codiedev 0.9.79 → 0.9.81

package/dist/commands/agents.js

@@ -0,0 +1,1130 @@
+"use strict";
+// `codiedev agents` — deploy and run agents on Codiedev.
+//
+// One primitive: run an agent. A run starts a fresh sandbox with the agent's
+// bundle, its gateway key (model calls land in Traces under the agent's
+// name) and its secrets, runs its entrypoint (Python, JS/TS or a shell
+// script) once with an input, records the output, and destroys the sandbox. Chains, schedules and webhooks are all
+// just ways of starting a run (see AGENT_GUIDE below, also written by `init`).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_GUIDE = exports.AGENTS_HELP = void 0;
+exports.parseEvery = parseEvery;
+exports.parseDuration = parseDuration;
+exports.runAgents = runAgents;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const shared_1 = require("./shared");
+const sdk = __importStar(require("./agentsSdk.generated"));
+const agentTemplates_generated_1 = require("./agentTemplates.generated");
+exports.AGENTS_HELP = `
+codiedev agents — deploy agents and run them in fresh sandboxes
+
+  codiedev agents init <name> [dir] [--lang python|ts|js] [--template <id>]
+                                         Scaffold an agent folder (entrypoint, agent.json, AGENTS.md),
+                                         blank or from a starter / your team's template
+  codiedev agents templates [--json]     Starter templates and the ones your team and company shared
+  codiedev agents publish <agent> [--company] [--summary "…"] [--title "…"] [--as <slug>]
+                                         Share an agent as a template (your team, or --company)
+  codiedev agents install <template> <name>
+                                         Deploy a copy of a shared template as your own agent
+  codiedev agents unpublish <template>   Take a template you shared off the marketplace
+  codiedev agents connect <name> [--description "…"] [--budget <usd>]
+                                         An agent you already run on your own servers: get its key.
+                                         Its model calls (via the gateway) show in Traces with spend,
+                                         budget and a kill switch; the key also reaches approvals and state
+  codiedev agents deploy [dir]           Package the folder and deploy it (new version each time)
+  codiedev agents run <name> [--input '<json>' | --input-file f] [--no-wait] [--json] [--quiet]
+                         [--idempotency-key k] [--delay 30m] [--retries n]
+                                         Start a run; streams its log, then prints the output
+  codiedev agents run --local [dir] [--input …] [--env-file .env] [--remote-state]
+                                         Run the agent on this machine with the same SDK, no deploy
+  codiedev agents runs [name] [--failed] [--limit n] [--json]
+                                         Recent runs, newest first
+  codiedev agents show <run-id> [--json] One run: input, output, error, log, cost, child runs
+  codiedev agents logs <run-id> [-f]     A run's log; -f follows it until the run ends
+  codiedev agents cancel <run-id>        Stop a run and its sandbox
+  codiedev agents list [--json]          Your company's agents, schedules and last runs
+  codiedev agents secrets <name> [set KEY=value | unset KEY] [--mine]
+                                         Environment variables the agent gets on every run
+  codiedev agents webhook <name> [--off] A URL that starts a run with the request body as input
+  codiedev agents stop <name> | --all [--reason "…"]  Kill switch: cancel its runs, cut model access, block every start
+  codiedev agents resume <name> | --all             Let it run again (owner or admin; --all is admins)
+  codiedev agents pull <name> [dir] [--version n]
+                                         Download a deployed agent's folder to change and redeploy
+  codiedev agents versions <name>        Its last 10 deploys
+  codiedev agents rollback <name> [--to n]
+                                         Ship an earlier version again (the previous one by default)
+  codiedev agents state <name> [list [prefix] | get <key> | set <key> '<json>' | delete <key>]
+                                         The agent's stored state (owner and admins)
+  codiedev agents approvals [--all] [--json]
+                                         Decisions agents are waiting on
+  codiedev agents decide <approval-id> <option> [--comment "…"]
+                                         Decide one; the agent's run starts with the decision
+  codiedev agents delete <name>          Remove an agent (its run history stays)
+
+  agent.json: { "name": "ticket-triage", "entrypoint": "agent.py", "timeoutSec": 600,
+                "every": "15m", "retries": 2, "cpu": 1, "memoryMb": 2048, "budgetUsd": 25 }
+  .codiedevignore lists extra files to leave out of the bundle (.env*, .git,
+  node_modules and virtualenvs are always left out).
+  entrypoint: a .py, .js, .mjs, .ts or .sh file. "every" (5m–7d) runs it on a
+  schedule; set null for none. retries (0–5) tries a failed run again on the
+  same run id, after 15s, 30s, 60s… cpu 0.25–8 cores, memoryMb 512–32768.
+  Leave a setting out to keep what it is now (it can be changed on the agent's
+  Setup tab in the portal); a new agent gets the defaults.
+`.trim();
+exports.AGENT_GUIDE = `# Building a Codiedev agent
+
+This folder is one agent. Each time it's started, Codiedev runs it once in a
+fresh sandbox, then destroys the sandbox. Model access, tracing and secrets
+are already wired in. You write the entrypoint (\`agent.py\`, \`agent.ts\`,
+\`agent.mjs\` or a \`.sh\` script, named in agent.json).
+
+## The primitive
+
+Python:
+
+\`\`\`python
+import codiedev_agents as agents
+
+task = agents.input()            # this run's input (any JSON), or None
+llm = agents.openai()            # OpenAI SDK client on the Codiedev gateway, traced
+reply = llm.chat.completions.create(model=MODEL, messages=[...])
+agents.output({"answer": "..."}) # this run's result (any JSON)
+\`\`\`
+
+TypeScript / JavaScript (\`codiedev-agents\` and \`openai\` are preinstalled):
+
+\`\`\`ts
+import * as agents from "codiedev-agents";
+
+const task = agents.input();
+const llm = await agents.openai();
+const reply = await llm.chat.completions.create({ model: MODEL, messages: [...] });
+agents.output({ answer: reply.choices[0].message.content });
+\`\`\`
+
+From a shell script: the input is \`/agent/.codiedev/input.json\`; write the
+result to \`/agent/.codiedev/output.json\`.
+
+- **Chain agents:** \`agents.run("other-agent", {...})\` starts another deployed
+  agent as a child run, waits, and returns it; its result is \`["output"]\`
+  (\`.output\` in JS). Use \`agents.start(...)\` + \`agents.get(id)\` to fan out in
+  parallel. Children show under their parent in Codiedev.
+- **Tools / MCP:** call APIs directly (\`httpx\`, \`fetch\`), or start any MCP
+  server over stdio: Python \`mcp\` and Node \`@modelcontextprotocol/sdk\` are
+  installed, and \`npx -y <server>\` works. For a remote MCP server, put its
+  URL and token in secrets.
+- **Personal secrets:** \`"personalSecrets": ["SALESFORCE_TOKEN"]\` in agent.json
+  means each person sets their own (\`secrets <name> set KEY=… --mine\`), and a
+  run someone starts uses theirs, never yours. Schedules and webhooks use the
+  shared value. Teammates "Use" your agent instead of copying it, so they get
+  your updates.
+- **Secrets:** \`codiedev agents secrets <name> set ZENDESK_TOKEN=…\`; read them
+  from the environment (\`os.environ["ZENDESK_TOKEN"]\`, \`process.env.ZENDESK_TOKEN\`).
+  Never put tokens in code.
+- **Dependencies:** \`requirements.txt\` and/or \`package.json\` (+ lock file). They
+  install once into a cached image when they change, not on every run.
+  Preinstalled: Python 3.12 with openai, mcp, httpx, pydantic; Node 22 with
+  openai, @modelcontextprotocol/sdk, tsx; git, curl.
+- **Exit code:** 0 = succeeded. An exception or non-zero exit = failed, with
+  the exception (or the last log line) as the error. Everything printed goes to the run's log.
+
+## The sandbox
+
+Linux x64 (Debian, glibc) with internet access. Your code is in \`/agent\` (the
+working directory); \`/tmp\` is writable. Every run gets these environment
+variables:
+
+| Variable | What it is |
+|---|---|
+| \`OPENAI_BASE_URL\`, \`OPENAI_API_KEY\` | The Codiedev model gateway and this agent's key. Any OpenAI-compatible tool picks them up as is. |
+| \`CODIEDEV_GATEWAY_URL\`, \`CODIEDEV_API_KEY\` | The same two, under Codiedev names |
+| \`CODIEDEV_AGENT\`, \`CODIEDEV_RUN_ID\` | This agent's name and this run's id |
+| \`CODIEDEV_ATTEMPT\`, \`CODIEDEV_MAX_ATTEMPTS\` | Which try this is, out of how many |
+| \`CODIEDEV_MODEL\` | The agent's default model: the first one its key allows (unset when it allows every model) |
+| your secrets | Each by its own name, e.g. \`GITHUB_TOKEN\` |
+
+**Models:** use a model id from your company's **Models** page, like
+\`openai/gpt-5.1-codex-mini\`. A model your company hasn't approved fails with
+\`model_not_allowed\`. Calls are traced under the agent's name and count
+toward its \`budgetUsd\` (a monthly budget for the agent, not per run).
+A call counts toward a run's cost when it sends the header
+\`X-Codiedev-Run-Id: $CODIEDEV_RUN_ID\`. \`agents.openai()\` does; for any other
+client or tool, add the header yourself (see opencode below).
+
+**Dependencies** from \`package.json\` install into \`/agent/node_modules\`, so
+their binaries are in \`/agent/node_modules/.bin\`. Python packages are importable
+as usual. A Python agent can have a \`package.json\` too (both install).
+
+## Outside tools (opencode, aider, Codex CLI…)
+
+Any tool that speaks the OpenAI API works: point it at \`OPENAI_BASE_URL\` with
+\`OPENAI_API_KEY\`. For example, opencode as a coding agent inside a run
+(\`"opencode-ai"\` in package.json, \`"timeoutSec": 3600\` and \`"cpu": 2,
+"memoryMb": 4096\` in agent.json):
+
+\`\`\`python
+import json, os, subprocess
+config = {
+    "$schema": "https://opencode.ai/config.json",
+    "autoupdate": False, "share": "disabled", "permission": "allow",
+    "provider": {"codiedev": {
+        "npm": "@ai-sdk/openai-compatible",
+        "options": {"baseURL": os.environ["OPENAI_BASE_URL"], "apiKey": "{env:OPENAI_API_KEY}",
+                    # Counts its model calls toward this run's cost.
+                    "headers": {"X-Codiedev-Run-Id": os.environ["CODIEDEV_RUN_ID"]}},
+        "models": {MODEL: {}},
+    }},
+}
+json.dump(config, open(f"{repo_dir}/opencode.json", "w"))
+subprocess.run(["/agent/node_modules/.bin/opencode", "run", "--model", f"codiedev/{MODEL}", prompt],
+               cwd=repo_dir, check=True, timeout=45 * 60)
+\`\`\`
+
+Keep the tool's own time limit under the run's, so the agent can still write
+its output. Git is installed; clone with a token from secrets
+(\`https://x-access-token:$GITHUB_TOKEN@github.com/owner/repo.git\`).
+
+## Building blocks
+
+All in the SDK (Python names shown; JS uses camelCase and returns promises).
+
+- **State that outlives runs:** \`agents.state.get(key, default)\`,
+  \`.set(key, value, ttl=None)\`, \`.delete(key)\`, \`.list(prefix)\`. Values are any
+  JSON up to 64 KB, 1,000 keys per agent, shared by all its runs. For a
+  counter or a cursor that parallel runs touch, use
+  \`agents.state.update(key, lambda old: ...)\`, or \`get_versioned\` +
+  \`set(..., if_version=n)\`, which raises \`StateConflict\` instead of overwriting.
+- **Retries:** \`"retries": 2\` in agent.json (or \`--retries\` / \`retries=\` per run)
+  tries a failed run again on the same run id after 15s, 30s, 60s… Callers
+  waiting on it keep waiting. \`agents.attempt()\` says which try this is.
+- **Steps (durable across retries):** wrap side effects in
+  \`agents.step("post-reply", lambda: post_reply())\`. A finished step returns
+  its saved result on a retry instead of running again, so a retry never
+  posts twice. A multi-step job is a list of steps.
+- **Answering a webhook:** a caller that POSTs to \`<webhook url>?wait=30\`
+  gets the run's result as the HTTP response (Slack slash commands, form
+  handlers). \`agents.respond(body, status=200, headers=None)\` sets exactly
+  what it gets; otherwise it's the output. Runs take seconds to start, so
+  for senders with a 3s limit, acknowledge and post back instead.
+- **Later:** \`agents.start("name", input, delay=3600)\` starts a run in an hour
+  (up to 7 days). An agent can schedule its own next check this way.
+- **Human approval:** \`agents.request_approval("Refund $120 to Acme?",
+  details=..., context={...})\` puts a decision in Codiedev (Agents →
+  Approvals, or \`codiedev agents decide\`) and returns a \`url\` to post anywhere.
+  End the run there; when someone decides, a new run of this agent starts
+  with input \`{"approval": {"decision", "comment", "decidedBy"}, "context": ...}\`.
+  Check \`agents.input().get("approval")\` at the top to tell the two apart.
+  Unanswered by \`expires_in\` (default 7 days): decision \`"expired"\`.
+  \`options=[...]\` for other choices; \`approvers=[emails]\` to limit who decides.
+
+## Ship, watch, iterate
+
+\`\`\`bash
+codiedev agents run --local --input '{"ticket": 42}' # run it here first, no deploy
+codiedev agents deploy                               # from this folder
+codiedev agents run <name> --input '{"ticket": 42}'  # streams the log, prints output
+codiedev agents runs <name> --failed                 # what broke
+codiedev agents show <run-id> --json                 # input, output, log, cost, children
+codiedev agents logs <run-id> -f                     # follow a run that's still going
+\`\`\`
+
+To fix a failing agent: \`codiedev agents runs <name> --failed\`, read the run
+with \`show --json\`, change the code, try it with \`run --local\` and the same
+input, \`deploy\`, then rerun it with \`codiedev agents run <name> --input-file <file>\`.
+A deploy that made things worse: \`codiedev agents rollback <name>\` (the last
+10 versions are kept; \`codiedev agents versions <name>\` lists them).
+
+\`run --local\` runs the entrypoint on your machine with the same SDK: secrets
+from \`.env\` (never bundled), state in \`.codiedev/local/state.json\`
+(\`--remote-state\` uses the deployed agent's), model calls on your own CLI
+token. Python agents need \`openai\` installed locally; TS runs through \`npx tsx\`. \`show\` also prints the run's
+Traces id, so \`codiedev traces\` (test cases, evals) works on it.
+
+## Starting runs
+
+- **Schedule:** set \`"every": "15m"\` in agent.json and redeploy. A scheduled run
+  is skipped while the previous one is still going.
+- **Webhook:** \`codiedev agents webhook <name>\` returns a URL. A POST to it
+  starts a run with the body as input (JSON parsed, anything else as a
+  string). \`agents.request()\` gives the exact request (method, query,
+  headers, raw body) so the agent can verify the sender's signature (Slack
+  \`X-Slack-Signature\`, GitHub \`X-Hub-Signature-256\`); keep the signing
+  secret in secrets. Slack's URL check is answered for you.
+- **From other code:** POST \`/api/agents/v1/run\` with \`{"agent", "input"}\` and
+  your CLI token, or \`codiedev_agents.run()\` with \`CODIEDEV_TOKEN\` and
+  \`CODIEDEV_AGENTS_URL\` set.
+- **No duplicates:** send \`Idempotency-Key\` (header, or \`idempotencyKey\` in the
+  body, or \`--idempotency-key\`). A repeat within a day returns the first run.
+
+## Sharing it
+
+\`codiedev agents publish <name> --summary "…"\` shares it as a template with
+your team (\`--company\` for everyone), like a skill. Teammates find it under
+Agents → Marketplace or \`codiedev agents templates\`; they can run yours as
+is, or install their own copy (\`codiedev agents install <template> <name>\`)
+with their own secrets. Publish again to update it. Write a README.md in the
+folder: it's what people read before installing.
+
+## Who can do what
+
+Anyone in the company can run, pull and watch any agent. Redeploying,
+deleting, rolling back, secrets, webhooks and reading its state from outside
+a run are for the agent's owner (who first deployed it) and company admins,
+since whoever can redeploy an agent can read its secrets. Anyone can decide
+an approval unless it names approvers.
+
+## Cost and limits
+
+Each run shows its sandbox time and cost (passed through at the provider's
+rate, about $0.19 an hour at 1 core / 2 GB) and its model spend. The agent's
+gateway key has a monthly budget (\`budgetUsd\` in agent.json, $25 by default).
+
+Input 64 KB, output 256 KB, bundle 10 MB, runs up to 1 hour, chains up to 5
+deep, 25 runs at once per company, retries up to 5, delays up to 7 days,
+state 1,000 keys × 64 KB per agent.
+`;
+const STARTER_AGENT = `"""%NAME% — a Codiedev agent. See AGENTS.md for the primitive."""
+
+import json
+import os
+
+import codiedev_agents as agents
+
+MODEL = os.environ.get("MODEL", "%MODEL%")
+
+
+def main() -> None:
+    task = agents.input() or {"question": "Say hello and tell me what you can do."}
+    llm = agents.openai()
+    reply = llm.chat.completions.create(
+        model=MODEL,
+        messages=[
+            {"role": "system", "content": "You are a concise, helpful assistant."},
+            {"role": "user", "content": json.dumps(task)},
+        ],
+    )
+    answer = reply.choices[0].message.content
+    print(answer)
+    agents.output({"answer": answer})
+
+
+if __name__ == "__main__":
+    main()
+`;
+const STARTER_TS = `// %NAME% — a Codiedev agent. See AGENTS.md for the primitive.
+import * as agents from "codiedev-agents";
+
+const MODEL = process.env.MODEL ?? "%MODEL%";
+
+const task = agents.input({ question: "Say hello and tell me what you can do." });
+const llm = await agents.openai();
+const reply = await llm.chat.completions.create({
+  model: MODEL,
+  messages: [
+    { role: "system", content: "You are a concise, helpful assistant." },
+    { role: "user", content: JSON.stringify(task) },
+  ],
+});
+const answer = reply.choices[0].message.content;
+console.log(answer);
+agents.output({ answer });
+`;
+const ENTRYPOINTS = ["agent.py", "agent.ts", "agent.mjs", "agent.js", "agent.sh"];
+const BOOLEAN_FLAGS = ["--mine", "--json", "--no-wait", "--failed", "--off", "--quiet", "--follow", "--force", "--local", "--remote-state", "--all"];
+function flag(args, name) {
+    const i = args.indexOf(name);
+    return i >= 0 ? args[i + 1] : undefined;
+}
+function positional(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "-f")
+            continue;
+        if (args[i].startsWith("--")) {
+            if (!BOOLEAN_FLAGS.includes(args[i]))
+                i++;
+            continue;
+        }
+        out.push(args[i]);
+    }
+    return out;
+}
+function parseEvery(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null || value === "" || value === "off")
+        return null;
+    const m = /^(\d+)\s*(m|min|h|d)$/.exec(String(value).trim());
+    if (!m)
+        throw new Error(`"every" looks like 15m, 2h or 1d (got ${value})`);
+    const n = Number(m[1]);
+    return m[2] === "d" ? n * 1440 : m[2] === "h" ? n * 60 : n;
+}
+function fail(message) {
+    console.error(message);
+    process.exit(1);
+}
+function readAgentJson(dir) {
+    const file = path.join(dir, "agent.json");
+    if (!fs.existsSync(file))
+        return {};
+    try {
+        return JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch (err) {
+        return fail(`agent.json isn't valid JSON: ${err.message}`);
+    }
+}
+const EXCLUDES = [".git", "node_modules", ".venv", "venv", "__pycache__", ".codiedev", ".env", ".env.*", "*.pyc", ".DS_Store"];
+/** Patterns from .codiedevignore (one per line, # comments), on top of EXCLUDES. */
+function ignorePatterns(dir) {
+    const file = path.join(dir, ".codiedevignore");
+    if (!fs.existsSync(file))
+        return [];
+    return fs.readFileSync(file, "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+}
+function bundle(dir) {
+    // macOS bsdtar: leave out extended attributes, which GNU tar warns about.
+    const mac = process.platform === "darwin" ? ["--no-mac-metadata", "--no-xattrs"] : [];
+    const excludes = [...EXCLUDES, ...ignorePatterns(dir)];
+    const args = ["-czf", "-", ...mac, ...excludes.map((e) => `--exclude=${e}`), "-C", dir, "."];
+    return (0, child_process_1.execFileSync)("tar", args, { maxBuffer: 64 * 1024 * 1024, env: { ...process.env, COPYFILE_DISABLE: "1" } });
+}
+function ago(at) {
+    if (!at)
+        return "—";
+    const s = Math.round((Date.now() - at) / 1000);
+    if (s < 60)
+        return `${s}s ago`;
+    if (s < 3600)
+        return `${Math.round(s / 60)}m ago`;
+    if (s < 86400)
+        return `${Math.round(s / 3600)}h ago`;
+    return `${Math.round(s / 86400)}d ago`;
+}
+const secs = (ms) => (ms == null ? "—" : `${(ms / 1000).toFixed(1)}s`);
+const DONE = ["succeeded", "failed", "cancelled"];
+const usd = (n) => (n == null ? "—" : n < 0.01 ? `$${n.toFixed(4)}` : `$${n.toFixed(2)}`);
+/** Prints the part of a run's log not printed yet. The run keeps the last
+ *  16 KB of its log and a count of everything logged, so the new part is the
+ *  tail's last (logChars - printed) characters; a gap means lines scrolled off. */
+function makeLogPrinter(write) {
+    let printed = 0;
+    return (run) => {
+        const tail = run.logTail ?? "";
+        const total = run.logChars ?? tail.length;
+        if (total <= printed)
+            return;
+        const fresh = total - printed;
+        if (fresh > tail.length)
+            write(`… ${fresh - tail.length} characters not shown …\n`);
+        write(tail.slice(Math.max(0, tail.length - fresh)));
+        printed = total;
+    };
+}
+function pretty(text) {
+    if (text == null)
+        return "(none)";
+    try {
+        return JSON.stringify(JSON.parse(text), null, 2);
+    }
+    catch {
+        return text;
+    }
+}
+function writeGuides(dir) {
+    if (!fs.existsSync(path.join(dir, "AGENTS.md")))
+        fs.writeFileSync(path.join(dir, "AGENTS.md"), exports.AGENT_GUIDE);
+    if (!fs.existsSync(path.join(dir, "CLAUDE.md")))
+        fs.writeFileSync(path.join(dir, "CLAUDE.md"), "@AGENTS.md\n");
+}
+/** Fills %NAME% and %MODEL%. Without --model, a run uses its agent's default
+ *  model (CODIEDEV_MODEL, the first one its key allows). */
+function fillTemplate(text, file, name, model) {
+    let out = text.replace(/%NAME%/g, name);
+    if (!model) {
+        const fallback = file.endsWith(".py") ? 'os.environ.get("CODIEDEV_MODEL", "codiedev/fast")' : '(process.env.CODIEDEV_MODEL ?? "codiedev/fast")';
+        out = out.replace(/"%MODEL%"/g, fallback);
+    }
+    return out.replace(/%MODEL%/g, model ?? "codiedev/fast");
+}
+/** init --template: a starter (built in) or a template your team or company shared. */
+async function initFromTemplate(name, dir, id, args) {
+    const model = flag(args, "--model");
+    const starter = agentTemplates_generated_1.TEMPLATES.find((t) => t.id === id);
+    if (starter) {
+        for (const [rel, text] of Object.entries(starter.files)) {
+            fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
+            fs.writeFileSync(path.join(dir, rel), fillTemplate(text, rel, name, model));
+        }
+        writeGuides(dir);
+        console.log(`Created ${path.relative(process.cwd(), dir) || "."}/ from the ${starter.title} template.`);
+        console.log(`Read its README.md, then try it: cd ${path.relative(process.cwd(), dir) || "."} && codiedev agents run --local`);
+        return;
+    }
+    const config = (0, shared_1.requireConfig)();
+    const res = await fetch(new URL(`/api/agents/v1/templates/bundle?slug=${encodeURIComponent(id)}`, config.backendUrl), { headers: { Authorization: `Bearer ${config.token}` } });
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        fail(`${body.error ?? `HTTP ${res.status}`}. Starter templates: ${agentTemplates_generated_1.TEMPLATES.map((t) => t.id).join(", ")} (codiedev agents templates)`);
+    }
+    const meta = JSON.parse(res.headers.get("x-codiedev-template") ?? "{}");
+    (0, child_process_1.execFileSync)("tar", ["-xzf", "-", "-C", dir], { input: Buffer.from(await res.arrayBuffer()) });
+    const agentJson = readAgentJson(dir);
+    fs.writeFileSync(path.join(dir, "agent.json"), JSON.stringify({ ...agentJson, name }, null, 2) + "\n");
+    writeGuides(dir);
+    console.log(`Created ${path.relative(process.cwd(), dir) || "."}/ from the ${id} template.`);
+    if (meta.secretNames?.length)
+        console.log(`It uses secrets: ${meta.secretNames.join(", ")}. Set them after deploying: codiedev agents secrets ${name} set NAME=value`);
+}
+async function cmdInit(args) {
+    const [name, dirArg] = positional(args);
+    if (!name || !/^[a-z][a-z0-9-]{1,47}$/.test(name))
+        fail("Usage: codiedev agents init <name> [dir] [--template <id>]   (lowercase letters, digits, dashes)");
+    const dir = path.resolve(dirArg ?? name);
+    const template = flag(args, "--template");
+    if (template) {
+        if (fs.existsSync(dir) && fs.readdirSync(dir).length)
+            fail(`${dir} isn't empty. Pick another folder.`);
+        fs.mkdirSync(dir, { recursive: true });
+        return initFromTemplate(name, dir, template, args);
+    }
+    const lang = flag(args, "--lang") ?? "python";
+    if (!["python", "py", "ts", "typescript", "js", "javascript"].includes(lang))
+        fail("--lang is python, ts or js");
+    const existing = ENTRYPOINTS.find((f) => fs.existsSync(path.join(dir, f)));
+    if (existing)
+        fail(`${dir} already has an ${existing}`);
+    fs.mkdirSync(dir, { recursive: true });
+    const model = flag(args, "--model");
+    let entrypoint = "agent.py";
+    if (lang.startsWith("py")) {
+        fs.writeFileSync(path.join(dir, "agent.py"), fillTemplate(STARTER_AGENT, "agent.py", name, model));
+        fs.writeFileSync(path.join(dir, "requirements.txt"), "# Extra packages for this agent, one per line. openai, mcp, httpx and pydantic are preinstalled.\n");
+    }
+    else {
+        entrypoint = lang.startsWith("t") ? "agent.ts" : "agent.mjs";
+        fs.writeFileSync(path.join(dir, entrypoint), fillTemplate(STARTER_TS, entrypoint, name, model));
+        // No dependencies needed to start (openai and codiedev-agents are
+        // preinstalled); add them here and they install into a cached image.
+        fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name, private: true, type: "module", dependencies: {} }, null, 2) + "\n");
+    }
+    fs.writeFileSync(path.join(dir, "agent.json"), JSON.stringify({ name, entrypoint, timeoutSec: 600 }, null, 2) + "\n");
+    writeGuides(dir);
+    console.log(`Created ${path.relative(process.cwd(), dir) || "."}/ with ${entrypoint}, agent.json and AGENTS.md.`);
+    console.log(`Want a head start? codiedev agents templates`);
+    console.log(`Next: edit ${entrypoint} (or ask your coding agent to, it reads AGENTS.md), then \`codiedev agents deploy ${dirArg ?? name}\`.`);
+}
+async function cmdDeploy(args, config) {
+    const dir = path.resolve(positional(args)[0] ?? ".");
+    const meta = readAgentJson(dir);
+    const name = flag(args, "--name") ?? meta.name;
+    if (!name)
+        fail("Name the agent in agent.json (\"name\") or with --name");
+    const entrypoint = meta.entrypoint ?? ENTRYPOINTS.find((f) => fs.existsSync(path.join(dir, f))) ?? "agent.py";
+    if (!fs.existsSync(path.join(dir, entrypoint)))
+        fail(`${entrypoint} not found in ${dir}. Set "entrypoint" in agent.json.`);
+    let everyMinutes;
+    try {
+        everyMinutes = parseEvery(flag(args, "--every") ?? (meta.every === undefined ? null : meta.every));
+    }
+    catch (err) {
+        fail(err.message);
+    }
+    const tgz = bundle(dir);
+    const res = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/deploy", {
+        config,
+        body: {
+            name,
+            bundle: tgz.toString("base64"),
+            entrypoint,
+            timeoutSec: Number(flag(args, "--timeout") ?? meta.timeoutSec ?? 600),
+            everyMinutes: everyMinutes ?? null,
+            ...(meta.cpu !== undefined ? { cpu: meta.cpu } : {}),
+            ...(meta.memoryMb !== undefined ? { memoryMb: meta.memoryMb } : {}),
+            ...(meta.budgetUsd !== undefined ? { monthlyBudgetUsd: meta.budgetUsd } : {}),
+            ...(meta.retries !== undefined ? { retries: meta.retries } : {}),
+            ...(meta.personalSecrets !== undefined ? { personalSecrets: meta.personalSecrets } : {}),
+        },
+    });
+    console.log(`${res.created ? "Deployed" : "Updated"} ${res.agent} → version ${res.version} (${(tgz.length / 1024).toFixed(1)} KB)${everyMinutes ? `, runs every ${everyMinutes}m` : ""}${meta.retries ? `, ${meta.retries} retries` : ""}`);
+    if (!res.created)
+        console.log(`Undo: codiedev agents rollback ${res.agent}`);
+    const deps = ["requirements.txt", "package.json"].filter((f) => fs.existsSync(path.join(dir, f)));
+    if (deps.length)
+        console.log(`Dependencies (${deps.join(", ")}) install on the first run after they change, then come from cache.`);
+    console.log(`Run it: codiedev agents run ${res.agent}`);
+}
+async function waitFor(config, id, timeoutMs, onUpdate) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const run = await (0, shared_1.apiRequest)("GET", `/api/agents/v1/run?id=${encodeURIComponent(id)}`, { config });
+        onUpdate?.(run);
+        if (DONE.includes(run.status))
+            return run;
+        if (Date.now() > deadline)
+            fail(`Still ${run.status} after ${timeoutMs / 1000}s. Check later: codiedev agents show ${id}`);
+        await new Promise((r) => setTimeout(r, 2000));
+    }
+}
+function readInput(args) {
+    const raw = flag(args, "--input") ?? (flag(args, "--input-file") ? fs.readFileSync(flag(args, "--input-file"), "utf8") : undefined);
+    if (raw === undefined)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+/** "90", "90s", "30m", "2h", "1d" → seconds. */
+function parseDuration(value) {
+    const m = /^(\d+)\s*(s|m|min|h|d)?$/.exec(value.trim());
+    if (!m)
+        throw new Error(`durations look like 90s, 30m, 2h or 1d (got ${value})`);
+    const n = Number(m[1]);
+    return m[2] === "d" ? n * 86400 : m[2] === "h" ? n * 3600 : m[2] === "m" || m[2] === "min" ? n * 60 : n;
+}
+async function cmdRun(args, config) {
+    const [name] = positional(args);
+    if (!name)
+        fail("Usage: codiedev agents run <name> [--input '<json>'] [--no-wait]   (or --local [dir])");
+    const input = readInput(args);
+    const idempotencyKey = flag(args, "--idempotency-key");
+    let delaySec;
+    try {
+        delaySec = flag(args, "--delay") ? parseDuration(flag(args, "--delay")) : undefined;
+    }
+    catch (err) {
+        fail(err.message);
+    }
+    const retries = flag(args, "--retries") !== undefined ? Number(flag(args, "--retries")) : undefined;
+    const started = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/run", {
+        config,
+        body: { agent: name, input, source: "cli", ...(idempotencyKey ? { idempotencyKey } : {}), ...(delaySec ? { delaySec } : {}), ...(retries !== undefined ? { retries } : {}) },
+    });
+    if (delaySec) {
+        console.log(args.includes("--json") ? JSON.stringify(started) : `Scheduled ${name} run ${started.runId} to start in ${flag(args, "--delay")}. Watch it: codiedev agents logs ${started.runId} -f`);
+        return;
+    }
+    if (args.includes("--no-wait")) {
+        console.log(args.includes("--json") ? JSON.stringify(started) : `${started.status === "existing" ? "Already started" : "Started"} ${name} run ${started.runId}`);
+        return;
+    }
+    // The log streams to stderr, so stdout stays just the output (pipe-friendly).
+    const quiet = args.includes("--quiet") || args.includes("--json");
+    process.stderr.write(`Run ${started.runId}${started.status === "existing" ? " (already started with this idempotency key)" : ""}\n`);
+    const printLog = makeLogPrinter((t) => process.stderr.write(t));
+    let lastStatus = "";
+    const run = await waitFor(config, started.runId, Number(flag(args, "--timeout") ?? 3900) * 1000, (r) => {
+        const label = r.attempt && r.attempt > 1 ? `${r.status} · attempt ${r.attempt}/${r.maxAttempts}` : r.status;
+        if (label !== lastStatus && !DONE.includes(r.status))
+            process.stderr.write(`[${label}]\n`);
+        lastStatus = label;
+        if (!quiet)
+            printLog(r);
+    });
+    const cost = `${secs(run.computeMs ?? run.durationMs)} · compute ${usd(run.computeUsd)} · models ${usd(run.modelUsd)}`;
+    if (args.includes("--json")) {
+        console.log(JSON.stringify(run, null, 2));
+    }
+    else if (run.status === "succeeded") {
+        process.stderr.write(`[succeeded · ${cost}]\n`);
+        console.log(pretty(run.output));
+    }
+    else {
+        process.stderr.write(`[${run.status} · ${cost}]\n`);
+        console.error(`${run.status}: ${run.error ?? "no error message"}`);
+        if (quiet && run.logTail)
+            console.error(`\nLog (tail):\n${run.logTail.split("\n").slice(-25).join("\n")}`);
+        console.error(`\nInspect: codiedev agents show ${run.id}`);
+    }
+    if (run.status !== "succeeded")
+        process.exit(1);
+}
+async function cmdRuns(args, config) {
+    const [name] = positional(args);
+    const q = new URLSearchParams();
+    if (name)
+        q.set("agent", name);
+    if (args.includes("--failed"))
+        q.set("status", "failed");
+    q.set("limit", flag(args, "--limit") ?? "20");
+    const { runs } = await (0, shared_1.apiRequest)("GET", `/api/agents/v1/runs?${q}`, { config });
+    if (args.includes("--json"))
+        return void console.log(JSON.stringify(runs, null, 2));
+    if (!runs.length)
+        return void console.log("No runs.");
+    for (const r of runs) {
+        const chain = r.parentRunId ? `  ↳ child of ${r.parentRunId}` : "";
+        console.log(`${r.id}  ${r.agent.padEnd(20)} ${r.status.padEnd(10)} ${r.trigger.padEnd(9)} ${secs(r.durationMs).padStart(7)} ${usd(r.computeUsd).padStart(8)}  ${ago(r.createdAt)}${chain}`);
+        if (r.error)
+            console.log(`    ${r.error}`);
+    }
+}
+async function cmdShow(args, config) {
+    const [id] = positional(args);
+    if (!id)
+        fail("Usage: codiedev agents show <run-id>");
+    const r = await (0, shared_1.apiRequest)("GET", `/api/agents/v1/run?id=${encodeURIComponent(id)}`, { config });
+    if (args.includes("--json"))
+        return void console.log(JSON.stringify(r, null, 2));
+    const attempts = r.maxAttempts && r.maxAttempts > 1 ? ` · attempt ${r.attempt}/${r.maxAttempts}` : "";
+    const scheduled = r.scheduledFor ? ` · starts ${new Date(r.scheduledFor).toLocaleString()}` : "";
+    console.log(`${r.agent} v${r.version} · ${r.status}${attempts}${scheduled} · ${r.trigger} · ${secs(r.durationMs)} · ${ago(r.createdAt)}`);
+    console.log(`Cost: compute ${usd(r.computeUsd)}${r.computeMs != null ? ` (${secs(r.computeMs)} sandbox)` : ""} · models ${usd(r.modelUsd)} over ${r.modelCalls ?? 0} calls`);
+    if (r.traceRunId)
+        console.log(`Trace: ${portalUrl()}/portal/traces?view=runs&run=${encodeURIComponent(r.traceRunId)}`);
+    if (r.parentRunId)
+        console.log(`Parent: ${r.parentRunId}`);
+    if (r.error)
+        console.log(`Error: ${r.error}`);
+    console.log(`\nInput:\n${pretty(r.input)}\n\nOutput:\n${pretty(r.output)}`);
+    if (r.children?.length) {
+        console.log("\nChild runs:");
+        for (const c of r.children)
+            console.log(`  ${c.id}  ${c.agent}  ${c.status}  ${secs(c.durationMs)}`);
+    }
+    if (r.logTail)
+        console.log(`\nLog${(r.logChars ?? 0) > r.logTail.length ? " (last 16 KB)" : ""}:\n${r.logTail}`);
+}
+function portalUrl() {
+    return (process.env.CODIEDEV_PORTAL_URL || "https://codiedev.com").replace(/\/$/, "");
+}
+async function cmdLogs(args, config) {
+    const [id] = positional(args);
+    if (!id)
+        fail("Usage: codiedev agents logs <run-id> [-f]");
+    const follow = args.includes("-f") || args.includes("--follow");
+    const print = makeLogPrinter((t) => process.stdout.write(t));
+    const run = follow
+        ? await waitFor(config, id, 3900 * 1000, print)
+        : await (0, shared_1.apiRequest)("GET", `/api/agents/v1/run?id=${encodeURIComponent(id)}`, { config });
+    if (!follow)
+        print(run);
+    if (follow || !DONE.includes(run.status))
+        process.stderr.write(`[${run.status}]\n`);
+}
+async function cmdList(args, config) {
+    const { agents } = await (0, shared_1.apiRequest)("GET", "/api/agents/v1/agents", { config });
+    if (args.includes("--json"))
+        return void console.log(JSON.stringify(agents, null, 2));
+    if (!agents.length)
+        return void console.log("No agents yet. Start one: codiedev agents init <name>");
+    for (const a of agents) {
+        const how = [a.everyMinutes ? `every ${a.everyMinutes}m` : null, a.hasWebhook ? "webhook" : null].filter(Boolean).join(", ") || "on demand";
+        const last = a.lastRun ? `${a.lastRun.status} ${ago(a.lastRun.createdAt)}` : "never run";
+        console.log(`${a.name.padEnd(24)} v${String(a.version).padEnd(4)} ${how.padEnd(20)} last: ${last.padEnd(20)} 24h: ${a.runs24h} runs, ${a.failed24h} failed, ${usd(a.computeUsd24h ?? 0)} compute  (${a.owner})`);
+    }
+}
+async function cmdSecrets(args, config) {
+    const [name, action, pair] = positional(args);
+    const mine = args.includes("--mine");
+    const usage = "Usage: codiedev agents secrets <name> [set KEY=value | unset KEY] [--mine]";
+    if (!name)
+        fail(usage);
+    if (!action) {
+        const { secrets } = await (0, shared_1.apiRequest)("GET", `/api/agents/v1/secrets?agent=${encodeURIComponent(name)}`, { config });
+        if (!secrets.length)
+            return void console.log(`${name} has no secrets. Add one: codiedev agents secrets ${name} set KEY=value`);
+        for (const s of secrets) {
+            const shared = s.updatedAt ? `shared, updated ${ago(s.updatedAt)}` : "no shared value";
+            console.log(s.personal ? `${s.name}  (personal: ${s.yours ? `yours set ${ago(s.yours)}` : `yours not set; codiedev agents secrets ${name} set ${s.name}=… --mine`}; ${shared})` : `${s.name}  (${shared})`);
+        }
+        return;
+    }
+    if (action === "set") {
+        const eq = pair?.indexOf("=") ?? -1;
+        if (!pair || eq < 1)
+            fail(usage);
+        await (0, shared_1.apiRequest)("POST", "/api/agents/v1/secrets", { config, body: { agent: name, name: pair.slice(0, eq), value: pair.slice(eq + 1), mine } });
+        return void console.log(mine ? `Set your own ${pair.slice(0, eq)} on ${name}. Runs you start use it.` : `Set ${pair.slice(0, eq)} on ${name}. It's in the environment from the next run.`);
+    }
+    if (action === "unset") {
+        if (!pair)
+            fail(usage);
+        await (0, shared_1.apiRequest)("POST", "/api/agents/v1/secrets", { config, body: { agent: name, name: pair, value: null, mine } });
+        return void console.log(mine ? `Removed your own ${pair} from ${name}.` : `Removed ${pair} from ${name}.`);
+    }
+    fail(usage);
+}
+/** Kill switch: stop (or resume) one agent, or every agent with --all (admins). */
+async function cmdControl(args, config, stop) {
+    const [name] = positional(args);
+    const all = args.includes("--all");
+    if (!name && !all)
+        fail(`Usage: codiedev agents ${stop ? "stop" : "resume"} <name> | --all${stop ? " [--reason \"…\"]" : ""}`);
+    const res = await (0, shared_1.apiRequest)("POST", `/api/agents/v1/${stop ? "stop" : "resume"}`, { config, body: { agent: name, all, reason: flag(args, "--reason") } });
+    const what = all ? "Every agent" : name;
+    if (stop)
+        console.log(res.already ? `${what} was already stopped.` : `${what} stopped. Cancelled ${res.cancelledRuns ?? 0} run(s) and revoked model access. Nothing starts it until someone resumes it.`);
+    else
+        console.log(res.companyStopped ? `${what} resumed, but every agent is still stopped company-wide; an admin runs codiedev agents resume --all.` : `${what} resumed with a fresh model key.`);
+}
+async function cmdWebhook(args, config) {
+    const [name] = positional(args);
+    if (!name)
+        fail("Usage: codiedev agents webhook <name> [--off]");
+    const res = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/webhook", { config, body: { agent: name, off: args.includes("--off") } });
+    if (!res.url)
+        return void console.log(`Removed ${name}'s webhook.`);
+    console.log(res.url);
+    if (process.stderr.isTTY)
+        process.stderr.write("POST JSON to this URL to start a run; the body is the input. It's shown once, and running this again replaces it.\n");
+}
+async function cmdPull(args, config) {
+    const [name, dirArg] = positional(args);
+    if (!name)
+        fail("Usage: codiedev agents pull <name> [dir]");
+    const dir = path.resolve(dirArg ?? name);
+    if (fs.existsSync(dir) && fs.readdirSync(dir).length && !args.includes("--force"))
+        fail(`${dir} isn't empty. Pick another folder or pass --force to unpack over it.`);
+    const version = flag(args, "--version");
+    const res = await fetch(new URL(`/api/agents/v1/bundle?agent=${encodeURIComponent(name)}${version ? `&version=${encodeURIComponent(version)}` : ""}`, config.backendUrl), {
+        headers: { Authorization: `Bearer ${config.token}` },
+    });
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        fail(`codiedev agents pull: ${body.error ?? `HTTP ${res.status}`}`);
+    }
+    fs.mkdirSync(dir, { recursive: true });
+    (0, child_process_1.execFileSync)("tar", ["-xzf", "-", "-C", dir], { input: Buffer.from(await res.arrayBuffer()) });
+    console.log(`Pulled ${name} v${res.headers.get("x-codiedev-agent-version") ?? "?"} into ${path.relative(process.cwd(), dir) || "."}/. Secrets stay in Codiedev; deploy from here to ship a new version.`);
+}
+async function cmdVersions(args, config) {
+    const [name] = positional(args);
+    if (!name)
+        fail("Usage: codiedev agents versions <name>");
+    const { versions } = await (0, shared_1.apiRequest)("GET", `/api/agents/v1/versions?agent=${encodeURIComponent(name)}`, { config });
+    if (args.includes("--json"))
+        return void console.log(JSON.stringify(versions, null, 2));
+    for (const r of versions) {
+        const note = [r.current ? "current" : null, r.rollbackOf ? `rollback to v${r.rollbackOf}` : null, r.everyMinutes ? `every ${r.everyMinutes}m` : null, r.retries ? `${r.retries} retries` : null].filter(Boolean).join(", ");
+        console.log(`v${String(r.version).padEnd(4)} ${ago(r.createdAt).padEnd(9)} ${r.deployedBy.padEnd(22)} ${(r.bundleBytes / 1024).toFixed(1).padStart(7)} KB  ${note}`);
+    }
+    if (versions.length > 1)
+        console.log(`\nRoll back: codiedev agents rollback ${name} [--to <n>]`);
+}
+async function cmdRollback(args, config) {
+    const [name] = positional(args);
+    if (!name)
+        fail("Usage: codiedev agents rollback <name> [--to <version>]");
+    const to = flag(args, "--to");
+    const res = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/rollback", { config, body: { agent: name, ...(to ? { to: Number(to.replace(/^v/, "")) } : {}) } });
+    console.log(`Rolled ${name} back to v${res.from}'s code and settings, as v${res.version}. New runs use it now.`);
+}
+async function cmdState(args, config) {
+    const [name, action = "list", key, value] = positional(args);
+    if (!name)
+        fail("Usage: codiedev agents state <name> [list [prefix] | get <key> | set <key> '<json>' | delete <key>]");
+    const agent = encodeURIComponent(name);
+    if (action === "list") {
+        const keys = [];
+        let after = null;
+        do {
+            const q = new URLSearchParams({ agent: name, prefix: key ?? "", values: args.includes("--json") ? "1" : "0", limit: "200", ...(after ? { after } : {}) });
+            const page = await (0, shared_1.apiRequest)("GET", `/api/agents/v1/state?${q}`, { config });
+            keys.push(...page.keys);
+            after = page.next;
+        } while (after);
+        if (args.includes("--json"))
+            return void console.log(JSON.stringify(keys.map((k) => ({ ...k, value: k.value ? JSON.parse(k.value) : undefined })), null, 2));
+        if (!keys.length)
+            return void console.log(`${name} has no state${key ? ` under ${key}` : ""}.`);
+        for (const k of keys)
+            console.log(`${k.key.padEnd(40)} v${String(k.version).padEnd(5)} ${String(k.bytes).padStart(7)} B  ${ago(k.updatedAt)}${k.expiresAt ? `  expires ${new Date(k.expiresAt).toLocaleString()}` : ""}`);
+        return;
+    }
+    if (!key)
+        fail(`Usage: codiedev agents state ${name} ${action} <key>`);
+    if (action === "get") {
+        const row = await (0, shared_1.apiRequest)("GET", `/api/agents/v1/state?agent=${agent}&key=${encodeURIComponent(key)}`, { config });
+        return void console.log(pretty(row.value));
+    }
+    if (action === "set" || action === "delete") {
+        let parsed = null;
+        if (action === "set") {
+            if (value === undefined)
+                fail(`Usage: codiedev agents state ${name} set <key> '<json>'`);
+            try {
+                parsed = JSON.parse(value);
+            }
+            catch {
+                parsed = value;
+            }
+        }
+        const res = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/state", { config, body: { agent: name, key, value: parsed } });
+        return void console.log(action === "set" ? `Set ${key} (v${res.version}).` : `Deleted ${key}.`);
+    }
+    fail("Usage: codiedev agents state <name> [list [prefix] | get <key> | set <key> '<json>' | delete <key>]");
+}
+async function cmdApprovals(args, config) {
+    const status = args.includes("--all") ? "decided" : "pending";
+    const { approvals } = await (0, shared_1.apiRequest)("GET", `/api/agents/v1/approvals?status=${status}`, { config });
+    if (args.includes("--json"))
+        return void console.log(JSON.stringify(approvals, null, 2));
+    if (!approvals.length)
+        return void console.log(status === "pending" ? "No approvals waiting." : "No decided approvals.");
+    for (const a of approvals) {
+        console.log(`${a.id}  ${a.agent.padEnd(20)} ${a.title}`);
+        if (a.status === "pending")
+            console.log(`    ${a.options.join(" | ")} · asked ${ago(a.createdAt)} · expires ${new Date(a.expiresAt).toLocaleString()}`);
+        else
+            console.log(`    ${a.decision} by ${a.decidedBy ?? "—"}${a.resumeRunId ? ` → run ${a.resumeRunId}` : ""}`);
+        if (a.details)
+            console.log(a.details.split("\n").slice(0, 6).map((l) => `    ${l}`).join("\n"));
+    }
+    if (status === "pending")
+        console.log(`\nDecide: codiedev agents decide <id> <option> [--comment "…"]`);
+}
+async function cmdDecide(args, config) {
+    const [id, decision] = positional(args);
+    if (!id || !decision)
+        fail('Usage: codiedev agents decide <approval-id> <option> [--comment "…"]');
+    const res = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/approvals/decide", { config, body: { id, decision, comment: flag(args, "--comment") } });
+    console.log(`Decided: ${res.decision}.${res.runId ? ` Started run ${res.runId} (codiedev agents logs ${res.runId} -f).` : ""}`);
+}
+function readEnvFile(file) {
+    const out = {};
+    for (const line of fs.readFileSync(file, "utf8").split("\n")) {
+        const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$/.exec(line);
+        if (!m)
+            continue;
+        out[m[1]] = m[2].replace(/^(["'])(.*)\1$/, "$2");
+    }
+    return out;
+}
+/** Runs the agent in this folder on this machine: same SDK, same input and
+ *  output files, secrets from .env, state in .codiedev/local/state.json (or
+ *  the deployed agent's with --remote-state), model calls on your own CLI
+ *  token. Child runs (agents.run) start for real in Codiedev. */
+async function cmdRunLocal(args) {
+    const dir = path.resolve(positional(args)[0] ?? ".");
+    const meta = readAgentJson(dir);
+    const name = meta.name ?? path.basename(dir);
+    const entrypoint = meta.entrypoint ?? ENTRYPOINTS.find((f) => fs.existsSync(path.join(dir, f)));
+    if (!entrypoint || !fs.existsSync(path.join(dir, entrypoint)))
+        fail(`No entrypoint in ${dir}. Set "entrypoint" in agent.json, or run from the agent's folder.`);
+    let config = null;
+    try {
+        config = (0, shared_1.requireConfig)();
+    }
+    catch {
+        // Not connected: still runs, but model calls, child runs and --remote-state need a token.
+    }
+    const work = path.join(dir, ".codiedev", "local");
+    fs.mkdirSync(path.join(work, "py"), { recursive: true });
+    fs.writeFileSync(path.join(work, "py", "codiedev_agents.py"), sdk.python);
+    // ESM resolves bare imports from node_modules next to the code.
+    const jsSdk = path.join(dir, "node_modules", "codiedev-agents");
+    if (/\.(m?[jt]s|cjs|mts)$/.test(entrypoint)) {
+        fs.mkdirSync(jsSdk, { recursive: true });
+        fs.writeFileSync(path.join(jsSdk, "index.mjs"), sdk.jsIndex);
+        fs.writeFileSync(path.join(jsSdk, "index.d.ts"), sdk.jsTypes);
+        fs.writeFileSync(path.join(jsSdk, "package.json"), sdk.jsPackage);
+    }
+    const files = { input: path.join(work, "input.json"), output: path.join(work, "output.json"), request: path.join(work, "request.json"), response: path.join(work, "response.json") };
+    fs.writeFileSync(files.input, JSON.stringify(readInput(args) ?? null));
+    for (const f of [files.output, files.response])
+        fs.rmSync(f, { force: true });
+    const requestFile = flag(args, "--request-file");
+    if (requestFile)
+        fs.copyFileSync(path.resolve(requestFile), files.request);
+    else
+        fs.rmSync(files.request, { force: true });
+    const envFile = flag(args, "--env-file") ?? (fs.existsSync(path.join(dir, ".env")) ? path.join(dir, ".env") : undefined);
+    const secrets = envFile ? readEnvFile(envFile) : {};
+    const remoteState = args.includes("--remote-state");
+    if (remoteState && !config)
+        fail("--remote-state needs `codiedev connect` first.");
+    // The deployed agent whose state this uses must be named, not guessed from the folder.
+    if (remoteState && !meta.name)
+        fail('--remote-state needs "name" in agent.json, so it uses the right agent\'s state.');
+    const runId = `local-${Date.now()}`;
+    const env = {
+        ...process.env,
+        ...secrets,
+        CODIEDEV_LOCAL: "1",
+        CODIEDEV_AGENT: name,
+        CODIEDEV_RUN_ID: runId,
+        CODIEDEV_ATTEMPT: "1",
+        CODIEDEV_MAX_ATTEMPTS: "1",
+        CODIEDEV_INPUT_PATH: files.input,
+        CODIEDEV_OUTPUT_PATH: files.output,
+        CODIEDEV_REQUEST_PATH: files.request,
+        CODIEDEV_RESPONSE_PATH: files.response,
+        ...(remoteState ? {} : { CODIEDEV_STATE_PATH: path.join(work, "state.json") }),
+        PYTHONPATH: [path.join(work, "py"), process.env.PYTHONPATH].filter(Boolean).join(path.delimiter),
+        ...(config ? { CODIEDEV_AGENTS_URL: config.backendUrl, CODIEDEV_TOKEN: config.token } : {}),
+    };
+    const ext = path.extname(entrypoint);
+    const [cmd, ...cmdArgs] = ext === ".py" ? [process.env.PYTHON ?? "python3", "-u", entrypoint]
+        : ext === ".sh" ? ["bash", entrypoint]
+            : ext === ".ts" || ext === ".mts" ? ["npx", "--yes", "tsx", entrypoint]
+                : [process.execPath, entrypoint];
+    process.stderr.write(`[local run of ${name} · ${entrypoint}${envFile ? ` · secrets from ${path.relative(process.cwd(), envFile) || envFile}` : ""} · state ${remoteState ? "from Codiedev" : "in .codiedev/local/state.json"}]\n`);
+    const started = Date.now();
+    // The agent's own output goes to stderr, so stdout stays just the result.
+    const res = (0, child_process_1.spawnSync)(cmd, cmdArgs, { cwd: dir, env, stdio: ["inherit", process.stderr, process.stderr] });
+    const took = `${((Date.now() - started) / 1000).toFixed(1)}s`;
+    if (res.error)
+        fail(`Couldn't start ${cmd}: ${res.error.message}`);
+    const output = fs.existsSync(files.output) ? fs.readFileSync(files.output, "utf8") : null;
+    const response = fs.existsSync(files.response) ? fs.readFileSync(files.response, "utf8") : null;
+    if (res.status === 0) {
+        process.stderr.write(`[succeeded · ${took} · local]\n`);
+        if (response)
+            process.stderr.write(`Webhook response: ${response}\n`);
+        console.log(pretty(output));
+    }
+    else {
+        process.stderr.write(`[failed · exit ${res.status ?? res.signal} · ${took} · local]\n`);
+        process.exit(1);
+    }
+}
+async function cmdTemplates(args) {
+    let shared = [];
+    try {
+        shared = (await (0, shared_1.apiRequest)("GET", "/api/agents/v1/templates", { config: (0, shared_1.requireConfig)() })).templates;
+    }
+    catch {
+        // Not connected (or agents off): starters only.
+    }
+    if (args.includes("--json"))
+        return void console.log(JSON.stringify({ starters: agentTemplates_generated_1.TEMPLATES.map(({ files: _f, ...t }) => t), shared }, null, 2));
+    console.log("Starter templates\n");
+    for (const t of agentTemplates_generated_1.TEMPLATES)
+        console.log(`  ${t.id.padEnd(18)} ${t.title} · ${t.trigger}\n  ${"".padEnd(18)} ${t.summary}\n`);
+    if (shared.length) {
+        console.log("Shared in your company\n");
+        for (const t of shared)
+            console.log(`  ${t.slug.padEnd(18)} ${t.title} · by ${t.publishedBy} · ${t.visibility === "team" ? `team${t.team ? ` ${t.team}` : ""}` : "company"} · ${t.installs} installs\n  ${"".padEnd(18)} ${t.summary}\n`);
+    }
+    console.log("Start one: codiedev agents init <name> --template <id>");
+    if (shared.length)
+        console.log("Or deploy a shared one as is: codiedev agents install <template> <name>");
+}
+async function cmdPublish(args, config) {
+    const [agent] = positional(args);
+    if (!agent)
+        fail('Usage: codiedev agents publish <agent> --summary "what it does" [--company] [--title "…"] [--as <slug>]');
+    const summary = flag(args, "--summary");
+    if (!summary)
+        fail('Add --summary "one line on what it does", so people know when to use it.');
+    const res = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/templates/publish", {
+        config,
+        body: { agent, summary, title: flag(args, "--title"), slug: flag(args, "--as"), visibility: args.includes("--company") ? "company" : "team" },
+    });
+    console.log(`${res.updated ? "Updated" : "Published"} ${res.slug} for ${args.includes("--company") ? "your whole company" : "your team"}. Teammates: codiedev agents install ${res.slug} <name>, or Agents → Marketplace.`);
+}
+async function cmdInstall(args, config) {
+    const [template, name] = positional(args);
+    if (!template || !name)
+        fail("Usage: codiedev agents install <template> <name>");
+    const res = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/templates/install", { config, body: { template, name } });
+    console.log(`Deployed ${res.name} (v${res.version}) from ${template}. You own it: run it with codiedev agents run ${res.name}.`);
+    if (res.secretNames.length)
+        console.log(`Set its secrets first: ${res.secretNames.map((s) => `codiedev agents secrets ${res.name} set ${s}=…`).join("\n  ")}`);
+}
+async function cmdUnpublish(args, config) {
+    const [template] = positional(args);
+    if (!template)
+        fail("Usage: codiedev agents unpublish <template>");
+    await (0, shared_1.apiRequest)("POST", "/api/agents/v1/templates/unpublish", { config, body: { template } });
+    console.log(`Removed ${template} from the marketplace. Agents installed from it keep working.`);
+}
+async function cmdCancel(args, config) {
+    const [id] = positional(args);
+    if (!id)
+        fail("Usage: codiedev agents cancel <run-id>");
+    const res = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/cancel", { config, body: { id } });
+    console.log(res.status && res.status !== "cancelled" ? `Run already ${res.status}.` : "Cancelled.");
+}
+async function cmdConnect(args, config) {
+    const [name] = positional(args);
+    if (!name)
+        fail('Usage: codiedev agents connect <name> [--description "…"] [--budget <usd>]');
+    const budget = flag(args, "--budget");
+    const out = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/connect", {
+        config,
+        body: { name, description: flag(args, "--description"), ...(budget ? { monthlyBudgetUsd: Number(budget) } : {}) },
+    });
+    console.log(`Connected ${out.agent}. Its key is shown once; put it in your secret manager.\n`);
+    console.log(`CODIEDEV_API_KEY=${out.key}`);
+    console.log(`CODIEDEV_GATEWAY_URL=${out.gatewayUrl}`);
+    console.log(`CODIEDEV_AGENTS_URL=${out.agentsUrl}\n`);
+    console.log("Point its OpenAI-compatible client at CODIEDEV_GATEWAY_URL with that key (one X-Codiedev-Run-Id per job groups its calls into a trace).");
+    console.log(`The same key calls ${out.agentsUrl}/api/agents/v1/approvals and /state. See it: Agents → ${out.agent}.`);
+}
+async function cmdDelete(args, config) {
+    const [name] = positional(args);
+    if (!name)
+        fail("Usage: codiedev agents delete <name>");
+    await (0, shared_1.apiRequest)("POST", "/api/agents/v1/delete", { config, body: { agent: name } });
+    console.log(`Deleted ${name}. Its run history stays in Codiedev.`);
+}
+async function runAgents(args, configOverride) {
+    const [sub, ...rest] = args;
+    if (sub === "init")
+        return cmdInit(rest).catch((err) => fail(`codiedev agents init: ${err.message}`));
+    if (sub === "templates")
+        return cmdTemplates(rest);
+    if (sub === "run" && rest.includes("--local"))
+        return cmdRunLocal(rest);
+    const commands = {
+        connect: cmdConnect, deploy: cmdDeploy, run: cmdRun, runs: cmdRuns, show: cmdShow, logs: cmdLogs, list: cmdList, ls: cmdList,
+        secrets: cmdSecrets, webhook: cmdWebhook, cancel: cmdCancel, stop: (a, c) => cmdControl(a, c, true), resume: (a, c) => cmdControl(a, c, false), delete: cmdDelete, pull: cmdPull,
+        versions: cmdVersions, rollback: cmdRollback, state: cmdState, approvals: cmdApprovals, decide: cmdDecide,
+        publish: cmdPublish, install: cmdInstall, unpublish: cmdUnpublish,
+    };
+    const fn = sub ? commands[sub] : undefined;
+    if (!fn) {
+        console.log(exports.AGENTS_HELP);
+        if (sub && sub !== "help")
+            process.exit(1);
+        return;
+    }
+    try {
+        const config = configOverride ?? (0, shared_1.requireConfig)();
+        await (0, shared_1.withTelemetry)(config, `codiedev_agents_${sub}`, () => fn(rest, config));
+    }
+    catch (err) {
+        fail(`codiedev agents ${sub}: ${err.message}`);
+    }
+}