buckyos 0.7.138 → 0.7.142

package/cli/dist/cli.mjs

@@ -2,7 +2,7 @@ import process from "node:process";
 import { fileURLToPath } from "node:url";
 import * as nodePath from "node:path";
 import { resolve as resolve$5, dirname as dirname$3 } from "node:path";
-import { BuckyOSSDK, RuntimeType, buckyos, namelib, VerifyHubClient, createAppInstanceId, parseSessionTokenClaims, ndn, ndm_proxy } from "buckyos/node";
+import { BuckyOSSDK, RuntimeType, buckyos, namelib, VerifyHubClient, createAppInstanceId, parseSessionTokenClaims, ndn, ndm_proxy, ExecutorCommandStream } from "buckyos/node";
 import * as provisionSdk from "buckyos/provision";
 import { createHash } from "node:crypto";
 import { readFile, writeFile, readdir, stat, lstat, realpath, mkdtemp, rename, rm, mkdir, chmod, symlink, copyFile, open } from "node:fs/promises";
@@ -345,20 +345,20 @@ function validateSchema(value, schema, path) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {
       throw new UsageError("SCHEMA_VALIDATION_FAILED", `${path} must be an object`);
     }
-    const object = value;
+    const object2 = value;
     for (const required of schema.required ?? []) {
-      if (!Object.hasOwn(object, required)) {
+      if (!Object.hasOwn(object2, required)) {
         throw new UsageError("SCHEMA_VALIDATION_FAILED", `${path}.${required} is required`);
       }
     }
     if (schema.additionalProperties === false) {
-      for (const key of Object.keys(object)) {
+      for (const key of Object.keys(object2)) {
         if (!Object.hasOwn(schema.properties ?? {}, key)) {
           throw new UsageError("SCHEMA_VALIDATION_FAILED", `${path}.${key} is not allowed`);
         }
       }
     }
-    for (const [key, propertyValue] of Object.entries(object)) {
+    for (const [key, propertyValue] of Object.entries(object2)) {
       const propertySchema = schema.properties?.[key];
       if (propertySchema)
         validateSchema(propertyValue, propertySchema, `${path}.${key}`);
@@ -1874,10 +1874,9 @@ class SdkAuthenticationTransport {
       }),
       timeoutMs
     );
-    const normalized = VerifyHubClient.normalizeLoginResponse(response);
-    if (!normalized.session_token)
+    if (!response.session_token)
       throw new Error("verify-hub returned no session token");
-    return normalized.session_token;
+    return response.session_token;
   }
 }
 function identityAuthTarget(principalKind, subject) {
@@ -2057,11 +2056,11 @@ function renderText(data) {
   if (typeof data === "string")
     return data;
   if (data && typeof data === "object" && !Array.isArray(data)) {
-    const object = data;
-    if (typeof object.script === "string")
-      return object.script;
-    if (typeof object.text === "string")
-      return object.text;
+    const object2 = data;
+    if (typeof object2.script === "string")
+      return object2.script;
+    if (typeof object2.text === "string")
+      return object2.text;
   }
   return JSON.stringify(data, null, 2);
 }
@@ -2069,11 +2068,11 @@ function renderTable(data) {
   if (Array.isArray(data))
     return renderRows(data);
   if (data && typeof data === "object") {
-    const object = data;
-    const arrayEntry = Object.entries(object).find(([, value]) => Array.isArray(value));
+    const object2 = data;
+    const arrayEntry = Object.entries(object2).find(([, value]) => Array.isArray(value));
     if (arrayEntry)
       return renderRows(arrayEntry[1]);
-    const rows = Object.entries(object).map(([key, value]) => ({ key, value: displayValue(value) }));
+    const rows = Object.entries(object2).map(([key, value]) => ({ key, value: displayValue(value) }));
     return renderRows(rows);
   }
   return String(data ?? "");
@@ -2499,7 +2498,7 @@ function replPrompt(config) {
   return `buckyos[${profile}|${zone}|${identity}]> `;
 }
 const EMPTY_INPUT$3 = { type: "object", properties: {}, additionalProperties: false };
-const OBJECT_OUTPUT$c = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$d = { type: "object", additionalProperties: true };
 function createAuthModule() {
   return {
     name: "auth",
@@ -2509,7 +2508,7 @@ function createAuthModule() {
         verb: "whoami",
         summary: "Show the effective principal and application identity",
         inputSchema: EMPTY_INPUT$3,
-        outputSchema: OBJECT_OUTPUT$c,
+        outputSchema: OBJECT_OUTPUT$d,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2527,7 +2526,7 @@ function createAuthModule() {
         verb: "session-status",
         summary: "Show the in-memory session state without exposing credentials",
         inputSchema: EMPTY_INPUT$3,
-        outputSchema: OBJECT_OUTPUT$c,
+        outputSchema: OBJECT_OUTPUT$d,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2548,7 +2547,7 @@ const EMPTY_INPUT$2 = {
   properties: {},
   additionalProperties: false
 };
-const OBJECT_OUTPUT$b = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$c = { type: "object", additionalProperties: true };
 function createCoreModules(registry) {
   return [createCommandModule(registry), createConfigModule(), createCompletionModule(registry)];
 }
@@ -2561,7 +2560,7 @@ function createCommandModule(registry) {
         verb: "list",
         summary: "List registered modules and commands",
         inputSchema: EMPTY_INPUT$2,
-        outputSchema: OBJECT_OUTPUT$b,
+        outputSchema: OBJECT_OUTPUT$c,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2594,7 +2593,7 @@ function createCommandModule(registry) {
           required: ["target_module", "target_verb"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$b,
+        outputSchema: OBJECT_OUTPUT$c,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2616,7 +2615,7 @@ function createConfigModule() {
         verb: "list",
         summary: "List the global configuration and available profiles",
         inputSchema: EMPTY_INPUT$2,
-        outputSchema: OBJECT_OUTPUT$b,
+        outputSchema: OBJECT_OUTPUT$c,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2647,7 +2646,7 @@ function createConfigModule() {
           },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$b,
+        outputSchema: OBJECT_OUTPUT$c,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2693,7 +2692,7 @@ function createConfigModule() {
           required: ["key", "value"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$b,
+        outputSchema: OBJECT_OUTPUT$c,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -2733,7 +2732,7 @@ function createConfigModule() {
           required: ["profile_name"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$b,
+        outputSchema: OBJECT_OUTPUT$c,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -2765,7 +2764,7 @@ function createConfigModule() {
           properties: { effective: { type: "boolean" } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$b,
+        outputSchema: OBJECT_OUTPUT$c,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -3007,7 +3006,7 @@ async function buckyosInfo(ctx) {
   );
 }
 const SERVICE_NAME = "system_config";
-const OBJECT_OUTPUT$a = { type: "object", additionalProperties: false };
+const OBJECT_OUTPUT$b = { type: "object", additionalProperties: false };
 const KEY_INPUT = {
   type: "object",
   properties: { key: { type: "string", minLength: 1 } },
@@ -3025,7 +3024,7 @@ function createSystemConfigModule() {
         positionals: [{ name: "key", description: "System-config key" }],
         inputSchema: KEY_INPUT,
         outputSchema: {
-          ...OBJECT_OUTPUT$a,
+          ...OBJECT_OUTPUT$b,
           properties: {
             key: { type: "string" },
             value: { type: "string" },
@@ -3068,7 +3067,7 @@ function createSystemConfigModule() {
           additionalProperties: false
         },
         outputSchema: {
-          ...OBJECT_OUTPUT$a,
+          ...OBJECT_OUTPUT$b,
           properties: {
             key: { type: "string" },
             items: { type: "array", items: { type: "string" } }
@@ -3122,7 +3121,7 @@ function setCommand() {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$a,
+      ...OBJECT_OUTPUT$b,
       properties: { key: { type: "string" }, updated: { type: "boolean" } },
       required: ["key", "updated"]
     },
@@ -3161,7 +3160,7 @@ function setFileCommand() {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$a,
+      ...OBJECT_OUTPUT$b,
       properties: { key: { type: "string" }, updated: { type: "boolean" } },
       required: ["key", "updated"]
     },
@@ -3198,7 +3197,7 @@ function mutationCommand(options) {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$a,
+      ...OBJECT_OUTPUT$b,
       properties: {
         key: { type: "string" },
         [options.resultProperty]: { type: "boolean" }
@@ -3240,8 +3239,8 @@ async function readValueFile(path) {
 function isConfigValue(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return false;
-  const object = value;
-  return typeof object.value === "string" && Number.isSafeInteger(object.version) && Number(object.version) >= 0;
+  const object2 = value;
+  return typeof object2.value === "string" && Number.isSafeInteger(object2.version) && Number(object2.version) >= 0;
 }
 function invalidResponse$3(method) {
   throw new ToolError(
@@ -3333,7 +3332,7 @@ async function gzipFile(source, destination) {
 async function readTarGz(bytes, limit) {
   const tar = await gunzipBytes(bytes, limit);
   const decoder = new TextDecoder("utf-8", { fatal: true });
-  const text = (offset2, length) => decoder.decode(tar.subarray(offset2, offset2 + length)).replace(/\0.*$/s, "");
+  const text2 = (offset2, length) => decoder.decode(tar.subarray(offset2, offset2 + length)).replace(/\0.*$/s, "");
   const files = [];
   const seen = /* @__PURE__ */ new Set();
   let offset = 0;
@@ -3342,10 +3341,10 @@ async function readTarGz(bytes, limit) {
     let size;
     let mode;
     try {
-      const prefix = text(offset + 257, 6) === "ustar" ? text(offset + 345, 155) : "";
-      raw = prefix ? `${prefix}/${text(offset, 100)}` : text(offset, 100);
-      size = Number.parseInt(text(offset + 124, 12).trim() || "0", 8);
-      mode = Number.parseInt(text(offset + 100, 8).trim() || "0", 8);
+      const prefix = text2(offset + 257, 6) === "ustar" ? text2(offset + 345, 155) : "";
+      raw = prefix ? `${prefix}/${text2(offset, 100)}` : text2(offset, 100);
+      size = Number.parseInt(text2(offset + 124, 12).trim() || "0", 8);
+      mode = Number.parseInt(text2(offset + 100, 8).trim() || "0", 8);
     } catch {
       throw invalidZip("payload", "tar header is not valid UTF-8");
     }
@@ -3961,14 +3960,14 @@ function writeString(target, offset, length, value) {
   target.set(bytes, offset);
 }
 function writeOctal(target, offset, length, value) {
-  const text = value.toString(8).padStart(length - 1, "0");
-  if (text.length >= length)
+  const text2 = value.toString(8).padStart(length - 1, "0");
+  if (text2.length >= length)
     throw new UsageError("FILE_TOO_LARGE", "tar field overflows");
-  writeString(target, offset, length, `${text}\0`);
+  writeString(target, offset, length, `${text2}\0`);
 }
 function writeChecksum(target, value) {
-  const text = value.toString(8).padStart(6, "0");
-  writeString(target, 148, 8, `${text}\0 `);
+  const text2 = value.toString(8).padStart(6, "0");
+  writeString(target, 148, 8, `${text2}\0 `);
 }
 function validateZipEntryName(name) {
   if (!name || name.includes("\0") || name.includes("\\") || name.startsWith("/")) {
@@ -5106,7 +5105,7 @@ function validateContentHandlers(value, permissions) {
   }
   return value;
 }
-const PACKAGE_VERSION = "0.7.138";
+const PACKAGE_VERSION = "0.7.142";
 const TOOL_VERSION = PACKAGE_VERSION;
 const SDK_VERSION = PACKAGE_VERSION;
 const PROTOCOL_VERSION = "1";
@@ -5123,7 +5122,7 @@ const VERSION$1 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 const SHA256_ID = /^sha256:[0-9a-f]{64}$/;
 const OBJECT_ID = /^(?:appdoc|pkg):[0-9a-f]{64}$/;
 const SAFE_GENERATED_FILE = /^[A-Za-z0-9._-]+$/;
-const OBJECT_OUTPUT$9 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$a = { type: "object", additionalProperties: true };
 const APP_KINDS = ["static-web", "script", "docker", "agent-skills"];
 const PATH_KINDS = {
   "static-web": { key: "web", category: "web", selectorType: "static" },
@@ -5166,7 +5165,7 @@ function createPikgModule(dependencies = {}) {
           properties: { meta_dir: { type: "string", minLength: 1 } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$9,
+        outputSchema: OBJECT_OUTPUT$a,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -5213,7 +5212,7 @@ function createPikgModule(dependencies = {}) {
           },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$9,
+        outputSchema: OBJECT_OUTPUT$a,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -5238,7 +5237,7 @@ function createPikgModule(dependencies = {}) {
           properties: { meta_dir: { type: "string", minLength: 1 } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$9,
+        outputSchema: OBJECT_OUTPUT$a,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -5259,7 +5258,7 @@ function createPikgModule(dependencies = {}) {
           properties: { dist_dir: { type: "string", minLength: 1 } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$9,
+        outputSchema: OBJECT_OUTPUT$a,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -5279,7 +5278,7 @@ function createPikgModule(dependencies = {}) {
           required: ["pikg_path"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$9,
+        outputSchema: OBJECT_OUTPUT$a,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -5300,7 +5299,7 @@ function createPikgModule(dependencies = {}) {
           properties: { meta_dir: { type: "string", minLength: 1 } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$9,
+        outputSchema: OBJECT_OUTPUT$a,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "destructive" },
         asyncMode: "sync",
@@ -6394,8 +6393,8 @@ function toPortablePath(path) {
   return path.split(getHost().path.sep).join("/") || ".";
 }
 function safeDockerError(bytes) {
-  const text = new TextDecoder().decode(bytes).trim().replaceAll(/[\r\n]+/g, " ");
-  return text.slice(0, 500) || "unknown Docker error";
+  const text2 = new TextDecoder().decode(bytes).trim().replaceAll(/[\r\n]+/g, " ");
+  return text2.slice(0, 500) || "unknown Docker error";
 }
 async function removeTreeIfExists(path) {
   try {
@@ -6563,7 +6562,7 @@ const CONTROL_PANEL_SERVICE = "control-panel";
 const PLAN_SCHEMA_VERSION = 4;
 const STAGING_RELEASE_TIMEOUT_MS = 5e3;
 const ZIP_LOCAL_MAGIC = [80, 75, 3, 4];
-const OBJECT_OUTPUT$8 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$9 = { type: "object", additionalProperties: true };
 const INSTALL_POLICIES = [
   "strict-public",
   "normal",
@@ -6614,7 +6613,7 @@ function cancelCommand$1() {
       required: ["task_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "sync",
@@ -6649,7 +6648,7 @@ function fetchCommand(dependencies) {
       target: { type: "object", additionalProperties: true },
       install_params: { type: "object", additionalProperties: true }
     }),
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -6666,7 +6665,7 @@ function listCommand$2() {
     verb: "list",
     summary: "List visible installed Apps",
     inputSchema: emptyInputSchema(),
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -6724,7 +6723,7 @@ function installCommand(dependencies) {
       no_wait: { type: "boolean" },
       policy: { type: "string", enum: [...INSTALL_POLICIES] }
     }),
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "either",
@@ -6768,7 +6767,7 @@ function upgradeCommand(dependencies) {
       },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "either",
@@ -6897,7 +6896,7 @@ function statusCommand$1() {
       properties: { app_name: { type: "string", minLength: 1 } },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -6968,7 +6967,7 @@ function publishCommand() {
       required: ["local_dir", "app_doc"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "sync",
@@ -7937,8 +7936,8 @@ async function releaseStaging(ctx, source) {
   }
 }
 function expectInspection(value) {
-  const object = expectObject$1(value, "apps.inspect response");
-  const schemaVersion = expectNumber(object, "schema_version");
+  const object2 = expectObject$1(value, "apps.inspect response");
+  const schemaVersion = expectNumber(object2, "schema_version");
   if (schemaVersion !== PLAN_SCHEMA_VERSION) {
     throw new ToolError(
       "UNSUPPORTED_SCHEMA_VERSION",
@@ -7947,9 +7946,9 @@ function expectInspection(value) {
   }
   const inspection = {
     schema_version: schemaVersion,
-    plan: expectObject$1(object.plan, "inspection.plan"),
-    resolution_status: expectObject$1(object.resolution_status, "inspection.resolution_status"),
-    status: expectObject$1(object.status, "inspection.status")
+    plan: expectObject$1(object2.plan, "inspection.plan"),
+    resolution_status: expectObject$1(object2.resolution_status, "inspection.resolution_status"),
+    status: expectObject$1(object2.status, "inspection.status")
   };
   assertPortablePlan(inspection.plan);
   if (inspection.status.plan_fingerprint !== inspection.plan.plan_fingerprint) {
@@ -8094,7 +8093,7 @@ function selectorCommand(options) {
       required: ["app_name"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: options.access },
     asyncMode: options.asyncMode,
@@ -8169,8 +8168,8 @@ function expectString(value, property) {
   }
   return candidate;
 }
-function expectNumber(object, property) {
-  const value = object[property];
+function expectNumber(object2, property) {
+  const value = object2[property];
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
     throw new ToolError("INVALID_SERVICE_RESPONSE", `${property} must be a non-negative integer`, 9);
   }
@@ -8258,7 +8257,7 @@ function toHex(bytes) {
   return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 const CONTROL_PANEL$3 = "control-panel";
-const OBJECT_OUTPUT$7 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$8 = { type: "object", additionalProperties: true };
 function createDiagnosticModule(dependencies = {}) {
   return {
     name: "diagnostic",
@@ -8297,7 +8296,7 @@ function collectCommand() {
       required: ["services"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$7,
+    outputSchema: OBJECT_OUTPUT$8,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "privileged" },
     asyncMode: "task",
@@ -8351,7 +8350,7 @@ function exportCommand$1(dependencies) {
       required: ["bundle_id", "path"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$7,
+    outputSchema: OBJECT_OUTPUT$8,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "privileged" },
     asyncMode: "sync",
@@ -8393,7 +8392,7 @@ function compact$2(value) {
   return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0));
 }
 const CONTROL_PANEL$2 = "control-panel";
-const OBJECT_OUTPUT$6 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$7 = { type: "object", additionalProperties: true };
 const LOG_LEVELS = ["error", "warning", "info", "debug", "trace"];
 function createLogModule(dependencies = {}) {
   return {
@@ -8401,7 +8400,7 @@ function createLogModule(dependencies = {}) {
     summary: "List services, query, follow, and export redacted system logs",
     commands: [
       servicesCommand(),
-      queryCommand(),
+      queryCommand$1(),
       tailCommand(dependencies),
       exportCommand(dependencies)
     ]
@@ -8414,7 +8413,7 @@ function servicesCommand() {
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     outputSchema: {
       type: "object",
-      properties: { services: { type: "array", items: OBJECT_OUTPUT$6 } },
+      properties: { services: { type: "array", items: OBJECT_OUTPUT$7 } },
       required: ["services"],
       additionalProperties: false
     },
@@ -8434,7 +8433,7 @@ function servicesCommand() {
     }
   };
 }
-function queryCommand() {
+function queryCommand$1() {
   return {
     verb: "query",
     summary: "Query structured redacted log entries",
@@ -8487,7 +8486,7 @@ function tailCommand(dependencies) {
       }
     ],
     inputSchema: filterSchema({ from: { type: "string", enum: ["start", "end"] } }),
-    outputSchema: OBJECT_OUTPUT$6,
+    outputSchema: OBJECT_OUTPUT$7,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "stream",
@@ -8543,7 +8542,7 @@ function exportCommand(dependencies) {
       ...filterSchema({ path: { type: "string", minLength: 1 } }),
       required: ["path"]
     },
-    outputSchema: OBJECT_OUTPUT$6,
+    outputSchema: OBJECT_OUTPUT$7,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -8695,7 +8694,7 @@ function abortableSleep(milliseconds, signal) {
 }
 const TASK_MANAGER = "task-manager";
 const CONTROL_PANEL$1 = "control-panel";
-const OBJECT_OUTPUT$5 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$6 = { type: "object", additionalProperties: true };
 function createTaskModule() {
   return {
     name: "task",
@@ -8798,7 +8797,7 @@ function getCommand$1() {
       required: ["task_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$5,
+    outputSchema: OBJECT_OUTPUT$6,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -8839,7 +8838,7 @@ function waitCommand() {
     summary: "Stream changes until a Task becomes terminal",
     positionals: [{ name: "task_id", description: "Opaque Task ID", required: true }],
     inputSchema: taskIdSchema(),
-    outputSchema: OBJECT_OUTPUT$5,
+    outputSchema: OBJECT_OUTPUT$6,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "stream",
@@ -8890,7 +8889,7 @@ function cancelCommand() {
       required: ["task_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$5,
+    outputSchema: OBJECT_OUTPUT$6,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "sync",
@@ -8933,7 +8932,7 @@ function retryCommand() {
       required: ["task_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$5,
+    outputSchema: OBJECT_OUTPUT$6,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "either",
@@ -9007,7 +9006,7 @@ function invalidResponse$1(label) {
   throw new ToolError("INVALID_SERVICE_RESPONSE", `${label} is invalid`, EXIT_INTERNAL);
 }
 const sdk = provisionSdk;
-const OBJECT_OUTPUT$4 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$5 = { type: "object", additionalProperties: true };
 const ROOT_OPTION = {
   name: "root",
   description: "Installed BuckyOS root on this machine (BUCKYOS_ROOT); read by status/check, written by activate",
@@ -9091,7 +9090,7 @@ function statusCommand(deps) {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$4,
+      ...OBJECT_OUTPUT$5,
       properties: {
         root: { type: "string" },
         state: {
@@ -9129,7 +9128,7 @@ function checkCommand(deps) {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$4,
+      ...OBJECT_OUTPUT$5,
       properties: {
         ready: { type: "boolean" },
         root: { type: "string" },
@@ -9177,7 +9176,7 @@ function activateCommand(deps) {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$4,
+      ...OBJECT_OUTPUT$5,
       properties: {
         root: { type: "string" },
         state: { type: "string", enum: ["configured"] },
@@ -9239,9 +9238,9 @@ function resolvePath(ctx, value) {
   const path = getHost().path;
   return path.isAbsolute(value) ? path.resolve(value) : path.resolve(ctx.cwd, value);
 }
-async function assertHostAccess(path, operation) {
+async function assertHostAccess(path, operation2) {
   try {
-    await getHost().assertAccess(path, operation);
+    await getHost().assertAccess(path, operation2);
   } catch (error) {
     if (isHostError(error, "PermissionDenied")) {
       throw new ToolError(
@@ -9249,7 +9248,7 @@ async function assertHostAccess(path, operation) {
         `${error.message}; pass the path on the command line (--root / --owner-key-backup) so the launcher can grant it`,
         EXIT_PERMISSION,
         false,
-        { path, operation }
+        { path, operation: operation2 }
       );
     }
     throw error;
@@ -9459,7 +9458,7 @@ function inputFingerprint(input) {
   hash.update(new TextEncoder().encode(JSON.stringify(material)));
   return hash.digestHex();
 }
-const OBJECT_OUTPUT$3 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$4 = { type: "object", additionalProperties: true };
 const SKILL_KINDS = ["cmd", "goal"];
 const SKILLS_SUB_PKG = "agent_skills";
 const SKILL_DIRS = ["cmd_skills", "goal_skills", "tools"];
@@ -9496,7 +9495,7 @@ function createSkillModule() {
           required: ["agent_id"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$3,
+        outputSchema: OBJECT_OUTPUT$4,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -9535,7 +9534,7 @@ function createSkillModule() {
           required: ["pikg_path", "agent_id"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$3,
+        outputSchema: OBJECT_OUTPUT$4,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -9562,7 +9561,7 @@ function createSkillModule() {
           required: ["name", "agent_id"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$3,
+        outputSchema: OBJECT_OUTPUT$4,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "destructive" },
         asyncMode: "sync",
@@ -9683,7 +9682,7 @@ function base64(bytes) {
   return btoa(binary);
 }
 const CONTROL_PANEL = "control-panel";
-const OBJECT_OUTPUT$2 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$3 = { type: "object", additionalProperties: true };
 const AGENT_POSITIONAL = {
   name: "agent_id",
   description: "Agent ID as `agent list` prints it (raw host name, e.g. jarvis.example.zone)"
@@ -9707,7 +9706,7 @@ function createAgentModule() {
         inputSchema: { type: "object", properties: {}, additionalProperties: false },
         outputSchema: {
           type: "object",
-          properties: { agents: { type: "array", items: OBJECT_OUTPUT$2 } },
+          properties: { agents: { type: "array", items: OBJECT_OUTPUT$3 } },
           required: ["agents"],
           additionalProperties: false
         },
@@ -9733,7 +9732,7 @@ function createAgentModule() {
         summary: "Get one Agent: profile, settings, install state, template, and runtime",
         positionals: [AGENT_POSITIONAL],
         inputSchema: AGENT_INPUT,
-        outputSchema: OBJECT_OUTPUT$2,
+        outputSchema: OBJECT_OUTPUT$3,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -9746,7 +9745,7 @@ function createAgentModule() {
         summary: "Get the public profile (display name, bio, avatar) of an Agent",
         positionals: [AGENT_POSITIONAL],
         inputSchema: AGENT_INPUT,
-        outputSchema: OBJECT_OUTPUT$2,
+        outputSchema: OBJECT_OUTPUT$3,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -9787,8 +9786,8 @@ function createAgentModule() {
           type: "object",
           properties: {
             agent_id: { type: "string" },
-            before: OBJECT_OUTPUT$2,
-            profile: OBJECT_OUTPUT$2
+            before: OBJECT_OUTPUT$3,
+            profile: OBJECT_OUTPUT$3
           },
           required: ["agent_id", "before", "profile"],
           additionalProperties: false
@@ -9833,7 +9832,7 @@ async function callAgent(ctx, method, params) {
   }
 }
 const AICC = "aicc";
-const OBJECT_OUTPUT$1 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$2 = { type: "object", additionalProperties: true };
 const EMPTY_INPUT = { type: "object", properties: {}, additionalProperties: false };
 const RANGES = ["last1d", "last7d", "last30d"];
 const GROUPS = [
@@ -9851,13 +9850,13 @@ function createAiModule() {
     name: "ai",
     summary: "Read AI provider, routing, usage and token quota state of the AICC service",
     commands: [
-      readCommand({
+      readCommand$1({
         verb: "providers",
         summary: "List configured AI provider instances with auth, health, and model inventory",
         method: "provider.list",
         description: "Credentials are reported only as configured/kind; secrets are never returned."
       }),
-      readCommand({
+      readCommand$1({
         verb: "routing",
         summary: "Get the AICC routing overlay and its settings revision",
         method: "routing.get",
@@ -9881,7 +9880,7 @@ function quotaCommand() {
       properties: { app: { type: "string", minLength: 1 } },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$1,
+    outputSchema: OBJECT_OUTPUT$2,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -9893,13 +9892,13 @@ function quotaCommand() {
     )
   };
 }
-function readCommand(options) {
+function readCommand$1(options) {
   return {
     verb: options.verb,
     summary: options.summary,
     description: options.description,
     inputSchema: EMPTY_INPUT,
-    outputSchema: OBJECT_OUTPUT$1,
+    outputSchema: OBJECT_OUTPUT$2,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -9951,7 +9950,7 @@ function usageCommand() {
       },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$1,
+    outputSchema: OBJECT_OUTPUT$2,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -9996,7 +9995,7 @@ function timeRange(input) {
   }
   return { kind: "explicit", start_time_ms: since, end_time_ms: until ?? Date.now() };
 }
-const OBJECT_OUTPUT = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$1 = { type: "object", additionalProperties: true };
 const DAY_MS = 864e5;
 const EXPIRES_HELP = "1d, 7d (default), 30d, none, or an RFC 3339 time";
 function createShareModule() {
@@ -10060,10 +10059,10 @@ function gatewayOrigin(endpoint) {
 function parseExpires(value) {
   if (value === void 0)
     return void 0;
-  const text = String(value).trim().toLowerCase();
-  if (text === "none" || text === "never")
+  const text2 = String(value).trim().toLowerCase();
+  if (text2 === "none" || text2 === "never")
     return null;
-  const days = text.match(/^(\d+)d$/);
+  const days = text2.match(/^(\d+)d$/);
   if (days)
     return Math.floor((Date.now() + Number(days[1]) * DAY_MS) / 1e3);
   const at = parseTimestamp(value, "expires");
@@ -10107,7 +10106,7 @@ function createCommand() {
       required: ["path"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT,
+    outputSchema: OBJECT_OUTPUT$1,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "either",
@@ -10176,7 +10175,7 @@ function listCommand() {
       },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT,
+    outputSchema: OBJECT_OUTPUT$1,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -10208,7 +10207,7 @@ function getCommand() {
       required: ["share_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT,
+    outputSchema: OBJECT_OUTPUT$1,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -10245,7 +10244,7 @@ function updateCommand() {
       required: ["share_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT,
+    outputSchema: OBJECT_OUTPUT$1,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "sync",
@@ -10289,7 +10288,7 @@ function stopCommand() {
       required: ["share_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT,
+    outputSchema: OBJECT_OUTPUT$1,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "destructive" },
     asyncMode: "sync",
@@ -10321,7 +10320,7 @@ function statsCommand() {
       },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT,
+    outputSchema: OBJECT_OUTPUT$1,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -10340,6 +10339,425 @@ function statsCommand() {
     }
   };
 }
+const text = { type: "string", minLength: 1 };
+const object = { type: "object", additionalProperties: true };
+const targetProperties = {
+  executor_id: text,
+  generation: { type: "integer", minimum: 1 },
+  profile_id: text,
+  store_id: text,
+  locator: text
+};
+function call(ctx, method, params) {
+  return ctx.clients.call("control-panel", method, params, {
+    traceId: ctx.traceId,
+    signal: ctx.signal,
+    timeoutMs: Math.max(1, (ctx.deadline ?? Date.now() + 3e4) - Date.now())
+  });
+}
+function management(verb, method, properties, required, write = false) {
+  return {
+    verb,
+    summary: `Executor ${verb}`,
+    inputSchema: { ...object, properties, required, additionalProperties: false },
+    outputSchema: object,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: write ? "write" : "read" },
+    asyncMode: "sync",
+    requiresSession: true,
+    options: Object.entries(properties).filter(([, schema]) => schema.type !== "object").map(([name, schema]) => ({
+      name: name.replaceAll("_", "-"),
+      property: name,
+      description: name,
+      type: schema.type === "integer" ? "integer" : "string",
+      required: required.includes(name)
+    })),
+    handler: (ctx, input) => call(ctx, method, input)
+  };
+}
+function createExecutorModule() {
+  return {
+    name: "executor",
+    summary: "Manage lightweight devices and explicitly target online command/file executors",
+    commands: [
+      management("create", "executor.device.create", { name: text, profiles: object, limits: object, expires_at_ms: { type: "integer" } }, ["name", "profiles"], true),
+      management("list", "executor.device.list", {}, []),
+      management("issue", "executor.device.issue", { executor_id: text, expires_at_ms: { type: "integer" } }, ["executor_id"], true),
+      management("revoke", "executor.device.revoke", { executor_id: text }, ["executor_id"], true),
+      management("delete", "executor.device.delete", { executor_id: text }, ["executor_id"], true),
+      management("online", "executor.online.list", {}, []),
+      operation("exec", { cmd: text, cwd: text, env: object, execution_timeout_ms: { type: "integer", minimum: 1 } }, ["cmd", "cwd"]),
+      operation("read", { path: text }, ["path"]),
+      operation("write", { path: text, content: { type: "string" }, mode: { type: "string", enum: ["replace", "append", "create_new"] } }, ["path", "content"]),
+      operation("edit", { path: text, old_string: text, new_string: { type: "string" } }, ["path", "old_string", "new_string"]),
+      operation("query", { channel: { type: "string", enum: ["stdout", "stderr", "content"] }, offset: { type: "integer", minimum: 0 }, wait_ms: { type: "integer", minimum: 0 } }, []),
+      operation("cancel", {}, [])
+    ]
+  };
+}
+function operation(verb, extra, required) {
+  const recovery = verb === "query" || verb === "cancel";
+  const properties = { ...targetProperties, ...extra };
+  return {
+    verb,
+    summary: `${verb} on an explicit executor; persist --locator before dispatch and query it after disconnection`,
+    inputSchema: { ...object, properties, required: [...Object.keys(targetProperties), ...required], additionalProperties: false },
+    outputSchema: object,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: ["read", "query"].includes(verb) ? "read" : "write" },
+    asyncMode: "sync",
+    requiresSession: true,
+    options: Object.entries(properties).filter(([, schema]) => schema.type !== "object").map(([name, schema]) => ({
+      name: name.replaceAll("_", "-"),
+      property: name,
+      description: name,
+      type: schema.type === "integer" ? "integer" : "string",
+      required: Object.keys(targetProperties).includes(name) || required.includes(name)
+    })),
+    handler: async (ctx, input) => {
+      const target = { executor_id: String(input.executor_id), generation: Number(input.generation), profile_id: String(input.profile_id), store_id: String(input.store_id) };
+      const path = String(input.locator);
+      const host2 = getHost();
+      let locator;
+      if (recovery)
+        locator = JSON.parse(await host2.readTextFile(path));
+      else {
+        locator = { ...target, op_id: crypto.randomUUID(), run_id: ctx.traceId, call_id: ctx.idempotencyKey ?? crypto.randomUUID() };
+        await host2.writeTextFile(path, JSON.stringify(locator) + "\n", { createNew: true, mode: 384 });
+      }
+      if (!ctx.session)
+        throw new ToolError("AUTH_REQUIRED", "An authenticated App session is required");
+      const { token } = await ctx.session.ensureValid();
+      const route = await call(ctx, "executor.stream.open", { executor_id: target.executor_id, generation: target.generation, profile_id: target.profile_id });
+      const stream = await ExecutorCommandStream.connect(route, target, token, "buckyos-cli", locator.run_id);
+      if (!stream)
+        throw new ToolError("INVALID_SERVICE_RESPONSE", "Executor stream did not initialize");
+      const abort = () => stream.close();
+      ctx.signal.addEventListener("abort", abort, { once: true });
+      try {
+        let reply;
+        if (verb === "exec")
+          reply = await stream.exec(locator, String(input.cmd), String(input.cwd), input.env ?? {}, Number(input.execution_timeout_ms ?? 6e4));
+        else if (verb === "read")
+          reply = await stream.read(locator, String(input.path));
+        else if (verb === "write")
+          reply = await stream.write(locator, String(input.path), new TextEncoder().encode(String(input.content)), input.mode ?? "replace");
+        else if (verb === "edit")
+          reply = await stream.edit(locator, String(input.path), [{ old_string: String(input.old_string), new_string: String(input.new_string) }]);
+        else if (verb === "cancel")
+          reply = await stream.cancel(locator);
+        else
+          reply = await stream.query(locator, input.channel, Number(input.offset ?? 0), Number(input.wait_ms ?? 0));
+        return { locator, reply };
+      } finally {
+        ctx.signal.removeEventListener("abort", abort);
+        stream.close();
+      }
+    }
+  };
+}
+const SERVICE = "aiworkspace";
+const OBJECT_OUTPUT = { type: "object", additionalProperties: true };
+const WORKSPACE_OPTION = { name: "workspace", property: "workspace_id", description: "Workspace id (ws_…)", type: "string", required: true };
+const RUN_OPTION = { name: "run", property: "run_id", description: "Run id (run_…)", type: "string", required: true };
+const ATTEMPT_OPTION = { name: "attempt", property: "attempt", description: "The attempt number `run-claim` answered", type: "integer", required: true };
+function workspaceInput(extra, required = []) {
+  return { type: "object", properties: { workspace_id: { type: "string", minLength: 1 }, ...extra }, required: ["workspace_id", ...required], additionalProperties: false };
+}
+async function aiws(ctx, method, params) {
+  const result = expectObject$4(await callService(ctx, SERVICE, method, params), method);
+  if (result.ok === false) {
+    const error = expectObject$4(result.error, `${method}.error`);
+    const code = typeof error.code === "string" ? error.code : "AIWS_ERROR";
+    const detail = typeof error.detail === "string" ? error.detail : code;
+    throw new ToolError(code, `${code}${typeof error.sub_code === "string" ? `/${error.sub_code}` : ""}: ${detail}`);
+  }
+  return result;
+}
+async function jsonInput(input, textKey, fileKey, label) {
+  const text2 = inputString(input, textKey);
+  const file = inputString(input, fileKey);
+  if (text2 && file)
+    throw new UsageError("AIWS_USAGE", `${textKey} and ${fileKey} are exclusive`);
+  if (file)
+    return JSON.parse(await getHost().readTextFile(file));
+  if (text2)
+    return JSON.parse(text2);
+  throw new UsageError("AIWS_USAGE", `${label}: pass --${textKey.replace(/_/g, "-")} or --${fileKey.replace(/_/g, "-")}`);
+}
+const readCommand = {
+  verb: "read",
+  summary: "Read one entity of a workspace (envelope and content)",
+  positionals: [{ name: "entity_id", description: "Entity id", required: true }],
+  options: [WORKSPACE_OPTION, { name: "selector", property: "selector", description: 'Selector JSON, e.g. {"kind":"table_record","record_id":"r1"}', type: "string" }],
+  inputSchema: workspaceInput({ entity_id: { type: "string", minLength: 1 }, selector: { type: "string" } }, ["entity_id"]),
+  outputSchema: OBJECT_OUTPUT,
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "read" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: ["buckyos aiws read orders --workspace ws_abc"],
+  handler: (ctx, input) => {
+    const selector = inputString(input, "selector");
+    return aiws(ctx, "doc.read", { workspace_id: requiredInputString(input, "workspace_id"), entity_id: requiredInputString(input, "entity_id"), ...selector ? { selector: JSON.parse(selector) } : {} });
+  }
+};
+const queryCommand = {
+  verb: "query",
+  summary: "Query the rows of a table (or through a saved view)",
+  options: [
+    WORKSPACE_OPTION,
+    { name: "source", property: "source_id", description: "Table entity id", type: "string" },
+    { name: "view", property: "view_id", description: "Table view (Block) id", type: "string" },
+    { name: "filter", property: "filter", description: "Filter JSON (README: doc.query)", type: "string" },
+    { name: "limit", property: "limit", description: "Rows per page (≤ 1000)", type: "integer" },
+    { name: "cursor", property: "cursor", description: "Continue from a previous page", type: "string" }
+  ],
+  inputSchema: workspaceInput({ source_id: { type: "string" }, view_id: { type: "string" }, filter: { type: "string" }, limit: { type: "integer" }, cursor: { type: "string" } }),
+  outputSchema: OBJECT_OUTPUT,
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "read" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: ["buckyos aiws query --workspace ws_abc --source orders --limit 100"],
+  handler: (ctx, input) => {
+    const params = { workspace_id: requiredInputString(input, "workspace_id") };
+    for (const key of ["source_id", "view_id", "cursor"]) {
+      const value = inputString(input, key);
+      if (value)
+        params[key] = value;
+    }
+    const filter = inputString(input, "filter");
+    if (filter)
+      params.filter = JSON.parse(filter);
+    if (typeof input.limit === "number")
+      params.limit = input.limit;
+    if (!params.source_id && !params.view_id)
+      throw new UsageError("AIWS_USAGE", "pass --source or --view");
+    return aiws(ctx, "doc.query", params);
+  }
+};
+const infoCommand = {
+  verb: "info",
+  summary: "Workspace info: versions, capabilities of the caller, usage, hosted execution configuration",
+  options: [WORKSPACE_OPTION],
+  inputSchema: workspaceInput({}),
+  outputSchema: OBJECT_OUTPUT,
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "read" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: ["buckyos aiws info --workspace ws_abc"],
+  handler: (ctx, input) => aiws(ctx, "ws.get_info", { workspace_id: requiredInputString(input, "workspace_id") })
+};
+const runGetCommand = {
+  verb: "run-get",
+  summary: "A wish run: state, execution context, the brief an executor starts from, candidate and preview",
+  options: [WORKSPACE_OPTION, RUN_OPTION],
+  inputSchema: workspaceInput({ run_id: { type: "string", minLength: 1 } }, ["run_id"]),
+  outputSchema: OBJECT_OUTPUT,
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "read" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: ["buckyos aiws run-get --workspace ws_abc --run run_xyz"],
+  handler: (ctx, input) => aiws(ctx, "proc.get", { workspace_id: requiredInputString(input, "workspace_id"), run_id: requiredInputString(input, "run_id") })
+};
+const runClaimCommand = {
+  verb: "run-claim",
+  summary: "Take a run as its executor: starts an attempt, answers the attempt number, a run token and the lease",
+  options: [WORKSPACE_OPTION, RUN_OPTION, { name: "claim-token", property: "claim_token", description: "The claim token the run was dispatched with (ct_…)", type: "string", required: true, secret: true }],
+  inputSchema: workspaceInput({ run_id: { type: "string", minLength: 1 }, claim_token: { type: "string", minLength: 1 } }, ["run_id", "claim_token"]),
+  outputSchema: OBJECT_OUTPUT,
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "write" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: ["buckyos aiws run-claim --workspace ws_abc --run run_xyz --claim-token ct_…"],
+  handler: (ctx, input) => aiws(ctx, "proc.claim", {
+    workspace_id: requiredInputString(input, "workspace_id"),
+    run_id: requiredInputString(input, "run_id"),
+    claim_token: requiredInputString(input, "claim_token"),
+    executor: { kind: "agent", principal: ctx.principal.id }
+  })
+};
+const runHeartbeatCommand = {
+  verb: "run-heartbeat",
+  summary: "Keep the lease of a claimed run alive (every minute while working); optionally report progress",
+  options: [WORKSPACE_OPTION, RUN_OPTION, ATTEMPT_OPTION, { name: "phase", property: "phase", description: 'A short progress phase, e.g. "reading inputs"', type: "string" }],
+  inputSchema: workspaceInput({ run_id: { type: "string", minLength: 1 }, attempt: { type: "integer", minimum: 1 }, phase: { type: "string" } }, ["run_id", "attempt"]),
+  outputSchema: OBJECT_OUTPUT,
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "write" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: ['buckyos aiws run-heartbeat --workspace ws_abc --run run_xyz --attempt 1 --phase "reading inputs"'],
+  handler: (ctx, input) => {
+    const phase = inputString(input, "phase");
+    return aiws(ctx, "proc.heartbeat", { workspace_id: requiredInputString(input, "workspace_id"), run_id: requiredInputString(input, "run_id"), attempt: input.attempt, ...phase ? { progress: { phase } } : {} });
+  }
+};
+const runFilesCommand = {
+  verb: "run-files",
+  summary: "Write the stage of a claimed run into a directory: the snapshot (context/), request.json, the Renderer catalog and the program host (lib/)",
+  description: "Run the program there the way the service does: `deno run -A lib/run.js` reads program/main.js and writes output/.aiws/results.json.",
+  options: [WORKSPACE_OPTION, RUN_OPTION, ATTEMPT_OPTION, { name: "dir", property: "dir", description: "Directory to write into (created)", type: "string", required: true }],
+  inputSchema: workspaceInput({ run_id: { type: "string", minLength: 1 }, attempt: { type: "integer", minimum: 1 }, dir: { type: "string", minLength: 1 } }, ["run_id", "attempt", "dir"]),
+  outputSchema: { type: "object", properties: { dir: { type: "string" }, files: { type: "array", items: { type: "string" } } }, required: ["dir", "files"], additionalProperties: true },
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "read" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: ["buckyos aiws run-files --workspace ws_abc --run run_xyz --attempt 1 --dir work"],
+  handler: async (ctx, input) => {
+    const result = await aiws(ctx, "proc.files", { workspace_id: requiredInputString(input, "workspace_id"), run_id: requiredInputString(input, "run_id"), attempt: input.attempt });
+    const dir = requiredInputString(input, "dir");
+    const host2 = getHost();
+    const written = [];
+    for (const [path, file] of Object.entries(expectObject$4(result.files, "proc.files.files"))) {
+      const f = expectObject$4(file, path);
+      if (typeof f.text !== "string" && typeof f.base64 !== "string")
+        continue;
+      const target = `${dir}/${path}`;
+      await host2.mkdir(target.slice(0, target.lastIndexOf("/")), { recursive: true });
+      if (typeof f.text === "string")
+        await host2.writeTextFile(target, f.text);
+      else
+        await host2.writeFile(target, Uint8Array.from(atob(f.base64), (c) => c.charCodeAt(0)));
+      written.push(path);
+    }
+    await host2.mkdir(`${dir}/output`, { recursive: true });
+    await host2.mkdir(`${dir}/program`, { recursive: true });
+    return { dir, files: written };
+  }
+};
+const runToolCommand = {
+  verb: "run-tool",
+  summary: "Call one stage tool of a claimed run (ws_profile, ws_read, ws_query, submit_analysis, put_result, check_results, finish, …): the service answers as it answers the model",
+  options: [WORKSPACE_OPTION, RUN_OPTION, ATTEMPT_OPTION, { name: "name", property: "name", description: "Tool name (the claim answered the list, with their argument schemas)", type: "string", required: true }, { name: "args", property: "args", description: "Arguments JSON", type: "string" }, { name: "args-file", property: "args_file", description: "Path of a JSON file holding the arguments", type: "string" }],
+  inputSchema: workspaceInput({ run_id: { type: "string", minLength: 1 }, attempt: { type: "integer", minimum: 1 }, name: { type: "string", minLength: 1 }, args: { type: "string" }, args_file: { type: "string" } }, ["run_id", "attempt", "name"]),
+  outputSchema: OBJECT_OUTPUT,
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "write" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: [`buckyos aiws run-tool --workspace ws_abc --run run_xyz --attempt 1 --name ws_profile --args '{"target":"@B1"}'`, `buckyos aiws run-tool --workspace ws_abc --run run_xyz --attempt 1 --name finish --args '{"summary":"done"}'`],
+  handler: async (ctx, input) => {
+    const args = inputString(input, "args") || inputString(input, "args_file") ? await jsonInput(input, "args", "args_file", "arguments") : {};
+    return aiws(ctx, "proc.tool", { workspace_id: requiredInputString(input, "workspace_id"), run_id: requiredInputString(input, "run_id"), attempt: input.attempt, name: requiredInputString(input, "name"), args });
+  }
+};
+const runProgramCommand = {
+  verb: "run-program",
+  summary: "Hand in a program run: the program source, what lib/run.js wrote to output/.aiws/results.json, the files under output/ and the log; the service validates it like its own run_program",
+  options: [
+    WORKSPACE_OPTION,
+    RUN_OPTION,
+    ATTEMPT_OPTION,
+    { name: "dir", property: "dir", description: "The stage directory written by run-files (program/main.js, output/)", type: "string", required: true },
+    { name: "log-file", property: "log_file", description: "Path of the program log to attach (stdout/stderr of deno run)", type: "string" }
+  ],
+  inputSchema: workspaceInput({ run_id: { type: "string", minLength: 1 }, attempt: { type: "integer", minimum: 1 }, dir: { type: "string", minLength: 1 }, log_file: { type: "string" } }, ["run_id", "attempt", "dir"]),
+  outputSchema: OBJECT_OUTPUT,
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "write" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: ["buckyos aiws run-program --workspace ws_abc --run run_xyz --attempt 1 --dir work --log-file work/run.log"],
+  handler: async (ctx, input) => {
+    const dir = requiredInputString(input, "dir");
+    const host2 = getHost();
+    const source = await host2.readTextFile(`${dir}/program/main.js`);
+    let results = null;
+    try {
+      results = JSON.parse(await host2.readTextFile(`${dir}/output/.aiws/results.json`));
+    } catch {
+      results = null;
+    }
+    const logFile = inputString(input, "log_file");
+    const log = logFile ? await host2.readTextFile(logFile).catch(() => "") : "";
+    const files = {};
+    const walk = async (rel) => {
+      for (const entry of await host2.readDir(`${dir}/output${rel ? `/${rel}` : ""}`)) {
+        const name = rel ? `${rel}/${entry.name}` : entry.name;
+        if (name === ".aiws" || name.startsWith(".aiws/"))
+          continue;
+        if (entry.isDirectory)
+          await walk(name);
+        else {
+          const bytes = await host2.readFile(`${dir}/output/${name}`);
+          let text2 = null;
+          try {
+            text2 = bytes.includes(0) ? null : new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+          } catch {
+            text2 = null;
+          }
+          files[`output/${name}`] = text2 ?? { base64: btoa(Array.from(bytes, (b) => String.fromCharCode(b)).join("")) };
+        }
+      }
+    };
+    await walk("");
+    return aiws(ctx, "proc.program", { workspace_id: requiredInputString(input, "workspace_id"), run_id: requiredInputString(input, "run_id"), attempt: input.attempt, source, results, log, files });
+  }
+};
+const runReportCommand = {
+  verb: "run-report",
+  summary: "End a claimed run: --finished after the stage tools accepted the work (submit_analysis / finish), or the candidate itself (results / analysis), or a failure",
+  description: "The service validates and plans what is reported; the user confirms it in the workspace. A superseded attempt or a cancelled run gets RUN_REVOKED.",
+  options: [
+    WORKSPACE_OPTION,
+    RUN_OPTION,
+    ATTEMPT_OPTION,
+    { name: "finished", property: "finished", description: "The stage is done: what the tools collected becomes the candidate", type: "boolean" },
+    { name: "results", property: "results", description: "Results JSON array (execute runs): [{ name, type, title?, content, config? }]", type: "string" },
+    { name: "results-file", property: "results_file", description: "Path of a JSON file holding the results array", type: "string" },
+    { name: "analysis", property: "analysis", description: "Analysis JSON (analyze runs, wish.analysis.v2)", type: "string" },
+    { name: "analysis-file", property: "analysis_file", description: "Path of a JSON file holding the analysis", type: "string" },
+    { name: "summary", property: "summary", description: "One paragraph on what was done", type: "string" },
+    { name: "warning", property: "warnings", description: "A warning for the user (repeatable)", type: "string" },
+    { name: "error", property: "error", description: "Report a failure instead: its reason", type: "string" }
+  ],
+  inputSchema: workspaceInput({ run_id: { type: "string", minLength: 1 }, attempt: { type: "integer", minimum: 1 }, finished: { type: "boolean" }, results: { type: "string" }, results_file: { type: "string" }, analysis: { type: "string" }, analysis_file: { type: "string" }, summary: { type: "string" }, warnings: { type: "string" }, error: { type: "string" } }, ["run_id", "attempt"]),
+  outputSchema: OBJECT_OUTPUT,
+  resultSchemaVersion: 1,
+  access: { mode: "fixed", level: "write" },
+  asyncMode: "sync",
+  requiresSession: true,
+  examples: [
+    "buckyos aiws run-report --workspace ws_abc --run run_xyz --attempt 1 --finished",
+    'buckyos aiws run-report --workspace ws_abc --run run_xyz --attempt 1 --results-file out/results.json --summary "monthly totals and a commentary"',
+    "buckyos aiws run-report --workspace ws_abc --run run_xyz --attempt 1 --analysis-file out/analysis.json",
+    'buckyos aiws run-report --workspace ws_abc --run run_xyz --attempt 1 --error "the input table is empty"'
+  ],
+  handler: async (ctx, input) => {
+    const params = { workspace_id: requiredInputString(input, "workspace_id"), run_id: requiredInputString(input, "run_id"), attempt: input.attempt };
+    const error = inputString(input, "error");
+    if (error) {
+      params.error = { code: "EXECUTOR_FAILED", detail: error };
+    } else if (input.finished === true) {
+      params.finished = true;
+    } else if (inputString(input, "analysis") || inputString(input, "analysis_file")) {
+      params.analysis = await jsonInput(input, "analysis", "analysis_file", "an analysis");
+    } else {
+      params.results = await jsonInput(input, "results", "results_file", "results");
+      params.read_set = [];
+    }
+    const summary2 = inputString(input, "summary");
+    if (summary2)
+      params.summary = summary2;
+    const warning = inputString(input, "warnings");
+    if (warning)
+      params.warnings = [warning];
+    return aiws(ctx, "proc.report", params);
+  }
+};
+function createAiwsModule() {
+  return {
+    name: "aiws",
+    summary: "AI Workspace: read a workspace, and execute wish runs as their executor (claim, heartbeat, report)",
+    commands: [infoCommand, readCommand, queryCommand, runGetCommand, runClaimCommand, runHeartbeatCommand, runFilesCommand, runToolCommand, runProgramCommand, runReportCommand]
+  };
+}
 const VERSION = TOOL_VERSION;
 class BuckyOSToolApplication {
   #environment;
@@ -10707,6 +11125,8 @@ function createRegistry(pikgDependencies, appDependencies, logDependencies, diag
   registry.register(createAgentModule());
   registry.register(createAiModule());
   registry.register(createShareModule());
+  registry.register(createExecutorModule());
+  registry.register(createAiwsModule());
   return registry;
 }
 function assertNoSessionOptions(global, command) {
@@ -10812,8 +11232,8 @@ async function runCli(host2, argv) {
   installHost(host2);
   return await new BuckyOSToolApplication().run(argv);
 }
-async function assertPathAccess(policy2, path, realPath, candidate, operation, resolveLinks = true) {
-  const roots = operation === "read" ? policy2.readPaths : policy2.writePaths;
+async function assertPathAccess(policy2, path, realPath, candidate, operation2, resolveLinks = true) {
+  const roots = operation2 === "read" ? policy2.readPaths : policy2.writePaths;
   const absolute = path.resolve(candidate);
   const physicalRoots = [];
   for (const root of roots) {
@@ -10827,7 +11247,7 @@ async function assertPathAccess(policy2, path, realPath, candidate, operation, r
   if (!insideAny(absolute, roots, path) && !insideAny(absolute, physicalRoots, path)) {
     throw new HostError(
       "PermissionDenied",
-      `${operation} access is outside ${policy2.name}: ${absolute}`,
+      `${operation2} access is outside ${policy2.name}: ${absolute}`,
       absolute
     );
   }
@@ -10838,7 +11258,7 @@ async function assertPathAccess(policy2, path, realPath, candidate, operation, r
     if (!insideAny(physical, physicalRoots, path)) {
       throw new HostError(
         "PermissionDenied",
-        `${operation} access escapes ${policy2.name}: ${absolute}`,
+        `${operation2} access escapes ${policy2.name}: ${absolute}`,
         absolute
       );
     }
@@ -11034,8 +11454,8 @@ class NodeHost {
       throw translateNodeError(error, path);
     }
   }
-  async assertAccess(path, operation) {
-    await this.assertPath(path, operation);
+  async assertAccess(path, operation2) {
+    await this.assertPath(path, operation2);
   }
   createHash(_algorithm) {
     const hash = createHash("sha256");
@@ -11162,7 +11582,7 @@ class NodeHost {
       throw new HostError("PermissionDenied", `subprocess is not allowed: ${command}`);
     }
   }
-  async assertPath(candidate, operation, resolveLinks = true) {
+  async assertPath(candidate, operation2, resolveLinks = true) {
     await assertPathAccess(
       this.policy,
       nodePath,
@@ -11174,7 +11594,7 @@ class NodeHost {
         }
       },
       candidate,
-      operation,
+      operation2,
       resolveLinks
     );
   }