firedrill-run 2.2.5 → 3.0.0

package/dist/cli/src/main.js

@@ -0,0 +1,1622 @@
+import { APP_ORIGIN } from './http.js';
+import { parseArgs } from 'node:util';
+import { once } from 'node:events';
+import { mcpConnection } from './mcp-connection.js';
+import { onboardingCommand } from './onboarding.js';
+import { api, login, logout, openBrowser, startCredentialCompanion } from './auth.js';
+import { configureCredentialMode } from './credential-mode.js';
+import { killOwnedGroups } from './native/owned-groups.js';
+import { randomUUID } from 'node:crypto';
+import { CliError } from './http.js';
+import { selectOne, terminalText, configurePrompts } from './prompts.js';
+import { chooseWorkspace, refreshWorkspaceAccess, selectedWorld, selectedWorkspace } from './world-access.js';
+import { workspaceRegistrationCommand } from './workspace-registration.js';
+import { localSource } from './local-source.js';
+import { sourceRuntimeCommand } from './source-runtime.js';
+import { connectSource, sourceRequests } from './source-connection.js';
+import { sourceSetsCommand } from './source-sets.js';
+import { registrationGuide } from './registration-guide.js';
+import { isScenarioDiscoveryAction, scenarioDiscoveryCommand } from './scenario-discovery.js';
+import { recordedContextCommand } from './recorded-context.js';
+import { worldRecipes } from './world-recipes.js';
+import { dependencyPreparationCommand, isDependencyPreparationAction } from './dependency-preparation.js';
+import { campaignDiagnoses } from './campaign-diagnoses.js';
+import { sourceBatchCommand } from './source-batch.js';
+import { runnerCommand } from './runner-identity.js';
+import { runCleanupCommand } from './native/run-cleanup.js';
+import { drillCleanupCommand } from './native/drill-cleanup.js';
+import { runtimeCommand } from './runner-runtime.js';
+import { runnerGrantCommand } from './runner-grants.js';
+import { runnerJobs } from './runner-jobs.js';
+import { localContainerPurpose, recoverLocalContainer } from './runner-container.js';
+import { executeAssignment } from './runner-execute.js';
+import { abandonLocalAssignment } from './runner-abandon.js';
+import { resumeSimulation, simulationCommand, simulationRequest } from './simulation-run.js';
+import { driverReviewCommand } from './driver-review.js';
+import { reportCommand } from './campaign-reports.js';
+import { policyCommand } from './company-policies.js';
+import { toolsCommand } from './tools.js';
+import { worldDatasetCommand } from './world-datasets.js';
+import { campaignControl } from './campaign-controls.js';
+import { worldSessionsCommand } from './world-sessions.js';
+import { assessCommand, criteriaCommand } from './evaluation-authoring.js';
+import { assessmentRequests } from './assessment-requests.js';
+import { priorityCommand } from './priority.js';
+import { changesCommand } from './agent-changes.js';
+import { configurationCommand } from './configuration.js';
+import { inspectCommand } from './world-inspection.js';
+import { scenarioRequests } from './scenario-requests.js';
+import { scenarioAuthoring } from './scenario-authoring.js';
+import { revisionRequests } from './revision-requests.js';
+import { scenarioPaths } from './scenario-paths.js';
+import { targetModelsCommand } from './target-models.js';
+import { realOperationsCommand } from './real-operations.js';
+import { billingCommand } from './billing.js';
+import { ciCommand } from './continuous-simulation.js';
+import { settingsCommand, teamCommand } from './administration.js';
+import { vaultCommand } from './vault.js';
+import { localValuesCommand } from './local-values.js';
+import { recordingsCommand } from './recordings.js';
+import { commandNames, completionScript } from './completion.js';
+import { resourceLifecycle } from './resource-lifecycle.js';
+import { createWorld, worldCreationCommand } from './world-creation.js';
+import { syncLocalTrialEvidence } from './runner-trial-sync.js';
+import { syncLocalTrialCompletion } from './runner-trial-completion.js';
+import { syncLocalWorldClosing } from './runner-world-completion.js';
+import { syncLocalWorldEvidence } from './runner-world-evidence-sync.js';
+import { forgetLocalEvidence, inspectLocalEvidence, pruneLocalEvidence } from './runner-evidence-erasure.js';
+import { syncLocalEvidence } from './runner-evidence.js';
+import { syncLocalCompletion } from './runner-completion.js';
+import { COMMON_COMMANDS, COMMON_HELP } from './simple/help.js';
+import { initCommand } from './simple/init.js';
+import { statusCommand } from './simple/status.js';
+import { applyCommand, planCommand } from './simple/plan-apply.js';
+import { libraryCommand, worldCommand } from './simple/authoring.js';
+import { runCommand } from './simple/run.js';
+import { watchCommand } from './simple/watch.js';
+import { nativeCancel, nativeReport, nativeReportShape } from './simple/native-report.js';
+import { reassessmentCommand, reassessmentShape } from './simple/reassessment.js';
+import { toolsAuthorCommand } from './simple/tools-author.js';
+import { NATIVE_TOOL_ACTIONS, nativeToolsCommand } from './simple/native-tools.js';
+import { TOOL_REUSE_VERB, toolReuseCommand } from './simple/tool-reuse.js';
+import { descriptorsCommand, registerCommand } from './simple/register.js';
+const kinds = new Set(['agents', 'worlds', 'scenarios', 'personas', 'evaluations', 'simulations']);
+const ADVANCED_HELP = `Firedrill: advanced commands (use firedrill help for the common flow)
+
+  firedrill login                       Authorize this terminal in your browser
+  firedrill login --organization <id>   Authorize one of your other organizations
+  firedrill workspace organizations     List your organization choices, not their resources
+  firedrill signup                      Create or authorize an account with WorkOS
+  firedrill signup guide                Read agent registration instructions without signing in
+  firedrill mcp [--agent codex|claude|other]  Show remote MCP connection guidance
+  firedrill docs                        Open terminal and product guides
+  firedrill support                     Open workspace help and support
+  firedrill agents new [github|upload]  Connect repository or upload code in the browser
+  firedrill onboarding                 Resume optional account and workspace setup
+  firedrill logout                      Revoke terminal access and remove credentials
+  firedrill settings                    View or change workspace settings
+  firedrill vault                       View, save or rotate values with hidden input
+  firedrill values                      Manage values kept in this device's OS credential store
+  firedrill vault list|show [id]         Search metadata without printing saved values
+  firedrill vault save|rotate [id]       Guided save, or --file metadata.json --value-stdin
+  firedrill vault expiry|remove <id>     Change expiry or revoke saved access
+  firedrill vault request|resume <key>   Inspect or continue the exact original save
+  firedrill settings update --file <settings.json> --approve-change
+  firedrill settings open [workspace|team|billing|account]
+  firedrill team                        View teammates or choose a team action
+  firedrill team list|invitations        Search and page actual team records
+  firedrill team show <member>          Read one teammate and current role
+  firedrill team invite [email] [role]  Invite with original-request recovery
+  firedrill team request|resume|withdraw <key>
+  firedrill team role <member> [role]   Change a role after confirmation
+  firedrill team remove <member>        Remove organization access
+  firedrill team revoke <invitation>    Revoke the exact invitation
+  firedrill completion bash|zsh|fish    Print shell completion setup
+  firedrill agents|worlds archive|restore|remove [id]
+  firedrill agents|worlds requests     Page original record-change history
+  firedrill agents|worlds request|resume|withdraw <key>
+  firedrill agents|worlds --records active|archived|all
+  firedrill billing                     Inspect balance and choose a billing action
+  firedrill billing credit-help         Read How credits work, with --no-browser or --json for a link only
+  firedrill billing usage|credit-ledger  Page resource credits with --from <ISO-time> --to <ISO-time>
+  firedrill billing credit-purchases    Page prepaid credit purchases
+  firedrill billing credit-purchase <id>  Inspect an original credit purchase
+  firedrill billing credit-allocations  Inspect credit sources and expiry dates
+  firedrill billing options --json      Read the configured catalog and available offers
+  firedrill billing subscribe           Open subscription choices in Billing
+  firedrill billing change              Review plan changes in Billing
+  firedrill billing topup               Open credit top-up settings in Billing
+  firedrill billing portal              Open hosted payment details and cancellation
+  firedrill billing purchases           Page payment requests
+  firedrill billing purchase <id>       Inspect the original payment status
+  firedrill billing open <id>           Open its current hosted payment page
+  firedrill billing refresh-purchase <id>  Request a current read, not another payment
+  firedrill billing invoices            Page retained invoice history
+  firedrill billing invoice|lines <id>  Inspect an invoice or its paged line items
+  firedrill billing refresh-invoice <id>  Request a current invoice read
+  firedrill billing redeem              Open private event-code entry in Billing
+  firedrill workspace                   Select an available workspace
+  firedrill workspace list              List your available workspaces
+  firedrill workspace use <id>          Select a workspace directly
+  firedrill workspace refresh           Refresh available workspace access
+  firedrill workspace create [name]     Create a workspace after the human accepts the terms [--request-key <key>]
+  firedrill workspace requests          List workspace requests made from the terminal
+  firedrill workspace request <key>     Recover one workspace request
+  firedrill workspace withdraw <key>    Withdraw a request that has not been sent [--approve-change]
+  firedrill ci                          View retained CI configurations and run history
+  firedrill ci list|show [id]           Search configurations or inspect one
+  firedrill ci scenarios [id] [rev]    Inspect the exact saved scenario selection
+  firedrill ci revisions [id] [rev]     Read saved configuration history
+  firedrill ci automatic-history [id] [rev]
+  firedrill ci approvals [id] [rev]     Inspect retained CI access history
+  firedrill ci runs [configuration] [sha]  Page exact-commit run history
+  firedrill ci run|result [run]         Inspect a CI run or its retained result
+  firedrill ci scores [run]             Page scores from the original CI policy
+  firedrill ci criteria [run]           Inspect original CI evaluation coverage
+  firedrill ci delivery|delivery-history <run> [check|comment]
+  firedrill ci access <configuration>   Review CI input access in the browser
+  firedrill ci inputs|open <run>        Open exact-run input review or its report
+  firedrill worlds                      List saved worlds
+  firedrill worlds <id>                 Inspect a saved world
+  firedrill worlds new [agent]          Create a world for a saved agent
+  firedrill worlds creation <key>       Inspect the original world creation request
+  firedrill worlds continue-creation|withdraw-creation <key>
+  firedrill inspect                     Choose a workflow, rule or event schedule
+  firedrill inspect workflows|rules|events|collections  Search world declarations
+  firedrill inspect schema <id> [JSON path]  Page a declared collection schema
+  firedrill inspect show <id>           Inspect exact declaration and source metadata
+  firedrill inspect entries <id> [path]  Page authored paths, steps or scheduled changes
+  firedrill scenarios requests          Page your saved scenario changes
+  firedrill scenarios create|edit [id]   Guided scenario changes, or --file <change.json>
+  firedrill scenarios duplicate|archive|restore [id]  Review a versioned change
+  firedrill scenarios definition [id]   Read canonical editable scenario input
+  firedrill scenarios history [id]      Page saved scenario revisions
+  firedrill scenarios paths [id] [path] [step]  Inspect authored paths and mapped interfaces
+  firedrill scenarios world-events <id>  Inspect the declared evolving-world schedule
+  firedrill scenarios request <key>     Recover an original change without repeating it
+  firedrill scenarios draft-request <parent> --request-key <key>  Read an original draft revision
+  firedrill scenarios execution-request <parent> --request-key <key>  Read an original settings revision
+  firedrill scenarios withdraw-request <key>  Cancel only an unsaved request
+  firedrill criteria requests           Page your criterion-save history
+  firedrill criteria request <key>      Inspect an original save without repeating it
+  firedrill criteria withdraw-request <key>  Cancel only an unsaved criterion request
+  firedrill assess requests <campaign> <drill>  Page your assessment request history
+  firedrill assess request <campaign> <drill> <key>  Check an original assessment request
+  firedrill priority                     Choose proposals and assess their priority
+  firedrill priority create <turn> <proposal...>  Assess an explicit saved selection
+  firedrill priority list <turn>          Page priority assessment history
+  firedrill priority show <batch>         Read the saved priority scores and scale
+  firedrill priority resume|forget --request-key <id>  Recover intent or remove its local copy
+  firedrill priority recover-replies <batch>  Check original saved replies, no reevaluation
+  firedrill priority requests <turn>     Page your priority request history (--world)
+  firedrill priority request <turn> <key>  Check an original priority request
+  firedrill priority withdraw-request <turn> <key>  Cancel only an unaccepted priority request
+  firedrill assess withdraw-request <campaign> <drill> <key>  Cancel before acceptance
+  firedrill tools                       Open the tools menu
+  firedrill tools show <version>        Inspect saved package metadata
+  firedrill tools services <version>    Search and page declared services
+  firedrill tools import                Upload a private tool package
+  firedrill tools contribute <version>  Open optional private contribution review
+  firedrill tools contributions [version]  Page your contribution requests
+  firedrill tools contribution <request>  Inspect the original contribution
+  firedrill tools contribution-withdraw <request>  Withdraw with --approve-tool-change
+  firedrill tools instances --state all|active|closed|removed
+  firedrill tools runnable              Saved versions and where each service runs (shared pool or isolated)
+  firedrill tools definitions [list|show|recipients|grants|share|share-request|withdraw-share-request|revoke|copy|copy-request|withdraw-copy-request|copy-status|withdraw-copy|dependents]
+                                        Share tool versions across your organization's workspaces and copy them privately
+  firedrill tools start                 Choose up to 32 tools with Space, then Enter; approve the estimate
+  firedrill tools start <version>... --seconds <n> [--service <key>]
+                                        Review saved versions and quote them; nothing starts until that estimate is approved
+  firedrill tools start --file selection.json  Review an exact {duration_seconds, selections} file the same way
+  firedrill tools start --request-key <key> [--usage-quote <key> --approve-tool-change]
+                                        Continue a start, or approve the exact estimate it printed
+  firedrill tools sessions --state all|active|preparing|closed  Page hosted tool sessions
+  firedrill tools session <session> [stop]  Inspect a tool session, or stop it (--approve-tool-change)
+  firedrill tools session <session> replace [--request-key <key>]  Review a stopped, never-approved session's tools again (--approve-tool-change)
+  firedrill tools session <session> renew --seconds <n> [--request-key <key> --usage-quote <quote-id>] [--approve-tool-change]
+                                        Review and approve an extension of its shared-pool tools
+  firedrill tools session <session> renewals|renewal <id>|cancel-renewal <id>|renewal-request <key>|withdraw-renewal <key>
+                                        Read renewals, close an unused review, or recover an original request
+  firedrill tools access <session> [--allow-writes] [--approve-tool-change]
+                                        Serve its tools to an agent on this machine (MCP + JSON)
+  firedrill tools state <instance> [checkpoint | edit <operation> --file <args.json> | operation <id> | snapshots]
+                                        Save or change a shared-pool tool's data (an edit needs --approve-tool-change); replay one only with its printed --request-key
+  firedrill tools state <instance> reset|fork <snapshot> --seconds <n> [--request-key <key> --usage-quote <key>] [--approve-tool-change]
+                                        Review, quote and (after approval of that exact estimate) start a reset or fork
+  firedrill tools state <instance> request|withdraw-request|clone-request|withdraw-clone <key>
+                                        Read back or explicitly withdraw an original state, reset or fork request
+  firedrill tools start-status <request>  Read the original setup request
+  firedrill tools setups                Search and page tool setups
+  firedrill tools setup <id>            Inspect a setup's original status
+  firedrill tools setup-members <id>    Inspect each original tool instance
+  firedrill tools setup-status <request>  Recover an original multi-tool request
+  firedrill tools group-state <setup>  Page coordinated checkpoints and recovery
+  firedrill tools capture-group <setup>  Save supported state together
+  firedrill tools reset-group|fork-group <setup>  Review all replacement instances
+  firedrill tools stop-setup <id>       Cancel queued setup and stop its instances
+  firedrill tools stop [instance]       Close connections and stop compute
+  firedrill tools remove [instance]     Stop and move an instance to Removed history
+  firedrill tools removed               Search and page removed instance history
+  firedrill tools removal [instance]    Inspect original removal state
+  firedrill tools remove-status <request>  Recover the original removal request
+  firedrill tools connect [instance]    Select permissions and save private connection details
+  firedrill tools open [instance]       Open the authenticated tool interface and history
+  firedrill tools connections [instance]  Inspect scoped tool access
+  firedrill tools connection-request <instance> <request>  Recover original issuance metadata
+  firedrill tools disconnect <instance> <connection>  Revoke tool access
+  firedrill tools call                  Select an instance and submit an operation
+  firedrill tools activity <instance>   Inspect retained history, --search/--outcome and saved --before/--anchor positions
+  firedrill tools download [instance] [command] [request|response] --into <file>  Save original private bytes, --approve-download for automation
+  firedrill tools checkpoints [instance]  Inspect saved tool data
+  firedrill tools data [instance] [checkpoint] [collection] [position]  Inspect saved tables, schema or a record
+  firedrill tools datasets [checkpoint]  Search saved tool dataset versions
+  firedrill tools dataset|dataset-document <version>  Inspect metadata or private JSON
+  firedrill tools dataset-export [version] --into <file.json>  Save original dataset bytes
+  firedrill tools dataset-save [checkpoint] [name] --file <edits.json>  Save versioned edits
+  firedrill tools dataset-request <request>  Recover the original save request
+  firedrill tools dataset-withdraw <version>  Withdraw one saved version
+  firedrill tools checkpoint [instance] Save a private data checkpoint
+  firedrill tools reset|resume [instance]  Start from saved starting/closing data
+  firedrill tools restore|fork [instance] [checkpoint]  Restore or fork saved data
+  firedrill tools transitions [instance]  Inspect data-operation history
+  firedrill tools transition <instance> <request>  Read an original data operation
+  firedrill tools checkpoint-status <instance> <request>  Read an original capture
+  firedrill datasets                    List saved world dataset versions
+  firedrill datasets show|document <version>  Inspect a version or its JSON
+  firedrill datasets export [version] --into <file.json>  Save original dataset bytes
+  firedrill datasets save [capture] [name] --file <edits.json>  Save synthetic edits
+  firedrill datasets request <request>  Recover the original save
+  firedrill datasets withdraw <version>  Withdraw one version
+  firedrill datasets start-status <request>  Read an original managed session opening request
+  firedrill sessions                    List this world's manual sessions
+  firedrill sessions show|close <id>    Inspect history or request closure
+  firedrill sessions request|withdraw <key>  Inspect or fence the original opening
+  firedrill sessions call               Choose a session, connection and operation
+  firedrill sessions call <session> <connection> <operation> --file <request.json>
+  firedrill sessions connections [session]  Browse its admitted connections
+  firedrill sessions requests [session]  Browse manual request history
+  firedrill sessions request-show <session> <id>  Inspect a saved request
+  firedrill sessions request-result <session> <key>  Recover without resending
+  firedrill sessions captures [session]  Browse captured database records
+  firedrill sessions capture [session]  Capture current database records
+  firedrill sessions capture-show <session> <id>  Inspect one capture
+  firedrill inspect data <capture> [collection] [row]  Read prepared records
+  firedrill inspect capture <session> <capture> [collection] [row]  Read session records
+  firedrill sessions capture-request <session> <key>  Recover the original capture
+  firedrill sessions resets [session]   Inspect reset history
+  firedrill sessions reset [session]    Restore sealed starting data
+  firedrill sessions reset-request <session> <key>  Recover the original reset
+  firedrill sessions voice [session]    Read voice history and browser controls
+  firedrill sessions voice-request <session> <key>  Recover the original audio action
+  firedrill sessions checkpoints [session]  Search saved checkpoints
+  firedrill sessions checkpoint [session] [name]  Save a database checkpoint
+  firedrill sessions restore [session] [checkpoint]  Restore selected database state
+  firedrill sessions checkpoint-actions [session]  Inspect save/restore history
+  firedrill sessions checkpoint-request <session> <key>  Recover the original action
+  firedrill sessions coordinated-checkpoints [session]  List saved world and agent state
+  firedrill sessions coordinated-checkpoint <id>  Inspect a capture or original request
+  firedrill sessions save-world-and-agent <session> --name <name>  Capture supported state
+  firedrill tools result <instance> <request>  Read the original operation result
+  firedrill tools catalog               Browse supported catalog tools
+  firedrill tools catalog --category <key>  Filter the paged catalog
+  firedrill tools catalog-categories    Browse available catalog categories
+  firedrill tools save [release]        Save a catalog version without compute
+  firedrill tools versions              List private saved versions
+  firedrill tools catalog-show [release]  Inspect a service page; --page and --search available
+  firedrill tools catalog-operations [release]  Choose a service or use --service in scripts
+  firedrill tools catalog-operation [release]  Choose a service and operation interactively
+  firedrill tools catalog-setups [release]  Inspect your paged catalog setup history
+  firedrill tools catalog-status <request>  Recover the exact original catalog setup
+  firedrill tools catalog-withdraw <request>  Withdraw an unfinished catalog setup
+  firedrill tools status|complete <request>  Inspect or finish an original package request
+  firedrill tools requests --import-status <status>  Filter package import history
+  firedrill configuration               Review or change this world's variable mappings
+  firedrill configuration save          Select saved values or use --file <metadata.json>
+  firedrill configuration vault         Open Vault without printing secret values
+  firedrill recordings                  Inspect this world's recorded activity
+  firedrill recordings list|show|records [id]  Page recordings or their observations
+  firedrill recordings upload|open      Open upload, consent and review in the browser
+  firedrill recordings request <key>    Inspect the original upload after an uncertain reply
+  firedrill configuration status|resume|withdraw|forget --request-key <id>
+  firedrill connections                 Review this world's dependency connections
+  firedrill connections show|save [id]   Inspect or configure a dependency
+  firedrill connections activity [id] [selected|all]  Inspect retained service receipts
+  firedrill connections preparation-decision <id> <digest>  Read original decision acceptance
+  firedrill connections continue-preparation <id> --file <json>  Continue the exact reviewed catalog cursor
+  firedrill configuration schema --json Read exact metadata input fields without signing in
+  firedrill connections schema --json   Read dependency input fields without signing in
+  firedrill models                      View or change this world's scoped model access
+  firedrill models save                 Connect a saved runtime credential, with guided selection
+  firedrill models show|remove [id]     Inspect or remove a model connection
+  firedrill models schema [remove] --json  Read exact metadata input fields
+  firedrill models status|resume|withdraw|forget --request-key <id>
+  firedrill real-operations             Inspect real-account requests for this world
+  firedrill real-operations show <id>   Read an exact operation without resending it
+  firedrill real-operations review <id> Record an administrator's outcome review
+  firedrill real-operations recover|forget --request-key <id>
+  firedrill report [campaign-id]        Inspect a saved simulation report
+  firedrill report <id> memory          Inspect memory checkpoints (interactive or --json)
+  firedrill report <id> style           Inspect selected prose measurements
+  firedrill report <id> checks          Inspect recorded check outcomes
+  firedrill report <id> checks --method exact|semantic|both|unknown
+  firedrill report <id> checks <check> --status met|unmet|unconfirmed
+  firedrill report <id> scores [cohort-assessment]  Inspect score distributions and drills
+  firedrill report <id> findings [scenario-revision]  Read scenario outcomes and example drills
+  firedrill report <id> insights       Read retained recommendations and follow-up links
+  firedrill report <id> export          Create or inspect private JSONL reports
+  firedrill report <id> export download <export> --into report.jsonl
+  firedrill report <id> usage [drill]   Inspect target-model relay usage
+  firedrill report <id> drill [drill]   Inspect saved input/output and tool actions
+  firedrill report <id> drill <drill> requests [receipt]  Inspect mapped service receipts
+  firedrill report <id> drill <drill> checks [position]  Inspect original recorded checks
+  firedrill report <id> drill <drill> reassess  Approve a separate new evaluation of retained evidence (no rerun)
+  firedrill report <id> drill <drill> reassessments|reassessment <id> [results]|reassessment-request <key>|cancel-reassessment <id>
+  firedrill report <id> drill <drill> coverage [messages|actions]  Page evidence coverage
+  firedrill report <id> drill <drill> state [comparison]  Inspect observed state changes
+  firedrill report <id> drill <drill> state <comparison> changes [change]
+  firedrill report <id> drill <drill> state <comparison> collections|events
+  firedrill report <id> drill <drill> state <comparison> causes <change>
+  firedrill report <id> drill <drill> state checkpoints [checkpoint]
+  firedrill report <id> drill <drill> state checkpoints <checkpoint> mutations
+  firedrill report <id> drill <drill> actions --service-request <receipt>
+  firedrill report <id> drill <drill> schedule  Inspect scheduled changes and conditions
+  firedrill report <id> drill <drill> world-events  Follow actual-time evolving world events
+  firedrill report <id> drill <drill> world-events controls|runtime
+  firedrill report <id> drill <drill> world-events pause|resume|cancel-future|revise-future
+                                      Guided review; automation uses --file --request-key --approve-change
+  firedrill report <id> drill <drill> world-events request <key>
+  firedrill report <id> drill --checks unmet  Find drills with unmet recorded checks
+  firedrill report <id> drill --cohort <assessment> --score-bucket <index>
+                                      Find drills from one retained score interval
+  firedrill report <id> assignments  Show current execution slots and drill links
+  firedrill report <id> activity     Read recent completions and service activity
+                                    --search <service-or-operation>
+  firedrill report <id> composite       Inspect frozen composite indices
+  firedrill report <id> compare [baseline]  Compare saved simulation evidence
+  firedrill report <id> compare <baseline> semantic|memory|style <assessment>
+                                      --side both|current|baseline
+  firedrill report <id> compare <baseline> checks <check> --side baseline
+  firedrill report <id> compare <baseline> performance|usage <cohort> --side baseline
+  firedrill report <id> compare <baseline> composite <cohort> models|trials
+                                      --side both|current|baseline --status all|available|unavailable
+                                      --evaluator <version|unavailable>
+  firedrill report <id> assessments [drill] [assessment]  Inspect evidence-based scores
+  firedrill report <id> assessment-status [drill]  Inspect automatic assessment preparation
+  firedrill report <id> assessments <drill> <assessment> evidence  Page used evidence
+  Drill list filters: --scenario <revision-id>, --status <execution-state>, --checks <outcome>
+  Check outcomes: met, unmet, unassessed, unavailable, missing. These are not semantic score thresholds.
+  Drill check filters: --status met|unmet|unassessed, --kind objective|semantic|both|unknown
+  Score filters: --score-bucket <index>, --assessment-status assessed|not-assessable|not-applicable
+  Score filters apply to a selected scores cohort. JSON output includes its exact interval indices.
+  firedrill criteria                    List saved evaluation criteria for a world
+  firedrill criteria save [id]          Create a criterion or save an exact JSON revision
+  firedrill criteria show|history <id>  Read a criterion or its immutable history
+  firedrill assess <campaign> [drill]   Evaluate retained evidence without rerunning the agent
+  firedrill criteria resume|forget     Inspect an original save or remove its local copy
+  firedrill assess resume|forget       Recover a request or remove its local copy
+  firedrill changes                    Review agent source changes or propose one
+  firedrill changes <campaign> files  List eligible baseline source files
+  firedrill changes <campaign> show|diff <change>  Inspect a request or its actual diffs
+  firedrill changes <campaign> propose --file <change.json>  Save a scoped proposal
+  firedrill changes <campaign> approve|accept <change>  Approve drafting or save a reviewed candidate
+  firedrill changes <campaign> resume-draft|retry-save|dismiss <change>
+  firedrill changes recover|forget --request-key <id>  Recover exact intent or remove its local copy
+  firedrill changes <campaign> copy <change> --into <new-folder>  Download an isolated candidate
+  firedrill changes copy-resume --request-key <id>  Resume the same candidate copy
+  firedrill changes copy-forget --request-key <id>  Remove only private download/recovery files
+  firedrill changes <campaign> compare <change>  Prepare frozen control and candidate worlds
+  firedrill changes <campaign> comparisons <change>  Read comparison setup and history
+  firedrill changes <campaign> comparison-runs <change> <comparison> --side control|candidate
+  firedrill policies                    View optional company policies for an agent
+  firedrill policies upload            Upload a private policy with --file and --name
+  firedrill policies paragraphs <id>   Read a retained policy version
+  firedrill source inspect [path]       Inspect local source without uploading it
+  firedrill source snapshot [path]      Capture a private local source copy
+  firedrill sources use --agent <id>    Choose source components for one application
+  firedrill sources options --agent <id> List paged connected sources for automation
+  firedrill sources status <key> --agent <id> Recover the original source selection
+  firedrill sources withdraw <key> --agent <id> Withdraw the original selection; automation uses --approve-change
+  firedrill connect [path]              Capture and review source transfer before connecting
+  firedrill connect requests            List cloud-retained source requests
+                                      --search <name-or-key> --status <state>
+                                      --after <returned-continuation>
+  firedrill connect status <key>        Inspect a source connection
+  firedrill connect resume <key>        Continue processing without repeating an upload
+  firedrill connect upload <key>        Explicitly attempt the same approved archive upload
+  firedrill connect withdraw <key>      Withdraw before source processing is accepted
+  firedrill runner enroll               Register a local device identity, not execution permission
+  firedrill runner list                 List registered runners in this workspace
+  firedrill runner status <key>         Inspect a saved runner receipt
+  firedrill runner connect <key>        Maintain signed outbound presence only
+  firedrill runner revoke <key>         Revoke this device or withdraw a delayed enrollment
+  firedrill runner runtime              Inspect the pinned image and local container host
+  firedrill runner runtime install      Download the pinned image after consent
+  firedrill runner runtime check        Observe source-free container storage/isolation
+  firedrill runner runtime policy       Export the exact local security profiles
+  firedrill runner runtime recover <key> Clean up the exact retained readiness request
+  firedrill runner authorize <key>       Review local permission for the selected world
+  firedrill runner grants               List this world's local permissions
+  firedrill runner grant status <key>   Inspect an exact local permission request
+  firedrill runner grant revoke <key>   Revoke or withdraw a local permission
+  firedrill runner jobs <device>       Inspect saved local assignments
+  firedrill runner abandon <device> <job>  Close an original claim before container handoff
+  firedrill runner claim status <device> <job> <key>    Read exact ownership
+  firedrill runner claim withdraw <device> <job> <key>  Withdraw exact ownership
+  firedrill runner cleanup <operation>  Remove only the exact saved execution container
+  firedrill runner run-cleanup <device> <campaign> [--approve-change] Recover shared-service closing evidence, never launch
+  firedrill runner drill-cleanup <device> <assignment> [--approve-change] Recover verified original process-close facts after expiry
+  firedrill runner evidence sync <operation>  Resume saved evidence transfer only
+  firedrill runner evidence forget <operation>  Remove that operation’s private evidence bytes
+  firedrill runner evidence inspect <operation>  Read private retention metadata only
+  firedrill runner evidence prune        Remove expired synchronized evidence after cleanup
+  firedrill runner completion sync <operation>  Submit or inspect saved closing facts
+  firedrill driver review [review-id]   Inspect input scope, completion, actions and source references
+  firedrill context import              Import a JSON recording for private review
+  firedrill context list|show <id>       Inspect saved recordings
+  firedrill context accept <id>         Use reviewed context in preparation
+  firedrill context discover <id>       Request scenario drafts from accepted records
+  firedrill context withdraw <key>      Withdraw the exact original upload with --approve-change
+  firedrill recipes list|save           Reuse a private prepared world recipe
+  firedrill recipes show|use <id>       Review its current inputs and open setup
+  firedrill recipes archive <id>        Archive a bookmark, not its world or history
+  firedrill recipes request <key>       Recover an original save in the selected world
+  firedrill simulation resume <id>      Watch an original simulation (read-only; starts nothing)
+  firedrill simulation pause [id]       Pause new drill scheduling, not active targets
+  firedrill simulation resume-scheduling [id]  Resume scheduling the original plan
+  firedrill simulation cancel [id]      Request cancellation and retained cleanup
+  firedrill simulation control-request <id> <pause|resume|cancel> <key>  Inspect the original action
+  firedrill simulation continue-control|withdraw-control <id> <action> <key>
+  firedrill simulation requests         Page saved setup requests (--after <id>)
+  firedrill simulation request status <key>    Inspect exact setup acceptance
+  firedrill simulation request continue <key>  Read the saved setup request back (never sent again)
+  firedrill simulation request withdraw <key> Fence setup before late acceptance
+
+Directories: agents, worlds, scenarios, personas, evaluations, simulations
+Options: --json, --page <number>, --search <text>, --workspace <id>, --world <id>, --no-browser
+Accessible choices: --accessible, FIREDRILL_ACCESSIBLE=1, TERM=dumb or NO_COLOR use plain numbered prompts.
+Piped/background commands never prompt. Secrets remain hidden or use their explicit stdin option.
+Billing: subscription, top-up, builder and event-code changes open the secure web flow.
+Payment offers and credit rates are server-owned. Opening a page does not confirm a payment.
+Billing history: --status for purchases/invoices; --kind and --search for ledger.
+Directory filters: --status <state>, --world <id> for world resources, --agent <id>
+Source connection: --name <name>, --upload-source (explicit transfer consent for automation)
+Source helper: firedrill source runtime install [--approve-download] or source runtime inspect
+Runner enrollment: --name <name>, --enroll-device (explicit consent for automation)
+Runtime download: --install-runtime (explicit image-download consent for automation)
+Local permission: --operations validation,trial,world_session --approve-local
+Optional permissions: --upload-evidence, --allow-vault-values, --allow-real-accounts, --allow-catalog-packages
+Local ceilings: --minutes, --parallel, --cpu, --memory-mb. Permission does not start work.
+Use runner abandon <device> <job> --world <id> to close an unstarted original claim, including after expiry. Container handoff requires cleanup instead.
+Starting work from the older world commands is retired in this release, managed or on this device: validate, simulate,
+simulation run, sessions open|resume|quote, runner execute, ci configure|setup-proposal and datasets start are refused before any request.
+simulation resume <id> only watches an original simulation and hands its original claims to recovery; it starts nothing.
+Retained history, reports, cancellation, cleanup and original-request recovery stay available. New simulations use plan, apply and run.
+Capture playback: report <campaign> drill <drill> clips [clip-id] lists saved MP4 clips and opens the capture inspector. Clips use retained images, not new agent runs.
+Evidence filters: report <campaign> drill <drill> evidence [artifact] --attempt <number> --step <id> --from-at <ISO-time> --to-at <ISO-time>.
+Evidence times require Z or a UTC offset and filter when files were retained. Timeline accepts --attempt, --from-at and --to-at for observation times.
+Criteria: --file <body.json>, --request-key <id>, --approve-criterion
+Configuration: --file <metadata.json>, --request-key <id>, --approve-configuration
+Configuration files contain variable names and saved-value references, never raw secret values.
+Real-account history: --service <id>, --outcome <state>, --needs-review
+Real-account review automation: --acknowledge-real-effects --acknowledge-duplicate-risk
+These acknowledge actual account review. They do not authorize another provider request.
+Saved evidence assessment: --file <rubric.json>, --request-key <id>, --approve-assessment
+Evaluation requests retain a private local recovery copy until explicitly forgotten.
+Source changes: --approve-change confirms the reviewed operation and private recovery retention.
+Credit budgets: --approve-credits separately approves a displayed quote only when workspace policy requires it; execution approval remains separate.
+Candidate acceptance in automation also requires --reviewed-draft <exact-sha256>.
+Candidate source downloads need separate --approve-download consent in automation.
+Proposals, drafting approval and diff acceptance are separate. Nothing applies edits or reruns an agent automatically.
+Source transfer and evidence sharing require their separate permissions.
+Logout recovery: --local-only removes this terminal's credentials without claiming cloud revocation.
+`;
+const LEGACY_LAUNCH_RETIRED = 'Starting work from the older world commands is retired in this release, managed or on this device; retained history, reports, cancellation, cleanup and original-request recovery stay available. Use firedrill plan, apply and run for new simulations. Nothing was sent.';
+function identifier(value) {
+    if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value))
+        throw new CliError('identifier_required', 'Choose a saved item by its ID.', 2);
+    return value;
+}
+export async function main() {
+    const controller = new AbortController();
+    // Signals stop owned work first (the controller), then the credential
+    // companion closes with reason 'signal' in finally, after that work drained.
+    // A second signal does not wait for that: it SIGKILLs every process group the
+    // run still owns (detached, so the terminal's interrupt never reached them)
+    // and exits, instead of leaving them running after the CLI is gone.
+    let signalled = false, companion = null;
+    const interrupt = () => {
+        if (signalled) {
+            killOwnedGroups();
+            process.exit(130);
+        }
+        signalled = true;
+        controller.abort();
+    };
+    process.on('SIGINT', interrupt);
+    process.on('SIGTERM', interrupt);
+    process.on('SIGHUP', interrupt);
+    let json = process.argv.includes('--json');
+    try {
+        const parsed = parseArgs({ allowPositionals: true, strict: true, tokens: true, options: {
+                json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' }, 'no-browser': { type: 'boolean' },
+                organization: { type: 'string' },
+                'local-only': { type: 'boolean' }, accessible: { type: 'boolean' }, state: { type: 'string' },
+                kind: { type: 'string' }, origin: { type: 'string' },
+                'discard-evidence': { type: 'boolean' },
+                managed: { type: 'boolean' }, before: { type: 'string' },
+                local: { type: 'boolean' }, device: { type: 'string' }, run: { type: 'boolean' }, validate: { type: 'boolean' },
+                'approve-real-startup': { type: 'boolean' }, 'acknowledge-external-effects': { type: 'boolean' },
+                'approve-real-simulation': { type: 'boolean' }, 'acknowledge-shared-state': { type: 'boolean' }, 'approve-real-session': { type: 'boolean' },
+                'all-scenarios': { type: 'boolean' }, scenario: { type: 'string', multiple: true }, repetitions: { type: 'string' },
+                seconds: { type: 'string' }, assess: { type: 'boolean' }, 'record-browser': { type: 'boolean' }, 'record-voice': { type: 'boolean' },
+                'record-desktop': { type: 'boolean' }, 'acknowledge-desktop-screen-content': { type: 'boolean' },
+                'approve-agent-input': { type: 'boolean' },
+                'contract-sha256': { type: 'string' }, baseline: { type: 'string' }, view: { type: 'string' },
+                change: { type: 'string' }, 'page-size': { type: 'string' },
+                'application-checkpoint': { type: 'string' }, 'acknowledge-fresh-world-state': { type: 'boolean' },
+                'share-application-checkpoint-with-device': { type: 'boolean' },
+                'coordinated-checkpoint': { type: 'string' }, 'acknowledge-supported-checkpoint-scope': { type: 'boolean' },
+                'share-coordinated-checkpoint-with-device': { type: 'boolean' },
+                'acknowledge-partial-state': { type: 'boolean' },
+                checkpoint: { type: 'string' }, checks: { type: 'string' }, status: { type: 'string' }, 'service-request': { type: 'string' },
+                'score-bucket': { type: 'string' }, 'assessment-status': { type: 'string' },
+                cohort: { type: 'string' }, method: { type: 'string' }, evaluator: { type: 'string' },
+                agent: { type: 'string' }, file: { type: 'string' }, 'policy-id': { type: 'string' },
+                'basis-version': { type: 'string' }, 'request-key': { type: 'string' }, 'approve-policy': { type: 'boolean' },
+                'terms-version': { type: 'string' }, 'privacy-version': { type: 'string' }, 'declared-agent-name': { type: 'string' },
+                'approve-criterion': { type: 'boolean' }, 'approve-assessment': { type: 'boolean' }, 'approve-credits': { type: 'boolean' },
+                'approve-change': { type: 'boolean' }, 'reviewed-draft': { type: 'string' },
+                'approve-configuration': { type: 'boolean' },
+                'value-stdin': { type: 'boolean' },
+                'approve-dataset': { type: 'boolean' }, dataset: { type: 'string' }, 'share-dataset-with-device': { type: 'boolean' },
+                'share-checkpoint-with-device': { type: 'boolean' },
+                'approve-tool-upload': { type: 'boolean' }, 'approve-tool-change': { type: 'boolean' },
+                'usage-quote': { type: 'string' },
+                service: { type: 'string' }, outcome: { type: 'string' }, 'needs-review': { type: 'boolean' },
+                'import-status': { type: 'string' },
+                'acknowledge-real-effects': { type: 'boolean' }, 'acknowledge-duplicate-risk': { type: 'boolean' },
+                'additional-scenario': { type: 'string', multiple: true }, side: { type: 'string' },
+                into: { type: 'string' }, 'approve-download': { type: 'boolean' },
+                attempt: { type: 'string' }, step: { type: 'string' }, 'from-at': { type: 'string' }, 'to-at': { type: 'string' },
+                'upload-source': { type: 'boolean' }, name: { type: 'string' },
+                'enroll-device': { type: 'boolean' },
+                parameters: { type: 'string' }, 'remove-parameters': { type: 'boolean' },
+                'install-runtime': { type: 'boolean' },
+                'approve-local': { type: 'boolean' }, operations: { type: 'string' }, minutes: { type: 'string' },
+                grant: { type: 'string' }, 'execute-local': { type: 'boolean' },
+                parallel: { type: 'string' }, cpu: { type: 'string' }, 'memory-mb': { type: 'string' },
+                'upload-evidence': { type: 'boolean' }, 'allow-vault-values': { type: 'boolean' }, 'allow-real-accounts': { type: 'boolean' }, 'allow-catalog-packages': { type: 'boolean' },
+                'allow-writes': { type: 'boolean' },
+                page: { type: 'string' }, after: { type: 'string' }, anchor: { type: 'string' }, search: { type: 'string' }, category: { type: 'string' }, workspace: { type: 'string' }, world: { type: 'string' },
+                from: { type: 'string' }, to: { type: 'string' },
+                trigger: { type: 'string' }, reference: { type: 'string' }, records: { type: 'string' },
+                'session-only': { type: 'boolean' }, persistent: { type: 'boolean' }, open: { type: 'boolean' }, plan: { type: 'string' }, descriptor: { type: 'string' }, approve: { type: 'boolean' },
+                'expected-revision': { type: 'string' }, request: { type: 'string' },
+                'world-revision': { type: 'string' }, 'descriptor-revision': { type: 'string' }, archived: { type: 'boolean' }, runner: { type: 'string' },
+                follow: { type: 'boolean' }, campaign: { type: 'string' }, cancel: { type: 'boolean' },
+            } });
+        json = parsed.values.json === true;
+        configurePrompts({ accessible: parsed.values.accessible === true, interactive: !json });
+        delete parsed.values.accessible;
+        // Credential mode is selected once per process, before any credential access.
+        // --session-only/--persistent apply to every command; only init --session-only
+        // and run may make this process the credential companion.
+        const sessionOnly = parsed.values['session-only'] === true, persistent = parsed.values.persistent === true;
+        delete parsed.values['session-only'];
+        delete parsed.values.persistent;
+        const explicitOpen = parsed.values.open === true;
+        const helpOnly = parsed.values.help === true || !parsed.positionals.length || parsed.positionals[0] === 'help';
+        // Local-only commands never touch credentials, the state directory or a companion.
+        const [first, second] = parsed.positionals;
+        const localOnly = first === 'completion' || (first === 'signup' && second === 'guide')
+            || (first === 'tools' && (second === 'init' || second === 'validate'));
+        const credentialMode = helpOnly || localOnly ? null : await configureCredentialMode({ sessionOnly, persistent, signal: controller.signal,
+            companion: first === 'init' ? 'if-session' : first === 'run' ? 'if-absent' : 'never' });
+        // A failed companion start closes with 'exit' and must surface its own error
+        // code, not a cancellation; only a real shutdown (logout, signal, lost lock) aborts.
+        if (credentialMode?.companion)
+            companion = await startCredentialCompanion({ onShutdown: reason => { if (reason !== 'exit')
+                    controller.abort(); } });
+        const args = parsed.positionals;
+        const evidenceFlags = new Set(['attempt', 'step', 'from-at', 'to-at']);
+        const selectedEvidenceFlags = parsed.tokens.filter(token => token.kind === 'option' && evidenceFlags.has(token.name));
+        if (new Set(selectedEvidenceFlags.map(token => token.kind === 'option' ? token.name : '')).size !== selectedEvidenceFlags.length)
+            throw new CliError('arguments_invalid', 'Provide each evidence filter once. Repeated filters do not select a different download.', 2);
+        if (parsed.values['approve-credits'] !== undefined && !(args[0] === 'apply'
+            || (args[0] === 'tools' && NATIVE_TOOL_ACTIONS.has(args[1]))
+            || (args[0] === 'report' && reassessmentShape(args.slice(1)))))
+            throw new CliError('arguments_invalid', 'Use --approve-credits only with native plan apply, tool admission or drill reassessment.', 2);
+        const driverFlags = new Set(['contract-sha256', 'baseline', 'view', 'change', 'page-size']);
+        if ([...driverFlags].some(key => parsed.values[key] !== undefined) && args[0] !== 'driver')
+            throw new CliError('arguments_invalid', 'Use driver review for recipe digest, baseline, view and change filters.', 2);
+        if (args[0] === 'driver') {
+            const selectors = new Set([...driverFlags, 'page', 'search', 'world', 'workspace']);
+            const supplied = parsed.tokens.filter(token => token.kind === 'option' && selectors.has(token.name));
+            if (new Set(supplied.map(token => token.kind === 'option' ? token.name : '')).size !== supplied.length)
+                throw new CliError('arguments_invalid', 'Provide each driver review selection and filter once.', 2);
+        }
+        if (parsed.values.category !== undefined && !(args[0] === 'tools' && args[1] === 'catalog'))
+            throw new CliError('arguments_invalid', 'Use --category only with tools catalog.', 2);
+        if ((parsed.values.from !== undefined || parsed.values.to !== undefined)
+            && !(args[0] === 'billing' && ['usage', 'credit-ledger'].includes(args[1])))
+            throw new CliError('arguments_invalid', 'Use --from and --to only with billing usage or billing credit-ledger history.', 2);
+        if ([parsed.values.attempt, parsed.values.step, parsed.values['from-at'], parsed.values['to-at']].some(value => value !== undefined)
+            && !(args[0] === 'report' && ['drill', 'trial'].includes(args[2]) && args[3] && ['evidence', 'timeline'].includes(args[4])))
+            throw new CliError('arguments_invalid', 'Use --attempt, --step, --from-at and --to-at only with report <campaign> drill <drill> evidence or timeline.', 2);
+        const output = (value, readable) => process.stdout.write(json ? JSON.stringify({ type: 'result', data: value }) + '\n' : readable + '\n');
+        const worldEvidenceOutput = async (value) => {
+            controller.signal.throwIfAborted();
+            const text = json ? JSON.stringify({ type: 'local_world_evidence_command', data: value })
+                : `Command ${value.command_id}: ${value.state === 'synchronized' ? 'evidence synchronized' : 'evidence unavailable (' + value.code + ')'}.`;
+            if (!process.stdout.write(text + '\n'))
+                await once(process.stdout, 'drain', { signal: controller.signal });
+        };
+        // Hosted tool session commands check their own flags (tools sessions takes --state).
+        if (parsed.values.state !== undefined && !(args[0] === 'tools' && (args[1] === 'instances' || NATIVE_TOOL_ACTIONS.has(args[1]))))
+            throw new CliError('arguments_invalid', 'Use --state only with tools instances (all, active, closed or removed) or tools sessions.', 2);
+        if (!parsed.values.help && (args[0] === 'docs' || args[0] === 'support' || args[0] === 'agents' && args[1] === 'new')) {
+            const intake = args[0] === 'agents';
+            if (args.length > (intake ? 3 : 1) || intake && args[2] && !['github', 'upload'].includes(args[2])
+                || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use agents new [github|upload], docs or support, with optional --workspace, --json and --no-browser.', 2);
+            const context = await selectedWorkspace({ workspace: parsed.values.workspace, interactive: !json && !!process.stdin.isTTY && !!process.stderr.isTTY,
+                signal: controller.signal, openBrowser: !parsed.values['no-browser'] });
+            const url = new URL(intake ? '/new' : '/agents', APP_ORIGIN);
+            url.searchParams.set('workspace', context.workspace);
+            if (intake)
+                url.searchParams.set('source', args[2] === 'upload' ? 'upload' : 'repository');
+            if (!intake)
+                url.searchParams.set('help', '1');
+            const opened = !json && !parsed.values['no-browser'] ? await openBrowser(url.href) : false;
+            output({ type: 'browser_handoff', url: url.href, opened, workspace_id: context.workspace, source_transferred: false }, `${opened ? 'Opened' : 'Open'} ${intake ? 'agent connection' : 'workspace help'} in the browser.\n${url.href}`);
+            return;
+        }
+        if (parsed.values.method !== undefined && args[0] !== 'report')
+            throw new CliError('arguments_invalid', 'Use --method with report recorded-check group lists.', 2);
+        if (parsed.values.evaluator !== undefined && args[0] !== 'report')
+            throw new CliError('arguments_invalid', 'Use --evaluator with composite comparison drills.', 2);
+        if (parsed.values.side !== undefined && !['report', 'changes'].includes(args[0]))
+            throw new CliError('arguments_invalid', 'Use --side with report comparison observations or source-change comparisons.', 2);
+        if (parsed.values.records !== undefined && !['agents', 'worlds'].includes(args[0]))
+            throw new CliError('arguments_invalid', 'Use --records only to list active or archived agents/worlds.', 2);
+        if (parsed.values['service-request'] !== undefined && args[0] !== 'report')
+            throw new CliError('arguments_invalid', 'Use --service-request with report drill action lists.', 2);
+        if (args[0] !== 'ci' && (parsed.values.trigger !== undefined || parsed.values.reference !== undefined))
+            throw new CliError('arguments_invalid', 'Use --trigger and --reference with firedrill ci runs.', 2);
+        if (parsed.values.cohort !== undefined && args[0] !== 'report')
+            throw new CliError('arguments_invalid', 'Use --cohort with firedrill report <campaign> drill or export create.', 2);
+        if ((parsed.values['score-bucket'] !== undefined || parsed.values['assessment-status'] !== undefined) && args[0] !== 'report') {
+            throw new CliError('arguments_invalid', 'Use score filters with firedrill report <campaign> scores <cohort-assessment>.', 2);
+        }
+        if (parsed.values.checks !== undefined && args[0] !== 'report')
+            throw new CliError('arguments_invalid', 'Use --checks with firedrill report drill lists.', 2);
+        if (parsed.values.status !== undefined && !['report', 'billing', 'ci', 'vault'].includes(args[0]) && !kinds.has(args[0])
+            && !(args[0] === 'connections' && args[1] === 'activity')
+            && !(args[0] === 'connect' && args[1] === 'requests')
+            && !(['criteria', 'assess', 'priority'].includes(args[0]) && args[1] === 'requests'))
+            throw new CliError('arguments_invalid', 'Use --status with a supported saved-resource or request history.', 2);
+        if (parsed.values.origin !== undefined && args[0] !== 'report')
+            throw new CliError('arguments_invalid', 'Use --origin with report assessment history.', 2);
+        if (parsed.values.kind !== undefined && !['billing', 'report', 'context', 'library', 'world'].includes(args[0])
+            && !(args[0] === 'scenarios' && args[1] === 'world-events') && !(args[0] === 'tools' && args[1] === TOOL_REUSE_VERB))
+            throw new CliError('arguments_invalid', 'Use --kind with billing history, report evidence, recording imports, scenario world events or reuse dependents.', 2);
+        if (parsed.values['discard-evidence'] !== undefined && !(args[0] === 'runner' && args[1] === 'evidence' && args[2] === 'forget')) {
+            throw new CliError('arguments_invalid', 'Use --discard-evidence only with runner evidence forget <operation>.', 2);
+        }
+        if ((parsed.values['approve-real-startup'] !== undefined || parsed.values['acknowledge-external-effects'] !== undefined)
+            && !(['simulate', 'validate'].includes(args[0]) || args[0] === 'simulation' && args[1] === 'run')) {
+            throw new CliError('arguments_invalid', 'Use startup approvals only with validate or simulate.', 2);
+        }
+        if (parsed.values['approve-real-simulation'] !== undefined
+            && !(args[0] === 'simulate' || args[0] === 'simulation' && args[1] === 'run')) {
+            throw new CliError('arguments_invalid', 'Use real-simulation approvals only with simulate.', 2);
+        }
+        if (parsed.values['approve-real-session'] !== undefined && !(args[0] === 'sessions' && args[1] === 'open')) {
+            throw new CliError('arguments_invalid', 'Use --approve-real-session only with sessions open.', 2);
+        }
+        if (parsed.values['acknowledge-shared-state'] !== undefined && !(args[0] === 'simulate'
+            || args[0] === 'simulation' && args[1] === 'run' || args[0] === 'sessions' && args[1] === 'open')) {
+            throw new CliError('arguments_invalid', 'Acknowledge shared state only for a simulation or a new manual session.', 2);
+        }
+        if (parsed.values.help || !args.length || args[0] === 'help') {
+            if (args[0] === 'help' && (args.length > 2 || args[1] !== undefined && args[1] !== 'advanced'
+                || Object.keys(parsed.values).some(key => !['json', 'help'].includes(key))))
+                throw new CliError('arguments_invalid', 'Use firedrill help for the common flow, or firedrill help advanced for additional commands.', 2);
+            const advanced = args[0] === 'help' && args[1] === 'advanced';
+            output({ commands: advanced ? commandNames : COMMON_COMMANDS, advanced }, advanced ? ADVANCED_HELP : COMMON_HELP);
+            return;
+        }
+        // Retired launch entrypoints (FIR-504), matching root's release gates (managed target, CI and assistant
+        // launches and legacy local execution are off): refused before any request, managed or on this device.
+        // Retained reads, reports, cancellation, cleanup, original-request recovery and a watch-only
+        // `simulation resume` stay available; new simulations use plan, apply and run.
+        if (['validate', 'simulate'].includes(args[0]) || args[0] === 'simulation' && args[1] === 'run'
+            || args[0] === 'sessions' && ['open', 'resume', 'quote'].includes(args[1]) || args[0] === 'runner' && args[1] === 'execute'
+            || args[0] === 'ci' && ['configure', 'setup-proposal'].includes(args[1]) || args[0] === 'datasets' && args[1] === 'start'
+            || parsed.values.managed !== undefined && !(args[0] === 'simulation' && args[1] === 'resume')) {
+            throw new CliError('legacy_launch_retired', LEGACY_LAUNCH_RETIRED, 2);
+        }
+        const emit = (type, data, readable) => {
+            if (json)
+                process.stdout.write(JSON.stringify({ type, data }) + '\n');
+            else if (readable)
+                process.stdout.write(readable.split('\n').map(terminalText).join('\n') + '\n');
+        };
+        if (args[0] === 'init') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'open'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use firedrill init with optional --session-only or --persistent, --workspace <id>, --no-browser, --open and --json.', 2);
+            await initCommand(args.slice(1), { json, signal: controller.signal, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], explicitOpen, mode: credentialMode.mode }, emit);
+            if (companion) {
+                // Session-only credentials live only in this process: keep serving until
+                // a signal or logout (companion shutdown) stops it.
+                emit('companion_running', { endpoint_ready: true, mode: 'session' }, 'Session-only companion running. Keep this terminal open; other firedrill commands use it. Stop it with Ctrl-C or firedrill logout.');
+                if (!controller.signal.aborted)
+                    await once(controller.signal, 'abort');
+                emit('companion_stopping', { reason: signalled ? 'signal' : 'shutdown' }, 'Stopping the companion. In-memory credentials are erased on close.');
+            }
+            return;
+        }
+        if (args[0] === 'status') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'plan'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use firedrill status with optional --plan <path|-> and --json.', 2);
+            await statusCommand(args.slice(1), { json, signal: controller.signal, plan: parsed.values.plan }, emit);
+            return;
+        }
+        if (args[0] === 'register') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'descriptor', 'name', 'agent', 'expected-revision', 'request', 'approve-change', 'declared-agent-name'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use register with --descriptor, --name or --agent and --expected-revision, and optional --request, --workspace and --json; or register request|withdraw-request <request-key>.', 2);
+            await registerCommand(args.slice(1), { json, signal: controller.signal, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], descriptor: parsed.values.descriptor, name: parsed.values.name, agent: parsed.values.agent,
+                expectedRevision: parsed.values['expected-revision'], request: parsed.values.request, approve: parsed.values['approve-change'],
+                declaredAgentName: parsed.values['declared-agent-name'] }, emit);
+            return;
+        }
+        if (args[0] === 'descriptors') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'agent', 'descriptor', 'page', 'approve-change'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use firedrill descriptors --agent <id> with optional --page <n> or --descriptor <id>, or descriptors request|withdraw-request <request-key> --agent <id>.', 2);
+            await descriptorsCommand(args.slice(1), { json, signal: controller.signal, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], agent: parsed.values.agent, descriptor: parsed.values.descriptor, page: parsed.values.page,
+                approve: parsed.values['approve-change'] }, emit);
+            return;
+        }
+        if (args[0] === 'plan' || args[0] === 'apply') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser',
+                ...(args[0] === 'plan' ? ['world', 'world-revision', 'request'] : ['approve', 'approve-credits', 'request', 'follow', 'cancel'])].includes(key)))
+                throw new CliError('arguments_invalid', 'Use firedrill plan --world <world-id> [--world-revision <id>], plan show <plan-id>, firedrill apply <plan-id> --approve [--request <key>] [--follow], or firedrill apply <plan-id> --request <key> --cancel.', 2);
+            await (args[0] === 'plan' ? planCommand : applyCommand)(args.slice(1), { json, signal: controller.signal,
+                workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'], approve: parsed.values.approve === true, approveCredits: parsed.values['approve-credits'],
+                world: parsed.values.world, worldRevision: parsed.values['world-revision'], request: parsed.values.request,
+                follow: parsed.values.follow === true, cancel: parsed.values.cancel === true }, emit);
+            return;
+        }
+        if (args[0] === 'library' || args[0] === 'world') {
+            const allowed = args[0] === 'library'
+                ? ['json', 'help', 'workspace', 'no-browser', 'kind', 'file', 'search', 'archived', 'page', 'expected-revision', 'request', 'approve-change',
+                    'parameters', 'remove-parameters']
+                : ['json', 'help', 'workspace', 'no-browser', 'agent', 'file', 'world', 'descriptor-revision', 'page', 'expected-revision', 'request', 'approve-change',
+                    'kind', 'search'];
+            if (Object.keys(parsed.values).some(key => !allowed.includes(key)))
+                throw new CliError('arguments_invalid', `Use firedrill ${args[0]} with only: ${allowed.filter(key => key !== 'help').map(key => '--' + key).join(', ')}.`, 2);
+            await (args[0] === 'library' ? libraryCommand : worldCommand)(args.slice(1), { json, signal: controller.signal,
+                workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'], kind: parsed.values.kind, file: parsed.values.file,
+                search: parsed.values.search, archived: parsed.values.archived, page: parsed.values.page,
+                expectedRevision: parsed.values['expected-revision'], request: parsed.values.request, agent: parsed.values.agent,
+                world: parsed.values.world, descriptorRevision: parsed.values['descriptor-revision'], approve: parsed.values['approve-change'],
+                parameters: parsed.values.parameters, removeParameters: parsed.values['remove-parameters'] }, emit);
+            return;
+        }
+        if (args[0] === 'run') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'open', 'session-only', 'persistent', 'plan', 'descriptor', 'approve', 'runner', 'campaign', 'enroll-device'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use firedrill run --plan <path|-> --descriptor <path|-> --campaign <id> with optional --approve, --runner, --workspace and --json (and --enroll-device in session-only mode).', 2);
+            await runCommand(args.slice(1), { json, signal: controller.signal, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], explicitOpen, plan: parsed.values.plan, descriptor: parsed.values.descriptor,
+                approve: parsed.values.approve === true, runner: parsed.values.runner, campaign: parsed.values.campaign,
+                enrollDevice: parsed.values['enroll-device'] === true }, emit);
+            return;
+        }
+        if (args[0] === 'watch') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'follow'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use firedrill watch <campaign> with optional --follow, --workspace and --json.', 2);
+            await watchCommand(args.slice(1), { json, signal: controller.signal, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], follow: parsed.values.follow === true }, emit);
+            return;
+        }
+        if (args[0] === 'driver') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'contract-sha256', 'baseline',
+                'view', 'change', 'page', 'page-size', 'search'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use driver review [review-id] with scope, recipe and page filters only.', 2);
+            await driverReviewCommand(args.slice(1), { json, world: parsed.values.world, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, contract: parsed.values['contract-sha256'],
+                baseline: parsed.values.baseline, view: parsed.values.view, change: parsed.values.change, page: parsed.values.page,
+                pageSize: parsed.values['page-size'], search: parsed.values.search }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (['agents', 'worlds'].includes(args[0]) && ['archive', 'restore', 'remove', 'requests', 'request', 'resume', 'withdraw'].includes(args[1])) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'status', 'request-key', 'approve-change'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use the exact record, original request or bounded history options.', 2);
+            await resourceLifecycle(args[0], args.slice(1), { json, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], page: parsed.values.page, search: parsed.values.search, status: parsed.values.status, request: parsed.values['request-key'],
+                approve: parsed.values['approve-change'], signal: controller.signal }, output);
+            return;
+        }
+        if (args[0] === 'completion') {
+            if (args.length !== 2 || Object.keys(parsed.values).some(key => !['json', 'help'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use completion bash, zsh or fish without account or change options.', 2);
+            const script = completionScript(args[1]);
+            output({ shell: args[1], script }, script);
+            return;
+        }
+        if (args[0] === 'recordings') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use recording scope, page/search or browser handoff options only.', 2);
+            await recordingsCommand(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], page: parsed.values.page, search: parsed.values.search, signal: controller.signal }, output);
+            return;
+        }
+        if (args[0] === 'values') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search', 'file', 'approve-change', 'value-stdin'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use local value metadata, scope, hidden input and explicit change approval only.', 2);
+            await localValuesCommand(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], page: parsed.values.page, search: parsed.values.search, file: parsed.values.file,
+                approve: parsed.values['approve-change'], valueStdin: parsed.values['value-stdin'], signal: controller.signal }, output);
+            return;
+        }
+        if (args[0] === 'vault') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'status', 'file', 'request-key', 'approve-change', 'value-stdin'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use Vault scope, metadata, original-request and hidden-value input options only.', 2);
+            await vaultCommand(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                page: parsed.values.page, search: parsed.values.search, status: parsed.values.status, file: parsed.values.file,
+                request: parsed.values['request-key'], approve: parsed.values['approve-change'], valueStdin: parsed.values['value-stdin'], signal: controller.signal }, output);
+            return;
+        }
+        if (args[0] === 'settings' || args[0] === 'team') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'file', 'request-key', 'approve-change'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use workspace, page/search and explicit reviewed-change options for administration.', 2);
+            const command = args[0] === 'settings' ? settingsCommand : teamCommand;
+            await command(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                page: parsed.values.page, search: parsed.values.search, file: parsed.values.file, request: parsed.values['request-key'],
+                approve: parsed.values['approve-change'], signal: controller.signal }, (value, readable) => output(value, readable.split('\n').map(terminalText).join('\n')));
+            return;
+        }
+        if (args[0] === 'recipes') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'name', 'page', 'search', 'request-key', 'approve-change'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use recipe scope, name, bounded history or reviewed change options.', 2);
+            await worldRecipes(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, name: parsed.values.name, page: parsed.values.page,
+                search: parsed.values.search, request: parsed.values['request-key'], approve: parsed.values['approve-change'] }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'context') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'file', 'kind', 'approve-change', 'page', 'search', 'request-key'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use context scope, import format, file, paging or reviewed change options only.', 2);
+            await recordedContextCommand(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, file: parsed.values.file, format: parsed.values.kind,
+                approve: parsed.values['approve-change'], page: parsed.values.page, search: parsed.values.search, request: parsed.values['request-key'] }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'scenarios' && isScenarioDiscoveryAction(args[1])) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'file', 'approve-change', 'page', 'search', 'request-key', 'kind'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use scenario discovery, paging, original request or reviewed change options only.', 2);
+            await scenarioDiscoveryCommand(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, file: parsed.values.file,
+                approve: parsed.values['approve-change'], page: parsed.values.page, search: parsed.values.search, request: parsed.values['request-key'], kind: parsed.values.kind }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'scenarios' && ['create', 'edit', 'duplicate', 'archive', 'restore', 'definition', 'history'].includes(args[1])) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'file', 'approve-change', 'page', 'search'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use scenario scope, reviewed input, explicit change approval or history paging only.', 2);
+            await scenarioAuthoring(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], file: parsed.values.file, approve: parsed.values['approve-change'],
+                page: parsed.values.page, search: parsed.values.search, signal: controller.signal }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'scenarios' && args[1] === 'paths') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search', 'basis-version'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use scenario scope, page/search and an optional original definition digest only.', 2);
+            await scenarioPaths(args.slice(2), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], page: parsed.values.page, search: parsed.values.search,
+                definition: parsed.values['basis-version'], signal: controller.signal }, output);
+            return;
+        }
+        if (args[0] === 'scenarios' && ['requests', 'request', 'withdraw-request'].includes(args[1])) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search', 'status', 'approve-change'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use scenario request scope, history filters and explicit withdrawal consent only.', 2);
+            await scenarioRequests(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], page: parsed.values.page, search: parsed.values.search,
+                status: parsed.values.status, approve: parsed.values['approve-change'], signal: controller.signal }, output);
+            return;
+        }
+        if (args[0] === 'criteria' && ['requests', 'request', 'withdraw-request'].includes(args[1])) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search', 'status', 'approve-change'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use criterion request scope, history filters and explicit withdrawal consent only.', 2);
+            await revisionRequests('evaluation', args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], page: parsed.values.page, search: parsed.values.search,
+                status: parsed.values.status, approve: parsed.values['approve-change'], signal: controller.signal }, output);
+            return;
+        }
+        if (parsed.values['import-status'] !== undefined && !(args[0] === 'tools' && args[1] === 'requests')) {
+            throw new CliError('arguments_invalid', 'Use --import-status only with firedrill tools requests.', 2);
+        }
+        if (args[0] === 'billing') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'status', 'kind', 'from', 'to'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use billing scope and history filters. Financial changes continue in the web billing flow.', 2);
+            }
+            await billingCommand(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'], signal: controller.signal,
+                page: parsed.values.page, search: parsed.values.search, status: parsed.values.status, kind: parsed.values.kind,
+                from: parsed.values.from, to: parsed.values.to }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'ci') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'status', 'world', 'trigger', 'reference', 'outcome'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use CI scope, search, paging, status and run-history filters only. Execution access is reviewed in the browser.', 2);
+            await ciCommand(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'], signal: controller.signal,
+                page: parsed.values.page, search: parsed.values.search, status: parsed.values.status, world: parsed.values.world,
+                trigger: parsed.values.trigger, reference: parsed.values.reference, outcome: parsed.values.outcome }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'tools' && ['init', 'validate', 'push'].includes(args[1])) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'file', 'approve-tool-upload', 'request-key'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use tools init|validate [directory], or tools push <package.zip> with --approve-tool-upload for automation.', 2);
+            await toolsAuthorCommand(args.slice(1), { json, signal: controller.signal, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], file: parsed.values.file, upload: parsed.values['approve-tool-upload'],
+                request: parsed.values['request-key'] }, emit);
+            return;
+        }
+        if (args[0] === 'tools' && args[1] === TOOL_REUSE_VERB) {
+            // Tool definition reuse across workspaces: sharing and exact private copies, never instances or state.
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'kind', 'request-key',
+                'approve-tool-change'].includes(key)))
+                throw new CliError('arguments_invalid', `Use firedrill tools ${TOOL_REUSE_VERB} with only: --workspace, --no-browser, --page, --search, --kind, `
+                    + '--request-key, --approve-tool-change and --json.', 2);
+            await toolReuseCommand(args.slice(2), { json, signal: controller.signal, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], search: parsed.values.search, page: parsed.values.page, kind: parsed.values.kind,
+                request: parsed.values['request-key'], approve: parsed.values['approve-tool-change'] }, emit);
+            return;
+        }
+        if (args[0] === 'tools' && NATIVE_TOOL_ACTIONS.has(args[1])) {
+            // Hosted tool sessions (mixed setups): saved tools on the shared pool or isolated, outside any drill.
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'state', 'service', 'seconds',
+                'file', 'request-key', 'usage-quote', 'approve-tool-change', 'approve-credits', 'follow', 'allow-writes'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use tool session scope, paging, an exact selection and explicit consent only. See firedrill help.', 2);
+            await nativeToolsCommand(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                signal: controller.signal, file: parsed.values.file, seconds: parsed.values.seconds, service: parsed.values.service,
+                request: parsed.values['request-key'], quote: parsed.values['usage-quote'], approve: parsed.values['approve-tool-change'], approveCredits: parsed.values['approve-credits'], follow: parsed.values.follow,
+                state: parsed.values.state, search: parsed.values.search, page: parsed.values.page, allowWrites: parsed.values['allow-writes'] }, emit);
+            return;
+        }
+        if (args[0] === 'tools') {
+            if (Object.keys(parsed.values).some(one => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'file',
+                'request-key', 'service', 'seconds', 'usage-quote', 'approve-tool-upload', 'approve-tool-change', 'import-status', 'before', 'after', 'anchor', 'outcome', 'into', 'approve-download', 'state', 'category'].includes(one))) {
+                throw new CliError('arguments_invalid', 'Use tool scope, paging, an exact package request and explicit upload/change consent only.', 2);
+            }
+            await toolsCommand(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                signal: controller.signal, page: parsed.values.page, search: parsed.values.search, category: parsed.values.category, file: parsed.values.file, state: parsed.values.state,
+                before: parsed.values.before, after: parsed.values.after, anchor: parsed.values.anchor, outcome: parsed.values.outcome,
+                into: parsed.values.into, approveDownload: parsed.values['approve-download'], usageQuote: parsed.values['usage-quote'],
+                request: parsed.values['request-key'], service: parsed.values.service, upload: parsed.values['approve-tool-upload'], change: parsed.values['approve-tool-change'], seconds: parsed.values.seconds, importStatus: parsed.values['import-status'] }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (parsed.values.anchor !== undefined)
+            throw new CliError('arguments_invalid', 'Use --anchor only with tools activity.', 2);
+        if (args[0] === 'datasets') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search', 'file', 'request-key', 'approve-dataset', 'into', 'approve-download'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use dataset scope, paging, an exact file/request and explicit save, withdrawal or download consent only.', 2);
+            }
+            await worldDatasetCommand(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, page: parsed.values.page, search: parsed.values.search,
+                file: parsed.values.file, request: parsed.values['request-key'], approve: parsed.values['approve-dataset'],
+                into: parsed.values.into, approveDownload: parsed.values['approve-download'] }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'sessions') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search', 'name', 'file', 'managed', 'local', 'device', 'grant', 'seconds', 'run', 'dataset', 'share-dataset-with-device', 'checkpoint', 'share-checkpoint-with-device', 'approve-real-session', 'acknowledge-shared-state', 'usage-quote', 'request-key', 'acknowledge-partial-state'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use session scope, paging, execution choice, duration and --run consent only.', 2);
+            }
+            await worldSessionsCommand(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, page: parsed.values.page,
+                managed: parsed.values.managed, local: parsed.values.local, device: parsed.values.device, grant: parsed.values.grant,
+                seconds: parsed.values.seconds, run: parsed.values.run, dataset: parsed.values.dataset,
+                usageQuote: parsed.values['usage-quote'], request: parsed.values['request-key'],
+                acknowledgePartialState: parsed.values['acknowledge-partial-state'],
+                shareDatasetWithDevice: parsed.values['share-dataset-with-device'], shareCheckpointWithDevice: parsed.values['share-checkpoint-with-device'],
+                approveRealSession: parsed.values['approve-real-session'], acknowledgeSharedState: parsed.values['acknowledge-shared-state'],
+                search: parsed.values.search, name: parsed.values.name, file: parsed.values.file, checkpoint: parsed.values.checkpoint }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (parsed.values['share-checkpoint-with-device'] !== undefined)
+            throw new CliError('arguments_invalid', 'Use --share-checkpoint-with-device only with sessions restore or open --checkpoint.', 2);
+        if (parsed.values['approve-dataset'] !== undefined)
+            throw new CliError('arguments_invalid', 'Use --approve-dataset only with firedrill datasets.', 2);
+        if (parsed.values['approve-tool-upload'] !== undefined || parsed.values['approve-tool-change'] !== undefined) {
+            throw new CliError('arguments_invalid', 'Use tool upload/change approvals only with firedrill tools.', 2);
+        }
+        if (args[0] === 'real-operations') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search', 'service', 'outcome', 'needs-review',
+                'request-key', 'acknowledge-real-effects', 'acknowledge-duplicate-risk'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use real-account scope, history filters and exact review acknowledgements only.', 2);
+            }
+            await realOperationsCommand(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, page: parsed.values.page, search: parsed.values.search,
+                service: parsed.values.service, outcome: parsed.values.outcome, needsReview: parsed.values['needs-review'],
+                request: parsed.values['request-key'], effects: parsed.values['acknowledge-real-effects'], duplicateRisk: parsed.values['acknowledge-duplicate-risk'] }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (['service', 'outcome', 'needs-review', 'acknowledge-real-effects', 'acknowledge-duplicate-risk'].some(key => Object.hasOwn(parsed.values, key))) {
+            throw new CliError('arguments_invalid', 'Use real-account filters and review acknowledgements only with firedrill real-operations.', 2);
+        }
+        if (args[0] === 'inspect') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use world/workspace scope, search and page options for inspection.', 2);
+            }
+            await inspectCommand(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, page: parsed.values.page, search: parsed.values.search }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'configuration' || args[0] === 'connections' || args[0] === 'models') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'file', 'page', 'search', 'request-key', 'approve-configuration', ...(args[0] === 'connections' && args[1] === 'activity' ? ['status'] : [])].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use configuration scope, paging, metadata file, consent or exact recovery options only.', 2);
+            }
+            const configure = { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, page: parsed.values.page, search: parsed.values.search,
+                file: parsed.values.file, request: parsed.values['request-key'], approve: parsed.values['approve-configuration'] };
+            const configured = (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n');
+            if (args[0] === 'models')
+                await targetModelsCommand(args.slice(1), configure, configured);
+            else if (args[0] === 'connections' && isDependencyPreparationAction(args[1]))
+                await dependencyPreparationCommand(args.slice(1), configure, configured);
+            else
+                await configurationCommand(args[0], args.slice(1), { ...configure, status: parsed.values.status }, configured);
+            return;
+        }
+        if (parsed.values['approve-configuration'] !== undefined)
+            throw new CliError('arguments_invalid', 'Use --approve-configuration only with configuration, connections or models.', 2);
+        if (args[0] === 'changes') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'file', 'page', 'search', 'request-key', 'approve-change', 'reviewed-draft', 'into', 'approve-download', 'additional-scenario', 'side'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use source-change scope, paging, review, consent and recovery options only.', 2);
+            }
+            await changesCommand(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                signal: controller.signal, file: parsed.values.file, page: parsed.values.page, search: parsed.values.search,
+                request: parsed.values['request-key'], approve: parsed.values['approve-change'], reviewedDraft: parsed.values['reviewed-draft'],
+                into: parsed.values.into, approveDownload: parsed.values['approve-download'],
+                additionalScenarios: parsed.values['additional-scenario'], side: parsed.values.side }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'simulation' && ['pause', 'resume-scheduling', 'cancel', 'control-request', 'continue-control', 'withdraw-control'].includes(args[1])) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'approve-change', ...(args[1] === 'cancel' ? ['request'] : [])].includes(key)))
+                throw new CliError('arguments_invalid', 'Use simulation scope and explicit scheduling-change approval only.', 2);
+            // A native campaign is cancelled through its own route; any other id keeps the hosted campaign control.
+            if (args[1] === 'cancel' && args.length === 3 && await nativeCancel(args[2], { json, workspace: parsed.values.workspace,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, approve: parsed.values['approve-change'] === true,
+                request: parsed.values.request }, emit))
+                return;
+            if (parsed.values.request !== undefined)
+                throw new CliError('arguments_invalid', 'Use --request only to recover a native campaign cancellation.', 2);
+            await campaignControl(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, approve: parsed.values['approve-change'] }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        const worldEventReport = args[0] === 'report' && ['trial', 'drill'].includes(args[2]) && args[4] === 'world-events';
+        const sourceWithdrawal = args[0] === 'sources' && args[1] === 'withdraw';
+        const runnerCleanup = args[0] === 'runner' && ['run-cleanup', 'drill-cleanup'].includes(args[1]);
+        if ([...(worldEventReport || sourceWithdrawal || runnerCleanup ? [] : ['approve-change']), 'reviewed-draft', 'additional-scenario', ...(args[0] === 'report' ? [] : ['side']), ...(args[0] === 'report' || args[0] === 'source' ? [] : ['into', 'approve-download'])].some(key => Object.hasOwn(parsed.values, key))) {
+            throw new CliError('arguments_invalid', 'Use source-change consent and review options only with firedrill changes.', 2);
+        }
+        if (args[0] === 'criteria' || args[0] === 'assess') {
+            const criterion = args[0] === 'criteria';
+            if (!criterion && ['requests', 'request', 'withdraw-request'].includes(args[1])) {
+                if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'status', 'approve-assessment'].includes(key))) {
+                    throw new CliError('arguments_invalid', 'Use only workspace, paging, search, status and explicit cancellation consent for assessment requests.', 2);
+                }
+                await assessmentRequests(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                    signal: controller.signal, page: parsed.values.page, search: parsed.values.search, status: parsed.values.status,
+                    approve: parsed.values['approve-assessment'] }, (data, readable) => process.stdout.write(json ? JSON.stringify({ type: 'result', data }) + '\n'
+                    : readable.split('\n').map(terminalText).join('\n') + '\n'));
+                return;
+            }
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'file', 'request-key',
+                ...(criterion ? ['world', 'page', 'search', 'approve-criterion'] : ['approve-assessment'])].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use only scope, authoring, consent and recovery options for this evaluation command.', 2);
+            }
+            await (criterion ? criteriaCommand : assessCommand)(args.slice(1), { json, workspace: parsed.values.workspace,
+                world: parsed.values.world, openBrowser: !parsed.values['no-browser'], signal: controller.signal, file: parsed.values.file,
+                page: parsed.values.page, search: parsed.values.search, request: parsed.values['request-key'],
+                approve: criterion ? parsed.values['approve-criterion'] : parsed.values['approve-assessment'] }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'policies') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'agent', 'file', 'name', 'policy-id', 'basis-version', 'request-key', 'approve-policy', 'page', 'search'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use policy, agent, file, paging or consent options for this command.', 2);
+            }
+            await policyCommand(args.slice(1), { json, workspace: parsed.values.workspace, agent: parsed.values.agent,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, file: parsed.values.file, name: parsed.values.name,
+                policy: parsed.values['policy-id'], basis: parsed.values['basis-version'], request: parsed.values['request-key'],
+                consent: parsed.values['approve-policy'], page: parsed.values.page, search: parsed.values.search }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (parsed.values.checkpoint !== undefined && args[0] !== 'report')
+            throw new CliError('arguments_invalid', 'Use --checkpoint with firedrill report.', 2);
+        if (args[0] === 'report') {
+            // A native drill's separately approved reassessments: a new evaluation of retained evidence, never a rerun.
+            if (reassessmentShape(args.slice(1))) {
+                if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'request-key', 'usage-quote', 'approve-assessment', 'approve-credits'].includes(key)))
+                    throw new CliError('arguments_invalid', 'Use --page, --request-key, --usage-quote or --approve-assessment with drill reassessments.', 2);
+                await reassessmentCommand(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                    signal: controller.signal, page: parsed.values.page, request: parsed.values['request-key'], quote: parsed.values['usage-quote'],
+                    approve: parsed.values['approve-assessment'], approveCredits: parsed.values['approve-credits'] }, emit);
+                return;
+            }
+            if (args[2] === 'diagnoses') {
+                if (args.length > 4 || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'kind'].includes(key)))
+                    throw new CliError('arguments_invalid', 'Use report <simulation> diagnoses [insight] with paging or insight filters.', 2);
+                await campaignDiagnoses([args[1], ...args.slice(3)], { json, workspace: parsed.values.workspace,
+                    openBrowser: !parsed.values['no-browser'], signal: controller.signal, page: parsed.values.page,
+                    search: parsed.values.search, kind: parsed.values.kind }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+                return;
+            }
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'checkpoint', 'scenario', 'checks', 'status', 'score-bucket', 'assessment-status', 'request-key', 'into', 'approve-download', 'cohort', 'origin', 'kind', 'service-request', 'side', 'method', 'evaluator', 'attempt', 'step', 'from-at', 'to-at', ...(worldEventReport ? ['file', 'approve-change'] : [])].includes(key))
+                || (parsed.values.scenario?.length ?? 0) > 1) {
+                throw new CliError('arguments_invalid', 'Use report, paging or checkpoint options for this command.', 2);
+            }
+            // A native campaign reads its slots, executions and retained evidence; any other id keeps the hosted reports.
+            if (nativeReportShape(args.slice(1)) && Object.keys(parsed.values).every(key => ['json', 'help', 'workspace', 'no-browser', 'page', 'kind'].includes(key))
+                && await nativeReport(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                    signal: controller.signal, page: parsed.values.page, kind: parsed.values.kind }, emit))
+                return;
+            await reportCommand(args.slice(1), { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                page: parsed.values.page, search: parsed.values.search, checkpoint: parsed.values.checkpoint,
+                scoreBucket: parsed.values['score-bucket'], assessmentStatus: parsed.values['assessment-status'],
+                cohort: parsed.values.cohort, origin: parsed.values.origin, evidenceKind: parsed.values.kind, side: parsed.values.side, checkMethod: parsed.values.method, evaluator: parsed.values.evaluator,
+                requestKey: parsed.values['request-key'], into: parsed.values.into, approveDownload: parsed.values['approve-download'],
+                evidenceAttempt: parsed.values.attempt, evidenceStep: parsed.values.step,
+                evidenceFrom: parsed.values['from-at'], evidenceTo: parsed.values['to-at'],
+                file: parsed.values.file, change: parsed.values['approve-change'],
+                scenario: parsed.values.scenario?.[0], checks: parsed.values.checks, status: parsed.values.status,
+                serviceRequest: parsed.values['service-request'], signal: controller.signal }, (value, readable) => output(value, readable.split('\n').map(terminalText).join('\n')));
+            return;
+        }
+        if (['simulate', 'validate', 'simulation'].includes(args[0])) {
+            const action = args[0] === 'simulate' ? 'run' : args[0] === 'validate' ? 'validate' : args[1];
+            const common = ['json', 'help', 'workspace', 'world', 'no-browser'];
+            const runOptions = ['managed', 'local', 'device', 'grant', 'run'];
+            const allowed = [...common, ...(['run', 'validate', 'resume'].includes(action) ? runOptions : []),
+                ...(action === 'requests' ? ['after'] : []),
+                ...(action === 'request' && args[2] === 'continue' ? ['run'] : []),
+                ...(['run', 'validate'].includes(action) ? ['approve-real-startup', 'acknowledge-external-effects'] : []),
+                ...(action === 'run' ? ['validate', 'all-scenarios', 'scenario', 'repetitions', 'parallel', 'seconds', 'assess', 'record-browser', 'record-voice', 'record-desktop', 'acknowledge-desktop-screen-content', 'dataset', 'share-dataset-with-device', 'approve-real-simulation', 'acknowledge-shared-state', 'approve-agent-input', 'application-checkpoint', 'acknowledge-fresh-world-state', 'share-application-checkpoint-with-device', 'coordinated-checkpoint', 'acknowledge-supported-checkpoint-scope', 'share-coordinated-checkpoint-with-device'] : [])];
+            if (Object.keys(parsed.values).some(key => !allowed.includes(key)))
+                throw new CliError('arguments_invalid', 'Use only options for this simulation action.', 2);
+            const options = { world: parsed.values.world, workspace: parsed.values.workspace, json, after: parsed.values.after,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, local: parsed.values.local,
+                managed: parsed.values.managed, device: parsed.values.device, grant: parsed.values.grant, run: parsed.values.run,
+                approveRealStartup: parsed.values['approve-real-startup'], acknowledgeExternalEffects: parsed.values['acknowledge-external-effects'],
+                approveRealSimulation: parsed.values['approve-real-simulation'], acknowledgeSharedState: parsed.values['acknowledge-shared-state'],
+                validate: parsed.values.validate, all: parsed.values['all-scenarios'], scenarios: parsed.values.scenario,
+                repetitions: parsed.values.repetitions, parallel: parsed.values.parallel, seconds: parsed.values.seconds, assess: parsed.values.assess, recordBrowser: parsed.values['record-browser'], recordVoice: parsed.values['record-voice'], dataset: parsed.values.dataset,
+                recordDesktop: parsed.values['record-desktop'], acknowledgeDesktopScreenContent: parsed.values['acknowledge-desktop-screen-content'],
+                approveAgentInput: parsed.values['approve-agent-input'],
+                applicationCheckpoint: parsed.values['application-checkpoint'], acknowledgeFreshWorldState: parsed.values['acknowledge-fresh-world-state'],
+                shareApplicationCheckpointWithDevice: parsed.values['share-application-checkpoint-with-device'],
+                coordinatedCheckpoint: parsed.values['coordinated-checkpoint'], acknowledgeSupportedCheckpointScope: parsed.values['acknowledge-supported-checkpoint-scope'],
+                shareCoordinatedCheckpointWithDevice: parsed.values['share-coordinated-checkpoint-with-device'],
+                shareDatasetWithDevice: parsed.values['share-dataset-with-device'] };
+            const event = (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n');
+            if (['run', 'validate'].includes(action) && args.length === 1)
+                await simulationCommand(action, options, event);
+            else if (args[0] === 'simulation' && action === 'resume' && args.length === 3)
+                await resumeSimulation(args[2], options, event);
+            else if (args[0] === 'simulation' && action === 'requests' && args.length === 2)
+                await simulationRequest('list', undefined, options, event);
+            else if (args[0] === 'simulation' && action === 'request' && ['status', 'continue', 'withdraw'].includes(args[2]) && args.length === 4) {
+                await simulationRequest(args[2], args[3], options, event);
+            }
+            else
+                throw new CliError('arguments_invalid', 'Use simulation resume <id> (watch only), simulation requests, or simulation request status|continue|withdraw <key>.', 2);
+            return;
+        }
+        if (args[0] === 'runner' && args[1] === 'abandon') {
+            if (args.length !== 4 || Object.keys(parsed.values).some(key => !['json', 'help', 'world', 'workspace', 'no-browser'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use runner abandon <device> <job> --world <world>. This permanently closes only an original pre-launch claim.', 2);
+            const selection = { workspace: parsed.values.workspace, interactive: !json && !!process.stdin.isTTY && !!process.stderr.isTTY,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal };
+            // Historical closure must remain reachable after a world is archived or
+            // its original grant expires. The closing API rechecks current membership.
+            const scope = parsed.values.world ? await selectedWorkspace(selection) : undefined;
+            const world = parsed.values.world ? identifier(parsed.values.world) : undefined;
+            const context = scope && world ? { ...scope, world, prefix: `/api/workspaces/${scope.workspace}/worlds/${world}` }
+                : await selectedWorld(selection);
+            const receipt = await abandonLocalAssignment(context, identifier(args[2]), identifier(args[3]), controller.signal);
+            output(receipt, receipt.settled ? 'Original unstarted job closed. No container or target was started.'
+                : 'Original no-launch closing receipt retained. Final reconciliation is pending; the job cannot be resumed.');
+            return;
+        }
+        if (args[0] === 'runner' && args[1] === 'execute') {
+            if (![3, 4].includes(args.length) || Object.keys(parsed.values).some(key => !['json', 'help', 'world', 'workspace', 'no-browser', 'grant', 'execute-local'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use runner execute <device> [job] with the saved world and local permission. This runs one existing assignment, not a new campaign.', 2);
+            }
+            await executeAssignment(args[2], args[3], { world: parsed.values.world, workspace: parsed.values.workspace,
+                json, openBrowser: !parsed.values['no-browser'], signal: controller.signal, grant: parsed.values.grant,
+                approve: parsed.values['execute-local'] === true }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'runner' && ['authorize', 'grants', 'grant'].includes(args[1])) {
+            const action = args[1] === 'authorize' ? 'authorize' : args[1] === 'grants' ? 'list' : args[2];
+            const allowed = ['json', 'help', 'workspace', 'world', 'no-browser', ...(action === 'list' ? ['page'] : []),
+                ...(action === 'authorize' ? ['approve-local', 'operations', 'minutes', 'parallel', 'cpu', 'memory-mb', 'upload-evidence', 'allow-vault-values', 'allow-real-accounts', 'allow-catalog-packages'] : [])];
+            if (!['authorize', 'list', 'status', 'revoke'].includes(action)
+                || (action === 'authorize' ? args.length !== 3 : action === 'list' ? args.length !== 2 : args.length !== 4)
+                || Object.keys(parsed.values).some(key => !allowed.includes(key))) {
+                throw new CliError('arguments_invalid', 'Use runner authorize <device>, runner grants or runner grant status|revoke <request>. Choose the saved world with --world.', 2);
+            }
+            await runnerGrantCommand(action, action === 'authorize' ? args[2] : args[3], {
+                world: parsed.values.world, workspace: parsed.values.workspace, json, openBrowser: !parsed.values['no-browser'], signal: controller.signal,
+                approve: parsed.values['approve-local'] === true, operations: parsed.values.operations, minutes: parsed.values.minutes,
+                parallel: parsed.values.parallel, cpu: parsed.values.cpu, memory: parsed.values['memory-mb'], evidence: parsed.values['upload-evidence'] === true,
+                vault: parsed.values['allow-vault-values'] === true, real: parsed.values['allow-real-accounts'] === true,
+                catalog: parsed.values['allow-catalog-packages'] === true, page: parsed.values.page
+            }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'runner' && args[1] === 'completion') {
+            if (args.length !== 4 || args[2] !== 'sync' || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use firedrill runner completion sync <operation>. This never starts or repeats an agent.', 2);
+            }
+            const scope = await selectedWorkspace({ workspace: parsed.values.workspace,
+                interactive: !json && !!process.stdin.isTTY && !!process.stderr.isTTY,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal });
+            const operation = identifier(args[3]);
+            const purpose = await localContainerPurpose(scope, operation);
+            const receipt = purpose === 'world_session' ? await syncLocalWorldClosing(scope, operation, controller.signal, { onCommand: worldEvidenceOutput }) : purpose === 'trial'
+                ? await syncLocalTrialCompletion(scope, operation, controller.signal, { wait: true })
+                : await syncLocalCompletion(scope, operation, controller.signal, { wait: true });
+            output(receipt, receipt.settled ? 'The saved execution outcome is retained. No agent was started again.'
+                : 'Closing receipt retained. Evidence processing is separate; no agent was started again.');
+            return;
+        }
+        if (args[0] === 'runner' && args[1] === 'evidence') {
+            if (['forget', 'inspect', 'prune'].includes(args[2])) {
+                if ((args[2] !== 'prune' ? args.length !== 4 : args.length !== 3)
+                    || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', ...(args[2] === 'forget' ? ['discard-evidence'] : [])].includes(key))) {
+                    throw new CliError('arguments_invalid', 'Use runner evidence inspect|forget <operation> or runner evidence prune. Only private local evidence is affected.', 2);
+                }
+                const options = { json, workspace: parsed.values.workspace, signal: controller.signal };
+                if (args[2] === 'forget')
+                    await forgetLocalEvidence(args[3], { ...options, approve: parsed.values['discard-evidence'] === true }, output);
+                else if (args[2] === 'inspect')
+                    await inspectLocalEvidence(args[3], options, output);
+                else
+                    await pruneLocalEvidence(options, output);
+                return;
+            }
+            if (args.length !== 4 || args[2] !== 'sync' || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use firedrill runner evidence sync <operation>. This never starts or repeats an agent.', 2);
+            }
+            const scope = await selectedWorkspace({ workspace: parsed.values.workspace,
+                interactive: !json && !!process.stdin.isTTY && !!process.stderr.isTTY,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal });
+            const operation = identifier(args[3]);
+            const purpose = await localContainerPurpose(scope, operation);
+            if (purpose === 'world_session') {
+                const receipt = await syncLocalWorldEvidence(scope, operation, controller.signal, { onCommand: worldEvidenceOutput });
+                output(receipt, receipt.state === 'closed' ? 'This world has closed. Inspect its saved report for retained and unavailable evidence.'
+                    : receipt.state === 'synced' ? 'Saved command records synchronized. World closure and file availability remain separate.'
+                        : 'Some original command evidence is unavailable. No agent action was repeated.');
+                return;
+            }
+            if (purpose === 'trial') {
+                const receipt = await syncLocalTrialEvidence(scope, operation, controller.signal, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                    : readable.split('\n').map(terminalText).join('\n') + '\n'));
+                output(receipt, 'Saved drill transfer inspected. Cloud publication and execution outcome remain separate in the closing receipt.');
+                return;
+            }
+            const receipt = await syncLocalEvidence(scope, operation, controller.signal);
+            output(receipt, receipt.state === 'cloud_retained' ? 'Evidence retained in the cloud. Execution completion is separate.'
+                : 'Evidence remains local. No agent was started and cloud completion was not recorded.');
+            return;
+        }
+        if (args[0] === 'runner' && ['run-cleanup', 'drill-cleanup'].includes(args[1])) {
+            if (args.length !== 4 || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'approve-change'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use firedrill runner run-cleanup <device-key> <campaign-id> or drill-cleanup <device-key> <assignment-id>, with optional --approve-change. This never starts or stops a process.', 2);
+            await (args[1] === 'drill-cleanup' ? drillCleanupCommand : runCleanupCommand)(args[2], args[3], { workspace: parsed.values.workspace, json,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, approve: parsed.values['approve-change'] === true }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'runner' && args[1] === 'cleanup') {
+            if (args.length !== 3 || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use firedrill runner cleanup <operation>. This never starts or repeats execution.', 2);
+            }
+            const scope = await selectedWorkspace({ workspace: parsed.values.workspace,
+                interactive: !json && !!process.stdin.isTTY && !!process.stderr.isTTY,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal });
+            const receipt = await recoverLocalContainer(scope, identifier(args[2]), controller.signal);
+            output(receipt, receipt.resource_state === 'not_dispatched' ? 'No container was dispatched. Closing receipt synchronization is separate.'
+                : receipt.cleanup_confirmed ? 'Exact local container cleanup confirmed. Cloud completion is separate.'
+                    : 'The saved container is not visible. A delayed create is not replayed and cleanup remains unconfirmed.');
+            if (!receipt.cleanup_confirmed)
+                throw new CliError('local_container_cleanup_pending', 'Keep this exact operation journal for a later cleanup lookup.');
+            return;
+        }
+        if (args[0] === 'runner' && ['jobs', 'claim'].includes(args[1])) {
+            const action = args[1] === 'jobs' ? 'list' : args[2];
+            if (!['list', 'status', 'withdraw'].includes(action)
+                || (action === 'list' ? args.length !== 3 : args.length !== 6)
+                || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', ...(action === 'list' ? ['page', 'search'] : [])].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use runner jobs <device> or runner claim status|withdraw <device> <job> <request>. These commands do not start execution.', 2);
+            }
+            await runnerJobs(action, action === 'list' ? args[2] : args[3], args[4], args[5], {
+                workspace: parsed.values.workspace, json, openBrowser: !parsed.values['no-browser'], signal: controller.signal,
+                page: parsed.values.page, search: parsed.values.search
+            }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'runner' && args[1] === 'runtime') {
+            const action = args[2] ?? 'inspect';
+            if (!['inspect', 'install', 'check', 'recover', 'policy'].includes(action)
+                || (action === 'recover' ? args.length !== 4 : args.length > 3)
+                || Object.keys(parsed.values).some(key => !['json', 'help', 'install-runtime', 'workspace', 'no-browser'].includes(key))
+                || action !== 'install' && parsed.values['install-runtime']) {
+                throw new CliError('arguments_invalid', 'Use firedrill runner runtime [inspect|install|check|policy|recover <key>]. No source or simulation is run by these commands.', 2);
+            }
+            await runtimeCommand(action, args[3], {
+                workspace: parsed.values.workspace, json, install: parsed.values['install-runtime'] === true,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal
+            }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'runner') {
+            const action = args[1] ?? 'list';
+            if (!['enroll', 'list', 'status', 'connect', 'revoke'].includes(action)
+                || (['enroll', 'list'].includes(action) ? args.length > 2 : args.length !== 3)
+                || Object.keys(parsed.values).some(key => !['json', 'help', 'name', 'enroll-device', 'workspace', 'no-browser', 'page', 'search'].includes(key))
+                || action !== 'enroll' && (parsed.values.name || parsed.values['enroll-device'])
+                || action !== 'list' && (parsed.values.page || parsed.values.search)) {
+                throw new CliError('arguments_invalid', 'Use firedrill runner enroll|list|status|connect|revoke. Presence does not start local execution.', 2);
+            }
+            await runnerCommand(action, args[2], { workspace: parsed.values.workspace, json, openBrowser: !parsed.values['no-browser'],
+                signal: controller.signal, name: parsed.values.name, enroll: parsed.values['enroll-device'] === true, page: parsed.values.page, search: parsed.values.search }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'connect') {
+            if (['multi', 'multi-status', 'multi-resume'].includes(args[1])) {
+                if (args.length > 3 || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'file', 'name', 'upload-source'].includes(key)))
+                    throw new CliError('arguments_invalid', 'Use connect multi --file <roots.json>, or multi-status|multi-resume <key>.', 2);
+                await sourceBatchCommand(args.slice(1), { json, workspace: parsed.values.workspace, file: parsed.values.file,
+                    name: parsed.values.name, upload: parsed.values['upload-source'], openBrowser: !parsed.values['no-browser'], signal: controller.signal }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+                return;
+            }
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'name', 'upload-source', 'workspace', 'no-browser', 'after', 'search', 'status'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Source connection does not select an execution location or start a build.', 2);
+            }
+            const event = (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n'
+                : readable.split('\n').map(terminalText).join('\n') + '\n');
+            const options = { name: parsed.values.name, workspace: parsed.values.workspace, json, openBrowser: !parsed.values['no-browser'], signal: controller.signal };
+            if (args[1] === 'requests' && args.length === 2) {
+                if (parsed.values.name !== undefined || parsed.values['upload-source'] !== undefined)
+                    throw new CliError('arguments_invalid', 'Request history does not change a source capture or consent.', 2);
+                await sourceRequests({ ...options, action: 'list', after: parsed.values.after, search: parsed.values.search, status: parsed.values.status }, event);
+                return;
+            }
+            if (['status', 'resume', 'upload', 'withdraw'].includes(args[1]) && args.length === 3) {
+                if (['name', 'upload-source', 'after', 'search', 'status'].some(key => Object.hasOwn(parsed.values, key)))
+                    throw new CliError('arguments_invalid', 'A saved request cannot change its capture or consent. Use the exact request key.', 2);
+                await sourceRequests({ ...options, action: args[1], key: args[2] }, event);
+                return;
+            }
+            if (args.length > 2 || ['after', 'search', 'status'].some(key => Object.hasOwn(parsed.values, key)))
+                throw new CliError('arguments_invalid', 'Use firedrill connect [path] or a saved request command.', 2);
+            await connectSource({ ...options, root: args[1], upload: parsed.values['upload-source'] === true }, event);
+            return;
+        }
+        if (args[0] === 'sources') {
+            if (args.length > (['status', 'withdraw'].includes(args[1]) ? 3 : 2) || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'agent', 'file', 'request-key', 'page', 'search', 'upload-source', 'approve-change', 'no-browser'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use sources list|options|use|status|withdraw with agent, paging or reviewed selection options.', 2);
+            await sourceSetsCommand(args.slice(1), { json, workspace: parsed.values.workspace, agent: parsed.values.agent,
+                file: parsed.values.file, request: parsed.values['request-key'], page: parsed.values.page, search: parsed.values.search,
+                approve: parsed.values['upload-source'] === true, change: parsed.values['approve-change'], openBrowser: !parsed.values['no-browser'], signal: controller.signal }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        if (args[0] === 'source') {
+            if (args[1] === 'runtime') {
+                const action = args[2] ?? 'inspect';
+                if (!['inspect', 'install'].includes(action) || args.length > 3
+                    || Object.keys(parsed.values).some(key => !['json', 'help', 'approve-download'].includes(key))
+                    || action !== 'install' && Object.hasOwn(parsed.values, 'approve-download')) {
+                    throw new CliError('arguments_invalid', 'Use firedrill source runtime inspect or install [--approve-download]. This does not upload source or run an agent.', 2);
+                }
+                await sourceRuntimeCommand(action, { signal: controller.signal, approve: parsed.values['approve-download'] === true, interactive: !json }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : terminalText(readable) + '\n'));
+                return;
+            }
+            if (!['inspect', 'snapshot'].includes(args[1]) || args.length > 3)
+                throw new CliError('arguments_invalid', 'Use firedrill source inspect|snapshot [path]. Nothing is uploaded by these commands.', 2);
+            if (Object.keys(parsed.values).some(key => key !== 'json' && key !== 'help'))
+                throw new CliError('arguments_invalid', 'Local source capture accepts a path and --json only. Cloud and build options do not apply.', 2);
+            const result = await localSource(args[1], args[2] ?? process.cwd(), controller.signal, !json);
+            output(result, [`${result.files.length} files, ${result.expanded_bytes} bytes`, `Content: ${result.content_digest}`,
+                `Base commit: ${result.repository?.base_commit ?? 'Not available'}`, `Detected configuration names: ${result.variables.map(item => item.name).join(', ') || 'None'}`,
+                ...(result.repository ? [`Changes from base: ${result.changes_from_base.length}`] : []),
+                ...(result.local_snapshot_path ? [`Saved locally: ${result.local_snapshot_path}`] : []),
+                'No source, environment values or credentials were uploaded.', result.disclosure].map(terminalText).join('\n'));
+            return;
+        }
+        if (args[0] === 'onboarding') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'no-browser'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use onboarding show or onboarding open with optional --json or --no-browser.', 2);
+            await onboardingCommand(args.slice(1), { json, openBrowser: !parsed.values['no-browser'], signal: controller.signal }, output);
+            return;
+        }
+        if (args[0] === 'mcp') {
+            if (args.length !== 1 || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'agent'].includes(key))
+                || parsed.values.agent !== undefined && !['codex', 'claude', 'other'].includes(parsed.values.agent))
+                throw new CliError('arguments_invalid', 'Use firedrill mcp with optional --agent codex|claude|other, --workspace, --json or --no-browser.', 2);
+            await mcpConnection({ json, workspace: parsed.values.workspace, agent: parsed.values.agent,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal }, output);
+            return;
+        }
+        if (args[0] === 'signup' && args[1] === 'guide') {
+            if (args.length !== 2 || Object.keys(parsed.values).some(key => !['json', 'help'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use signup guide with optional --json. No account is created by reading the guide.', 2);
+            await registrationGuide(controller.signal, output);
+            return;
+        }
+        if (['login', 'signup'].includes(args[0]) && args.length === 1) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'no-browser', 'organization', 'open'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use signup or login with optional --organization, --json, --open and --no-browser.', 2);
+            const session = await login({ json, open: !parsed.values['no-browser'], explicitOpen, organization: parsed.values.organization, signal: controller.signal });
+            output(session, `Signed in as ${terminalText(session.user.email)}.`);
+            return;
+        }
+        if (args[0] === 'logout' && args.length === 1) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'local-only'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use firedrill logout with optional --local-only and --json. Nothing was signed out.', 2);
+            const result = await logout({ localOnly: parsed.values['local-only'] === true });
+            output(result, result.revoked ? 'Terminal access revoked. Saved credentials removed.' : 'Saved credentials removed. Cloud revocation is not confirmed. Revoke the session in Account settings.');
+            return;
+        }
+        if (args[0] === 'priority') {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'world', 'no-browser', 'page', 'search', 'status', 'request-key', 'approve-assessment'].includes(key)))
+                throw new CliError('arguments_invalid', 'Use world/workspace, the selected action’s paging options, original request key and explicit assessment consent.', 2);
+            await priorityCommand(args.slice(1), { json, workspace: parsed.values.workspace, world: parsed.values.world,
+                openBrowser: !parsed.values['no-browser'], signal: controller.signal, page: parsed.values.page, search: parsed.values.search,
+                status: parsed.values.status, request: parsed.values['request-key'], approve: parsed.values['approve-assessment'] }, (type, data, readable) => process.stdout.write(json ? JSON.stringify({ type, data }) + '\n' : readable.split('\n').map(terminalText).join('\n') + '\n'));
+            return;
+        }
+        const pageNumber = parsed.values.page ?? '1';
+        if (!/^[1-9][0-9]{0,8}$/.test(pageNumber) || (parsed.values.search?.length ?? 0) > 200)
+            throw new CliError('query_invalid', 'Use a valid page number and a search of up to 200 characters.', 2);
+        if (args[0] === 'workspace' && ['create', 'requests', 'request', 'withdraw'].includes(args[1])) {
+            // Creating a workspace from the terminal: the human approves its name and accepts the terms; nothing is inferred.
+            const allowed = args[1] === 'create' ? ['request-key', 'terms-version', 'privacy-version', 'approve-change', 'no-browser']
+                : args[1] === 'requests' ? ['page'] : args[1] === 'withdraw' ? ['approve-change'] : [];
+            if (Object.keys(parsed.values).some(key => !['json', 'help', ...allowed].includes(key)))
+                throw new CliError('arguments_invalid', 'Use workspace create [name] [--request-key <key> --terms-version <v> --privacy-version <v>] [--approve-change], workspace requests [--page <n>], workspace request <key> or workspace withdraw <key> [--approve-change].', 2);
+            const scope = await api('/api/auth/native/session', { signal: controller.signal });
+            await workspaceRegistrationCommand(args.slice(1), { json, owner: identifier(scope.user.id), openBrowser: !parsed.values['no-browser'],
+                signal: controller.signal, request: parsed.values['request-key'], termsVersion: parsed.values['terms-version'],
+                privacyVersion: parsed.values['privacy-version'], approve: parsed.values['approve-change'], page: parsed.values.page }, output);
+            return;
+        }
+        if (args[0] === 'workspace') {
+            const refresh = args[1] === 'refresh' && args.length === 2;
+            if (Object.keys(parsed.values).some(key => !['json', 'help', ...(refresh ? ['request-key'] : ['page', 'search', 'no-browser'])].includes(key)))
+                throw new CliError('arguments_invalid', 'Use page/search for workspace lists, or an original request key for workspace refresh.', 2);
+            const scope = await api('/api/auth/native/session', { signal: controller.signal });
+            const owner = identifier(scope.user.id);
+            if (args[1] === 'organizations' && args.length === 2) {
+                const page = await api(`/api/auth/native/organizations?page=${pageNumber}&q=${encodeURIComponent(parsed.values.search ?? '')}`, { actor: owner, signal: controller.signal });
+                output(page, [page.results.map(item => `${item.id}  ${terminalText(item.name)}`).join('\n') || 'No matching organizations.',
+                    'Use firedrill login --organization <id> for a new organization grant.'].join('\n'));
+                return;
+            }
+            if (refresh) {
+                const key = parsed.values['request-key'] ?? randomUUID();
+                if (!/^[A-Za-z0-9_-]{1,128}$/.test(key))
+                    throw new CliError('membership_discovery_request_invalid', 'Use the original workspace refresh request key.', 2);
+                if (json)
+                    output({ type: 'request_prepared', request_key: key }, '');
+                else
+                    process.stderr.write(`Recovery: firedrill workspace refresh --request-key ${key}\n`);
+                const result = await refreshWorkspaceAccess(owner, controller.signal, key);
+                output({ ...result, request_key: key }, result.state === 'running' ? 'Checking workspace access. Use firedrill workspace list to see available workspaces.' :
+                    result.state === 'completed' ? 'Workspace access refreshed.' : 'Workspace access needs another refresh. No workspace was selected.');
+                return;
+            }
+            if (args[1] === 'use' && args.length === 3) {
+                const session = await api('/api/auth/native/workspaces', { method: 'POST', body: { workspace_id: identifier(args[2]) }, actor: owner, signal: controller.signal });
+                output(session, `Workspace: ${terminalText(session.workspace?.name ?? 'Not selected')}`);
+                return;
+            }
+            if (args.length === 1 && process.stdin.isTTY && !json) {
+                const chosen = await chooseWorkspace(owner, controller.signal, !parsed.values['no-browser']);
+                const session = await api('/api/auth/native/workspaces', { method: 'POST', body: { workspace_id: chosen }, actor: owner, signal: controller.signal });
+                output(session, `Workspace: ${terminalText(session.workspace?.name ?? 'Not selected')}`);
+                return;
+            }
+            if (args.length === 1 || args[1] === 'list' && args.length === 2) {
+                const page = await api(`/api/auth/native/workspaces?page=${pageNumber}&q=${encodeURIComponent(parsed.values.search ?? '')}`, { actor: owner, signal: controller.signal });
+                const progress = page.membership_sync.state === 'running' ? 'Checking workspace access.' :
+                    page.membership_sync.state === 'attention_required' ? 'Access refresh did not finish. Use firedrill workspace refresh.' : '';
+                output(page, [page.results.map(item => `${item.id}  ${terminalText(item.name)}  ${terminalText(item.role)}`).join('\n') ||
+                        (progress ? '' : 'No matching workspaces.'), progress].filter(Boolean).join('\n'));
+                return;
+            }
+        }
+        if (args[0] === 'worlds' && ['new', 'creation', 'continue-creation', 'withdraw-creation'].includes(args[1])) {
+            if (args.length > 3 || Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'request-key', 'approve-change'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use worlds new [agent] or worlds creation|continue-creation|withdraw-creation <key>. Automation can pass --approve-change for a reviewed write.', 2);
+            }
+            const options = { json, workspace: parsed.values.workspace, openBrowser: !parsed.values['no-browser'],
+                request: parsed.values['request-key'], approve: parsed.values['approve-change'], signal: controller.signal };
+            if (args[1] === 'new')
+                await createWorld(options, output, args[2]);
+            else
+                await worldCreationCommand(args.slice(1), options, output);
+            return;
+        }
+        if (kinds.has(args[0]) && args.length <= 2) {
+            if (Object.keys(parsed.values).some(key => !['json', 'help', 'workspace', 'no-browser', 'page', 'search', 'world', 'agent', 'status', 'records'].includes(key))) {
+                throw new CliError('arguments_invalid', 'Use saved-directory search, scope, status and page options only.', 2);
+            }
+            if (args[1] && ['page', 'search', 'world', 'agent', 'status', 'records'].some(key => parsed.values[key] !== undefined)) {
+                throw new CliError('arguments_invalid', 'Directory filters apply to a list, not a single saved item.', 2);
+            }
+            if ((parsed.values.world && ['agents', 'worlds'].includes(args[0])) || (parsed.values.agent && args[0] === 'agents')) {
+                throw new CliError('arguments_invalid', 'Use --agent with worlds or their resources; --world applies to scenarios, personas, evaluations and simulations.', 2);
+            }
+            if (parsed.values.status && !/^[a-z][a-z0-9_]{0,31}$/.test(parsed.values.status))
+                throw new CliError('query_invalid', 'Use the saved item status from the directory.', 2);
+            if (parsed.values.records !== undefined && !['active', 'archived', 'all'].includes(parsed.values.records))
+                throw new CliError('query_invalid', 'Choose active, archived or all records.', 2);
+            const session = await api('/api/auth/native/session', { signal: controller.signal });
+            const workspace = parsed.values.workspace ?? session.workspace?.id;
+            if (!workspace)
+                throw new CliError('workspace_required', 'Run firedrill workspace or pass --workspace <id>.', 2);
+            const prefix = `/api/workspaces/${identifier(workspace)}/${args[0]}`;
+            if (args[1]) {
+                const result = await api(`${prefix}/${identifier(args[1])}`, { actor: session.user.id, signal: controller.signal });
+                output(result, `${terminalText(result.name)}\n${terminalText(result.status)}\n${terminalText(result.description ?? '')}`);
+                return;
+            }
+            const query = new URLSearchParams({ page: pageNumber, q: parsed.values.search ?? '', status: parsed.values.status ?? '' });
+            if (parsed.values.records !== undefined)
+                query.set('lifecycle', parsed.values.records);
+            if (parsed.values.world)
+                query.set('world', identifier(parsed.values.world));
+            if (parsed.values.agent)
+                query.set('agent', identifier(parsed.values.agent));
+            const result = await api(`${prefix}?${query}`, { actor: session.user.id, signal: controller.signal });
+            const rows = result.results.map(item => `${item.id}  ${terminalText(item.name)}  ${terminalText(item.status)}${item.world_name ? `  ${terminalText(item.world_name)}` : ''}${item.source_label ? `  ${terminalText(item.source_label)} (${terminalText(item.source_revision ?? '')})` : ''}${item.counts ? `  ${item.counts.worlds !== undefined ? `${item.counts.worlds} worlds, ` : ''}${item.counts.simulations} simulations` : ''}`);
+            output(result, (rows.join('\n') || 'No matching saved items.') + `\nPage ${result.page}, ${result.count} matching items.${result.next ? ` Use --page ${result.page + 1} with the same filters to continue.` : ''}`);
+            return;
+        }
+        throw new CliError('command_unknown', 'Use firedrill --help to choose a command.', 2);
+    }
+    catch (error) {
+        const canceled = controller.signal.aborted || error instanceof CliError && error.code === 'canceled';
+        const invalidArguments = error instanceof Error && 'code' in error && [
+            'ERR_PARSE_ARGS_UNKNOWN_OPTION', 'ERR_PARSE_ARGS_INVALID_OPTION_VALUE', 'ERR_PARSE_ARGS_UNEXPECTED_POSITIONAL',
+        ].includes(String(error.code));
+        const problem = canceled ? new CliError('canceled', 'Stopped. No pending operation is retried automatically.', 130)
+            : error instanceof CliError ? error : invalidArguments
+                ? new CliError('arguments_invalid', 'Unrecognized or invalid arguments. Use firedrill --help to see commands and options. No command was started.', 2)
+                : new CliError('command_failed', 'The command could not finish. No success is implied.');
+        process.stderr.write(json ? JSON.stringify({ type: 'error', error: { code: problem.code, message: problem.message },
+            ...(problem.code === 'workspace_setup_required' ? { action_required: 'create_or_select_workspace', browser_url: APP_ORIGIN + '/onboarding' } : {}) }) + '\n' : problem.message + '\n');
+        process.exitCode = problem.exitCode;
+    }
+    finally {
+        process.off('SIGINT', interrupt);
+        process.off('SIGTERM', interrupt);
+        process.off('SIGHUP', interrupt);
+        await companion?.close(signalled ? 'signal' : 'exit').catch(() => undefined);
+    }
+}