools} tools (${counts.classified} classified) \xB7 ${counts.unclassified} unclassified \xB7 ${counts.withTwin} with twins`,
-            `Wrote ${join15(".agenttwin", "inventory.json")}`,
+            `Wrote ${join17(".agenttwin", "inventory.json")}`,
             result.blocked.length > 0 ? `Blocked: ${result.blocked.join("; ")}` : "",
             result.opportunities.length > 0 ? `Opportunities: ${result.opportunities.join("; ")}` : "",
             result.reconciliation.splits.length > 0 ? `Splits: ${result.reconciliation.splits.map((s) => s.from).join(", ")}` : ""
@@ -5170,7 +5380,7 @@ Run: agenttwin run --file "${result.worldPath}"`);
         printResult(
           result,
           `Plan: ${result.plan.items.length} tools \xB7 ${Object.entries(byStrategy).map(([k, v]) => `${k} ${v}`).join(", ")}
-Wrote ${join15(".agenttwin", "plan.json")}`
+Wrote ${join17(".agenttwin", "plan.json")}`
         );
         return;
       }