open-multi-agent-kit 1.0.0 → 1.2.2

package/CHANGELOG.md

@@ -1,6 +1,57 @@
 # Changelog
 
-## [Unreleased]
+## [1.2.2] - 2026-09-23
+
+### Fixed
+
+- Verified-run termination witness: the supervisor drain now witnesses PID-namespace init death instead of enumerating the host process table, and inconclusive probes retry until the cleanup deadline instead of settling terminal `unknown` early. Host-dependent false positives (zombie tasks keeping their ns link, unreadable same-uid tasks) no longer quarantine every sandboxed dispatch — this was the ubuntu-22.04 CI failure that blocked v1.2.1 publishing.
+- Test infrastructure: `./test.sh` runs the suite against an isolated agent directory (`OMK_CODING_AGENT_DIR` on a throwaway dir) instead of moving the live credential store aside for the whole run. Concurrent sessions no longer read an empty store, fall back to stale environment credentials, or have a freshly written store clobbered by the restore. The test environment preserves `OMK_CODING_AGENT_DIR` while scrubbing other `OMK_*` values so the isolation reaches spawned CLI processes.
+- Compaction no longer livelocks while an extension writes session state. A summary is now committed over `custom` entries appended while it was generated (for example pi-landstrip background-task snapshots every few seconds) when the file only grew by such entries; a message, model change, provenance entry, rewrite or branch move still discards it with `revision_mismatch`.
+- A compaction window may hold up to 65,536 entries (was 4,096), so a session dominated by extension state entries can compact instead of failing with `source.entryIds must be a bounded array`. An older binary cannot open a session whose compaction envelope lists more than 4,096 entries.
+
+## [1.2.1] - 2026-09-23
+
+### New Features
+
+- **Verified run authority wiring**: the authority store now runs on the real dispatch path (WP00–WP06) — durable admission leases, an exit proof that Git publication binds to, secret-path refusal, and a separate publish-start gate. See [Verified Run](docs/verified-run.md).
+- **Metadata-first session listing with separate search**: the session picker lists from metadata first and runs search as its own pass, so large session directories render immediately. See [Sessions](docs/sessions.md).
+- **Portable `mcp.json` paths**: `~/` and `$VAR` expand in server paths, so one config works across machines. See [MCP](docs/mcp.md).
+- **New model catalog**: Claude Opus 5.5 and GPT-6 Sol/Luna, with per-route thinking-level contracts so the selector only offers effort the route actually sends. See [Models](docs/models.md).
+
+### Added
+
+- Atomic commit planner public API in `omk-agent-core`. See [Atomic commit planning](docs/atomic-commit-planning.md).
+- Terminal output observation (`TerminalOutput`) exposed to interactive diagnostics. See [TUI](docs/tui.md).
+
+### Changed
+
+- The MCP manager is split into a connection queue and a runtime, with a startup concurrency cap so many servers connect without unbounded fan-out. See [MCP](docs/mcp.md).
+- Assistant message rendering caches content views, cutting render cost on long transcripts.
+- A cached skill catalog is reused only when its fingerprint is complete; otherwise it reloads. See [Skills](docs/skills.md).
+- SDK auxiliary modules and hooks public paths are reorganized (`package-resource-patterns`, `approval-api`, session-lifecycle types), and redundant development dependencies are removed.
+
+### Fixed
+
+- Verified-run publication boundaries: Git publication records ownership and binds the exit proof, refuses secret paths, treats a git-ref authority as authorization rather than a termination proof, blocks inherited hooks and config injection in the publishing Git, and preserves publish-path and authority-reuse semantics.
+- Shard settlement returns permits and waits for sibling task termination.
+- Compaction: prompts are rejected during manual compaction, pre-prompt compaction no longer continues, and replacement-model auth and cancellation handling are strengthened.
+- Coordination primitives and probability boundaries are tightened, with the metacognition contract updated. See [Metacognition](docs/metacognition.md).
+- Resource loading excludes directories (#7106), and an imported session is never overwritten (#8985).
+- The active turn settles before an in-memory fork (#8937).
+- Linux downloads the statically linked musl builds of `fd` and `ripgrep` (#9070), and image scanning walks past non-EXIF APP1 segments (#8616).
+- RPC bash no longer bypasses `user_bash` (#7214).
+- Read errors are not highlighted (#6731) and `stripAnsi` matches `strip-ansi`.
+- Fetch overrides are preserved, the stale hooks export and the DynamicBorder theme crash are fixed, and dependencies reinstall when `git clean` fails (#7570).
+- Share viewer shortcuts use browser-safe keys (#3374), and device-code login no longer opens a browser.
+- Session name changes are emitted to extensions.
+- Test environment: `Date.now` is monotonic so host wall-clock rollbacks cannot surface as `clock_anomaly` failures, and the model-registry fixture references live OpenRouter model ids with a catalog guard test.
+
+## [1.2.0] - 2026-09-20
+
+### Added
+
+- Parallel-session coordination kernel (`coordination/`): an admission broker that keeps a possibly-live effect's resource claims held until a trusted supervisor confirms termination — expiry, cancellation and authority restart are authorization events, not termination proofs — plus prefix-based claim conflict algebra, a publisher that admits a candidate only when its read versions, parent revision and receipt binding all still match, generation-tagged session lifecycle that discards a late init from a superseded generation and retains the handle when close fails, an operation lifecycle whose dispatch consumes a recorded observation rather than a re-interpreted instruction and re-evaluates the permit at the dispatch boundary, and conservative change-invalidation and frontier admission helpers.
+- Metacognition evidence primitives: finite-sample Clopper–Pearson risk bounds for automation gating (a point estimate never widens scope; zero trials is absent evidence, not zero risk), probability calibration with temperature scaling, Brier/log-loss/ECE reported with bin occupancy, a selective-execution gate that reports coverage beside risk and leaves risk undefined when nothing was admitted, observation validity that separates time decay from the change indicator and lets explicit age and generation bounds override the decay score, state packing that returns `incomplete-state` instead of silently dropping required evidence, cost- and latency-aware route selection with safety as a hard filter outside the utility, and three-valued verification where `unknown` is never negated into `true` and evidence level is labelled by the strongest witness actually held.
 
 ## [1.0.0] - 2026-09-18
 

package/README.md

@@ -47,7 +47,7 @@ OMK stores user configuration under `~/.omk/agent/` and project configuration un
 Install `omk-book-to-skill` to compile documents into reusable skills without adding Python extractors to OMK core:
 
 ```bash
-omk install npm:omk-book-to-skill@1.0.0
+omk install npm:omk-book-to-skill@1.2.2
 ```
 
 It provides compile, update, and verification commands plus a local SHA-256 provenance manifest. See [Book to Skill](https://github.com/dmae97/omk/blob/main/packages/coding-agent/docs/book-to-skill.md).
@@ -258,7 +258,7 @@ npm test
 
 See [Development](https://github.com/dmae97/omk/blob/main/packages/coding-agent/docs/development.md) and [CONTRIBUTING.md](https://github.com/dmae97/omk/blob/main/CONTRIBUTING.md).
 
-Release notes: [v1.0.0](https://github.com/dmae97/omk/blob/main/.github/RELEASE_NOTES_v1.0.0.md).
+Release notes: [v1.2.2](https://github.com/dmae97/omk/blob/main/.github/RELEASE_NOTES_v1.2.2.md).
 
 ## License
 

package/dist/approval-api.d.ts

@@ -0,0 +1,5 @@
+export { type ApprovalContentDigest, type ApprovalDecision, type ApprovalPlanDigest, type ApprovalReceipt, type ApprovalReceiptCore, computeApprovalContentDigest, computeApprovalReceiptCoreSha256, createApprovalReceipt, parseApprovalReceipt, serializeApprovalReceipt, validateApprovalReceipt, } from "./approvals/approval-receipt.ts";
+export { ApprovalReceiptStore, type ApprovalReceiptWriteResult } from "./approvals/approval-receipt-store.ts";
+export { type ApprovalExecutionBinding, type ApprovalVerificationFailure, type ApprovalVerificationResult, verifyApprovalForExecution, } from "./approvals/approval-verifier.ts";
+export { type ApprovalEventBus, PLANNOTATOR_REQUEST_CHANNEL, PLANNOTATOR_REVIEW_RESULT_CHANNEL, PlannotatorApprovalBridge, type PlannotatorApprovalBridgeOptions, type PlanReviewCorrelation, type PlanReviewRequest, type ReviewResultOutcome, } from "./approvals/plannotator-approval-bridge.ts";
+//# sourceMappingURL=approval-api.d.ts.map

package/dist/approval-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-api.d.ts","sourceRoot":"","sources":["../src/approval-api.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,4BAA4B,EAC5B,gCAAgC,EAChC,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,KAAK,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAC9G,OAAO,EACN,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,KAAK,gBAAgB,EACrB,2BAA2B,EAC3B,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACxB,MAAM,4CAA4C,CAAC","sourcesContent":["export {\n\ttype ApprovalContentDigest,\n\ttype ApprovalDecision,\n\ttype ApprovalPlanDigest,\n\ttype ApprovalReceipt,\n\ttype ApprovalReceiptCore,\n\tcomputeApprovalContentDigest,\n\tcomputeApprovalReceiptCoreSha256,\n\tcreateApprovalReceipt,\n\tparseApprovalReceipt,\n\tserializeApprovalReceipt,\n\tvalidateApprovalReceipt,\n} from \"./approvals/approval-receipt.ts\";\nexport { ApprovalReceiptStore, type ApprovalReceiptWriteResult } from \"./approvals/approval-receipt-store.ts\";\nexport {\n\ttype ApprovalExecutionBinding,\n\ttype ApprovalVerificationFailure,\n\ttype ApprovalVerificationResult,\n\tverifyApprovalForExecution,\n} from \"./approvals/approval-verifier.ts\";\nexport {\n\ttype ApprovalEventBus,\n\tPLANNOTATOR_REQUEST_CHANNEL,\n\tPLANNOTATOR_REVIEW_RESULT_CHANNEL,\n\tPlannotatorApprovalBridge,\n\ttype PlannotatorApprovalBridgeOptions,\n\ttype PlanReviewCorrelation,\n\ttype PlanReviewRequest,\n\ttype ReviewResultOutcome,\n} from \"./approvals/plannotator-approval-bridge.ts\";\n"]}

package/dist/approval-api.js

@@ -0,0 +1,5 @@
+export { computeApprovalContentDigest, computeApprovalReceiptCoreSha256, createApprovalReceipt, parseApprovalReceipt, serializeApprovalReceipt, validateApprovalReceipt, } from "./approvals/approval-receipt.js";
+export { ApprovalReceiptStore } from "./approvals/approval-receipt-store.js";
+export { verifyApprovalForExecution, } from "./approvals/approval-verifier.js";
+export { PLANNOTATOR_REQUEST_CHANNEL, PLANNOTATOR_REVIEW_RESULT_CHANNEL, PlannotatorApprovalBridge, } from "./approvals/plannotator-approval-bridge.js";
+//# sourceMappingURL=approval-api.js.map

package/dist/approval-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-api.js","sourceRoot":"","sources":["../src/approval-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAMN,4BAA4B,EAC5B,gCAAgC,EAChC,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAmC,MAAM,uCAAuC,CAAC;AAC9G,OAAO,EAIN,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEN,2BAA2B,EAC3B,iCAAiC,EACjC,yBAAyB,GAKzB,MAAM,4CAA4C,CAAC","sourcesContent":["export {\n\ttype ApprovalContentDigest,\n\ttype ApprovalDecision,\n\ttype ApprovalPlanDigest,\n\ttype ApprovalReceipt,\n\ttype ApprovalReceiptCore,\n\tcomputeApprovalContentDigest,\n\tcomputeApprovalReceiptCoreSha256,\n\tcreateApprovalReceipt,\n\tparseApprovalReceipt,\n\tserializeApprovalReceipt,\n\tvalidateApprovalReceipt,\n} from \"./approvals/approval-receipt.ts\";\nexport { ApprovalReceiptStore, type ApprovalReceiptWriteResult } from \"./approvals/approval-receipt-store.ts\";\nexport {\n\ttype ApprovalExecutionBinding,\n\ttype ApprovalVerificationFailure,\n\ttype ApprovalVerificationResult,\n\tverifyApprovalForExecution,\n} from \"./approvals/approval-verifier.ts\";\nexport {\n\ttype ApprovalEventBus,\n\tPLANNOTATOR_REQUEST_CHANNEL,\n\tPLANNOTATOR_REVIEW_RESULT_CHANNEL,\n\tPlannotatorApprovalBridge,\n\ttype PlannotatorApprovalBridgeOptions,\n\ttype PlanReviewCorrelation,\n\ttype PlanReviewRequest,\n\ttype ReviewResultOutcome,\n} from \"./approvals/plannotator-approval-bridge.ts\";\n"]}

package/dist/cli/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,wBAAgB,SAAS,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,GAAG,IAAI,CAkMhE","sourcesContent":["import chalk from \"chalk\";\nimport { APP_NAME, CONFIG_DIR_NAME, ENV_AGENT_DIR, ENV_SESSION_DIR } from \"../config.ts\";\nimport type { ExtensionFlag } from \"../core/extensions/types.ts\";\n\nexport function printHelp(extensionFlags?: ExtensionFlag[]): void {\n\tlet extensionFlagsText = \"\";\n\tif (extensionFlags && extensionFlags.length > 0) {\n\t\textensionFlagsText = `\\n${chalk.bold(\"Extension CLI Flags:\")}\\n${extensionFlags\n\t\t\t.map((flag) => {\n\t\t\t\tconst value = flag.type === \"string\" ? \" <value>\" : \"\";\n\t\t\t\tconst description = flag.description ?? `Registered by ${flag.extensionPath}`;\n\t\t\t\treturn `  --${flag.name}${value}`.padEnd(30) + description;\n\t\t\t})\n\t\t\t.join(\"\\n\")}\\n`;\n\t}\n\t// CLI help is intentional stdout, not application debug logging.\n\t// pi-lens-ignore: no-console-except-error\n\tconsole.log(`${chalk.bold(APP_NAME)} - AI coding assistant with read, bash, edit, write tools\n\n${chalk.bold(\"Usage:\")}\n  ${APP_NAME} [options] [@files...] [messages...]\n\n${chalk.bold(\"Commands:\")}\n  ${APP_NAME} init --global [--dry-run] Create missing user context documents without overwriting settings\n  ${APP_NAME} install <source> [-l]     Install extension source and add to settings\n  ${APP_NAME} remove <source> [-l]      Remove extension source from settings\n  ${APP_NAME} uninstall <source> [-l]   Alias for remove\n  ${APP_NAME} update [source|self|omk]  Update OMK and installed extensions\n  ${APP_NAME} list                      List installed extensions from settings\n  ${APP_NAME} package doctor <source>   Diagnose omk/pi manifest and runtime compatibility as JSON\n  ${APP_NAME} config                    Open TUI to enable/disable package resources\n  ${APP_NAME} quota                     Manage CodexBar quota connector and summaries\n  ${APP_NAME} provider doctor <id>      Diagnose a provider as sanitized JSON (--probe-model adds an\n                                 opt-in Level-2 generative probe that may incur provider costs)\n  ${APP_NAME} session doctor            Inspect or safely repair one session (--session, --repair, --dry-run)\n  ${APP_NAME} doctor resources [--json] [--report] Inspect current pressure or aggregate local observations\n  ${APP_NAME} doctor adaptorch [--json]  Verify ADAPTORCH_API_KEY reaches the AdaptOrch API (0 ok, 1 unset, 2 failed)\n  ${APP_NAME} router-feedback compile-bias  Compile this repository's bounded router bias snapshot\n  ${APP_NAME} <command> --help          Show help for install/remove/uninstall/update/list\n\n${chalk.bold(\"Options:\")}\n  --provider <name>              Provider name (default: google)\n  --model <pattern>              Model pattern or ID (supports \"provider/id\" and optional \":<thinking>\")\n  --model-contract <file>        Pin an optional JSON model/effort/output dispatch policy\n  --api-key <key>                API key (defaults to env vars)\n  --system-prompt <text>         System prompt (default: coding assistant prompt)\n  --append-system-prompt <text>  Append text or file contents to the system prompt (can be used multiple times)\n  --mode <mode>                  Output mode: text (default), json, rpc, or acp (conversation-only)\n  --print, -p                    Non-interactive mode: process prompt and exit\n  --continue, -c                 Continue previous session\n  --resume, -r                   Select a session to resume\n  --session <path|id>            Use specific session file or partial UUID\n  --session-id <id>              Use exact project session ID, creating it if missing\n  --fork <path|id>               Fork specific session file or partial UUID into a new session\n  --session-dir <dir>            Directory for session storage and lookup\n  --no-session                   Don't save session (ephemeral)\n  --name, -n <name>              Set session display name\n  --models <patterns>            Comma-separated model patterns for Ctrl+P cycling\n                                 Supports globs (anthropic/*, *sonnet*) and fuzzy matching\n  --no-tools, -nt                Disable all tools by default (built-in and extension)\n  --no-builtin-tools, -nbt       Disable built-in tools by default but keep extension/custom tools enabled\n  --tools, -t <tools>            Comma-separated allowlist of tool names to enable\n                                 Applies to built-in, extension, and custom tools\n  --exclude-tools, -xt <tools>   Comma-separated denylist of tool names to disable\n                                 Applies to built-in, extension, and custom tools\n  --thinking <level>             Set thinking level: off, minimal, low, medium, high, xhigh, max, ultra\n  --extension, -e <path>         Load an extension file (can be used multiple times)\n  --no-extensions, -ne           Disable extension discovery (explicit -e paths still work)\n  --skill <path>                 Load a skill file or directory (can be used multiple times)\n  --no-skills, -ns               Disable skills discovery and loading\n  --prompt-template <path>       Load a prompt template file or directory (can be used multiple times)\n  --no-prompt-templates, -np     Disable prompt template discovery and loading\n  --theme <path>                 Load a theme file or directory (can be used multiple times)\n  --no-themes                    Disable theme discovery and loading\n  --no-context-files, -nc        Disable AGENTS.md and CLAUDE.md discovery and loading\n  --export <file>                Export session file to HTML and exit\n  --list-models [search]         List available models (with optional fuzzy search)\n  --verbose                      Force verbose startup (overrides quietStartup setting)\n  --offline                      Disable startup network operations (same as OMK_OFFLINE=1)\n  --help, -h                     Show this help\n  --version, -v                  Show version number\n\nExtensions can register additional flags (e.g., --plan from plan-mode extension).${extensionFlagsText}\n\n${chalk.bold(\"Examples:\")}\n  # Interactive mode\n  ${APP_NAME}\n\n  # Interactive mode with initial prompt\n  ${APP_NAME} \"List all .ts files in src/\"\n\n  # Include files in initial message\n  ${APP_NAME} @prompt.md @image.png \"What color is the sky?\"\n\n  # Non-interactive mode (process and exit)\n  ${APP_NAME} -p \"List all .ts files in src/\"\n\n  # Multiple messages (interactive)\n  ${APP_NAME} \"Read package.json\" \"What dependencies do we have?\"\n\n  # Continue previous session\n  ${APP_NAME} --continue \"What did we discuss?\"\n\n  # Start a named session\n  ${APP_NAME} --name \"Refactor auth module\"\n\n  # Use different model\n  ${APP_NAME} --provider openai --model gpt-4o-mini \"Help me refactor this code\"\n\n  # Use model with provider prefix (no --provider needed)\n  ${APP_NAME} --model openai/gpt-4o \"Help me refactor this code\"\n\n  # Use model with thinking level shorthand\n  ${APP_NAME} --model sonnet:high \"Solve this complex problem\"\n\n  # Limit model cycling to specific models\n  ${APP_NAME} --models claude-sonnet,claude-haiku,gpt-4o\n\n  # Limit to a specific provider with glob pattern\n  ${APP_NAME} --models \"github-copilot/*\"\n\n  # Cycle models with fixed thinking levels\n  ${APP_NAME} --models sonnet:high,haiku:low\n\n  # Start with a specific thinking level\n  ${APP_NAME} --thinking high \"Solve this complex problem\"\n\n  # Read-only mode (no file modifications possible)\n  ${APP_NAME} --tools read,grep,find,ls -p \"Review the code in src/\"\n\n  # Disable one tool while keeping the rest available\n  ${APP_NAME} --exclude-tools ask_question\n\n  # Export a session file to HTML\n  ${APP_NAME} --export ~/${CONFIG_DIR_NAME}/agent/sessions/--path--/session.jsonl\n  ${APP_NAME} --export session.jsonl output.html\n\n${chalk.bold(\"Environment Variables:\")}\n  ANTHROPIC_API_KEY                - Anthropic Claude API key\n  ANTHROPIC_OAUTH_TOKEN            - Anthropic OAuth token (alternative to API key)\n  ANT_LING_API_KEY                 - Ant Ling API key\n  OPENAI_API_KEY                   - OpenAI GPT API key\n  AZURE_OPENAI_API_KEY             - Azure OpenAI API key\n  AZURE_OPENAI_BASE_URL            - Azure OpenAI/Cognitive Services base URL (e.g. https://{resource}.openai.azure.com)\n  AZURE_OPENAI_RESOURCE_NAME       - Azure OpenAI resource name (alternative to base URL)\n  AZURE_OPENAI_API_VERSION         - Azure OpenAI API version (default: v1)\n  AZURE_OPENAI_DEPLOYMENT_NAME_MAP - Azure OpenAI model=deployment map (comma-separated)\n  DEEPSEEK_API_KEY                 - DeepSeek API key\n  DEVIN_API_KEY                    - Devin CLI subscription session token (or /login devin)\n  NVIDIA_API_KEY                   - NVIDIA NIM API key\n  GEMINI_API_KEY                   - Google Gemini API key\n  GROQ_API_KEY                     - Groq API key\n  CEREBRAS_API_KEY                 - Cerebras API key\n  XAI_API_KEY                      - xAI Grok API key\n  FIREWORKS_API_KEY                - Fireworks API key\n  TOGETHER_API_KEY                 - Together AI API key\n  OPENROUTER_API_KEY               - OpenRouter API key\n  AI_GATEWAY_API_KEY               - Vercel AI Gateway API key\n  ZAI_API_KEY                      - ZAI API key\n  ZAI_CODING_CN_API_KEY            - ZAI Coding Plan API key (China)\n  MISTRAL_API_KEY                  - Mistral API key\n  MINIMAX_API_KEY                  - MiniMax API key\n  MOONSHOT_API_KEY                 - Moonshot AI API key\n  META_API_KEY                     - Meta Model API key (Muse Spark); META_MODEL_API_KEY/MODEL_API_KEY also read\n  OPENCODE_API_KEY                 - OpenCode Zen/OpenCode Go API key\n  KIMI_API_KEY                     - Kimi For Coding API key\n  CLOUDFLARE_API_KEY               - Cloudflare API token (Workers AI and AI Gateway)\n  CLOUDFLARE_ACCOUNT_ID            - Cloudflare account id (required for both)\n  CLOUDFLARE_GATEWAY_ID            - Cloudflare AI Gateway slug (required for AI Gateway)\n  XIAOMI_API_KEY                   - Xiaomi MiMo API key (api.xiaomimimo.com billing)\n  XIAOMI_TOKEN_PLAN_CN_API_KEY     - Xiaomi MiMo Token Plan API key (China region)\n  XIAOMI_TOKEN_PLAN_AMS_API_KEY    - Xiaomi MiMo Token Plan API key (Amsterdam region)\n  XIAOMI_TOKEN_PLAN_SGP_API_KEY    - Xiaomi MiMo Token Plan API key (Singapore region)\n  ZYLOO_API_KEY                    - Zyloo API key\n  AWS_PROFILE                      - AWS profile for Amazon Bedrock\n  AWS_ACCESS_KEY_ID                - AWS access key for Amazon Bedrock\n  AWS_SECRET_ACCESS_KEY            - AWS secret key for Amazon Bedrock\n  AWS_BEARER_TOKEN_BEDROCK         - Bedrock API key (bearer token)\n  AWS_REGION                       - AWS region for Amazon Bedrock (e.g., us-east-1)\n  ${ENV_AGENT_DIR.padEnd(32)} - Config directory (default: ~/${CONFIG_DIR_NAME}/agent)\n  ${ENV_SESSION_DIR.padEnd(32)} - Session storage directory (overridden by --session-dir)\n  OMK_PACKAGE_DIR                  - Override package directory (for Nix/Guix store paths)\n  OMK_TOOL_SCHEDULER               - Tool scheduler override: dag-v2 or waves-v1 rollback\n  OMK_OFFLINE                      - Disable startup network operations when set to 1/true/yes\n  OMK_TELEMETRY                    - Override install telemetry when set to 1/true/yes or 0/false/no\n  OMK_SHARE_VIEWER_URL             - Base URL for /share command (default: https://omk.dev/session/)\n  ADAPTORCH_API_KEY                - AdaptOrch API key (optional; enables the doctor adaptorch check)\n  ADAPTORCH_API_URL                - AdaptOrch API base URL (default: https://api.adaptorch.com)\n\n${chalk.bold(\"Built-in Tool Names:\")}\n  read   - Read file contents\n  bash   - Execute bash commands\n  edit   - Edit files with find/replace\n  write  - Write files (creates/overwrites)\n  grep   - Search file contents (read-only, off by default)\n  find   - Find files by glob pattern (read-only, off by default)\n  ls     - List directory contents (read-only, off by default)\n`);\n}\n"]}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,wBAAgB,SAAS,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,GAAG,IAAI,CAmMhE","sourcesContent":["import chalk from \"chalk\";\nimport { APP_NAME, CONFIG_DIR_NAME, ENV_AGENT_DIR, ENV_SESSION_DIR } from \"../config.ts\";\nimport type { ExtensionFlag } from \"../core/extensions/types.ts\";\n\nexport function printHelp(extensionFlags?: ExtensionFlag[]): void {\n\tlet extensionFlagsText = \"\";\n\tif (extensionFlags && extensionFlags.length > 0) {\n\t\textensionFlagsText = `\\n${chalk.bold(\"Extension CLI Flags:\")}\\n${extensionFlags\n\t\t\t.map((flag) => {\n\t\t\t\tconst value = flag.type === \"string\" ? \" <value>\" : \"\";\n\t\t\t\tconst description = flag.description ?? `Registered by ${flag.extensionPath}`;\n\t\t\t\treturn `  --${flag.name}${value}`.padEnd(30) + description;\n\t\t\t})\n\t\t\t.join(\"\\n\")}\\n`;\n\t}\n\t// CLI help is intentional stdout, not application debug logging.\n\t// pi-lens-ignore: no-console-except-error\n\tconsole.log(`${chalk.bold(APP_NAME)} - AI coding assistant with read, bash, edit, write tools\n\n${chalk.bold(\"Usage:\")}\n  ${APP_NAME} [options] [@files...] [messages...]\n\n${chalk.bold(\"Commands:\")}\n  ${APP_NAME} init --global [--dry-run] Create missing user context documents without overwriting settings\n  ${APP_NAME} install <source> [-l]     Install extension source and add to settings\n  ${APP_NAME} remove <source> [-l]      Remove extension source from settings\n  ${APP_NAME} uninstall <source> [-l]   Alias for remove\n  ${APP_NAME} update [source|self|omk]  Update OMK and installed extensions\n  ${APP_NAME} list                      List installed extensions from settings\n  ${APP_NAME} package doctor <source>   Diagnose omk/pi manifest and runtime compatibility as JSON\n  ${APP_NAME} config                    Open TUI to enable/disable package resources\n  ${APP_NAME} quota                     Manage CodexBar quota connector and summaries\n  ${APP_NAME} provider doctor <id>      Diagnose a provider as sanitized JSON (--probe-model adds an\n                                 opt-in Level-2 generative probe that may incur provider costs)\n  ${APP_NAME} session doctor            Inspect or safely repair one session (--session, --repair, --dry-run)\n  ${APP_NAME} doctor resources [--json] [--report] Inspect current pressure or aggregate local observations\n  ${APP_NAME} doctor adaptorch [--json]  Verify ADAPTORCH_API_KEY reaches the AdaptOrch API (0 ok, 1 unset, 2 failed)\n  ${APP_NAME} router-feedback compile-bias  Compile this repository's bounded router bias snapshot\n  ${APP_NAME} <command> --help          Show help for install/remove/uninstall/update/list\n\n${chalk.bold(\"Options:\")}\n  --provider <name>              Provider name (default: google)\n  --model <pattern>              Model pattern or ID (supports \"provider/id\" and optional \":<thinking>\")\n  --model-contract <file>        Pin an optional JSON model/effort/output dispatch policy\n  --api-key <key>                API key (defaults to env vars)\n  --system-prompt <text>         System prompt (default: coding assistant prompt)\n  --append-system-prompt <text>  Append text or file contents to the system prompt (can be used multiple times)\n  --mode <mode>                  Output mode: text (default), json, rpc, or acp (conversation-only)\n  --print, -p                    Non-interactive mode: process prompt and exit\n  --continue, -c                 Continue previous session\n  --resume, -r                   Select a session to resume\n  --session <path|id>            Use specific session file or partial UUID\n  --session-id <id>              Use exact project session ID, creating it if missing\n  --fork <path|id>               Fork specific session file or partial UUID into a new session\n  --session-dir <dir>            Directory for session storage and lookup\n  --no-session                   Don't save session (ephemeral)\n  --name, -n <name>              Set session display name\n  --models <patterns>            Comma-separated model patterns for Ctrl+P cycling\n                                 Supports globs (anthropic/*, *sonnet*) and fuzzy matching\n  --no-tools, -nt                Disable all tools by default (built-in and extension)\n  --no-builtin-tools, -nbt       Disable built-in tools by default but keep extension/custom tools enabled\n  --tools, -t <tools>            Comma-separated allowlist of tool names to enable\n                                 Applies to built-in, extension, and custom tools\n  --exclude-tools, -xt <tools>   Comma-separated denylist of tool names to disable\n                                 Applies to built-in, extension, and custom tools\n  --thinking <level>             Set thinking level: off, minimal, low, medium, high, xhigh, max, ultra\n  --extension, -e <path>         Load an extension file (can be used multiple times)\n  --no-extensions, -ne           Disable extension discovery (explicit -e paths still work)\n  --skill <path>                 Load a skill file or directory (can be used multiple times)\n  --no-skills, -ns               Disable skills discovery and loading\n  --prompt-template <path>       Load a prompt template file or directory (can be used multiple times)\n  --no-prompt-templates, -np     Disable prompt template discovery and loading\n  --theme <path>                 Load a theme file or directory (can be used multiple times)\n  --no-themes                    Disable theme discovery and loading\n  --no-context-files, -nc        Disable AGENTS.md and CLAUDE.md discovery and loading\n  --export <file>                Export session file to HTML and exit\n  --list-models [search]         List available models (with optional fuzzy search)\n  --verbose                      Force verbose startup (overrides quietStartup setting)\n  --offline                      Disable startup network operations (same as OMK_OFFLINE=1)\n  --help, -h                     Show this help\n  --version, -v                  Show version number\n\nExtensions can register additional flags (e.g., --plan from plan-mode extension).${extensionFlagsText}\n\n${chalk.bold(\"Examples:\")}\n  # Interactive mode\n  ${APP_NAME}\n\n  # Interactive mode with initial prompt\n  ${APP_NAME} \"List all .ts files in src/\"\n\n  # Include files in initial message\n  ${APP_NAME} @prompt.md @image.png \"What color is the sky?\"\n\n  # Non-interactive mode (process and exit)\n  ${APP_NAME} -p \"List all .ts files in src/\"\n\n  # Multiple messages (interactive)\n  ${APP_NAME} \"Read package.json\" \"What dependencies do we have?\"\n\n  # Continue previous session\n  ${APP_NAME} --continue \"What did we discuss?\"\n\n  # Start a named session\n  ${APP_NAME} --name \"Refactor auth module\"\n\n  # Use different model\n  ${APP_NAME} --provider openai --model gpt-4o-mini \"Help me refactor this code\"\n\n  # Use model with provider prefix (no --provider needed)\n  ${APP_NAME} --model openai/gpt-4o \"Help me refactor this code\"\n\n  # Use model with thinking level shorthand\n  ${APP_NAME} --model sonnet:high \"Solve this complex problem\"\n\n  # Limit model cycling to specific models\n  ${APP_NAME} --models claude-sonnet,claude-haiku,gpt-4o\n\n  # Limit to a specific provider with glob pattern\n  ${APP_NAME} --models \"github-copilot/*\"\n\n  # Cycle models with fixed thinking levels\n  ${APP_NAME} --models sonnet:high,haiku:low\n\n  # Start with a specific thinking level\n  ${APP_NAME} --thinking high \"Solve this complex problem\"\n\n  # Read-only mode (no file modifications possible)\n  ${APP_NAME} --tools read,grep,find,ls -p \"Review the code in src/\"\n\n  # Disable one tool while keeping the rest available\n  ${APP_NAME} --exclude-tools ask_question\n\n  # Export a session file to HTML\n  ${APP_NAME} --export ~/${CONFIG_DIR_NAME}/agent/sessions/--path--/session.jsonl\n  ${APP_NAME} --export session.jsonl output.html\n\n${chalk.bold(\"Environment Variables:\")}\n  ANTHROPIC_API_KEY                - Anthropic Claude API key\n  ANTHROPIC_OAUTH_TOKEN            - Anthropic OAuth token (alternative to API key)\n  ANT_LING_API_KEY                 - Ant Ling API key\n  OPENAI_API_KEY                   - OpenAI GPT API key\n  AZURE_OPENAI_API_KEY             - Azure OpenAI API key\n  AZURE_OPENAI_BASE_URL            - Azure OpenAI/Cognitive Services base URL (e.g. https://{resource}.openai.azure.com)\n  AZURE_OPENAI_RESOURCE_NAME       - Azure OpenAI resource name (alternative to base URL)\n  AZURE_OPENAI_API_VERSION         - Azure OpenAI API version (default: v1)\n  AZURE_OPENAI_DEPLOYMENT_NAME_MAP - Azure OpenAI model=deployment map (comma-separated)\n  DEEPSEEK_API_KEY                 - DeepSeek API key\n  DEVIN_API_KEY                    - Devin CLI subscription session token (or /login devin)\n  NVIDIA_API_KEY                   - NVIDIA NIM API key\n  GEMINI_API_KEY                   - Google Gemini API key\n  GROQ_API_KEY                     - Groq API key\n  CEREBRAS_API_KEY                 - Cerebras API key\n  XAI_API_KEY                      - xAI Grok API key\n  FIREWORKS_API_KEY                - Fireworks API key\n  TOGETHER_API_KEY                 - Together AI API key\n  OPENROUTER_API_KEY               - OpenRouter API key\n  AI_GATEWAY_API_KEY               - Vercel AI Gateway API key\n  ZAI_API_KEY                      - ZAI API key\n  ZAI_CODING_CN_API_KEY            - ZAI Coding Plan API key (China)\n  MISTRAL_API_KEY                  - Mistral API key\n  MINIMAX_API_KEY                  - MiniMax API key\n  MOONSHOT_API_KEY                 - Moonshot AI API key\n  META_API_KEY                     - Meta Model API key (Muse Spark); META_MODEL_API_KEY/MODEL_API_KEY also read\n  OPENCODE_API_KEY                 - OpenCode Zen/OpenCode Go API key\n  KIMI_API_KEY                     - Kimi For Coding API key\n  WORKBUDDY_API_KEY                - WorkBuddy (Tencent CodeBuddy) plan key\n  CLOUDFLARE_API_KEY               - Cloudflare API token (Workers AI and AI Gateway)\n  CLOUDFLARE_ACCOUNT_ID            - Cloudflare account id (required for both)\n  CLOUDFLARE_GATEWAY_ID            - Cloudflare AI Gateway slug (required for AI Gateway)\n  XIAOMI_API_KEY                   - Xiaomi MiMo API key (api.xiaomimimo.com billing)\n  XIAOMI_TOKEN_PLAN_CN_API_KEY     - Xiaomi MiMo Token Plan API key (China region)\n  XIAOMI_TOKEN_PLAN_AMS_API_KEY    - Xiaomi MiMo Token Plan API key (Amsterdam region)\n  XIAOMI_TOKEN_PLAN_SGP_API_KEY    - Xiaomi MiMo Token Plan API key (Singapore region)\n  ZYLOO_API_KEY                    - Zyloo API key\n  AWS_PROFILE                      - AWS profile for Amazon Bedrock\n  AWS_ACCESS_KEY_ID                - AWS access key for Amazon Bedrock\n  AWS_SECRET_ACCESS_KEY            - AWS secret key for Amazon Bedrock\n  AWS_BEARER_TOKEN_BEDROCK         - Bedrock API key (bearer token)\n  AWS_REGION                       - AWS region for Amazon Bedrock (e.g., us-east-1)\n  ${ENV_AGENT_DIR.padEnd(32)} - Config directory (default: ~/${CONFIG_DIR_NAME}/agent)\n  ${ENV_SESSION_DIR.padEnd(32)} - Session storage directory (overridden by --session-dir)\n  OMK_PACKAGE_DIR                  - Override package directory (for Nix/Guix store paths)\n  OMK_TOOL_SCHEDULER               - Tool scheduler override: dag-v2 or waves-v1 rollback\n  OMK_OFFLINE                      - Disable startup network operations when set to 1/true/yes\n  OMK_TELEMETRY                    - Override install telemetry when set to 1/true/yes or 0/false/no\n  OMK_SHARE_VIEWER_URL             - Base URL for /share command (default: https://omk.dev/session/)\n  ADAPTORCH_API_KEY                - AdaptOrch API key (optional; enables the doctor adaptorch check)\n  ADAPTORCH_API_URL                - AdaptOrch API base URL (default: https://api.adaptorch.com)\n\n${chalk.bold(\"Built-in Tool Names:\")}\n  read   - Read file contents\n  bash   - Execute bash commands\n  edit   - Edit files with find/replace\n  write  - Write files (creates/overwrites)\n  grep   - Search file contents (read-only, off by default)\n  find   - Find files by glob pattern (read-only, off by default)\n  ls     - List directory contents (read-only, off by default)\n`);\n}\n"]}

package/dist/cli/help.js

@@ -162,6 +162,7 @@ ${chalk.bold("Environment Variables:")}
   META_API_KEY                     - Meta Model API key (Muse Spark); META_MODEL_API_KEY/MODEL_API_KEY also read
   OPENCODE_API_KEY                 - OpenCode Zen/OpenCode Go API key
   KIMI_API_KEY                     - Kimi For Coding API key
+  WORKBUDDY_API_KEY                - WorkBuddy (Tencent CodeBuddy) plan key
   CLOUDFLARE_API_KEY               - Cloudflare API token (Workers AI and AI Gateway)
   CLOUDFLARE_ACCOUNT_ID            - Cloudflare account id (required for both)
   CLOUDFLARE_GATEWAY_ID            - Cloudflare AI Gateway slug (required for AI Gateway)

package/dist/cli/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGzF,MAAM,UAAU,SAAS,CAAC,cAAgC,EAAQ;IACjE,IAAI,kBAAkB,GAAG,EAAE,CAAC;IAC5B,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,kBAAkB,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,cAAc;aAC7E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9E,OAAO,OAAO,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;QAAA,CAC3D,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IACD,iEAAiE;IACjE,0CAA0C;IAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;;EAElC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClB,QAAQ;;EAEV,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;IACrB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;;IAER,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;;EAEV,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mFA0C2D,kBAAkB;;EAEnG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;;IAErB,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ,eAAe,eAAe;IACtC,QAAQ;;EAEV,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0ClC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,mCAAmC,eAAe;IAC1E,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;;;;;;;;;EAS5B,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;;;;;;;;CAQnC,CAAC,CAAC;AAAA,CACF","sourcesContent":["import chalk from \"chalk\";\nimport { APP_NAME, CONFIG_DIR_NAME, ENV_AGENT_DIR, ENV_SESSION_DIR } from \"../config.ts\";\nimport type { ExtensionFlag } from \"../core/extensions/types.ts\";\n\nexport function printHelp(extensionFlags?: ExtensionFlag[]): void {\n\tlet extensionFlagsText = \"\";\n\tif (extensionFlags && extensionFlags.length > 0) {\n\t\textensionFlagsText = `\\n${chalk.bold(\"Extension CLI Flags:\")}\\n${extensionFlags\n\t\t\t.map((flag) => {\n\t\t\t\tconst value = flag.type === \"string\" ? \" <value>\" : \"\";\n\t\t\t\tconst description = flag.description ?? `Registered by ${flag.extensionPath}`;\n\t\t\t\treturn `  --${flag.name}${value}`.padEnd(30) + description;\n\t\t\t})\n\t\t\t.join(\"\\n\")}\\n`;\n\t}\n\t// CLI help is intentional stdout, not application debug logging.\n\t// pi-lens-ignore: no-console-except-error\n\tconsole.log(`${chalk.bold(APP_NAME)} - AI coding assistant with read, bash, edit, write tools\n\n${chalk.bold(\"Usage:\")}\n  ${APP_NAME} [options] [@files...] [messages...]\n\n${chalk.bold(\"Commands:\")}\n  ${APP_NAME} init --global [--dry-run] Create missing user context documents without overwriting settings\n  ${APP_NAME} install <source> [-l]     Install extension source and add to settings\n  ${APP_NAME} remove <source> [-l]      Remove extension source from settings\n  ${APP_NAME} uninstall <source> [-l]   Alias for remove\n  ${APP_NAME} update [source|self|omk]  Update OMK and installed extensions\n  ${APP_NAME} list                      List installed extensions from settings\n  ${APP_NAME} package doctor <source>   Diagnose omk/pi manifest and runtime compatibility as JSON\n  ${APP_NAME} config                    Open TUI to enable/disable package resources\n  ${APP_NAME} quota                     Manage CodexBar quota connector and summaries\n  ${APP_NAME} provider doctor <id>      Diagnose a provider as sanitized JSON (--probe-model adds an\n                                 opt-in Level-2 generative probe that may incur provider costs)\n  ${APP_NAME} session doctor            Inspect or safely repair one session (--session, --repair, --dry-run)\n  ${APP_NAME} doctor resources [--json] [--report] Inspect current pressure or aggregate local observations\n  ${APP_NAME} doctor adaptorch [--json]  Verify ADAPTORCH_API_KEY reaches the AdaptOrch API (0 ok, 1 unset, 2 failed)\n  ${APP_NAME} router-feedback compile-bias  Compile this repository's bounded router bias snapshot\n  ${APP_NAME} <command> --help          Show help for install/remove/uninstall/update/list\n\n${chalk.bold(\"Options:\")}\n  --provider <name>              Provider name (default: google)\n  --model <pattern>              Model pattern or ID (supports \"provider/id\" and optional \":<thinking>\")\n  --model-contract <file>        Pin an optional JSON model/effort/output dispatch policy\n  --api-key <key>                API key (defaults to env vars)\n  --system-prompt <text>         System prompt (default: coding assistant prompt)\n  --append-system-prompt <text>  Append text or file contents to the system prompt (can be used multiple times)\n  --mode <mode>                  Output mode: text (default), json, rpc, or acp (conversation-only)\n  --print, -p                    Non-interactive mode: process prompt and exit\n  --continue, -c                 Continue previous session\n  --resume, -r                   Select a session to resume\n  --session <path|id>            Use specific session file or partial UUID\n  --session-id <id>              Use exact project session ID, creating it if missing\n  --fork <path|id>               Fork specific session file or partial UUID into a new session\n  --session-dir <dir>            Directory for session storage and lookup\n  --no-session                   Don't save session (ephemeral)\n  --name, -n <name>              Set session display name\n  --models <patterns>            Comma-separated model patterns for Ctrl+P cycling\n                                 Supports globs (anthropic/*, *sonnet*) and fuzzy matching\n  --no-tools, -nt                Disable all tools by default (built-in and extension)\n  --no-builtin-tools, -nbt       Disable built-in tools by default but keep extension/custom tools enabled\n  --tools, -t <tools>            Comma-separated allowlist of tool names to enable\n                                 Applies to built-in, extension, and custom tools\n  --exclude-tools, -xt <tools>   Comma-separated denylist of tool names to disable\n                                 Applies to built-in, extension, and custom tools\n  --thinking <level>             Set thinking level: off, minimal, low, medium, high, xhigh, max, ultra\n  --extension, -e <path>         Load an extension file (can be used multiple times)\n  --no-extensions, -ne           Disable extension discovery (explicit -e paths still work)\n  --skill <path>                 Load a skill file or directory (can be used multiple times)\n  --no-skills, -ns               Disable skills discovery and loading\n  --prompt-template <path>       Load a prompt template file or directory (can be used multiple times)\n  --no-prompt-templates, -np     Disable prompt template discovery and loading\n  --theme <path>                 Load a theme file or directory (can be used multiple times)\n  --no-themes                    Disable theme discovery and loading\n  --no-context-files, -nc        Disable AGENTS.md and CLAUDE.md discovery and loading\n  --export <file>                Export session file to HTML and exit\n  --list-models [search]         List available models (with optional fuzzy search)\n  --verbose                      Force verbose startup (overrides quietStartup setting)\n  --offline                      Disable startup network operations (same as OMK_OFFLINE=1)\n  --help, -h                     Show this help\n  --version, -v                  Show version number\n\nExtensions can register additional flags (e.g., --plan from plan-mode extension).${extensionFlagsText}\n\n${chalk.bold(\"Examples:\")}\n  # Interactive mode\n  ${APP_NAME}\n\n  # Interactive mode with initial prompt\n  ${APP_NAME} \"List all .ts files in src/\"\n\n  # Include files in initial message\n  ${APP_NAME} @prompt.md @image.png \"What color is the sky?\"\n\n  # Non-interactive mode (process and exit)\n  ${APP_NAME} -p \"List all .ts files in src/\"\n\n  # Multiple messages (interactive)\n  ${APP_NAME} \"Read package.json\" \"What dependencies do we have?\"\n\n  # Continue previous session\n  ${APP_NAME} --continue \"What did we discuss?\"\n\n  # Start a named session\n  ${APP_NAME} --name \"Refactor auth module\"\n\n  # Use different model\n  ${APP_NAME} --provider openai --model gpt-4o-mini \"Help me refactor this code\"\n\n  # Use model with provider prefix (no --provider needed)\n  ${APP_NAME} --model openai/gpt-4o \"Help me refactor this code\"\n\n  # Use model with thinking level shorthand\n  ${APP_NAME} --model sonnet:high \"Solve this complex problem\"\n\n  # Limit model cycling to specific models\n  ${APP_NAME} --models claude-sonnet,claude-haiku,gpt-4o\n\n  # Limit to a specific provider with glob pattern\n  ${APP_NAME} --models \"github-copilot/*\"\n\n  # Cycle models with fixed thinking levels\n  ${APP_NAME} --models sonnet:high,haiku:low\n\n  # Start with a specific thinking level\n  ${APP_NAME} --thinking high \"Solve this complex problem\"\n\n  # Read-only mode (no file modifications possible)\n  ${APP_NAME} --tools read,grep,find,ls -p \"Review the code in src/\"\n\n  # Disable one tool while keeping the rest available\n  ${APP_NAME} --exclude-tools ask_question\n\n  # Export a session file to HTML\n  ${APP_NAME} --export ~/${CONFIG_DIR_NAME}/agent/sessions/--path--/session.jsonl\n  ${APP_NAME} --export session.jsonl output.html\n\n${chalk.bold(\"Environment Variables:\")}\n  ANTHROPIC_API_KEY                - Anthropic Claude API key\n  ANTHROPIC_OAUTH_TOKEN            - Anthropic OAuth token (alternative to API key)\n  ANT_LING_API_KEY                 - Ant Ling API key\n  OPENAI_API_KEY                   - OpenAI GPT API key\n  AZURE_OPENAI_API_KEY             - Azure OpenAI API key\n  AZURE_OPENAI_BASE_URL            - Azure OpenAI/Cognitive Services base URL (e.g. https://{resource}.openai.azure.com)\n  AZURE_OPENAI_RESOURCE_NAME       - Azure OpenAI resource name (alternative to base URL)\n  AZURE_OPENAI_API_VERSION         - Azure OpenAI API version (default: v1)\n  AZURE_OPENAI_DEPLOYMENT_NAME_MAP - Azure OpenAI model=deployment map (comma-separated)\n  DEEPSEEK_API_KEY                 - DeepSeek API key\n  DEVIN_API_KEY                    - Devin CLI subscription session token (or /login devin)\n  NVIDIA_API_KEY                   - NVIDIA NIM API key\n  GEMINI_API_KEY                   - Google Gemini API key\n  GROQ_API_KEY                     - Groq API key\n  CEREBRAS_API_KEY                 - Cerebras API key\n  XAI_API_KEY                      - xAI Grok API key\n  FIREWORKS_API_KEY                - Fireworks API key\n  TOGETHER_API_KEY                 - Together AI API key\n  OPENROUTER_API_KEY               - OpenRouter API key\n  AI_GATEWAY_API_KEY               - Vercel AI Gateway API key\n  ZAI_API_KEY                      - ZAI API key\n  ZAI_CODING_CN_API_KEY            - ZAI Coding Plan API key (China)\n  MISTRAL_API_KEY                  - Mistral API key\n  MINIMAX_API_KEY                  - MiniMax API key\n  MOONSHOT_API_KEY                 - Moonshot AI API key\n  META_API_KEY                     - Meta Model API key (Muse Spark); META_MODEL_API_KEY/MODEL_API_KEY also read\n  OPENCODE_API_KEY                 - OpenCode Zen/OpenCode Go API key\n  KIMI_API_KEY                     - Kimi For Coding API key\n  CLOUDFLARE_API_KEY               - Cloudflare API token (Workers AI and AI Gateway)\n  CLOUDFLARE_ACCOUNT_ID            - Cloudflare account id (required for both)\n  CLOUDFLARE_GATEWAY_ID            - Cloudflare AI Gateway slug (required for AI Gateway)\n  XIAOMI_API_KEY                   - Xiaomi MiMo API key (api.xiaomimimo.com billing)\n  XIAOMI_TOKEN_PLAN_CN_API_KEY     - Xiaomi MiMo Token Plan API key (China region)\n  XIAOMI_TOKEN_PLAN_AMS_API_KEY    - Xiaomi MiMo Token Plan API key (Amsterdam region)\n  XIAOMI_TOKEN_PLAN_SGP_API_KEY    - Xiaomi MiMo Token Plan API key (Singapore region)\n  ZYLOO_API_KEY                    - Zyloo API key\n  AWS_PROFILE                      - AWS profile for Amazon Bedrock\n  AWS_ACCESS_KEY_ID                - AWS access key for Amazon Bedrock\n  AWS_SECRET_ACCESS_KEY            - AWS secret key for Amazon Bedrock\n  AWS_BEARER_TOKEN_BEDROCK         - Bedrock API key (bearer token)\n  AWS_REGION                       - AWS region for Amazon Bedrock (e.g., us-east-1)\n  ${ENV_AGENT_DIR.padEnd(32)} - Config directory (default: ~/${CONFIG_DIR_NAME}/agent)\n  ${ENV_SESSION_DIR.padEnd(32)} - Session storage directory (overridden by --session-dir)\n  OMK_PACKAGE_DIR                  - Override package directory (for Nix/Guix store paths)\n  OMK_TOOL_SCHEDULER               - Tool scheduler override: dag-v2 or waves-v1 rollback\n  OMK_OFFLINE                      - Disable startup network operations when set to 1/true/yes\n  OMK_TELEMETRY                    - Override install telemetry when set to 1/true/yes or 0/false/no\n  OMK_SHARE_VIEWER_URL             - Base URL for /share command (default: https://omk.dev/session/)\n  ADAPTORCH_API_KEY                - AdaptOrch API key (optional; enables the doctor adaptorch check)\n  ADAPTORCH_API_URL                - AdaptOrch API base URL (default: https://api.adaptorch.com)\n\n${chalk.bold(\"Built-in Tool Names:\")}\n  read   - Read file contents\n  bash   - Execute bash commands\n  edit   - Edit files with find/replace\n  write  - Write files (creates/overwrites)\n  grep   - Search file contents (read-only, off by default)\n  find   - Find files by glob pattern (read-only, off by default)\n  ls     - List directory contents (read-only, off by default)\n`);\n}\n"]}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGzF,MAAM,UAAU,SAAS,CAAC,cAAgC,EAAQ;IACjE,IAAI,kBAAkB,GAAG,EAAE,CAAC;IAC5B,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,kBAAkB,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,cAAc;aAC7E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9E,OAAO,OAAO,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;QAAA,CAC3D,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IACD,iEAAiE;IACjE,0CAA0C;IAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;;EAElC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClB,QAAQ;;EAEV,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;IACrB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;;IAER,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;;EAEV,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mFA0C2D,kBAAkB;;EAEnG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;;IAErB,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ;;;IAGR,QAAQ,eAAe,eAAe;IACtC,QAAQ;;EAEV,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2ClC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,mCAAmC,eAAe;IAC1E,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;;;;;;;;;EAS5B,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;;;;;;;;CAQnC,CAAC,CAAC;AAAA,CACF","sourcesContent":["import chalk from \"chalk\";\nimport { APP_NAME, CONFIG_DIR_NAME, ENV_AGENT_DIR, ENV_SESSION_DIR } from \"../config.ts\";\nimport type { ExtensionFlag } from \"../core/extensions/types.ts\";\n\nexport function printHelp(extensionFlags?: ExtensionFlag[]): void {\n\tlet extensionFlagsText = \"\";\n\tif (extensionFlags && extensionFlags.length > 0) {\n\t\textensionFlagsText = `\\n${chalk.bold(\"Extension CLI Flags:\")}\\n${extensionFlags\n\t\t\t.map((flag) => {\n\t\t\t\tconst value = flag.type === \"string\" ? \" <value>\" : \"\";\n\t\t\t\tconst description = flag.description ?? `Registered by ${flag.extensionPath}`;\n\t\t\t\treturn `  --${flag.name}${value}`.padEnd(30) + description;\n\t\t\t})\n\t\t\t.join(\"\\n\")}\\n`;\n\t}\n\t// CLI help is intentional stdout, not application debug logging.\n\t// pi-lens-ignore: no-console-except-error\n\tconsole.log(`${chalk.bold(APP_NAME)} - AI coding assistant with read, bash, edit, write tools\n\n${chalk.bold(\"Usage:\")}\n  ${APP_NAME} [options] [@files...] [messages...]\n\n${chalk.bold(\"Commands:\")}\n  ${APP_NAME} init --global [--dry-run] Create missing user context documents without overwriting settings\n  ${APP_NAME} install <source> [-l]     Install extension source and add to settings\n  ${APP_NAME} remove <source> [-l]      Remove extension source from settings\n  ${APP_NAME} uninstall <source> [-l]   Alias for remove\n  ${APP_NAME} update [source|self|omk]  Update OMK and installed extensions\n  ${APP_NAME} list                      List installed extensions from settings\n  ${APP_NAME} package doctor <source>   Diagnose omk/pi manifest and runtime compatibility as JSON\n  ${APP_NAME} config                    Open TUI to enable/disable package resources\n  ${APP_NAME} quota                     Manage CodexBar quota connector and summaries\n  ${APP_NAME} provider doctor <id>      Diagnose a provider as sanitized JSON (--probe-model adds an\n                                 opt-in Level-2 generative probe that may incur provider costs)\n  ${APP_NAME} session doctor            Inspect or safely repair one session (--session, --repair, --dry-run)\n  ${APP_NAME} doctor resources [--json] [--report] Inspect current pressure or aggregate local observations\n  ${APP_NAME} doctor adaptorch [--json]  Verify ADAPTORCH_API_KEY reaches the AdaptOrch API (0 ok, 1 unset, 2 failed)\n  ${APP_NAME} router-feedback compile-bias  Compile this repository's bounded router bias snapshot\n  ${APP_NAME} <command> --help          Show help for install/remove/uninstall/update/list\n\n${chalk.bold(\"Options:\")}\n  --provider <name>              Provider name (default: google)\n  --model <pattern>              Model pattern or ID (supports \"provider/id\" and optional \":<thinking>\")\n  --model-contract <file>        Pin an optional JSON model/effort/output dispatch policy\n  --api-key <key>                API key (defaults to env vars)\n  --system-prompt <text>         System prompt (default: coding assistant prompt)\n  --append-system-prompt <text>  Append text or file contents to the system prompt (can be used multiple times)\n  --mode <mode>                  Output mode: text (default), json, rpc, or acp (conversation-only)\n  --print, -p                    Non-interactive mode: process prompt and exit\n  --continue, -c                 Continue previous session\n  --resume, -r                   Select a session to resume\n  --session <path|id>            Use specific session file or partial UUID\n  --session-id <id>              Use exact project session ID, creating it if missing\n  --fork <path|id>               Fork specific session file or partial UUID into a new session\n  --session-dir <dir>            Directory for session storage and lookup\n  --no-session                   Don't save session (ephemeral)\n  --name, -n <name>              Set session display name\n  --models <patterns>            Comma-separated model patterns for Ctrl+P cycling\n                                 Supports globs (anthropic/*, *sonnet*) and fuzzy matching\n  --no-tools, -nt                Disable all tools by default (built-in and extension)\n  --no-builtin-tools, -nbt       Disable built-in tools by default but keep extension/custom tools enabled\n  --tools, -t <tools>            Comma-separated allowlist of tool names to enable\n                                 Applies to built-in, extension, and custom tools\n  --exclude-tools, -xt <tools>   Comma-separated denylist of tool names to disable\n                                 Applies to built-in, extension, and custom tools\n  --thinking <level>             Set thinking level: off, minimal, low, medium, high, xhigh, max, ultra\n  --extension, -e <path>         Load an extension file (can be used multiple times)\n  --no-extensions, -ne           Disable extension discovery (explicit -e paths still work)\n  --skill <path>                 Load a skill file or directory (can be used multiple times)\n  --no-skills, -ns               Disable skills discovery and loading\n  --prompt-template <path>       Load a prompt template file or directory (can be used multiple times)\n  --no-prompt-templates, -np     Disable prompt template discovery and loading\n  --theme <path>                 Load a theme file or directory (can be used multiple times)\n  --no-themes                    Disable theme discovery and loading\n  --no-context-files, -nc        Disable AGENTS.md and CLAUDE.md discovery and loading\n  --export <file>                Export session file to HTML and exit\n  --list-models [search]         List available models (with optional fuzzy search)\n  --verbose                      Force verbose startup (overrides quietStartup setting)\n  --offline                      Disable startup network operations (same as OMK_OFFLINE=1)\n  --help, -h                     Show this help\n  --version, -v                  Show version number\n\nExtensions can register additional flags (e.g., --plan from plan-mode extension).${extensionFlagsText}\n\n${chalk.bold(\"Examples:\")}\n  # Interactive mode\n  ${APP_NAME}\n\n  # Interactive mode with initial prompt\n  ${APP_NAME} \"List all .ts files in src/\"\n\n  # Include files in initial message\n  ${APP_NAME} @prompt.md @image.png \"What color is the sky?\"\n\n  # Non-interactive mode (process and exit)\n  ${APP_NAME} -p \"List all .ts files in src/\"\n\n  # Multiple messages (interactive)\n  ${APP_NAME} \"Read package.json\" \"What dependencies do we have?\"\n\n  # Continue previous session\n  ${APP_NAME} --continue \"What did we discuss?\"\n\n  # Start a named session\n  ${APP_NAME} --name \"Refactor auth module\"\n\n  # Use different model\n  ${APP_NAME} --provider openai --model gpt-4o-mini \"Help me refactor this code\"\n\n  # Use model with provider prefix (no --provider needed)\n  ${APP_NAME} --model openai/gpt-4o \"Help me refactor this code\"\n\n  # Use model with thinking level shorthand\n  ${APP_NAME} --model sonnet:high \"Solve this complex problem\"\n\n  # Limit model cycling to specific models\n  ${APP_NAME} --models claude-sonnet,claude-haiku,gpt-4o\n\n  # Limit to a specific provider with glob pattern\n  ${APP_NAME} --models \"github-copilot/*\"\n\n  # Cycle models with fixed thinking levels\n  ${APP_NAME} --models sonnet:high,haiku:low\n\n  # Start with a specific thinking level\n  ${APP_NAME} --thinking high \"Solve this complex problem\"\n\n  # Read-only mode (no file modifications possible)\n  ${APP_NAME} --tools read,grep,find,ls -p \"Review the code in src/\"\n\n  # Disable one tool while keeping the rest available\n  ${APP_NAME} --exclude-tools ask_question\n\n  # Export a session file to HTML\n  ${APP_NAME} --export ~/${CONFIG_DIR_NAME}/agent/sessions/--path--/session.jsonl\n  ${APP_NAME} --export session.jsonl output.html\n\n${chalk.bold(\"Environment Variables:\")}\n  ANTHROPIC_API_KEY                - Anthropic Claude API key\n  ANTHROPIC_OAUTH_TOKEN            - Anthropic OAuth token (alternative to API key)\n  ANT_LING_API_KEY                 - Ant Ling API key\n  OPENAI_API_KEY                   - OpenAI GPT API key\n  AZURE_OPENAI_API_KEY             - Azure OpenAI API key\n  AZURE_OPENAI_BASE_URL            - Azure OpenAI/Cognitive Services base URL (e.g. https://{resource}.openai.azure.com)\n  AZURE_OPENAI_RESOURCE_NAME       - Azure OpenAI resource name (alternative to base URL)\n  AZURE_OPENAI_API_VERSION         - Azure OpenAI API version (default: v1)\n  AZURE_OPENAI_DEPLOYMENT_NAME_MAP - Azure OpenAI model=deployment map (comma-separated)\n  DEEPSEEK_API_KEY                 - DeepSeek API key\n  DEVIN_API_KEY                    - Devin CLI subscription session token (or /login devin)\n  NVIDIA_API_KEY                   - NVIDIA NIM API key\n  GEMINI_API_KEY                   - Google Gemini API key\n  GROQ_API_KEY                     - Groq API key\n  CEREBRAS_API_KEY                 - Cerebras API key\n  XAI_API_KEY                      - xAI Grok API key\n  FIREWORKS_API_KEY                - Fireworks API key\n  TOGETHER_API_KEY                 - Together AI API key\n  OPENROUTER_API_KEY               - OpenRouter API key\n  AI_GATEWAY_API_KEY               - Vercel AI Gateway API key\n  ZAI_API_KEY                      - ZAI API key\n  ZAI_CODING_CN_API_KEY            - ZAI Coding Plan API key (China)\n  MISTRAL_API_KEY                  - Mistral API key\n  MINIMAX_API_KEY                  - MiniMax API key\n  MOONSHOT_API_KEY                 - Moonshot AI API key\n  META_API_KEY                     - Meta Model API key (Muse Spark); META_MODEL_API_KEY/MODEL_API_KEY also read\n  OPENCODE_API_KEY                 - OpenCode Zen/OpenCode Go API key\n  KIMI_API_KEY                     - Kimi For Coding API key\n  WORKBUDDY_API_KEY                - WorkBuddy (Tencent CodeBuddy) plan key\n  CLOUDFLARE_API_KEY               - Cloudflare API token (Workers AI and AI Gateway)\n  CLOUDFLARE_ACCOUNT_ID            - Cloudflare account id (required for both)\n  CLOUDFLARE_GATEWAY_ID            - Cloudflare AI Gateway slug (required for AI Gateway)\n  XIAOMI_API_KEY                   - Xiaomi MiMo API key (api.xiaomimimo.com billing)\n  XIAOMI_TOKEN_PLAN_CN_API_KEY     - Xiaomi MiMo Token Plan API key (China region)\n  XIAOMI_TOKEN_PLAN_AMS_API_KEY    - Xiaomi MiMo Token Plan API key (Amsterdam region)\n  XIAOMI_TOKEN_PLAN_SGP_API_KEY    - Xiaomi MiMo Token Plan API key (Singapore region)\n  ZYLOO_API_KEY                    - Zyloo API key\n  AWS_PROFILE                      - AWS profile for Amazon Bedrock\n  AWS_ACCESS_KEY_ID                - AWS access key for Amazon Bedrock\n  AWS_SECRET_ACCESS_KEY            - AWS secret key for Amazon Bedrock\n  AWS_BEARER_TOKEN_BEDROCK         - Bedrock API key (bearer token)\n  AWS_REGION                       - AWS region for Amazon Bedrock (e.g., us-east-1)\n  ${ENV_AGENT_DIR.padEnd(32)} - Config directory (default: ~/${CONFIG_DIR_NAME}/agent)\n  ${ENV_SESSION_DIR.padEnd(32)} - Session storage directory (overridden by --session-dir)\n  OMK_PACKAGE_DIR                  - Override package directory (for Nix/Guix store paths)\n  OMK_TOOL_SCHEDULER               - Tool scheduler override: dag-v2 or waves-v1 rollback\n  OMK_OFFLINE                      - Disable startup network operations when set to 1/true/yes\n  OMK_TELEMETRY                    - Override install telemetry when set to 1/true/yes or 0/false/no\n  OMK_SHARE_VIEWER_URL             - Base URL for /share command (default: https://omk.dev/session/)\n  ADAPTORCH_API_KEY                - AdaptOrch API key (optional; enables the doctor adaptorch check)\n  ADAPTORCH_API_URL                - AdaptOrch API base URL (default: https://api.adaptorch.com)\n\n${chalk.bold(\"Built-in Tool Names:\")}\n  read   - Read file contents\n  bash   - Execute bash commands\n  edit   - Edit files with find/replace\n  write  - Write files (creates/overwrites)\n  grep   - Search file contents (read-only, off by default)\n  find   - Find files by glob pattern (read-only, off by default)\n  ls     - List directory contents (read-only, off by default)\n`);\n}\n"]}

package/dist/cli/session-picker.d.ts

@@ -1,8 +1,8 @@
 /**
  * TUI session selector for --resume flag
  */
-import type { SessionInfo, SessionListProgress } from "../core/session-manager.ts";
-type SessionsLoader = (onProgress?: SessionListProgress) => Promise<SessionInfo[]>;
+import type { SessionListEntry, SessionListProgress } from "../core/session-manager.ts";
+type SessionsLoader = (onProgress?: SessionListProgress) => Promise<SessionListEntry[]>;
 /** Show TUI session selector and return selected session path or null if cancelled */
 export declare function selectSession(currentSessionsLoader: SessionsLoader, allSessionsLoader: SessionsLoader): Promise<string | null>;
 export {};

package/dist/cli/session-picker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-picker.d.ts","sourceRoot":"","sources":["../../src/cli/session-picker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGnF,KAAK,cAAc,GAAG,CAAC,UAAU,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AAEnF,sFAAsF;AACtF,wBAAsB,aAAa,CAClC,qBAAqB,EAAE,cAAc,EACrC,iBAAiB,EAAE,cAAc,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB","sourcesContent":["/**\n * TUI session selector for --resume flag\n */\n\nimport { ProcessTerminal, setKeybindings, TUI } from \"omk-tui\";\nimport { KeybindingsManager } from \"../core/keybindings.ts\";\nimport type { SessionInfo, SessionListProgress } from \"../core/session-manager.ts\";\nimport { SessionSelectorComponent } from \"../modes/interactive/components/session-selector.ts\";\n\ntype SessionsLoader = (onProgress?: SessionListProgress) => Promise<SessionInfo[]>;\n\n/** Show TUI session selector and return selected session path or null if cancelled */\nexport async function selectSession(\n\tcurrentSessionsLoader: SessionsLoader,\n\tallSessionsLoader: SessionsLoader,\n): Promise<string | null> {\n\treturn new Promise((resolve) => {\n\t\tconst ui = new TUI(new ProcessTerminal());\n\t\tconst keybindings = KeybindingsManager.create();\n\t\tsetKeybindings(keybindings);\n\t\tlet resolved = false;\n\n\t\tconst selector = new SessionSelectorComponent(\n\t\t\tcurrentSessionsLoader,\n\t\t\tallSessionsLoader,\n\t\t\t(path: string) => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tresolve(path);\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tresolve(null);\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\t{ showRenameHint: false, keybindings },\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getSessionList());\n\t\tui.start();\n\t});\n}\n"]}
+{"version":3,"file":"session-picker.d.ts","sourceRoot":"","sources":["../../src/cli/session-picker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGxF,KAAK,cAAc,GAAG,CAAC,UAAU,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;AAExF,sFAAsF;AACtF,wBAAsB,aAAa,CAClC,qBAAqB,EAAE,cAAc,EACrC,iBAAiB,EAAE,cAAc,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB","sourcesContent":["/**\n * TUI session selector for --resume flag\n */\n\nimport { ProcessTerminal, setKeybindings, TUI } from \"omk-tui\";\nimport { KeybindingsManager } from \"../core/keybindings.ts\";\nimport type { SessionListEntry, SessionListProgress } from \"../core/session-manager.ts\";\nimport { SessionSelectorComponent } from \"../modes/interactive/components/session-selector.ts\";\n\ntype SessionsLoader = (onProgress?: SessionListProgress) => Promise<SessionListEntry[]>;\n\n/** Show TUI session selector and return selected session path or null if cancelled */\nexport async function selectSession(\n\tcurrentSessionsLoader: SessionsLoader,\n\tallSessionsLoader: SessionsLoader,\n): Promise<string | null> {\n\treturn new Promise((resolve) => {\n\t\tconst ui = new TUI(new ProcessTerminal());\n\t\tconst keybindings = KeybindingsManager.create();\n\t\tsetKeybindings(keybindings);\n\t\tlet resolved = false;\n\n\t\tconst selector = new SessionSelectorComponent(\n\t\t\tcurrentSessionsLoader,\n\t\t\tallSessionsLoader,\n\t\t\t(path: string) => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tresolve(path);\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tresolve(null);\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\t{ showRenameHint: false, keybindings },\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getSessionList());\n\t\tui.start();\n\t});\n}\n"]}

package/dist/cli/session-picker.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-picker.js","sourceRoot":"","sources":["../../src/cli/session-picker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAI/F,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,qBAAqC,EACrC,iBAAiC,EACR;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC;QAChD,cAAc,CAAC,WAAW,CAAC,CAAC;QAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAC5C,qBAAqB,EACrB,iBAAiB,EACjB,CAAC,IAAY,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC;gBAChB,EAAE,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QAAA,CACD,EACD,GAAG,EAAE,CAAC;YACL,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC;gBAChB,EAAE,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QAAA,CACD,EACD,GAAG,EAAE,CAAC;YACL,EAAE,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAA,CAChB,EACD,GAAG,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EACxB,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,CACtC,CAAC;QAEF,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAA,CACX,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * TUI session selector for --resume flag\n */\n\nimport { ProcessTerminal, setKeybindings, TUI } from \"omk-tui\";\nimport { KeybindingsManager } from \"../core/keybindings.ts\";\nimport type { SessionInfo, SessionListProgress } from \"../core/session-manager.ts\";\nimport { SessionSelectorComponent } from \"../modes/interactive/components/session-selector.ts\";\n\ntype SessionsLoader = (onProgress?: SessionListProgress) => Promise<SessionInfo[]>;\n\n/** Show TUI session selector and return selected session path or null if cancelled */\nexport async function selectSession(\n\tcurrentSessionsLoader: SessionsLoader,\n\tallSessionsLoader: SessionsLoader,\n): Promise<string | null> {\n\treturn new Promise((resolve) => {\n\t\tconst ui = new TUI(new ProcessTerminal());\n\t\tconst keybindings = KeybindingsManager.create();\n\t\tsetKeybindings(keybindings);\n\t\tlet resolved = false;\n\n\t\tconst selector = new SessionSelectorComponent(\n\t\t\tcurrentSessionsLoader,\n\t\t\tallSessionsLoader,\n\t\t\t(path: string) => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tresolve(path);\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tresolve(null);\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\t{ showRenameHint: false, keybindings },\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getSessionList());\n\t\tui.start();\n\t});\n}\n"]}
+{"version":3,"file":"session-picker.js","sourceRoot":"","sources":["../../src/cli/session-picker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAI/F,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,qBAAqC,EACrC,iBAAiC,EACR;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC;QAChD,cAAc,CAAC,WAAW,CAAC,CAAC;QAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAC5C,qBAAqB,EACrB,iBAAiB,EACjB,CAAC,IAAY,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC;gBAChB,EAAE,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QAAA,CACD,EACD,GAAG,EAAE,CAAC;YACL,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC;gBAChB,EAAE,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QAAA,CACD,EACD,GAAG,EAAE,CAAC;YACL,EAAE,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAA,CAChB,EACD,GAAG,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EACxB,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,CACtC,CAAC;QAEF,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAA,CACX,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * TUI session selector for --resume flag\n */\n\nimport { ProcessTerminal, setKeybindings, TUI } from \"omk-tui\";\nimport { KeybindingsManager } from \"../core/keybindings.ts\";\nimport type { SessionListEntry, SessionListProgress } from \"../core/session-manager.ts\";\nimport { SessionSelectorComponent } from \"../modes/interactive/components/session-selector.ts\";\n\ntype SessionsLoader = (onProgress?: SessionListProgress) => Promise<SessionListEntry[]>;\n\n/** Show TUI session selector and return selected session path or null if cancelled */\nexport async function selectSession(\n\tcurrentSessionsLoader: SessionsLoader,\n\tallSessionsLoader: SessionsLoader,\n): Promise<string | null> {\n\treturn new Promise((resolve) => {\n\t\tconst ui = new TUI(new ProcessTerminal());\n\t\tconst keybindings = KeybindingsManager.create();\n\t\tsetKeybindings(keybindings);\n\t\tlet resolved = false;\n\n\t\tconst selector = new SessionSelectorComponent(\n\t\t\tcurrentSessionsLoader,\n\t\t\tallSessionsLoader,\n\t\t\t(path: string) => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tresolve(path);\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tresolve(null);\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\t{ showRenameHint: false, keybindings },\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getSessionList());\n\t\tui.start();\n\t});\n}\n"]}

package/dist/commands/verified-run-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verified-run-cli.d.ts","sourceRoot":"","sources":["../../src/commands/verified-run-cli.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAoG/E,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAyHnE","sourcesContent":["import { join } from \"node:path\";\nimport { parseRunContract, RunContractError, VERIFIED_COMMAND_VERSION } from \"omk-protocol\";\nimport { getAgentDir } from \"../config.ts\";\nimport { planVerifiedRun, RunCoordinator } from \"../core/verified-run/coordinator.ts\";\nimport type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { digestBytes, readJson, VerifiedRunError } from \"../core/verified-run/storage.ts\";\n\nconst USAGE = `Usage: omk run plan --contract FILE [--json]\n       omk run start --contract FILE --approve DIGEST --command-id ID [--state-dir DIR]\n       omk run inspect|evidence ID [--state-dir DIR] [--json]\n       omk run inspect ID --recovery|--writer-recovery|--task-recovery [--state-dir DIR]\n       omk run retry-tasks ID --execute --tasks ID[,ID...]|- --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]\nThe opt-in command, scripted-agent and bounded command-DAG profiles never apply changes to the original workspace.\nResume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Command-DAG concurrency defaults to 1 and supports an explicit cap of 2. Plan amendment, managed apply and TUI/RPC control are not implemented.`;\n\ninterface Parsed {\n\treadonly action:\n\t\t| \"plan\"\n\t\t| \"start\"\n\t\t| \"resume\"\n\t\t| \"restart-writer\"\n\t\t| \"retry-tasks\"\n\t\t| \"inspect\"\n\t\t| \"evidence\"\n\t\t| \"artifact\";\n\treadonly id: string | undefined;\n\treadonly flags: ReadonlyMap<string, string>;\n}\n\nfunction parse(args: readonly string[]): Parsed {\n\tconst action = args[1];\n\tif (\n\t\taction !== \"plan\" &&\n\t\taction !== \"start\" &&\n\t\taction !== \"resume\" &&\n\t\taction !== \"restart-writer\" &&\n\t\taction !== \"retry-tasks\" &&\n\t\taction !== \"inspect\" &&\n\t\taction !== \"evidence\" &&\n\t\taction !== \"artifact\"\n\t)\n\t\tthrow new VerifiedRunError(\"usage\");\n\tconst hasId = action !== \"plan\" && action !== \"start\";\n\tconst id = hasId ? args[2] : undefined;\n\tif (hasId && (!id || id.startsWith(\"--\"))) throw new VerifiedRunError(\"usage\");\n\tconst allowed =\n\t\taction === \"plan\"\n\t\t\t? [\"--contract\", \"--json\"]\n\t\t\t: action === \"start\"\n\t\t\t\t? [\"--contract\", \"--approve\", \"--command-id\", \"--state-dir\", \"--json\"]\n\t\t\t\t: action === \"resume\" || action === \"restart-writer\" || action === \"retry-tasks\"\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\taction === \"resume\" ? \"--candidate\" : \"--base\",\n\t\t\t\t\t\t\t...(action === \"retry-tasks\" ? [\"--tasks\"] : []),\n\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t]\n\t\t\t\t\t: action === \"artifact\"\n\t\t\t\t\t\t? [\"--candidate\", \"--path\", \"--state-dir\", \"--json\"]\n\t\t\t\t\t\t: action === \"inspect\"\n\t\t\t\t\t\t\t? [\"--state-dir\", \"--json\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"]\n\t\t\t\t\t\t\t: [\"--state-dir\", \"--json\"];\n\tconst flags = new Map<string, string>();\n\tfor (let index = hasId ? 3 : 2; index < args.length; index++) {\n\t\tconst flag = args[index];\n\t\tif (!allowed.includes(flag) || flags.has(flag)) throw new VerifiedRunError(\"usage\");\n\t\tconst value = [\"--json\", \"--execute\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"].includes(flag)\n\t\t\t? \"true\"\n\t\t\t: args[++index];\n\t\tif (!value || value.startsWith(\"--\")) throw new VerifiedRunError(\"usage\");\n\t\tflags.set(flag, value);\n\t}\n\tif ([\"--recovery\", \"--writer-recovery\", \"--task-recovery\"].filter((flag) => flags.has(flag)).length > 1)\n\t\tthrow new VerifiedRunError(\"usage\");\n\treturn { action, id, flags };\n}\n\nfunction required(parsed: Parsed, name: string): string {\n\tconst value = parsed.flags.get(name);\n\tif (!value) throw new VerifiedRunError(\"usage\");\n\treturn value;\n}\n\nasync function withRunSignal<T>(run: (signal: AbortSignal) => Promise<T>): Promise<T> {\n\tconst controller = new AbortController();\n\tconst cancel = (): void => controller.abort();\n\tprocess.once(\"SIGINT\", cancel);\n\tprocess.once(\"SIGTERM\", cancel);\n\ttry {\n\t\treturn await run(controller.signal);\n\t} finally {\n\t\tprocess.off(\"SIGINT\", cancel);\n\t\tprocess.off(\"SIGTERM\", cancel);\n\t}\n}\n\nexport async function runVerifiedRunCli(\n\targs: string[],\n\truntime?: VerifiedRunRuntime,\n): Promise<{ readonly handled: boolean; readonly exitCode: number }> {\n\tif (args[0] !== \"run\") return { handled: false, exitCode: 0 };\n\tif (args.length === 2 && args[1] === \"--help\") {\n\t\tprocess.stdout.write(`${USAGE}\\n`);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\ttry {\n\t\tconst parsed = parse(args);\n\t\tconst coordinator = new RunCoordinator(\n\t\t\tparsed.flags.get(\"--state-dir\") ?? join(getAgentDir(), \"verified-runs\"),\n\t\t\truntime,\n\t\t);\n\t\tlet result: unknown;\n\t\tlet exitCode = 0;\n\t\tswitch (parsed.action) {\n\t\t\tcase \"plan\":\n\t\t\t\tresult = planVerifiedRun(readJson(required(parsed, \"--contract\")));\n\t\t\t\tbreak;\n\t\t\tcase \"start\": {\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst commandId = required(parsed, \"--command-id\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.start(\n\t\t\t\t\t\tcontract,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"start\",\n\t\t\t\t\t\t\trunId: contract.runId,\n\t\t\t\t\t\t\tcommandId,\n\t\t\t\t\t\t\texpectedRevision: 0,\n\t\t\t\t\t\t\texpectedGeneration: 0,\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resume\":\n\t\t\tcase \"retry-tasks\":\n\t\t\tcase \"restart-writer\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst request = {\n\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t};\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tparsed.action === \"retry-tasks\"\n\t\t\t\t\t\t? coordinator.retryTasks(\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t...request,\n\t\t\t\t\t\t\t\t\tkind: \"retry_tasks\",\n\t\t\t\t\t\t\t\t\tbaseDigest: required(parsed, \"--base\"),\n\t\t\t\t\t\t\t\t\ttaskIds: required(parsed, \"--tasks\") === \"-\" ? [] : required(parsed, \"--tasks\").split(\",\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t: parsed.action === \"resume\"\n\t\t\t\t\t\t\t? coordinator.resume(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"resume\", candidateDigest: required(parsed, \"--candidate\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: coordinator.restartWriter(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"restart_writer\", baseDigest: required(parsed, \"--base\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"inspect\":\n\t\t\t\tresult = parsed.flags.has(\"--recovery\")\n\t\t\t\t\t? coordinator.inspectRecovery(parsed.id ?? \"\")\n\t\t\t\t\t: parsed.flags.has(\"--writer-recovery\")\n\t\t\t\t\t\t? coordinator.inspectWriterRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t: parsed.flags.has(\"--task-recovery\")\n\t\t\t\t\t\t\t? coordinator.inspectTaskRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t\t: coordinator.inspect(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"evidence\":\n\t\t\t\tresult = coordinator.evidence(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"artifact\": {\n\t\t\t\tconst candidate = required(parsed, \"--candidate\");\n\t\t\t\tconst path = required(parsed, \"--path\");\n\t\t\t\tconst bytes = coordinator.artifact(parsed.id ?? \"\", candidate, path);\n\t\t\t\tresult = {\n\t\t\t\t\tcandidateDigest: candidate,\n\t\t\t\t\tpath,\n\t\t\t\t\tdigest: digestBytes(bytes),\n\t\t\t\t\tbyteCount: bytes.length,\n\t\t\t\t\tencoding: \"base64\",\n\t\t\t\t\tdata: bytes.toString(\"base64\"),\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = parsed.action;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tprocess.stdout.write(`${JSON.stringify(result)}\\n`);\n\t\treturn { handled: true, exitCode };\n\t} catch (error) {\n\t\tconst usage = error instanceof RunContractError || (error instanceof VerifiedRunError && error.code === \"usage\");\n\t\tconst message =\n\t\t\terror instanceof VerifiedRunError || error instanceof RunContractError\n\t\t\t\t? error.message\n\t\t\t\t: \"verified-run: operation_failed\";\n\t\tprocess.stderr.write(`${message}\\n${usage ? `${USAGE}\\n` : \"\"}`);\n\t\treturn { handled: true, exitCode: usage ? 2 : 1 };\n\t}\n}\n"]}
+{"version":3,"file":"verified-run-cli.d.ts","sourceRoot":"","sources":["../../src/commands/verified-run-cli.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAgH/E,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoKnE","sourcesContent":["import { join } from \"node:path\";\nimport { parseRunContract, RunContractError, VERIFIED_COMMAND_VERSION } from \"omk-protocol\";\nimport { getAgentDir } from \"../config.ts\";\nimport { planVerifiedRun, RunCoordinator } from \"../core/verified-run/coordinator.ts\";\nimport { publishPolicyDigest } from \"../core/verified-run/run-publish.ts\";\nimport type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { digestBytes, readJson, VerifiedRunError } from \"../core/verified-run/storage.ts\";\nimport { withRunSignal } from \"./verified-run-signal.ts\";\n\nconst USAGE = `Usage: omk run plan --contract FILE [--json]\n       omk run start --contract FILE --approve DIGEST --command-id ID [--state-dir DIR]\n       omk run inspect|evidence|status|events ID [--state-dir DIR] [--json]\n       omk run authority [--state-dir DIR] [--json]\n       omk run inspect ID --recovery|--writer-recovery|--task-recovery [--state-dir DIR]\n       omk run retry-tasks ID --execute --tasks ID[,ID...]|- --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run publish ID --execute --contract FILE --approve DIGEST --candidate DIGEST --parent OID --receipt DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]\nThe opt-in command, scripted-agent and bounded command-DAG profiles never apply changes to the original workspace.\nResume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Command-DAG concurrency defaults to 1 and supports an explicit cap of 2. Plan amendment, managed apply and TUI/RPC control are not implemented.`;\n\ninterface Parsed {\n\treadonly action:\n\t\t| \"plan\"\n\t\t| \"start\"\n\t\t| \"resume\"\n\t\t| \"restart-writer\"\n\t\t| \"retry-tasks\"\n\t\t| \"publish\"\n\t\t| \"inspect\"\n\t\t| \"status\"\n\t\t| \"events\"\n\t\t| \"authority\"\n\t\t| \"evidence\"\n\t\t| \"artifact\";\n\treadonly id: string | undefined;\n\treadonly flags: ReadonlyMap<string, string>;\n}\n\nfunction parse(args: readonly string[]): Parsed {\n\tconst action = args[1];\n\tif (\n\t\taction !== \"plan\" &&\n\t\taction !== \"start\" &&\n\t\taction !== \"resume\" &&\n\t\taction !== \"restart-writer\" &&\n\t\taction !== \"retry-tasks\" &&\n\t\taction !== \"publish\" &&\n\t\taction !== \"inspect\" &&\n\t\taction !== \"status\" &&\n\t\taction !== \"events\" &&\n\t\taction !== \"authority\" &&\n\t\taction !== \"evidence\" &&\n\t\taction !== \"artifact\"\n\t)\n\t\tthrow new VerifiedRunError(\"usage\");\n\tconst hasId = action !== \"plan\" && action !== \"start\" && action !== \"authority\";\n\tconst id = hasId ? args[2] : undefined;\n\tif (hasId && (!id || id.startsWith(\"--\"))) throw new VerifiedRunError(\"usage\");\n\tconst allowed =\n\t\taction === \"plan\"\n\t\t\t? [\"--contract\", \"--json\"]\n\t\t\t: action === \"start\"\n\t\t\t\t? [\"--contract\", \"--approve\", \"--command-id\", \"--state-dir\", \"--json\"]\n\t\t\t\t: action === \"resume\" || action === \"restart-writer\" || action === \"retry-tasks\"\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\taction === \"resume\" ? \"--candidate\" : \"--base\",\n\t\t\t\t\t\t\t...(action === \"retry-tasks\" ? [\"--tasks\"] : []),\n\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t]\n\t\t\t\t\t: action === \"publish\"\n\t\t\t\t\t\t? [\n\t\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\t\"--contract\",\n\t\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\t\t\"--candidate\",\n\t\t\t\t\t\t\t\t\"--parent\",\n\t\t\t\t\t\t\t\t\"--receipt\",\n\t\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t: action === \"artifact\"\n\t\t\t\t\t\t\t? [\"--candidate\", \"--path\", \"--state-dir\", \"--json\"]\n\t\t\t\t\t\t\t: action === \"inspect\"\n\t\t\t\t\t\t\t\t? [\"--state-dir\", \"--json\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"]\n\t\t\t\t\t\t\t\t: [\"--state-dir\", \"--json\"];\n\tconst flags = new Map<string, string>();\n\tfor (let index = hasId ? 3 : 2; index < args.length; index++) {\n\t\tconst flag = args[index];\n\t\tif (!allowed.includes(flag) || flags.has(flag)) throw new VerifiedRunError(\"usage\");\n\t\tconst value = [\"--json\", \"--execute\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"].includes(flag)\n\t\t\t? \"true\"\n\t\t\t: args[++index];\n\t\tif (!value || value.startsWith(\"--\")) throw new VerifiedRunError(\"usage\");\n\t\tflags.set(flag, value);\n\t}\n\tif ([\"--recovery\", \"--writer-recovery\", \"--task-recovery\"].filter((flag) => flags.has(flag)).length > 1)\n\t\tthrow new VerifiedRunError(\"usage\");\n\treturn { action, id, flags };\n}\n\nfunction required(parsed: Parsed, name: string): string {\n\tconst value = parsed.flags.get(name);\n\tif (!value) throw new VerifiedRunError(\"usage\");\n\treturn value;\n}\n\nexport async function runVerifiedRunCli(\n\targs: string[],\n\truntime?: VerifiedRunRuntime,\n): Promise<{ readonly handled: boolean; readonly exitCode: number }> {\n\tif (args[0] !== \"run\") return { handled: false, exitCode: 0 };\n\tif (args.length === 2 && args[1] === \"--help\") {\n\t\tprocess.stdout.write(`${USAGE}\\n`);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\ttry {\n\t\tconst parsed = parse(args);\n\t\tconst coordinator = new RunCoordinator(\n\t\t\tparsed.flags.get(\"--state-dir\") ?? join(getAgentDir(), \"verified-runs\"),\n\t\t\truntime,\n\t\t);\n\t\tlet result: unknown;\n\t\tlet exitCode = 0;\n\t\tswitch (parsed.action) {\n\t\t\tcase \"plan\":\n\t\t\t\tresult = planVerifiedRun(readJson(required(parsed, \"--contract\")));\n\t\t\t\tbreak;\n\t\t\tcase \"start\": {\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst commandId = required(parsed, \"--command-id\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.start(\n\t\t\t\t\t\tcontract,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"start\",\n\t\t\t\t\t\t\trunId: contract.runId,\n\t\t\t\t\t\t\tcommandId,\n\t\t\t\t\t\t\texpectedRevision: 0,\n\t\t\t\t\t\t\texpectedGeneration: 0,\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resume\":\n\t\t\tcase \"retry-tasks\":\n\t\t\tcase \"restart-writer\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst request = {\n\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t};\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tparsed.action === \"retry-tasks\"\n\t\t\t\t\t\t? coordinator.retryTasks(\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t...request,\n\t\t\t\t\t\t\t\t\tkind: \"retry_tasks\",\n\t\t\t\t\t\t\t\t\tbaseDigest: required(parsed, \"--base\"),\n\t\t\t\t\t\t\t\t\ttaskIds: required(parsed, \"--tasks\") === \"-\" ? [] : required(parsed, \"--tasks\").split(\",\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t: parsed.action === \"resume\"\n\t\t\t\t\t\t\t? coordinator.resume(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"resume\", candidateDigest: required(parsed, \"--candidate\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: coordinator.restartWriter(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"restart_writer\", baseDigest: required(parsed, \"--base\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"publish\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.publish(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"publish\",\n\t\t\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t\tcandidateDigest: required(parsed, \"--candidate\"),\n\t\t\t\t\t\t\tparentOid: required(parsed, \"--parent\"),\n\t\t\t\t\t\t\treceiptDigest: required(parsed, \"--receipt\"),\n\t\t\t\t\t\t\tpolicyDigest: publishPolicyDigest(contract),\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.publication === \"accepted\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"inspect\":\n\t\t\t\tresult = parsed.flags.has(\"--recovery\")\n\t\t\t\t\t? coordinator.inspectRecovery(parsed.id ?? \"\")\n\t\t\t\t\t: parsed.flags.has(\"--writer-recovery\")\n\t\t\t\t\t\t? coordinator.inspectWriterRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t: parsed.flags.has(\"--task-recovery\")\n\t\t\t\t\t\t\t? coordinator.inspectTaskRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t\t: coordinator.inspect(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"status\": {\n\t\t\t\tconst status = coordinator.status(parsed.id ?? \"\");\n\t\t\t\tresult = status;\n\t\t\t\t// Same truth the start/publish exit codes encode: a recovered,\n\t\t\t\t// quarantined or unverified run is never a clean exit 0.\n\t\t\t\texitCode = status.cleanSuccess ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"events\":\n\t\t\t\tresult = coordinator.events(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"authority\":\n\t\t\t\tresult = coordinator.inspectAuthority();\n\t\t\t\tbreak;\n\t\t\tcase \"evidence\": {\n\t\t\t\tconst projection = coordinator.evidenceRead(parsed.id ?? \"\");\n\t\t\t\tresult = { ...projection.evidence, ...projection };\n\t\t\t\texitCode = projection.authenticity === \"valid\" && projection.verification === \"passed\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"artifact\": {\n\t\t\t\tconst candidate = required(parsed, \"--candidate\");\n\t\t\t\tconst path = required(parsed, \"--path\");\n\t\t\t\tconst bytes = coordinator.artifact(parsed.id ?? \"\", candidate, path);\n\t\t\t\tresult = {\n\t\t\t\t\tcandidateDigest: candidate,\n\t\t\t\t\tpath,\n\t\t\t\t\tdigest: digestBytes(bytes),\n\t\t\t\t\tbyteCount: bytes.length,\n\t\t\t\t\tencoding: \"base64\",\n\t\t\t\t\tdata: bytes.toString(\"base64\"),\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = parsed.action;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tprocess.stdout.write(`${JSON.stringify(result)}\\n`);\n\t\treturn { handled: true, exitCode };\n\t} catch (error) {\n\t\tconst usage = error instanceof RunContractError || (error instanceof VerifiedRunError && error.code === \"usage\");\n\t\tconst message =\n\t\t\terror instanceof VerifiedRunError || error instanceof RunContractError\n\t\t\t\t? error.message\n\t\t\t\t: \"verified-run: operation_failed\";\n\t\tprocess.stderr.write(`${message}\\n${usage ? `${USAGE}\\n` : \"\"}`);\n\t\treturn { handled: true, exitCode: usage ? 2 : 1 };\n\t}\n}\n"]}

package/dist/commands/verified-run-cli.js

@@ -2,14 +2,18 @@ import { join } from "node:path";
 import { parseRunContract, RunContractError, VERIFIED_COMMAND_VERSION } from "omk-protocol";
 import { getAgentDir } from "../config.js";
 import { planVerifiedRun, RunCoordinator } from "../core/verified-run/coordinator.js";
+import { publishPolicyDigest } from "../core/verified-run/run-publish.js";
 import { digestBytes, readJson, VerifiedRunError } from "../core/verified-run/storage.js";
+import { withRunSignal } from "./verified-run-signal.js";
 const USAGE = `Usage: omk run plan --contract FILE [--json]
        omk run start --contract FILE --approve DIGEST --command-id ID [--state-dir DIR]
-       omk run inspect|evidence ID [--state-dir DIR] [--json]
+       omk run inspect|evidence|status|events ID [--state-dir DIR] [--json]
+       omk run authority [--state-dir DIR] [--json]
        omk run inspect ID --recovery|--writer-recovery|--task-recovery [--state-dir DIR]
        omk run retry-tasks ID --execute --tasks ID[,ID...]|- --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]
        omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]
        omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]
+       omk run publish ID --execute --contract FILE --approve DIGEST --candidate DIGEST --parent OID --receipt DIGEST --revision N --generation N --command-id ID [--state-dir DIR]
        omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]
 The opt-in command, scripted-agent and bounded command-DAG profiles never apply changes to the original workspace.
 Resume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Command-DAG concurrency defaults to 1 and supports an explicit cap of 2. Plan amendment, managed apply and TUI/RPC control are not implemented.`;
@@ -20,11 +24,15 @@ function parse(args) {
         action !== "resume" &&
         action !== "restart-writer" &&
         action !== "retry-tasks" &&
+        action !== "publish" &&
         action !== "inspect" &&
+        action !== "status" &&
+        action !== "events" &&
+        action !== "authority" &&
         action !== "evidence" &&
         action !== "artifact")
         throw new VerifiedRunError("usage");
-    const hasId = action !== "plan" && action !== "start";
+    const hasId = action !== "plan" && action !== "start" && action !== "authority";
     const id = hasId ? args[2] : undefined;
     if (hasId && (!id || id.startsWith("--")))
         throw new VerifiedRunError("usage");
@@ -44,11 +52,25 @@ function parse(args) {
                     "--state-dir",
                     "--json",
                 ]
-                : action === "artifact"
-                    ? ["--candidate", "--path", "--state-dir", "--json"]
-                    : action === "inspect"
-                        ? ["--state-dir", "--json", "--recovery", "--writer-recovery", "--task-recovery"]
-                        : ["--state-dir", "--json"];
+                : action === "publish"
+                    ? [
+                        "--execute",
+                        "--contract",
+                        "--approve",
+                        "--candidate",
+                        "--parent",
+                        "--receipt",
+                        "--revision",
+                        "--generation",
+                        "--command-id",
+                        "--state-dir",
+                        "--json",
+                    ]
+                    : action === "artifact"
+                        ? ["--candidate", "--path", "--state-dir", "--json"]
+                        : action === "inspect"
+                            ? ["--state-dir", "--json", "--recovery", "--writer-recovery", "--task-recovery"]
+                            : ["--state-dir", "--json"];
     const flags = new Map();
     for (let index = hasId ? 3 : 2; index < args.length; index++) {
         const flag = args[index];
@@ -71,19 +93,6 @@ function required(parsed, name) {
         throw new VerifiedRunError("usage");
     return value;
 }
-async function withRunSignal(run) {
-    const controller = new AbortController();
-    const cancel = () => controller.abort();
-    process.once("SIGINT", cancel);
-    process.once("SIGTERM", cancel);
-    try {
-        return await run(controller.signal);
-    }
-    finally {
-        process.off("SIGINT", cancel);
-        process.off("SIGTERM", cancel);
-    }
-}
 export async function runVerifiedRunCli(args, runtime) {
     if (args[0] !== "run")
         return { handled: false, exitCode: 0 };
@@ -144,6 +153,27 @@ export async function runVerifiedRunCli(args, runtime) {
                 exitCode = state.application === "candidate_ready" ? 0 : 1;
                 break;
             }
+            case "publish": {
+                required(parsed, "--execute");
+                const approvedContractDigest = required(parsed, "--approve");
+                const contract = parseRunContract(readJson(required(parsed, "--contract")));
+                const state = await withRunSignal((signal) => coordinator.publish({
+                    schemaVersion: VERIFIED_COMMAND_VERSION,
+                    kind: "publish",
+                    runId: parsed.id ?? "",
+                    commandId: required(parsed, "--command-id"),
+                    expectedRevision: Number(required(parsed, "--revision")),
+                    expectedGeneration: Number(required(parsed, "--generation")),
+                    contractDigest: approvedContractDigest,
+                    candidateDigest: required(parsed, "--candidate"),
+                    parentOid: required(parsed, "--parent"),
+                    receiptDigest: required(parsed, "--receipt"),
+                    policyDigest: publishPolicyDigest(contract),
+                }, { approvedContractDigest, signal }));
+                result = state;
+                exitCode = state.publication === "accepted" ? 0 : 1;
+                break;
+            }
             case "inspect":
                 result = parsed.flags.has("--recovery")
                     ? coordinator.inspectRecovery(parsed.id ?? "")
@@ -153,9 +183,26 @@ export async function runVerifiedRunCli(args, runtime) {
                             ? coordinator.inspectTaskRecovery(parsed.id ?? "")
                             : coordinator.inspect(parsed.id ?? "");
                 break;
-            case "evidence":
-                result = coordinator.evidence(parsed.id ?? "");
+            case "status": {
+                const status = coordinator.status(parsed.id ?? "");
+                result = status;
+                // Same truth the start/publish exit codes encode: a recovered,
+                // quarantined or unverified run is never a clean exit 0.
+                exitCode = status.cleanSuccess ? 0 : 1;
                 break;
+            }
+            case "events":
+                result = coordinator.events(parsed.id ?? "");
+                break;
+            case "authority":
+                result = coordinator.inspectAuthority();
+                break;
+            case "evidence": {
+                const projection = coordinator.evidenceRead(parsed.id ?? "");
+                result = { ...projection.evidence, ...projection };
+                exitCode = projection.authenticity === "valid" && projection.verification === "passed" ? 0 : 1;
+                break;
+            }
             case "artifact": {
                 const candidate = required(parsed, "--candidate");
                 const path = required(parsed, "--path");