tines 0.0.1

package/dist/index.js

@@ -0,0 +1,2454 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { hostname as hostname2 } from "node:os";
+import { dirname as dirname3, join as join3 } from "node:path";
+import { createInterface } from "node:readline/promises";
+
+// src/daemon/daemon.ts
+import { spawn } from "node:child_process";
+import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { hostname, platform, arch } from "node:os";
+import { dirname as dirname2, join as join2 } from "node:path";
+
+// ../shared/src/types.ts
+function actorLabel(actor) {
+  if (actor.run) {
+    const ref = actor.run.issue_ref ? `run on ${actor.run.issue_ref.project_name}/${actor.run.issue_ref.number}` : `run ${actor.run.run_id}`;
+    return `${actor.user_name} via ${actor.run.runner_name} \xB7 ${ref}`;
+  }
+  return actor.api_key_name ? `${actor.user_name} via ${actor.api_key_name}` : actor.user_name;
+}
+var PROMPT_MAX_BYTES = 32 * 1024;
+var SKILL_MAX_TOTAL_BYTES = 100 * 1024;
+var AGENT_GUIDELINES_NAME = "agent-guidelines";
+var JOURNAL_NAME = "journal";
+var AGENT_GUIDELINES_BODY = `You are an agent working on a Tines issue over its HTTP API / CLI. Beyond doing the work, leave the workspace smarter than you found it. Four places to write, chosen by who should inherit what you learned:
+
+- **Issue comments** \u2014 all prose about this issue: progress, findings, dead ends, questions, and instructions for whoever picks it up next. \`tines issues comment <project>/<number> "<markdown>"\`
+- **Issue context (artifacts)** \u2014 things this issue needs *attached*, not said: a skill, a repo/branch pin, or an override of a broader item (reuse its name): \`tines context create --kind <k> --name <n> --issue <project>/<number> \u2026\`. Never notes \u2014 notes are comments.
+- **Your journal** \u2014 shared notes for anyone doing this stage of work in this project. Append a dated bullet whenever you learn something they would want: commands that actually work, gotchas, where things live (see "Journal" at the end of this prompt for the exact commands). If an entry is wrong or stale, rewrite the journal to fix it \u2014 do not append a correction on top. Keep it short; prune when you touch it.
+- **Context change requests** \u2014 never edit shared context (project-, state-, or global-scoped items) directly. Propose instead: file an issue in the project you are working in, titled \`Context change: <scope label>\`, naming the item (kind, name, scope) with the full proposed text in the description. A human reviews and applies it.
+
+When in doubt: comment. If the lesson outlives this issue, journal it. Only file a context change when a shared rule is wrong or missing.`;
+var AGENT_GUIDELINES_DESCRIPTION = "How agents should use comments, artifacts, the journal, and context change requests";
+function repoDirFromUrl(url) {
+  const stripped = url.replace(/[?#].*$/, "").replace(/\/+$/, "");
+  const lastSlash = Math.max(stripped.lastIndexOf("/"), stripped.lastIndexOf(":"));
+  const base = stripped.slice(lastSlash + 1).replace(/\.git$/, "");
+  if (!base || base === "." || base === ".." || base.includes("\\") || base.includes("=")) return "repo";
+  return base;
+}
+var MODEL_TIERS = ["smartest", "balanced", "cheapest"];
+var RUNNER_ONLINE_WINDOW_MS = 2 * 60 * 1e3;
+var RUNNER_OFFLINE_FAIL_MS = 5 * 60 * 1e3;
+var LAUNCH_STALL_MS = 5 * 60 * 1e3;
+var RUN_KEY_SLACK_MS = 10 * 60 * 1e3;
+var RUN_LOG_MAX_BYTES = 256 * 1024;
+function runDurationLabel(run, now = Date.now()) {
+  if (!run.started_at) return "\u2014";
+  const seconds = Math.max(0, Math.round(((run.ended_at ?? now) - run.started_at) / 1e3));
+  return seconds < 60 ? `${seconds}s` : `${Math.floor(seconds / 60)}m`;
+}
+function utilizationLabel(quota2, activeRuns, stateName = (id) => id) {
+  if (quota2.type === "global_cap") {
+    return `${activeRuns.length}/${quota2.limit} global slot${quota2.limit === 1 ? "" : "s"} in use`;
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const run of activeRuns) {
+    const entry = counts.get(run.state_id_at_start) ?? {
+      name: run.state_at_start_name ?? stateName(run.state_id_at_start),
+      n: 0
+    };
+    entry.n += 1;
+    counts.set(run.state_id_at_start, entry);
+  }
+  for (const stateId of Object.keys(quota2.overrides)) {
+    if (!counts.has(stateId)) counts.set(stateId, { name: stateName(stateId), n: 0 });
+  }
+  if (counts.size === 0) return `no active runs (roster default ${quota2.default_limit} per state)`;
+  return [...counts.entries()].map(([stateId, { name, n }]) => `${name} ${n}/${quota2.overrides[stateId] ?? quota2.default_limit}`).join(" \xB7 ");
+}
+
+// ../shared/src/client.ts
+var ApiError = class extends Error {
+  status;
+  code;
+  details;
+  constructor(status, body, fallback) {
+    super(body?.message ?? fallback);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = body?.code ?? "unknown";
+    this.details = body?.details;
+  }
+};
+function query(params) {
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== "" && value !== null) search.set(key, String(value));
+  }
+  const s = search.toString();
+  return s ? `?${s}` : "";
+}
+function createApiClient(options) {
+  const base = options.baseUrl.replace(/\/+$/, "");
+  const fetchFn = options.fetch ?? globalThis.fetch;
+  async function request(method, path, body) {
+    const headers = { accept: "application/json" };
+    if (options.apiKey) headers.authorization = `Bearer ${options.apiKey}`;
+    if (body !== void 0) headers["content-type"] = "application/json";
+    const res = await fetchFn(`${base}${path}`, {
+      method,
+      headers,
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+    if (!res.ok) {
+      let parsed = null;
+      try {
+        parsed = (await res.json()).error ?? null;
+      } catch {
+      }
+      throw new ApiError(res.status, parsed, `${method} ${path} failed: ${res.status}`);
+    }
+    if (res.status === 204) return void 0;
+    return await res.json();
+  }
+  const get = (path) => request("GET", path);
+  return {
+    getTime: () => get("/api/time"),
+    // Projects
+    listProjects: (page = {}) => get(`/api/v1/projects${query(page)}`),
+    createProject: (body) => request("POST", "/api/v1/projects", body),
+    getProject: (id) => get(`/api/v1/projects/${id}`),
+    updateProject: (id, body) => request("PATCH", `/api/v1/projects/${id}`, body),
+    deleteProject: (id, body) => request("DELETE", `/api/v1/projects/${id}`, body),
+    // Workflows
+    listWorkflows: (page = {}) => get(`/api/v1/workflows${query(page)}`),
+    createWorkflow: (body) => request("POST", "/api/v1/workflows", body),
+    getWorkflow: (id) => get(`/api/v1/workflows/${id}`),
+    updateWorkflow: (id, body) => request("PATCH", `/api/v1/workflows/${id}`, body),
+    deleteWorkflow: (id, body) => request("DELETE", `/api/v1/workflows/${id}`, body),
+    // Issues
+    listIssues: (filters = {}) => get(`/api/v1/issues${query(filters)}`),
+    listProjectIssues: (projectId, filters = {}) => get(`/api/v1/projects/${projectId}/issues${query(filters)}`),
+    createIssue: (projectId, body) => request("POST", `/api/v1/projects/${projectId}/issues`, body),
+    getIssue: (id) => get(`/api/v1/issues/${id}`),
+    getIssueByNumber: (projectId, number) => get(`/api/v1/projects/${projectId}/issues/${number}`),
+    updateIssue: (id, body) => request("PATCH", `/api/v1/issues/${id}`, body),
+    transitionIssue: (id, body) => request("POST", `/api/v1/issues/${id}/transition`, body),
+    /** Un-park: clears needs_attention, resets the attempt count. */
+    resumeIssue: (id) => request("POST", `/api/v1/issues/${id}/resume`),
+    /** The dispatch explainer: "why isn't this running?". */
+    getIssueDispatch: (id) => get(`/api/v1/issues/${id}/dispatch`),
+    // Issue links (dependencies & duplicates)
+    addIssueLink: (issueId, body) => request("POST", `/api/v1/issues/${issueId}/links`, body),
+    removeIssueLink: (issueId, linkId) => request("DELETE", `/api/v1/issues/${issueId}/links/${linkId}`),
+    // Comments
+    listComments: (issueId, page = {}) => get(`/api/v1/issues/${issueId}/comments${query(page)}`),
+    createComment: (issueId, body) => request("POST", `/api/v1/issues/${issueId}/comments`, body),
+    // Scheduled tasks
+    listSchedules: (filters = {}) => get(`/api/v1/schedules${query(filters)}`),
+    listProjectSchedules: (projectId, page = {}) => get(`/api/v1/projects/${projectId}/schedules${query(page)}`),
+    getSchedule: (id) => get(`/api/v1/schedules/${id}`),
+    updateSchedule: (id, body) => request("PATCH", `/api/v1/schedules/${id}`, body),
+    deleteSchedule: (id) => request("DELETE", `/api/v1/schedules/${id}`),
+    /** Run now: creates an instance immediately (gate-respecting; 422 when blocked). */
+    runSchedule: (id) => request("POST", `/api/v1/schedules/${id}/run`),
+    // Context items
+    listContext: (filters = {}) => get(`/api/v1/context${query(filters)}`),
+    createContextItem: (body) => request("POST", "/api/v1/context", body),
+    getContextItem: (id) => get(`/api/v1/context/${id}`),
+    updateContextItem: (id, body) => request("PATCH", `/api/v1/context/${id}`, body),
+    deleteContextItem: (id) => request("DELETE", `/api/v1/context/${id}`),
+    /** Atomic append to a prompt item's body (blank-line separated). */
+    appendContextItem: (id, body) => request("POST", `/api/v1/context/${id}/append`, body),
+    /** Effective context for an issue: the assembled bundle. */
+    getIssueContext: (issueId) => get(`/api/v1/issues/${issueId}/context`),
+    /** Launch prompt: stitched context plus the generated issue block. */
+    getIssuePrompt: (issueId) => get(`/api/v1/issues/${issueId}/prompt`),
+    // Events
+    listEvents: (filters = {}) => get(`/api/v1/events${query(filters)}`),
+    // Runners
+    listRunners: () => get("/api/v1/runners"),
+    createRunner: (body) => request("POST", "/api/v1/runners", body),
+    getRunner: (id) => get(`/api/v1/runners/${id}`),
+    updateRunner: (id, body) => request("PATCH", `/api/v1/runners/${id}`, body),
+    /** Reject-by-default: 422 names referencing rules/pins unless `force`. */
+    deleteRunner: (id, body) => request("DELETE", `/api/v1/runners/${id}`, body),
+    /** Create/reconnect a local runner; the response's token is shown once. */
+    registerRunner: (body) => request("POST", "/api/v1/runners/register", body),
+    /** Invalidate the runner token and mint a fresh one (shown once). */
+    rotateRunnerToken: (id) => request("POST", `/api/v1/runners/${id}/rotate-token`),
+    // Local runner protocol (runner-token auth: construct the client with
+    // the runner token as `apiKey`)
+    pollRunner: (id, body) => request("POST", `/api/v1/runners/${id}/poll`, body),
+    appendRunLog: (runId, body) => request("POST", `/api/v1/runs/${runId}/logs`, body),
+    finishRun: (runId, body) => request("POST", `/api/v1/runs/${runId}/finish`, body),
+    // Agent runs
+    listRuns: (filters = {}) => get(`/api/v1/runs${query(filters)}`),
+    getRun: (id) => get(`/api/v1/runs/${id}`),
+    cancelRun: (id) => request("POST", `/api/v1/runs/${id}/cancel`),
+    // Routing rules (one per exact scope; responses carry shadow hints)
+    listRoutingRules: () => get("/api/v1/routing-rules"),
+    createRoutingRule: (body) => request("POST", "/api/v1/routing-rules", body),
+    updateRoutingRule: (id, body) => request("PATCH", `/api/v1/routing-rules/${id}`, body),
+    deleteRoutingRule: (id) => request("DELETE", `/api/v1/routing-rules/${id}`),
+    // Supervisor settings
+    getSupervisorSettings: () => get("/api/v1/supervisor/settings"),
+    updateSupervisorSettings: (body) => request("PUT", "/api/v1/supervisor/settings", body),
+    // API keys (create/revoke require a browser session, not a key)
+    listApiKeys: () => get("/api/v1/api-keys"),
+    createApiKey: (body) => request("POST", "/api/v1/api-keys", body),
+    revokeApiKey: (id) => request("DELETE", `/api/v1/api-keys/${id}`)
+  };
+}
+
+// ../shared/src/schedule.ts
+var WEEKDAY_NAMES = [
+  "Sunday",
+  "Monday",
+  "Tuesday",
+  "Wednesday",
+  "Thursday",
+  "Friday",
+  "Saturday"
+];
+function describeRecurrence(preset, cron) {
+  if (preset) {
+    switch (preset.kind) {
+      case "hourly": {
+        const every = preset.every_hours ?? 1;
+        const at = preset.minute ? ` at :${String(preset.minute).padStart(2, "0")}` : "";
+        return every === 1 ? `Every hour${at}` : `Every ${every} hours${at}`;
+      }
+      case "daily":
+        return `Every day at ${preset.time}`;
+      case "weekly":
+        return `Every ${WEEKDAY_NAMES[preset.weekday ?? 0]} at ${preset.time}`;
+      case "monthly":
+        return `Monthly on day ${preset.day_of_month} at ${preset.time}`;
+    }
+  }
+  return `Cron \u201C${cron}\u201D`;
+}
+var PLACEHOLDER_DESCRIPTIONS = {
+  date: "run date, e.g. 2026-08-23",
+  time: "run time, e.g. 09:30",
+  datetime: "date and time together",
+  schedule_name: "the schedule's name",
+  count: "how many instances it has created, starting at 1"
+};
+var TEMPLATE_PLACEHOLDERS = Object.keys(PLACEHOLDER_DESCRIPTIONS).map((key) => ({ key, description: PLACEHOLDER_DESCRIPTIONS[key] }));
+
+// src/daemon/store.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+function defaultConfigDir() {
+  return process.env.TINES_CONFIG_DIR ?? join(homedir(), ".config", "tines");
+}
+function readJsonFile(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeJsonFile(path, value, { secret = false } = {}) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, secret ? { mode: 384 } : {});
+}
+function credentialsKey(url, name) {
+  return `${url.replace(/\/+$/, "")}#${name}`;
+}
+function credentialsPath(dir) {
+  return join(dir, "runners.json");
+}
+function loadRunnerCredentials(dir, url, name) {
+  const all = readJsonFile(credentialsPath(dir));
+  const entry = all?.[credentialsKey(url, name)];
+  return entry && typeof entry.runner_id === "string" && typeof entry.token === "string" ? entry : null;
+}
+function saveRunnerCredentials(dir, url, name, creds) {
+  const path = credentialsPath(dir);
+  const all = readJsonFile(path) ?? {};
+  all[credentialsKey(url, name)] = creds;
+  writeJsonFile(path, all, { secret: true });
+}
+function hasRunnerCredentials(dir, url, name) {
+  return loadRunnerCredentials(dir, url, name) !== null;
+}
+function clearRunnerCredentials(dir, url, name) {
+  const path = credentialsPath(dir);
+  const all = readJsonFile(path) ?? {};
+  delete all[credentialsKey(url, name)];
+  writeJsonFile(path, all, { secret: true });
+}
+function daemonStatePath(dir, runnerId) {
+  return join(dir, `daemon-state-${runnerId}.json`);
+}
+function loadDaemonState(path) {
+  const state = readJsonFile(path);
+  if (!state || !Array.isArray(state.runs)) return [];
+  return state.runs.filter(
+    (e) => typeof e === "object" && e !== null && typeof e.run_id === "string" && typeof e.pid === "number" && typeof e.workspace === "string"
+  );
+}
+function saveDaemonState(path, runs) {
+  writeJsonFile(path, { runs });
+}
+function processStartTimeMs(pid) {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    const afterComm = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+    const startTicks = Number(afterComm[19]);
+    const btimeLine = readFileSync("/proc/stat", "utf8").split("\n").find((line) => line.startsWith("btime "));
+    const btime = Number(btimeLine?.slice("btime ".length));
+    if (!Number.isFinite(startTicks) || !Number.isFinite(btime)) return null;
+    return btime * 1e3 + startTicks / 100 * 1e3;
+  } catch {
+    return null;
+  }
+}
+
+// src/daemon/support.ts
+var HARNESS_KINDS = ["claude_code", "codex", "custom"];
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function expandCommandTemplate(template, input) {
+  return template.replaceAll("{prompt_file}", shellQuote(input.promptFile)).replaceAll("{workspace}", shellQuote(input.workspace)).replaceAll("{model}", input.model ? shellQuote(input.model) : "''");
+}
+function buildHarnessInvocation(spec, input) {
+  switch (spec.harness) {
+    case "claude_code":
+      return {
+        file: "sh",
+        args: [
+          "-c",
+          `claude -p${input.model ? ` --model ${shellQuote(input.model)}` : ""} < ${shellQuote(input.promptFile)}`
+        ]
+      };
+    case "codex":
+      return {
+        file: "codex",
+        args: ["exec", ...input.model ? ["--model", input.model] : [], input.prompt]
+      };
+    case "custom": {
+      if (!spec.command) throw new Error("the custom harness needs a --command template");
+      return { file: "sh", args: ["-c", expandCommandTemplate(spec.command, input)] };
+    }
+  }
+}
+var RunTable = class {
+  constructor(effects) {
+    this.effects = effects;
+  }
+  effects;
+  runs = /* @__PURE__ */ new Map();
+  get size() {
+    return this.runs.size;
+  }
+  ids() {
+    return [...this.runs.keys()];
+  }
+  values() {
+    return [...this.runs.values()];
+  }
+  has(runId) {
+    return this.runs.has(runId);
+  }
+  track(run) {
+    this.runs.set(run.runId, run);
+    this.effects.persist();
+  }
+  /** Call after setting a run's pid so the state file reflects it. */
+  persist() {
+    this.effects.persist();
+  }
+  /** Removes the run and releases its local traces. Safe to call twice. */
+  cleanup(run) {
+    this.runs.delete(run.runId);
+    this.effects.persist();
+    this.effects.release(run);
+  }
+  /**
+   * Ends a run: flush logs, finish-report, clean up. On a run someone
+   * already settled (a poll-cancel racing a clone failure or spawn error)
+   * this still cleans up — the slot, workspace, and state entry must never
+   * outlive the run — but reports nothing.
+   */
+  async finishAndCleanup(run, status, error) {
+    if (run.settled) return this.cleanup(run);
+    run.settled = true;
+    await run.flush?.();
+    try {
+      await this.effects.finish(run, status, error);
+      this.effects.log(`run ${run.runId} finished: ${status}${error ? ` (${error})` : ""}`);
+    } catch (err) {
+      this.effects.log(
+        `finish report for run ${run.runId} not accepted: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    this.cleanup(run);
+  }
+  /**
+   * Marks a supervisor-settled run (`cancels`): kill, do NOT finish-report.
+   * Returns the run for the caller to kill when it was live; null when
+   * unknown or already settled. A run with no pid yet (still materializing)
+   * is cleaned up by the launch path's next settled check.
+   */
+  markCanceled(runId) {
+    const run = this.runs.get(runId);
+    if (!run || run.settled) return null;
+    run.canceled = true;
+    run.settled = true;
+    return run;
+  }
+};
+var LogBatcher = class {
+  constructor(send, opts = {}) {
+    this.send = send;
+    this.opts = opts;
+  }
+  send;
+  opts;
+  buffer = "";
+  timer = null;
+  sending = Promise.resolve();
+  append(text) {
+    if (!text) return;
+    this.buffer += text;
+    if (Buffer.byteLength(this.buffer, "utf8") >= (this.opts.maxBytes ?? 8 * 1024)) {
+      void this.flush();
+    } else if (!this.timer) {
+      this.timer = setTimeout(() => void this.flush(), this.opts.intervalMs ?? 2e3);
+      this.timer.unref?.();
+    }
+  }
+  /** Sends whatever is buffered now; resolves when every send so far settled. */
+  flush() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    const chunk = this.buffer;
+    this.buffer = "";
+    if (chunk) {
+      this.sending = this.sending.then(() => this.send(chunk)).catch((err) => this.opts.onError?.(err));
+    }
+    return this.sending;
+  }
+};
+
+// src/daemon/daemon.ts
+var log = (message2) => console.log(`[${(/* @__PURE__ */ new Date()).toISOString().slice(11, 19)}] ${message2}`);
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function killTree(pid, signal) {
+  try {
+    process.kill(-pid, signal);
+  } catch {
+    try {
+      process.kill(pid, signal);
+    } catch {
+    }
+  }
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function runDaemon(opts) {
+  mkdirSync2(opts.configDir, { recursive: true });
+  let creds = loadRunnerCredentials(opts.configDir, opts.url, opts.name);
+  if (creds) {
+    log(`reconnecting as runner "${opts.name}" (${creds.runner_id}) \u2014 token from ${opts.configDir}`);
+  } else {
+    if (!opts.apiKey) {
+      throw new Error(
+        `no stored runner token for "${opts.name}" at ${opts.url} \u2014 set TINES_API_KEY (a user API key) to register`
+      );
+    }
+    const userClient = createApiClient({ baseUrl: opts.url, apiKey: opts.apiKey });
+    const registered = await userClient.registerRunner({
+      name: opts.name,
+      harness: opts.harness,
+      ...opts.command !== void 0 ? { command: opts.command } : {},
+      max_concurrent: opts.maxConcurrent,
+      hostname: hostname(),
+      platform: `${platform()} ${arch()}`
+    });
+    creds = { runner_id: registered.runner.id, token: registered.runner_token };
+    saveRunnerCredentials(opts.configDir, opts.url, opts.name, creds);
+    log(`registered runner "${opts.name}" (${creds.runner_id}); token stored in ${opts.configDir}`);
+  }
+  const client2 = createApiClient({ baseUrl: opts.url, apiKey: creds.token });
+  const statePath = daemonStatePath(opts.configDir, creds.runner_id);
+  let shuttingDown = false;
+  const table2 = new RunTable({
+    finish: async (run, status, error) => {
+      await client2.finishRun(run.runId, { status, ...error ? { error } : {} });
+    },
+    release: (run) => {
+      if (run.timeout) clearTimeout(run.timeout);
+      rmSync(run.workspace, { recursive: true, force: true });
+    },
+    persist: () => {
+      const entries = table2.values().filter((run) => run.child?.pid !== void 0).map((run) => ({
+        run_id: run.runId,
+        pid: run.child.pid,
+        workspace: run.workspace,
+        key_fingerprint: run.keyFingerprint,
+        started_at: run.spawnedAt
+      }));
+      saveDaemonState(statePath, entries);
+    },
+    log
+  });
+  for (const orphan of loadDaemonState(statePath)) {
+    if (pidAlive(orphan.pid)) {
+      const processStart = processStartTimeMs(orphan.pid);
+      const reused = processStart !== null && orphan.started_at !== void 0 && processStart > orphan.started_at + 6e4;
+      if (reused) {
+        log(`state-file pid ${orphan.pid} (run ${orphan.run_id}) was recycled; not killing it`);
+      } else {
+        log(`killing orphaned harness from a previous life: run ${orphan.run_id} (pid ${orphan.pid})`);
+        killTree(orphan.pid, "SIGKILL");
+      }
+    }
+    try {
+      await client2.finishRun(orphan.run_id, {
+        status: "failed",
+        error: "daemon restarted; orphaned harness killed"
+      });
+    } catch {
+    }
+    rmSync(orphan.workspace, { recursive: true, force: true });
+  }
+  saveDaemonState(statePath, []);
+  const killWithoutFinish = (runId) => {
+    const run = table2.markCanceled(runId);
+    if (!run) return;
+    log(`supervisor canceled run ${runId}; killing without finish-reporting`);
+    if (run.child?.pid) {
+      const pid = run.child.pid;
+      killTree(pid, "SIGTERM");
+      setTimeout(() => killTree(pid, "SIGKILL"), 5e3).unref?.();
+    }
+  };
+  const launch = async (assignment) => {
+    const runId = assignment.run.id;
+    if (table2.has(runId)) return;
+    const workspace = join2(opts.configDir, "workspaces", runId);
+    const run = {
+      runId,
+      workspace,
+      canceled: false,
+      timedOut: false,
+      settled: false,
+      keyFingerprint: assignment.run_key.slice(0, 14),
+      batcher: new LogBatcher((chunk) => client2.appendRunLog(runId, { chunk }).then(() => {
+      }), {
+        onError: (err) => log(`log append for run ${runId} failed: ${message(err)}`)
+      })
+    };
+    run.flush = () => run.batcher.flush();
+    table2.track(run);
+    log(`run ${runId} assigned (issue ${assignment.run.issue_ref ? `${assignment.run.issue_ref.project_name}/${assignment.run.issue_ref.number}` : assignment.run.issue_id}); materializing workspace`);
+    try {
+      rmSync(workspace, { recursive: true, force: true });
+      mkdirSync2(workspace, { recursive: true });
+      writeFileSync2(join2(workspace, "prompt.md"), `${assignment.prompt}
+`);
+      for (const skill of assignment.bundle.skills) {
+        for (const file of skill.files) {
+          const target = join2(workspace, "skills", skill.name, file.path);
+          mkdirSync2(dirname2(target), { recursive: true });
+          writeFileSync2(target, file.content);
+        }
+      }
+      writeFileSync2(
+        join2(workspace, "repos.json"),
+        `${JSON.stringify(assignment.bundle.repos, null, 2)}
+`
+      );
+      for (const repo of assignment.bundle.repos) {
+        if (run.settled) return table2.cleanup(run);
+        const args = ["clone", ...repo.branch ? ["--branch", repo.branch] : [], repo.url, repo.dir];
+        run.batcher.append(`$ git ${args.join(" ")}
+`);
+        const result = await runGit(args, workspace, run.batcher);
+        if (result !== 0) {
+          return table2.finishAndCleanup(run, "failed", `git clone failed for ${repo.url} (exit ${result})`);
+        }
+      }
+      if (run.settled) return table2.cleanup(run);
+      const invocation = buildHarnessInvocation(
+        { harness: opts.harness, command: opts.command },
+        {
+          workspace,
+          promptFile: join2(workspace, "prompt.md"),
+          prompt: assignment.prompt,
+          model: assignment.run.model
+        }
+      );
+      const child = spawn(invocation.file, invocation.args, {
+        cwd: workspace,
+        env: { ...process.env, TINES_API_KEY: assignment.run_key, TINES_API_URL: opts.url },
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: true
+      });
+      run.child = child;
+      run.spawnedAt = Date.now();
+      table2.persist();
+      log(`run ${runId}: launched ${invocation.file} (pid ${child.pid})`);
+      child.stdout?.on("data", (data) => run.batcher.append(data.toString("utf8")));
+      child.stderr?.on("data", (data) => run.batcher.append(data.toString("utf8")));
+      run.timeout = setTimeout(
+        () => {
+          if (run.settled) return;
+          log(`run ${runId} hit its ${assignment.timeout_minutes}m timeout; killing`);
+          run.timedOut = true;
+          if (child.pid) killTree(child.pid, "SIGTERM");
+          if (child.pid) setTimeout(() => killTree(child.pid, "SIGKILL"), 5e3).unref?.();
+        },
+        assignment.timeout_minutes * 6e4
+      );
+      child.on("error", (err) => {
+        void table2.finishAndCleanup(run, "failed", `failed to launch harness: ${message(err)}`);
+      });
+      child.on("exit", (code, signal) => {
+        if (run.timedOut) {
+          void table2.finishAndCleanup(
+            run,
+            "failed",
+            `run exceeded the ${assignment.timeout_minutes}m timeout; harness killed`
+          );
+        } else if (code === 0) {
+          void table2.finishAndCleanup(run, "completed");
+        } else {
+          void table2.finishAndCleanup(
+            run,
+            "failed",
+            signal ? `harness killed by ${signal}` : `harness exited with code ${code}`
+          );
+        }
+      });
+    } catch (err) {
+      void table2.finishAndCleanup(run, "failed", `workspace setup failed: ${message(err)}`);
+    }
+  };
+  const shutdown = async () => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    log("shutting down; failing in-flight runs");
+    await Promise.all(
+      table2.values().map(async (run) => {
+        if (run.child?.pid) killTree(run.child.pid, "SIGTERM");
+        await table2.finishAndCleanup(run, "failed", "daemon shut down");
+      })
+    );
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown());
+  process.on("SIGTERM", () => void shutdown());
+  log(
+    `polling ${opts.url} every ${Math.round(opts.pollIntervalMs / 1e3)}s (harness ${opts.harness}, max ${opts.maxConcurrent} concurrent) \u2014 Ctrl-C to stop`
+  );
+  let failures = 0;
+  while (!shuttingDown) {
+    try {
+      const res = await client2.pollRunner(creds.runner_id, {
+        owned_runs: table2.ids(),
+        max_concurrent: opts.maxConcurrent
+      });
+      failures = 0;
+      for (const runId of res.cancels) killWithoutFinish(runId);
+      for (const assignment of res.assignments) {
+        if (table2.size >= opts.maxConcurrent) {
+          log(
+            `warning: supervisor delivered ${assignment.run.id} beyond --max-concurrent ${opts.maxConcurrent}; launching anyway (the server cap governs)`
+          );
+        }
+        void launch(assignment);
+      }
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 401) {
+        for (const run of table2.values()) {
+          if (run.child?.pid) killTree(run.child.pid, "SIGKILL");
+          rmSync(run.workspace, { recursive: true, force: true });
+        }
+        saveDaemonState(statePath, []);
+        clearRunnerCredentials(opts.configDir, opts.url, opts.name);
+        throw new Error(
+          `the supervisor rejected this runner's token (was it rotated?) \u2014 the stored token was dropped; restart with the new token via \`tines runners rotate-token ${opts.name}\` on this machine, or with TINES_API_KEY set to re-register`
+        );
+      }
+      failures += 1;
+      log(`poll failed (${message(err)}); retrying with backoff`);
+    }
+    const backoff = Math.min(
+      opts.pollIntervalMs * 2 ** Math.min(failures, 3),
+      Math.max(6e4, opts.pollIntervalMs * 5)
+    );
+    await sleep(failures > 0 ? backoff : opts.pollIntervalMs);
+  }
+}
+function message(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function runGit(args, cwd, batcher) {
+  return new Promise((resolve) => {
+    const child = spawn("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    child.stdout?.on("data", (data) => batcher.append(data.toString("utf8")));
+    child.stderr?.on("data", (data) => batcher.append(data.toString("utf8")));
+    child.on("error", () => resolve(127));
+    child.on("exit", (code) => resolve(code ?? 1));
+  });
+}
+
+// src/help-guard.ts
+function helpGuard(command, markdown) {
+  if (markdown === "--help" || markdown === "-h") {
+    command.help();
+    return true;
+  }
+  return false;
+}
+
+// src/index.ts
+import { Command } from "commander";
+var DEFAULT_URL = "http://localhost:5173";
+function withCommon(cmd, { baseUrlFlag = true } = {}) {
+  if (baseUrlFlag) {
+    cmd.option(
+      "-u, --url <url>",
+      `base URL of the Tines API (or set TINES_API_URL; default ${DEFAULT_URL})`
+    );
+  }
+  return cmd.option("--api-key <key>", "API key (or set TINES_API_KEY)").option("--json", "output the raw JSON response");
+}
+function withList(cmd) {
+  return withCommon(
+    cmd.option("--limit <n>", "maximum items to return", (v) => Number.parseInt(v, 10)).option("--cursor <cursor>", "resume from the next_cursor of a previous page")
+  );
+}
+function resolveUrl(opts) {
+  return opts.url ?? process.env.TINES_API_URL ?? DEFAULT_URL;
+}
+function resolveApiKey(opts) {
+  return opts.apiKey ?? process.env.TINES_API_KEY;
+}
+function client(opts) {
+  return createApiClient({ baseUrl: resolveUrl(opts), apiKey: resolveApiKey(opts) });
+}
+function die(message2) {
+  console.error(`error: ${message2}`);
+  process.exit(1);
+}
+function reportError(err) {
+  if (err instanceof ApiError) {
+    let message2 = `${err.message} (${err.code})`;
+    const allowed = err.details?.allowed_transitions;
+    if (Array.isArray(allowed)) {
+      const actions = allowed.map((t) => {
+        const at = t;
+        return at.to_state ? `"${at.name}" \u2192 ${at.to_state.name}` : `"${at.name}"`;
+      });
+      message2 += actions.length > 0 ? `
+allowed actions: ${actions.join(", ")}` : "\nallowed actions: none (terminal state)";
+    }
+    die(message2);
+  }
+  die(err instanceof Error ? err.message : String(err));
+}
+function printJson(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+function printList(res, opts, render) {
+  if (opts.json) return printJson(res);
+  render(res.items);
+  if (res.next_cursor) console.log(`
+more results: rerun with --cursor ${res.next_cursor}`);
+}
+function table(rows) {
+  if (rows.length === 0) return;
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+  for (const row of rows) {
+    console.log(row.map((cell, i) => cell.padEnd(widths[i])).join("  ").trimEnd());
+  }
+}
+function timestamp(ms) {
+  return new Date(ms).toISOString().replace("T", " ").slice(0, 19);
+}
+function parseJsonObject(raw, source) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch (err) {
+    die(`invalid JSON from ${source}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    die(`expected a JSON object from ${source}`);
+  }
+  return value;
+}
+function readJsonBody(inline, file) {
+  if (inline !== void 0 && file !== void 0) {
+    die("pass the JSON inline or with --file, not both");
+  }
+  if (inline !== void 0) return parseJsonObject(inline, "the argument");
+  if (file !== void 0 && file !== "-") {
+    let raw;
+    try {
+      raw = readFileSync2(file, "utf8");
+    } catch (err) {
+      die(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return parseJsonObject(raw, file);
+  }
+  if (file === "-" || !process.stdin.isTTY) {
+    const raw = readFileSync2(0, "utf8");
+    if (raw.trim() === "") {
+      if (file === "-") die("no JSON on stdin");
+      return void 0;
+    }
+    return parseJsonObject(raw, "stdin");
+  }
+  return void 0;
+}
+function assertNewStatesHavePrompts(states, prompts) {
+  if (prompts === false || !Array.isArray(states)) return;
+  const missing = states.filter((s) => typeof s === "object" && s !== null).filter((s) => s.id === void 0 && !String(s.prompt ?? "").trim()).map((s) => typeof s.name === "string" ? s.name : "?");
+  if (missing.length > 0) {
+    die(
+      `new state${missing.length === 1 ? "" : "s"} ${missing.map((n) => `"${n}"`).join(", ")} ${missing.length === 1 ? "has" : "have"} no initial prompt \u2014 issues sitting in a state inherit its context
+  add "prompt": "<markdown>" to each new state in the JSON (its stage instructions), or pass --no-prompts to skip`
+    );
+  }
+}
+var WORKFLOW_JSON_HELP = `
+The JSON body may be passed inline, via --file <path>, --file - (stdin), or
+piped on stdin. Shape:
+
+  {
+    "name": "Review",
+    "description": "Two-step review",
+    "initial_state": "Draft",
+    "states": [
+      { "name": "Draft", "category": "active", "prompt": "Drafting means\u2026" },
+      { "name": "In review", "category": "awaiting_human", "prompt": "Review checklist\u2026" },
+      { "name": "Done", "category": "done", "prompt": "\u2026" }
+    ],
+    "transitions": [
+      { "name": "submit", "from": "Draft", "to": "In review" },
+      { "name": "approve", "from": "In review", "to": "Done" },
+      { "name": "send back", "from": "In review", "to": "Draft" }
+    ]
+  }
+
+Categories: backlog, active, awaiting_human, done. On edit, a state with an
+"id" updates that existing state; states/transitions arrays replace the
+existing sets wholesale when present.
+
+Each NEW state should carry a "prompt" \u2014 its initial stage instructions,
+created as a state-scoped context item \u2014 or pass --no-prompts to skip.
+`;
+async function resolveProject(api, ref) {
+  const { items } = await api.listProjects();
+  const byId = items.find((p) => p.id === ref);
+  if (byId) return byId;
+  const byName = items.filter((p) => p.name === ref);
+  if (byName.length === 1) return byName[0];
+  if (byName.length > 1) {
+    die(`project name "${ref}" is ambiguous; use an id: ${byName.map((p) => p.id).join(", ")}`);
+  }
+  die(`no project named "${ref}" (have: ${items.map((p) => p.name).join(", ") || "none"})`);
+}
+async function resolveWorkflow(api, ref) {
+  const { items } = await api.listWorkflows();
+  const found = items.find((w) => w.id === ref) ?? (items.filter((w) => w.name === ref).length === 1 ? items.find((w) => w.name === ref) : void 0);
+  if (found) return found;
+  if (items.filter((w) => w.name === ref).length > 1) {
+    die(`workflow name "${ref}" is ambiguous; use an id`);
+  }
+  die(`no workflow "${ref}" (have: ${items.map((w) => `${w.name} [${w.id}]`).join(", ")})`);
+}
+function parseScheduleRef(ref) {
+  const sep = ref.indexOf("/");
+  if (sep < 1 || sep === ref.length - 1) {
+    die(`schedule reference must look like <project>/<name>, got "${ref}"`);
+  }
+  return { project: ref.slice(0, sep), name: ref.slice(sep + 1) };
+}
+async function resolveSchedule(api, ref) {
+  const { project, name } = parseScheduleRef(ref);
+  const proj = await resolveProject(api, project);
+  const { items } = await api.listProjectSchedules(proj.id, { limit: 100 });
+  const found = items.find((s) => s.name === name) ?? items.find((s) => s.id === name);
+  if (!found) {
+    die(
+      `no schedule "${name}" in project "${proj.name}" (have: ${items.map((s) => s.name).join(", ") || "none"})`
+    );
+  }
+  return found;
+}
+function parseIssueRef(ref) {
+  const match = ref.match(/^(.+)\/(\d+)$/);
+  if (!match) die(`issue reference must look like <project>/<number>, got "${ref}"`);
+  return { project: match[1], number: Number.parseInt(match[2], 10) };
+}
+async function resolveIssue(api, ref) {
+  const { project, number } = parseIssueRef(ref);
+  const proj = await resolveProject(api, project);
+  return api.getIssueByNumber(proj.id, number);
+}
+async function resolveStateFlag(api, ref) {
+  const sep = ref.indexOf("/");
+  if (sep < 1 || sep === ref.length - 1) {
+    die(`--state must look like <workflow>/<state>, got "${ref}"`);
+  }
+  const workflow = await resolveWorkflow(api, ref.slice(0, sep));
+  const stateRef = ref.slice(sep + 1);
+  const state = workflow.states.find((s) => s.name === stateRef) ?? workflow.states.find((s) => s.id === stateRef);
+  if (!state) {
+    die(
+      `workflow "${workflow.name}" has no state "${stateRef}" (have: ${workflow.states.map((s) => s.name).join(", ")})`
+    );
+  }
+  return { workflow, state };
+}
+async function resolveScopeFlags(api, opts) {
+  const scope = {};
+  if (opts.project !== void 0) scope.project_id = (await resolveProject(api, opts.project)).id;
+  if (opts.state !== void 0) scope.workflow_state_id = (await resolveStateFlag(api, opts.state)).state.id;
+  if (opts.issue !== void 0) scope.issue_id = (await resolveIssue(api, opts.issue)).id;
+  return scope;
+}
+function readBodyValue(value) {
+  if (value.startsWith("@@")) return value.slice(1);
+  if (value.startsWith("@")) {
+    const file = value.slice(1);
+    try {
+      return readFileSync2(file, "utf8");
+    } catch (err) {
+      die(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return value;
+}
+function parseFileSpec(spec) {
+  const sep = spec.indexOf("=");
+  if (sep < 1 || sep === spec.length - 1) {
+    die(`--file must look like <path>=@<local-file>, got "${spec}"`);
+  }
+  const path = spec.slice(0, sep);
+  const source = spec.slice(sep + 1);
+  if (!source.startsWith("@")) {
+    die(`skill file content always comes from a local file: --file ${path}=@<local-file>`);
+  }
+  const file = source.slice(1);
+  try {
+    return { path, content: readFileSync2(file, "utf8") };
+  } catch (err) {
+    die(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+var collect = (value, previous) => [...previous, value];
+function contextItemSummary(item) {
+  switch (item.kind) {
+    case "prompt":
+      return `${Buffer.byteLength(item.body ?? "", "utf8")} bytes`;
+    case "skill":
+      return `${item.file_count ?? item.files?.length ?? 0} file${(item.file_count ?? item.files?.length ?? 0) === 1 ? "" : "s"}`;
+    case "repo":
+      return `${item.repo_url}${item.repo_branch ? `#${item.repo_branch}` : ""}`;
+  }
+}
+function printContextItem(item) {
+  console.log(`${item.kind} "${item.name}"  [${item.id}]  v${item.version}`);
+  if (item.description) console.log(item.description);
+  console.log(`scope: ${item.scope.label}`);
+  console.log(`updated: ${timestamp(item.updated_at)}  created: ${timestamp(item.created_at)}`);
+  if (item.kind === "prompt") {
+    console.log(`
+${item.body}`);
+  } else if (item.kind === "skill") {
+    console.log(`
+files (seeded at skills/${item.name}/):`);
+    for (const f of item.files ?? []) {
+      console.log(`  ${f.path}  (${Buffer.byteLength(f.content, "utf8")} bytes)`);
+    }
+    if ((item.files ?? []).length === 0) console.log("  (none)");
+  } else {
+    console.log(`
+url: ${item.repo_url}`);
+    if (item.repo_branch) console.log(`branch: ${item.repo_branch}`);
+    console.log(`dir: ${item.repo_dir ?? `${repoDirFromUrl(item.repo_url ?? "")} (derived from the URL)`}`);
+  }
+}
+var systemTimezone = () => Intl.DateTimeFormat().resolvedOptions().timeZone;
+function parseWeekday(value) {
+  const trimmed = value.trim().toLowerCase();
+  if (/^\d+$/.test(trimmed)) {
+    const n = Number.parseInt(trimmed, 10);
+    if (n <= 7) return n % 7;
+    die(`--on weekday must be 0-7 or a name, got "${value}"`);
+  }
+  if (trimmed.length >= 3) {
+    const idx = WEEKDAY_NAMES.findIndex((w) => w.toLowerCase().startsWith(trimmed));
+    if (idx !== -1) return idx;
+  }
+  die(`unknown weekday "${value}" (use e.g. monday, tue, or 0-6 with 0 = Sunday)`);
+}
+function buildRecurrence(opts) {
+  const hasPresetFlags = opts.every !== void 0 || opts.at !== void 0 || opts.on !== void 0;
+  if (opts.cron !== void 0 && hasPresetFlags) {
+    die("pass --cron or --every/--at/--on, not both");
+  }
+  if (opts.cron !== void 0) return { cron: opts.cron };
+  if (!hasPresetFlags) return void 0;
+  if (opts.every === void 0) {
+    die("--at/--on set a preset time; add --every <hourly|Nh|daily|weekly|monthly>");
+  }
+  const hourly = opts.every === "hourly" ? 1 : opts.every.match(/^(\d+)h$/)?.[1];
+  if (hourly !== void 0) {
+    if (opts.on !== void 0) die("an hourly recurrence does not take --on");
+    const every = typeof hourly === "number" ? hourly : Number.parseInt(hourly, 10);
+    if (every < 1 || every > 23) die(`--every <N>h needs N between 1 and 23, got "${opts.every}"`);
+    let minute = 0;
+    if (opts.at !== void 0) {
+      const m = opts.at.match(/^:?(\d{1,2})$/);
+      if (!m || Number.parseInt(m[1], 10) > 59) {
+        die(`with an hourly recurrence, --at is the minute past the hour (0-59 or :MM), got "${opts.at}"`);
+      }
+      minute = Number.parseInt(m[1], 10);
+    }
+    return { preset: { kind: "hourly", every_hours: every, minute } };
+  }
+  const time = opts.at ?? "09:00";
+  switch (opts.every) {
+    case "daily": {
+      if (opts.on !== void 0) die("--every daily does not take --on");
+      return { preset: { kind: "daily", time } };
+    }
+    case "weekly": {
+      if (opts.on === void 0) die("--every weekly needs --on <weekday>");
+      return { preset: { kind: "weekly", time, weekday: parseWeekday(opts.on) } };
+    }
+    case "monthly": {
+      if (opts.on === void 0) die("--every monthly needs --on <day-of-month>");
+      const day = Number.parseInt(opts.on, 10);
+      if (!/^\d+$/.test(opts.on.trim()) || day < 1 || day > 31) {
+        die(`--on day-of-month must be 1-31, got "${opts.on}"`);
+      }
+      return { preset: { kind: "monthly", time, day_of_month: day } };
+    }
+    default:
+      die(`--every must be hourly, <N>h, daily, weekly, or monthly, got "${opts.every}"`);
+  }
+}
+function recurrenceLabel(schedule) {
+  return `${describeRecurrence(schedule.preset, schedule.cron)}, ${schedule.timezone}`;
+}
+function issueRef(ref) {
+  return `${ref.project_name}/${ref.number}`;
+}
+function linkRows(entries, note = () => "") {
+  return entries.map((e) => [
+    `  ${issueRef(e)}`,
+    e.title,
+    `${e.effective_state.name} (${e.effective_state.category})`,
+    note(e)
+  ]);
+}
+function printIssueLinks(links) {
+  if (links.blocked_by.length > 0) {
+    console.log("\nblocked by:");
+    table(linkRows(links.blocked_by, (e) => e.effective_state.category === "done" ? "" : "(open)"));
+  }
+  if (links.blocks.length > 0) {
+    console.log("\nblocks:");
+    table(linkRows(links.blocks));
+  }
+  if (links.duplicate_of) {
+    console.log("\nduplicate of:");
+    table(linkRows([links.duplicate_of], () => "(the state shown above follows it)"));
+  }
+  if (links.duplicated_by.length > 0) {
+    console.log("\nduplicates:");
+    table(linkRows(links.duplicated_by));
+  }
+}
+function printIssueDetail(issue) {
+  console.log(`${issue.project_name}/#${issue.number}  ${issue.title}`);
+  const dup = issue.duplicate_of;
+  console.log(
+    `state: ${issue.effective_state.name} (${issue.effective_state.category})${dup ? ` (via ${issueRef(dup)} \u2014 duplicate)` : ""}  workflow: ${issue.workflow.name}  updated: ${timestamp(issue.updated_at)}`
+  );
+  if (dup) {
+    console.log(`own state: ${issue.state.name} (${issue.state.category}) \u2014 dormant while this is a duplicate`);
+  }
+  console.log(`id: ${issue.id}`);
+  printIssueLinks(issue.links);
+  if (issue.description) {
+    console.log(`
+${issue.description}`);
+  }
+  const allowed = issue.allowed_transitions.map((t) => `"${t.name}" \u2192 ${t.to_state.name}`);
+  console.log(`
+allowed actions: ${allowed.length ? allowed.join(", ") : "none (terminal state)"}`);
+  if (issue.comments.length > 0) {
+    console.log(`
+comments (${issue.comments.length}):`);
+    for (const c of issue.comments) {
+      console.log(`
+  [${timestamp(c.created_at)}] ${actorLabel(c.actor)}:`);
+      for (const line of c.body.split("\n")) console.log(`  ${line}`);
+    }
+  }
+}
+function printWorkflowDetail(wf) {
+  console.log(`${wf.name}${wf.is_system ? " (standard, read-only)" : ""}  [${wf.id}]`);
+  if (wf.description) console.log(wf.description);
+  console.log("\nstates:");
+  const byId = new Map(wf.states.map((s) => [s.id, s]));
+  table(
+    wf.states.map((s) => [
+      `  ${s.name}`,
+      s.category,
+      s.id === wf.initial_state_id ? "(initial)" : ""
+    ])
+  );
+  console.log("\ntransitions:");
+  for (const t of wf.transitions) {
+    console.log(
+      `  "${t.name}": ${byId.get(t.from_state_id)?.name} \u2192 ${byId.get(t.to_state_id)?.name}`
+    );
+  }
+  for (const w of wf.warnings ?? []) console.log(`
+warning: ${w}`);
+}
+function eventSummary(ev) {
+  const p = ev.payload;
+  const issue = ev.issue_ref ? `${ev.issue_ref.project_name}/#${ev.issue_ref.number}` : null;
+  switch (ev.type) {
+    case "issue.created":
+      return `created ${issue}: ${p.title}${p.scheduled_task_name ? ` (via schedule "${p.scheduled_task_name}")` : ""}`;
+    case "issue.updated":
+      return `updated ${issue} (${p.changed?.join(", ")})`;
+    case "issue.transitioned":
+      return `${p.action ? `"${p.action}" on` : "moved"} ${issue}: ${p.from_state_name} \u2192 ${p.to_state_name}`;
+    case "issue.commented":
+      return `commented on ${issue}`;
+    case "project.created":
+    case "project.updated":
+    case "project.deleted":
+      return `${ev.type.split(".")[1]} project "${p.name ?? ev.project_name}"`;
+    case "workflow.created":
+    case "workflow.updated":
+    case "workflow.deleted":
+      return `${ev.type.split(".")[1]} workflow "${p.name}"`;
+    case "api_key.created":
+      return `created API key "${p.name}"`;
+    case "api_key.revoked":
+      return `revoked API key "${p.name}"`;
+    case "scheduled_task.created":
+    case "scheduled_task.updated":
+    case "scheduled_task.deleted":
+      return `${ev.type.split(".")[1]} schedule "${p.name}"`;
+    case "context.created":
+    case "context.updated":
+    case "context.deleted": {
+      const scope = p.scope;
+      const verb = ev.type.split(".")[1];
+      return `${verb} ${p.kind} "${p.name}"${scope?.label ? ` [${scope.label}]` : ""}`;
+    }
+    case "scheduled_task.skipped": {
+      const blocking = Array.isArray(p.blocking) ? p.blocking.length : 0;
+      return `skipped schedule "${p.name}" (${blocking} open instance${blocking === 1 ? "" : "s"})`;
+    }
+    case "runner.registered":
+    case "runner.updated":
+    case "runner.removed":
+      return `${ev.type.split(".")[1]} runner "${p.name}"`;
+    case "runner.errored":
+      return `runner "${p.runner_name}" failed to launch (${p.consecutive_failures} consecutive): ${p.error}`;
+    case "agent_run.started":
+      return `run started on ${issue} via ${p.runner_name} (${p.tier}${p.model ? ` \u2192 ${p.model}` : ""})`;
+    case "agent_run.ended":
+      return `run ${p.status} on ${issue} via ${p.runner_name}${p.outcome ? ` \u2014 ${p.outcome}` : ""}`;
+    case "issue.parked":
+      return `parked ${issue} after ${p.attempt_count} strikes \u2014 needs attention`;
+    case "issue.resumed":
+      return `resumed ${issue} (attempt count reset)`;
+    case "routing_rule.created":
+    case "routing_rule.updated":
+    case "routing_rule.deleted":
+      return `${ev.type.split(".")[1]} the ${p.scope_label} routing rule`;
+    case "settings.updated":
+      return `updated supervisor settings (${p.changed?.join(", ") || "no changes"})`;
+    default:
+      return ev.type;
+  }
+}
+var program = new Command();
+program.name("tines").description("CLI for Tines").version("0.0.1").enablePositionalOptions();
+withCommon(program.command("time").description("Fetch the current time from the Tines API")).action(
+  async (opts) => {
+    const result = await client(opts).getTime();
+    if (opts.json) printJson(result);
+    else console.log(`Server time: ${result.time} (unix ${result.unix})`);
+  }
+);
+var projects = program.command("projects").description("Manage projects");
+withList(projects.command("list").description("List projects")).action(async (opts) => {
+  const res = await client(opts).listProjects({ limit: opts.limit, cursor: opts.cursor });
+  printList(res, opts, (items) => {
+    if (items.length === 0) return console.log("no projects");
+    table([
+      ["NAME", "ISSUES", "ID", "CREATED"],
+      ...items.map((p) => [p.name, String(p.issue_count), p.id, timestamp(p.created_at)])
+    ]);
+  });
+});
+withCommon(
+  projects.command("create <name>").description("Create a project (with its initial context prompt)").option("-d, --description <text>", "project description").option("-w, --default-workflow <id-or-name>", "default workflow for new issues").option("--prompt <md>", "initial conventions prompt, stitched into every issue's agent prompt: inline Markdown or @file").option("--no-prompt", "create without an initial prompt")
+).action(
+  async (name, opts) => {
+    if (opts.prompt === void 0 || opts.prompt === true) {
+      die(
+        'every issue in a project inherits its context \u2014 give the project an initial prompt:\n  --prompt "<markdown>"   house conventions, inline or @file\n  --no-prompt             create without one (add later: tines context create -k prompt -n conventions -p <name> --body \u2026)'
+      );
+    }
+    const api = client(opts);
+    const workflowId = opts.defaultWorkflow ? (await resolveWorkflow(api, opts.defaultWorkflow)).id : void 0;
+    const project = await api.createProject({
+      name,
+      description: opts.description,
+      default_workflow_id: workflowId,
+      initial_prompt: typeof opts.prompt === "string" ? readBodyValue(opts.prompt) : void 0
+    });
+    if (opts.json) return printJson(project);
+    console.log(
+      `created project "${project.name}" (${project.id})${typeof opts.prompt === "string" ? ' with its "conventions" prompt' : ""}`
+    );
+  }
+);
+withCommon(projects.command("show <id-or-name>").description("Show a project")).action(
+  async (ref, opts) => {
+    const api = client(opts);
+    const project = await resolveProject(api, ref);
+    if (opts.json) return printJson(project);
+    console.log(`${project.name}  [${project.id}]`);
+    if (project.description) console.log(project.description);
+    const defaultWorkflow = project.default_workflow_id ? (await api.getWorkflow(project.default_workflow_id)).name : "(standard)";
+    console.log(`
+default workflow: ${defaultWorkflow}`);
+    console.log(
+      `issues: ${project.issue_count}  created: ${timestamp(project.created_at)}  updated: ${timestamp(project.updated_at)}`
+    );
+  }
+);
+withCommon(
+  projects.command("edit <id-or-name>").description("Edit a project").option("-n, --name <name>", "rename the project").option("-d, --description <text>", "set the description").option("-w, --default-workflow <id-or-name>", "set the default workflow for new issues").option("--no-default-workflow", "clear the default workflow (fall back to standard)")
+).action(
+  async (ref, opts) => {
+    const api = client(opts);
+    const project = await resolveProject(api, ref);
+    const body = {};
+    if (opts.name !== void 0) body.name = opts.name;
+    if (opts.description !== void 0) body.description = opts.description;
+    if (opts.defaultWorkflow === false) body.default_workflow_id = null;
+    else if (opts.defaultWorkflow !== void 0) {
+      body.default_workflow_id = (await resolveWorkflow(api, opts.defaultWorkflow)).id;
+    }
+    if (Object.keys(body).length === 0) {
+      die("nothing to update: pass --name, --description, or --[no-]default-workflow");
+    }
+    const updated = await api.updateProject(project.id, body);
+    if (opts.json) return printJson(updated);
+    console.log(`updated project "${updated.name}" (${updated.id})`);
+  }
+);
+withCommon(
+  projects.command("delete <id-or-name>").description("Delete a project (refused while it still contains issues)")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const project = await resolveProject(api, ref);
+  await api.deleteProject(project.id);
+  console.log(`deleted project "${project.name}" (${project.id})`);
+});
+var workflows = program.command("workflows").description("Manage the workflow library");
+withList(workflows.command("list").description("List the workflow library")).action(
+  async (opts) => {
+    const res = await client(opts).listWorkflows({ limit: opts.limit, cursor: opts.cursor });
+    printList(res, opts, (items) => {
+      if (items.length === 0) return console.log("no workflows");
+      table([
+        ["NAME", "STATES", "ISSUES", "ID", ""],
+        ...items.map((w) => [
+          w.name,
+          String(w.states.length),
+          String(w.issue_count),
+          w.id,
+          w.is_system ? "(standard, read-only)" : ""
+        ])
+      ]);
+    });
+  }
+);
+withCommon(
+  workflows.command("show <id-or-name>").description("Show a workflow with states and transitions")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const wf = await resolveWorkflow(api, ref);
+  if (opts.json) return printJson(wf);
+  printWorkflowDetail(wf);
+});
+withCommon(
+  workflows.command("create [json]").description('Create a workflow from a JSON definition (states carry initial "prompt" instructions)').option("-f, --file <path>", 'read the JSON definition from a file ("-" for stdin)').option("--no-prompts", 'allow states without initial "prompt" instructions').addHelpText("after", WORKFLOW_JSON_HELP)
+).action(async (inline, opts) => {
+  const body = readJsonBody(inline, opts.file);
+  if (!body) {
+    die(
+      `missing workflow JSON: pass it inline, with --file <path>, or pipe it on stdin
+see \`tines workflows create --help\` for the expected shape`
+    );
+  }
+  assertNewStatesHavePrompts(body.states, opts.prompts);
+  const wf = await client(opts).createWorkflow(body);
+  if (opts.json) return printJson(wf);
+  console.log(`created workflow "${wf.name}" (${wf.id})
+`);
+  printWorkflowDetail(wf);
+});
+withCommon(
+  workflows.command("edit <id-or-name> [json]").description("Update a workflow from a JSON definition and/or flags").option("-f, --file <path>", 'read the JSON definition from a file ("-" for stdin)').option("-n, --name <name>", "rename the workflow").option("-d, --description <text>", "set the description").option("--initial-state <id-or-name>", "set the initial state").option("--no-prompts", 'allow new states without initial "prompt" instructions').addHelpText("after", WORKFLOW_JSON_HELP)
+).action(
+  async (ref, inline, opts) => {
+    const api = client(opts);
+    const wf = await resolveWorkflow(api, ref);
+    const body = readJsonBody(inline, opts.file) ?? {};
+    assertNewStatesHavePrompts(body.states, opts.prompts);
+    if (opts.name !== void 0) body.name = opts.name;
+    if (opts.description !== void 0) body.description = opts.description;
+    if (opts.initialState !== void 0) body.initial_state = opts.initialState;
+    if (Object.keys(body).length === 0) {
+      die("nothing to update: pass JSON and/or --name/--description/--initial-state");
+    }
+    const updated = await api.updateWorkflow(wf.id, body);
+    if (opts.json) return printJson(updated);
+    console.log(`updated workflow "${updated.name}" (${updated.id})
+`);
+    printWorkflowDetail(updated);
+  }
+);
+withCommon(
+  workflows.command("delete <id-or-name>").description("Delete a workflow (refused while issues still reference it)")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const wf = await resolveWorkflow(api, ref);
+  await api.deleteWorkflow(wf.id);
+  console.log(`deleted workflow "${wf.name}" (${wf.id})`);
+});
+var issues = program.command("issues").description("Work with issues");
+withList(
+  issues.command("list").description("List issues across projects (hides done issues unless --all)").option("-p, --project <name>", "filter by project name or id").option("-s, --state <name>", "filter by state name or id").option("-c, --category <cat>", "filter by state category").option("-w, --workflow <id-or-name>", "filter by workflow").option("-a, --all", "include issues in done states").option("--ready", "only issues that are actionable now (not done, not a duplicate, no open blockers)")
+).action(
+  async (opts) => {
+    const res = await client(opts).listIssues({
+      project: opts.project,
+      state: opts.state,
+      category: opts.category,
+      workflow: opts.workflow,
+      hide_done: !opts.all,
+      ready: opts.ready,
+      limit: opts.limit,
+      cursor: opts.cursor
+    });
+    printList(res, opts, (items) => {
+      if (items.length === 0) return console.log(opts.ready ? "no ready issues" : "no issues");
+      table([
+        ["REF", "TITLE", "STATE", "CATEGORY", "LAST ACTIVITY", ""],
+        ...items.map((i) => [
+          `${i.project_name}/${i.number}`,
+          i.title,
+          // Duplicates display their canonical issue's state, so lists
+          // (and the filters above) go by the effective state.
+          i.effective_state.name,
+          i.effective_state.category,
+          timestamp(i.last_activity_at),
+          [i.open_blockers.length > 0 ? "blocked" : "", i.duplicate_of ? "dup" : ""].filter(Boolean).join(" ")
+        ])
+      ]);
+    });
+  }
+);
+withCommon(
+  issues.command("create <project>").description("Create an issue in a project, optionally with a recurrence (a scheduled task)").requiredOption("-t, --title <title>", "issue title (doubles as the title template with a recurrence)").option("-d, --description <markdown>", "issue description (Markdown)").option("-w, --workflow <id-or-name>", "workflow (defaults to project default, else standard)").option("-s, --state <name>", "starting state (defaults to the workflow's initial state)").option("--every <preset>", 'repeat hourly (or every N hours: "6h"), daily, weekly, or monthly').option("--at <when>", "preset time of day HH:MM (default 09:00); for hourly, the minute past the hour :MM (default :00)").option("--on <when>", "weekday (weekly) or day of month (monthly)").option("--cron <expr>", "5-field cron expression (alternative to --every/--at/--on)").option("--tz <iana>", "schedule timezone (defaults to the system timezone)").option("--if-closed", "only create a new instance when all previous instances are closed").option("--schedule-name <name>", "schedule name, unique per project (defaults to the title)")
+).action(
+  async (projectRef, opts) => {
+    const api = client(opts);
+    const project = await resolveProject(api, projectRef);
+    const workflowId = opts.workflow ? (await resolveWorkflow(api, opts.workflow)).id : void 0;
+    const recurrence = buildRecurrence(opts);
+    if (!recurrence && (opts.ifClosed !== void 0 || opts.scheduleName !== void 0)) {
+      die('--if-closed/--schedule-name need a recurrence: add --every \u2026 or --cron "<expr>"');
+    }
+    const schedule = recurrence ? {
+      ...recurrence,
+      name: opts.scheduleName,
+      timezone: opts.tz ?? systemTimezone(),
+      require_all_closed: opts.ifClosed ?? false
+    } : void 0;
+    const issue = await api.createIssue(project.id, {
+      title: opts.title,
+      description: opts.description,
+      workflow_id: workflowId,
+      state: opts.state,
+      schedule
+    });
+    if (opts.json) return printJson(issue);
+    console.log(
+      `created ${issue.project_name}/#${issue.number} "${issue.title}" in state "${issue.state.name}"`
+    );
+    if (issue.schedule) {
+      console.log(
+        `created schedule "${issue.project_name}/${issue.schedule.name}": ${recurrenceLabel(issue.schedule)} \u2014 next run ${timestamp(issue.schedule.next_run_at)}`
+      );
+    }
+  }
+);
+withCommon(
+  issues.command("show <ref>").description("Show an issue (<project>/<number>), including allowed transitions")
+).action(async (ref, opts) => {
+  const issue = await resolveIssue(client(opts), ref);
+  if (opts.json) return printJson(issue);
+  printIssueDetail(issue);
+});
+withCommon(
+  issues.command("edit <ref>").description("Edit an issue: title, description, workflow, or force-set state").option("-t, --title <title>", "set the title").option("-d, --description <markdown>", "set the description (Markdown)").option(
+    "-s, --state <name>",
+    "force-set the state, bypassing the workflow's transitions (records a forced move)"
+  ).option("-w, --workflow <id-or-name>", "move the issue onto another workflow")
+).action(
+  async (ref, opts) => {
+    const api = client(opts);
+    const issue = await resolveIssue(api, ref);
+    const body = {};
+    if (opts.title !== void 0) body.title = opts.title;
+    if (opts.description !== void 0) body.description = opts.description;
+    if (opts.state !== void 0) body.state = opts.state;
+    if (opts.workflow !== void 0) body.workflow_id = (await resolveWorkflow(api, opts.workflow)).id;
+    if (Object.keys(body).length === 0) {
+      die("nothing to update: pass --title, --description, --state, and/or --workflow");
+    }
+    const updated = await api.updateIssue(issue.id, body);
+    if (opts.json) return printJson(updated);
+    const notes = [];
+    if (body.title !== void 0) notes.push(`title "${updated.title}"`);
+    if (body.description !== void 0) notes.push("description");
+    if (body.workflow_id !== void 0) notes.push(`workflow "${updated.workflow.name}"`);
+    if (updated.state.id !== issue.state.id) {
+      notes.push(`state ${issue.state.name} \u2192 ${updated.state.name}`);
+    }
+    console.log(`updated ${updated.project_name}/#${updated.number}: ${notes.join(", ")}`);
+  }
+);
+withCommon(
+  issues.command("move <ref> <action>").description('Take a transition on an issue by its action name (e.g. "approve")')
+).action(async (ref, action, opts) => {
+  const api = client(opts);
+  const issue = await resolveIssue(api, ref);
+  const moved = await api.transitionIssue(issue.id, { action });
+  if (opts.json) return printJson(moved);
+  console.log(
+    `${moved.project_name}/#${moved.number}: ${issue.state.name} \u2192 ${moved.state.name} ("${action}")`
+  );
+});
+withCommon(
+  issues.command("comment <ref> <markdown>").description("Comment on an issue (Markdown body)").passThroughOptions()
+).action(async (ref, markdown, opts, command) => {
+  if (helpGuard(command, markdown)) return;
+  const api = client(opts);
+  const issue = await resolveIssue(api, ref);
+  const comment = await api.createComment(issue.id, { body: markdown });
+  if (opts.json) return printJson(comment);
+  console.log(`commented on ${issue.project_name}/#${issue.number} as ${actorLabel(comment.actor)}`);
+});
+withCommon(
+  issues.command("block <blocker> <blocked>").description("Record that <blocker> blocks <blocked> (advisory: transitions stay allowed)")
+).action(async (blockerRef, blockedRef, opts) => {
+  const api = client(opts);
+  const blocker = await resolveIssue(api, blockerRef);
+  const blocked = await resolveIssue(api, blockedRef);
+  const link = await api.addIssueLink(blocked.id, { kind: "blocked_by", issue_id: blocker.id });
+  if (opts.json) return printJson(link);
+  console.log(
+    `${blocker.project_name}/#${blocker.number} now blocks ${blocked.project_name}/#${blocked.number} "${blocked.title}"`
+  );
+});
+withCommon(
+  issues.command("unblock <blocker> <blocked>").description("Remove the link making <blocker> block <blocked>")
+).action(async (blockerRef, blockedRef, opts) => {
+  const api = client(opts);
+  const blocker = await resolveIssue(api, blockerRef);
+  const blocked = await resolveIssue(api, blockedRef);
+  const link = blocked.links.blocked_by.find((l) => l.issue_id === blocker.id);
+  if (!link) {
+    die(
+      `${blocked.project_name}/#${blocked.number} is not blocked by ${blocker.project_name}/#${blocker.number} (blocked by: ${blocked.links.blocked_by.map(issueRef).join(", ") || "nothing"})`
+    );
+  }
+  await api.removeIssueLink(blocked.id, link.link_id);
+  if (opts.json) return printJson({ removed: link });
+  console.log(
+    `${blocker.project_name}/#${blocker.number} no longer blocks ${blocked.project_name}/#${blocked.number}`
+  );
+});
+withCommon(
+  issues.command("duplicate <ref> <canonical>").alias("dupe").description("Mark <ref> as a duplicate of <canonical> (its state then follows <canonical>)")
+).action(async (ref, canonicalRef, opts) => {
+  const api = client(opts);
+  const issue = await resolveIssue(api, ref);
+  const canonical = await resolveIssue(api, canonicalRef);
+  const link = await api.addIssueLink(issue.id, { kind: "duplicate_of", issue_id: canonical.id });
+  if (opts.json) return printJson(link);
+  console.log(
+    `${issue.project_name}/#${issue.number} is now a duplicate of ${canonical.project_name}/#${canonical.number} "${canonical.title}" \u2014 showing its state (${canonical.effective_state.name})`
+  );
+});
+withCommon(
+  issues.command("context <ref>").description("Print an issue's effective context (the assembled bundle for its current state)").option("--out <dir>", "write the bundle to a directory: prompt.md, skills/<name>/\u2026, repos.json").option("--force", "allow --out into a non-empty directory")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const issue = await resolveIssue(api, ref);
+  const context2 = await api.getIssueContext(issue.id);
+  if (opts.json && !opts.out) return printJson(context2);
+  if (opts.out === void 0) {
+    if (context2.prompt.text) console.log(context2.prompt.text);
+    if (context2.skills.length > 0) {
+      console.log(`
+skills: ${context2.skills.map((s) => s.name).join(", ")}`);
+    }
+    for (const repo of context2.repos) {
+      console.log(`repo: ${repo.name} ${repo.url}${repo.branch ? `#${repo.branch}` : ""} \u2192 ${repo.dir}/`);
+    }
+    for (const o of context2.overridden) {
+      console.log(`overridden: ${o.kind} "${o.name}" [${o.scope.label}] (overridden by ${o.overridden_by})`);
+    }
+    for (const c of context2.conflicts) {
+      console.log(`conflict: repos ${c.item_ids.join(", ")} all resolve to checkout dir "${c.dir}"`);
+    }
+    return;
+  }
+  if (context2.conflicts.length > 0) {
+    die(
+      `refusing to write: checkout-directory conflict${context2.conflicts.length === 1 ? "" : "s"} among the effective repos (${context2.conflicts.map((c) => `"${c.dir}": ${c.item_ids.join(", ")}`).join("; ")}); rename or re-dir the items first`
+    );
+  }
+  if (existsSync2(opts.out) && readdirSync(opts.out).length > 0 && !opts.force) {
+    die(`refusing to write into non-empty directory ${opts.out} (pass --force to override)`);
+  }
+  mkdirSync3(opts.out, { recursive: true });
+  writeFileSync3(join3(opts.out, "prompt.md"), context2.prompt.text ? `${context2.prompt.text}
+` : "");
+  for (const skill of context2.skills) {
+    for (const file of skill.files) {
+      const target = join3(opts.out, "skills", skill.name, file.path);
+      mkdirSync3(dirname3(target), { recursive: true });
+      writeFileSync3(target, file.content);
+    }
+  }
+  writeFileSync3(join3(opts.out, "repos.json"), `${JSON.stringify(context2.repos, null, 2)}
+`);
+  console.log(
+    `wrote ${opts.out}/prompt.md, ${context2.skills.length} skill${context2.skills.length === 1 ? "" : "s"}, repos.json (${context2.repos.length} repo${context2.repos.length === 1 ? "" : "s"})`
+  );
+});
+withCommon(
+  issues.command("unduplicate <ref>").alias("undupe").description("Unmark a duplicate (its own state was never changed, so it simply reappears)")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const issue = await resolveIssue(api, ref);
+  const link = issue.links.duplicate_of;
+  if (!link) die(`${issue.project_name}/#${issue.number} is not marked as a duplicate`);
+  await api.removeIssueLink(issue.id, link.link_id);
+  if (opts.json) return printJson({ removed: link });
+  console.log(
+    `${issue.project_name}/#${issue.number} is no longer a duplicate of ${issueRef(link)} \u2014 state ${issue.state.name} (${issue.state.category})`
+  );
+});
+withCommon(
+  issues.command("prompt <ref>").description("Print the launch prompt: the stitched context followed by the issue block")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const issue = await resolveIssue(api, ref);
+  const prompt = await api.getIssuePrompt(issue.id);
+  if (opts.json) return printJson(prompt);
+  console.log(prompt.text);
+});
+withCommon(
+  issues.command("assign <ref> [runner]").description("Pin an issue to a runner (<runner>[:tier]) \u2014 replaces routing rules for it; --clear unpins").option("--clear", "remove the pin")
+).action(async (ref, runnerSpec, opts) => {
+  const api = client(opts);
+  const issue = await resolveIssue(api, ref);
+  if (opts.clear) {
+    if (runnerSpec !== void 0) die("--clear does not take a runner");
+    const updated2 = await api.updateIssue(issue.id, { pinned_runner_id: null });
+    if (opts.json) return printJson(updated2);
+    return console.log(`unpinned ${updated2.project_name}/#${updated2.number} \u2014 routing rules apply again`);
+  }
+  if (runnerSpec === void 0) die("pass <runner>[:tier] to pin, or --clear to unpin");
+  const { name, tier } = parseTargetSpec(runnerSpec);
+  const runner = await resolveRunner(api, name);
+  const updated = await api.updateIssue(issue.id, {
+    pinned_runner_id: runner.id,
+    pinned_tier: tier ?? null
+  });
+  if (opts.json) return printJson(updated);
+  console.log(
+    `pinned ${updated.project_name}/#${updated.number} to ${runner.name}${tier ? ` (tier ${tier})` : ""} \u2014 only this runner will take it`
+  );
+});
+withCommon(
+  issues.command("dispatch <ref>").description("Explain why an issue is (not) dispatching: eligibility, routing, per-runner verdicts")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const issue = await resolveIssue(api, ref);
+  const ex = await api.getIssueDispatch(issue.id);
+  if (opts.json) return printJson(ex);
+  printExplainer(issue, ex);
+});
+withCommon(
+  issues.command("resume <ref>").description("Un-park an issue: clear needs-attention and reset the attempt count")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const issue = await resolveIssue(api, ref);
+  const updated = await api.resumeIssue(issue.id);
+  if (opts.json) return printJson(updated);
+  console.log(
+    issue.needs_attention || issue.attempt_count > 0 ? `resumed ${updated.project_name}/#${updated.number} \u2014 attempt count reset, back in the pool` : `${updated.project_name}/#${updated.number} was not parked \u2014 nothing to do`
+  );
+});
+function printExplainer(issue, ex) {
+  console.log(`${issue.project_name}/#${issue.number}  ${issue.title}`);
+  console.log(`
+${ex.verdict}
+`);
+  table(ex.checks.map((c) => [`  ${c.ok ? "ok" : "FAIL"}`, c.name.replaceAll("_", " "), c.detail]));
+  if (ex.pin) {
+    console.log(
+      `
+pinned to ${ex.pin.runner_name ?? ex.pin.runner_id}${ex.pin.tier ? `:${ex.pin.tier}` : ""} (replaces rule matching)`
+    );
+  } else if (ex.matched_rule) {
+    console.log(`
+matched rule: ${ex.matched_rule.scope_label}`);
+  }
+  if (ex.targets.length > 0) {
+    console.log("targets (preference order):");
+    table(
+      ex.targets.map((t) => [
+        `  ${t.runner_name}`,
+        `${t.tier} \u2192 ${t.model ?? "(model n/a)"}`,
+        t.verdict === "ok" ? "available" : t.verdict.replaceAll("_", " "),
+        t.verdict === "ok" ? "" : t.detail
+      ])
+    );
+  }
+  if (ex.queue_position !== null && ex.queue_position > 0) {
+    console.log(`queue: ${ex.queue_position} eligible issue${ex.queue_position === 1 ? "" : "s"} ahead of this one`);
+  }
+  if (ex.active_run) {
+    console.log(
+      `active run: ${ex.active_run.id} on ${ex.active_run.runner_name} (${ex.active_run.status})`
+    );
+  }
+  if (ex.parked) {
+    console.log(
+      `parked after ${ex.attempt_count}/${ex.attempt_limit} strikes \u2014 \`tines issues resume\` (or any manual transition) revives it`
+    );
+  }
+}
+var context = program.command("context").description("Manage context items (prompts, skills, repo pointers) scoped to projects, states, and issues");
+var SCOPE_FLAGS_HELP = `
+Scope flags (combinable \u2014 an item applies where ALL of its set dimensions match):
+  --project <name>              only for issues in this project
+  --state <workflow>/<state>    only for issues currently in this state
+  --issue <project>/<number>    only for this issue
+`;
+function withScopeFlags(cmd) {
+  return cmd.option("-p, --project <name>", "scope: project name or id").option("-s, --state <workflow/state>", "scope: workflow-qualified state").option("-i, --issue <ref>", "scope: issue (<project>/<number>)").addHelpText("after", SCOPE_FLAGS_HELP);
+}
+withList(
+  withScopeFlags(
+    context.command("list").description("List context items (scope filters match every item whose scope includes the element)").option("-k, --kind <kind>", "filter by kind: prompt, skill, or repo").option("--exact", "only items whose scope sets exactly the given dimensions").option("-q, --search <text>", "search names and descriptions")
+  )
+).action(async (opts) => {
+  const api = client(opts);
+  const scope = await resolveScopeFlags(api, opts);
+  const res = await api.listContext({
+    kind: opts.kind,
+    project: scope.project_id ?? void 0,
+    state: scope.workflow_state_id ?? void 0,
+    issue: scope.issue_id ?? void 0,
+    q: opts.search,
+    exact: opts.exact ? true : void 0,
+    limit: opts.limit,
+    cursor: opts.cursor
+  });
+  printList(res, opts, (items) => {
+    if (items.length === 0) return console.log("no context items");
+    table([
+      ["KIND", "NAME", "SCOPE", "PAYLOAD", "UPDATED", "ID"],
+      ...items.map((i) => [
+        i.kind,
+        i.name,
+        i.scope.label,
+        contextItemSummary(i),
+        timestamp(i.updated_at),
+        i.id
+      ])
+    ]);
+  });
+});
+withCommon(context.command("show <id>").description("Show a context item (skills include their files)")).action(
+  async (id, opts) => {
+    const item = await client(opts).getContextItem(id);
+    if (opts.json) return printJson(item);
+    printContextItem(item);
+  }
+);
+withCommon(
+  withScopeFlags(
+    context.command("create").description("Create a context item scoped to a project, state, and/or issue").requiredOption("-k, --kind <kind>", "prompt, skill, or repo").requiredOption("-n, --name <name>", "item name (slug-like for skills; the dedup/override key)").option("-d, --description <text>", "one-liner shown in lists").option("--body <md>", "prompt body: inline Markdown or @file (escape a literal @ as @@)").option("--file <path>=@<local>", "skill file: workspace path = local file (repeatable)", collect, []).option("--url <url>", "repo: clone URL").option("--branch <branch>", "repo: branch to check out").option("--dir <dir>", "repo: checkout directory (defaults to the URL's basename)")
+  ),
+  // --url is the repo pointer here; the API base comes from TINES_API_URL.
+  { baseUrlFlag: false }
+).action(
+  async (opts) => {
+    const api = client({ apiKey: opts.apiKey, json: opts.json });
+    const scope = await resolveScopeFlags(api, opts);
+    const body = {
+      kind: opts.kind,
+      name: opts.name,
+      description: opts.description,
+      ...scope
+    };
+    if (opts.body !== void 0) body.body = readBodyValue(opts.body);
+    if (opts.file.length > 0) body.files = opts.file.map(parseFileSpec);
+    if (opts.kind === "skill" && body.files === void 0) body.files = [];
+    if (opts.url !== void 0) body.repo_url = opts.url;
+    if (opts.branch !== void 0) body.repo_branch = opts.branch;
+    if (opts.dir !== void 0) body.repo_dir = opts.dir;
+    const item = await api.createContextItem(body);
+    if (opts.json) return printJson(item);
+    console.log(`created ${item.kind} "${item.name}" (${item.id}) \u2014 scope: ${item.scope.label}`);
+  }
+);
+withCommon(
+  withScopeFlags(
+    context.command("edit <id>").description("Edit a context item: payload, name, description, or scope").option("-n, --name <name>", "rename the item").option("-d, --description <text>", "set the description").option("--body <md>", "prompt body: inline Markdown or @file (escape a literal @ as @@)").option("--file <path>=@<local>", "add or replace a skill file (repeatable)", collect, []).option("--remove-file <path>", "remove a skill file (repeatable)", collect, []).option("--url <url>", "repo: clone URL").option("--branch <branch>", "repo: branch (empty string clears it)").option("--dir <dir>", "repo: checkout directory (empty string restores the URL default)").option("--unset <dimension>", "drop a scope dimension: project, state, or issue (repeatable)", collect, []).option(
+      "--expect-version <n>",
+      "fail (409) unless the item is still at this version",
+      (v) => Number.parseInt(v, 10)
+    )
+  ),
+  // --url is the repo pointer here; the API base comes from TINES_API_URL.
+  { baseUrlFlag: false }
+).action(
+  async (id, opts) => {
+    const api = client({ apiKey: opts.apiKey, json: opts.json });
+    const body = {};
+    if (opts.expectVersion !== void 0) body.expected_version = opts.expectVersion;
+    if (opts.name !== void 0) body.name = opts.name;
+    if (opts.description !== void 0) body.description = opts.description;
+    const scope = await resolveScopeFlags(api, opts);
+    Object.assign(body, scope);
+    for (const dim of opts.unset) {
+      if (dim === "project") body.project_id = null;
+      else if (dim === "state") body.workflow_state_id = null;
+      else if (dim === "issue") body.issue_id = null;
+      else die(`--unset takes project, state, or issue, got "${dim}"`);
+    }
+    if (opts.body !== void 0) body.body = readBodyValue(opts.body);
+    if (opts.file.length > 0 || opts.removeFile.length > 0) {
+      const current = await api.getContextItem(id);
+      if (current.kind !== "skill") die(`--file/--remove-file only apply to skills (this is a ${current.kind})`);
+      if (body.expected_version === void 0) body.expected_version = current.version;
+      const files = new Map((current.files ?? []).map((f) => [f.path, f.content]));
+      for (const path of opts.removeFile) {
+        if (!files.delete(path)) {
+          die(`no file "${path}" in skill "${current.name}" (have: ${[...files.keys()].join(", ") || "none"})`);
+        }
+      }
+      for (const spec of opts.file) {
+        const f = parseFileSpec(spec);
+        files.set(f.path, f.content);
+      }
+      body.files = [...files.entries()].map(([path, content]) => ({ path, content }));
+    }
+    if (opts.url !== void 0) body.repo_url = opts.url;
+    if (opts.branch !== void 0) body.repo_branch = opts.branch === "" ? null : opts.branch;
+    if (opts.dir !== void 0) body.repo_dir = opts.dir === "" ? null : opts.dir;
+    if (Object.keys(body).length === 0) {
+      die("nothing to update: pass payload flags, --name/--description, scope flags, and/or --unset");
+    }
+    const item = await api.updateContextItem(id, body);
+    if (opts.json) return printJson(item);
+    console.log(`updated ${item.kind} "${item.name}" (${item.id}) \u2014 scope: ${item.scope.label}`);
+  }
+);
+withCommon(context.command("delete <id>").description("Delete a context item")).action(
+  async (id, opts) => {
+    const api = client(opts);
+    const item = await api.getContextItem(id);
+    await api.deleteContextItem(id);
+    console.log(`deleted ${item.kind} "${item.name}" (${item.id}) \u2014 scope: ${item.scope.label}`);
+  }
+);
+withCommon(
+  context.command("init").description('Seed the global "agent-guidelines" prompt (a no-op if it already exists)')
+).action(async (opts) => {
+  const api = client(opts);
+  const { items } = await api.listContext({ kind: "prompt", exact: true, limit: 100 });
+  const existing = items.find((i) => i.name === AGENT_GUIDELINES_NAME);
+  if (existing) {
+    if (opts.json) return printJson(existing);
+    return console.log(
+      `"${AGENT_GUIDELINES_NAME}" already exists (${existing.id}, v${existing.version}) \u2014 left untouched`
+    );
+  }
+  const created = await api.createContextItem({
+    kind: "prompt",
+    name: AGENT_GUIDELINES_NAME,
+    description: AGENT_GUIDELINES_DESCRIPTION,
+    body: AGENT_GUIDELINES_BODY
+  });
+  if (opts.json) return printJson(created);
+  console.log(
+    `seeded global "${AGENT_GUIDELINES_NAME}" (${created.id}) \u2014 it now opens every launch prompt; edit it freely`
+  );
+});
+var journal = program.command("journal").description("An issue's stage journal: shared notes for its project + current state");
+async function resolveJournal(api, ref) {
+  const issue = await resolveIssue(api, ref);
+  const { items } = await api.listContext({
+    kind: "prompt",
+    project: issue.project_id,
+    state: issue.state.id,
+    exact: true,
+    limit: 100
+  });
+  return { issue, item: items.find((i) => i.name === JOURNAL_NAME) ?? null };
+}
+withCommon(
+  journal.command("show <ref>").description("Print the journal for the issue's project and current state")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const { issue, item } = await resolveJournal(api, ref);
+  if (!item) {
+    die(
+      `no journal exists yet for project ${issue.project_name} \xB7 state ${issue.state.name}
+start one: tines journal append ${issue.project_name}/${issue.number} "- <date>: <lesson>"`
+    );
+  }
+  const full = await api.getContextItem(item.id);
+  if (opts.json) return printJson(full);
+  console.log(`journal for project ${issue.project_name} \xB7 state ${issue.state.name}  (v${full.version})`);
+  console.log("");
+  console.log(full.body ?? "");
+});
+withCommon(
+  journal.command("append <ref> <markdown>").description("Append a lesson (creates the journal on first use)").passThroughOptions()
+).action(async (ref, markdown, opts, command) => {
+  if (helpGuard(command, markdown)) return;
+  const api = client(opts);
+  const { issue, item } = await resolveJournal(api, ref);
+  const scopeLabel = `project ${issue.project_name} \xB7 state ${issue.state.name}`;
+  if (item) {
+    const updated = await api.appendContextItem(item.id, { text: markdown });
+    if (opts.json) return printJson(updated);
+    return console.log(`appended to the ${scopeLabel} journal (now v${updated.version})`);
+  }
+  try {
+    const created = await api.createContextItem({
+      kind: "prompt",
+      name: JOURNAL_NAME,
+      project_id: issue.project_id,
+      workflow_state_id: issue.state.id,
+      body: markdown.trim()
+    });
+    if (opts.json) return printJson(created);
+    console.log(`started the ${scopeLabel} journal (${created.id})`);
+  } catch (err) {
+    if (!(err instanceof ApiError) || err.code !== "duplicate_context_name") throw err;
+    const { item: fresh } = await resolveJournal(api, ref);
+    if (!fresh) throw err;
+    const updated = await api.appendContextItem(fresh.id, { text: markdown });
+    if (opts.json) return printJson(updated);
+    console.log(`appended to the ${scopeLabel} journal (now v${updated.version})`);
+  }
+});
+withCommon(
+  journal.command("rewrite <ref>").description("Replace the journal body (to fix or prune entries) \u2014 version-checked").requiredOption("--body <md>", "the full new body: inline Markdown or @file").requiredOption(
+    "--expect-version <n>",
+    "the version being replaced (from the prompt or journal show)",
+    (v) => Number.parseInt(v, 10)
+  )
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const { issue, item } = await resolveJournal(api, ref);
+  if (!item) {
+    die(
+      `no journal exists yet for project ${issue.project_name} \xB7 state ${issue.state.name}; nothing to rewrite`
+    );
+  }
+  const updated = await api.updateContextItem(item.id, {
+    body: readBodyValue(opts.body),
+    expected_version: opts.expectVersion
+  });
+  if (opts.json) return printJson(updated);
+  console.log(
+    `rewrote the project ${issue.project_name} \xB7 state ${issue.state.name} journal (now v${updated.version})`
+  );
+});
+var schedules = program.command("schedules").description("Manage scheduled tasks (addressed as <project>/<name>)");
+function scheduleRef(s) {
+  return `${s.project_name}/${s.name}`;
+}
+function printScheduleDetail(s) {
+  console.log(`${scheduleRef(s)}  [${s.id}]${s.enabled ? "" : "  (paused)"}`);
+  console.log(`${recurrenceLabel(s)} (cron "${s.cron}")`);
+  console.log(
+    `gate: ${s.require_all_closed ? "only create when previous instances are closed" : "off"}  workflow: ${s.workflow_name}  start state: ${s.state_name ?? "(initial)"}`
+  );
+  console.log(
+    `next run: ${s.enabled ? timestamp(s.next_run_at) : "(paused)"}  last run: ${s.last_run_at ? timestamp(s.last_run_at) : "never"}  runs: ${s.run_count}  open instances: ${s.open_instances}`
+  );
+  console.log(`
+title template: ${s.title_template}`);
+  if (s.description_template) {
+    console.log("description template:");
+    for (const line of s.description_template.split("\n")) console.log(`  ${line}`);
+  }
+}
+withList(
+  schedules.command("list").description("List scheduled tasks (hides paused schedules unless --all)").option("-p, --project <name>", "filter by project name or id").option("-a, --all", "include paused schedules")
+).action(async (opts) => {
+  const res = await client(opts).listSchedules({
+    project: opts.project,
+    enabled: opts.all ? void 0 : true,
+    limit: opts.limit,
+    cursor: opts.cursor
+  });
+  printList(res, opts, (items) => {
+    if (items.length === 0) return console.log("no schedules");
+    table([
+      ["NAME", "RECURRENCE", "NEXT RUN", "LAST RUN", "OPEN", ""],
+      ...items.map((s) => [
+        scheduleRef(s),
+        recurrenceLabel(s),
+        s.enabled ? timestamp(s.next_run_at) : "\u2014",
+        s.last_run_at ? timestamp(s.last_run_at) : "never",
+        String(s.open_instances),
+        s.enabled ? "" : "(paused)"
+      ])
+    ]);
+  });
+});
+withCommon(
+  schedules.command("show <ref>").description("Show a schedule (<project>/<name>): config, next/last run, recent instances")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const schedule = await resolveSchedule(api, ref);
+  if (opts.json) return printJson(schedule);
+  printScheduleDetail(schedule);
+  const { items } = await api.listIssues({ schedule: schedule.id, limit: 10 });
+  if (items.length > 0) {
+    console.log(`
+recent instances:`);
+    table(
+      items.map((i) => [
+        `  ${i.project_name}/${i.number}`,
+        i.title,
+        i.state.name,
+        timestamp(i.created_at)
+      ])
+    );
+  }
+});
+withCommon(
+  schedules.command("edit <ref>").description("Edit a schedule: templates, workflow, start state, recurrence, timezone, gate, or name").option("-t, --title <template>", "set the title template").option("-d, --description <markdown>", "set the description template (Markdown)").option(
+    "-w, --workflow <id-or-name>",
+    "move future instances onto another workflow (resets the start state to its initial state unless --state is also given)"
+  ).option(
+    "-s, --state <id-or-name>",
+    "start state for future instances (the workflow's initial state = the default)"
+  ).option("--every <preset>", 'repeat hourly (or every N hours: "6h"), daily, weekly, or monthly').option("--at <when>", "preset time of day HH:MM (default 09:00); for hourly, the minute past the hour :MM (default :00)").option("--on <when>", "weekday (weekly) or day of month (monthly)").option("--cron <expr>", "5-field cron expression (alternative to --every/--at/--on)").option("--tz <iana>", "set the schedule timezone").option("--if-closed", "only create a new instance when all previous instances are closed").option("--no-if-closed", "clear the only-when-closed gate").option("--name <new-name>", "rename the schedule")
+).action(
+  async (ref, opts) => {
+    const api = client(opts);
+    const schedule = await resolveSchedule(api, ref);
+    const body = {};
+    if (opts.title !== void 0) body.title_template = opts.title;
+    if (opts.description !== void 0) body.description_template = opts.description;
+    if (opts.workflow !== void 0) body.workflow_id = (await resolveWorkflow(api, opts.workflow)).id;
+    if (opts.state !== void 0) body.state = opts.state;
+    const recurrence = buildRecurrence(opts);
+    if (recurrence?.preset) body.preset = recurrence.preset;
+    if (recurrence?.cron !== void 0) body.cron = recurrence.cron;
+    if (opts.tz !== void 0) body.timezone = opts.tz;
+    if (opts.ifClosed !== void 0) body.require_all_closed = opts.ifClosed;
+    if (opts.name !== void 0) body.name = opts.name;
+    if (Object.keys(body).length === 0) {
+      die(
+        "nothing to update: pass --title, --description, --workflow, --state, --every/--at/--on, --cron, --tz, --[no-]if-closed, and/or --name"
+      );
+    }
+    const updated = await api.updateSchedule(schedule.id, body);
+    if (opts.json) return printJson(updated);
+    console.log(`updated schedule "${scheduleRef(updated)}"
+`);
+    printScheduleDetail(updated);
+  }
+);
+withCommon(schedules.command("pause <ref>").description("Pause a schedule (keeps config and history)")).action(
+  async (ref, opts) => {
+    const api = client(opts);
+    const schedule = await resolveSchedule(api, ref);
+    const updated = await api.updateSchedule(schedule.id, { enabled: false });
+    if (opts.json) return printJson(updated);
+    console.log(`paused schedule "${scheduleRef(updated)}"`);
+  }
+);
+withCommon(
+  schedules.command("resume <ref>").description("Resume a paused schedule (recomputes the next occurrence from now)")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const schedule = await resolveSchedule(api, ref);
+  const updated = await api.updateSchedule(schedule.id, { enabled: true });
+  if (opts.json) return printJson(updated);
+  console.log(`resumed schedule "${scheduleRef(updated)}" \u2014 next run ${timestamp(updated.next_run_at)}`);
+});
+withCommon(
+  schedules.command("run <ref>").description("Create an instance now (respects the only-when-closed gate)")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const schedule = await resolveSchedule(api, ref);
+  const issue = await api.runSchedule(schedule.id);
+  if (opts.json) return printJson(issue);
+  console.log(
+    `created ${issue.project_name}/#${issue.number} "${issue.title}" in state "${issue.state.name}"`
+  );
+});
+withCommon(
+  schedules.command("delete <ref>").description("Delete a schedule (existing issues are kept)").option("-y, --yes", "skip the confirmation prompt")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const schedule = await resolveSchedule(api, ref);
+  if (!opts.yes) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question(
+      `Delete schedule "${scheduleRef(schedule)}"? Its ${schedule.run_count} existing issue${schedule.run_count === 1 ? "" : "s"} will be kept. [y/N] `
+    );
+    rl.close();
+    if (!/^y(es)?$/i.test(answer.trim())) die("aborted");
+  }
+  await api.deleteSchedule(schedule.id);
+  console.log(`deleted schedule "${scheduleRef(schedule)}" (issues kept)`);
+});
+async function resolveRunner(api, ref) {
+  const { items } = await api.listRunners();
+  const found = items.find((r) => r.name === ref) ?? items.find((r) => r.id === ref);
+  if (!found) {
+    die(`no runner named "${ref}" (have: ${items.map((r) => r.name).join(", ") || "none"})`);
+  }
+  return found;
+}
+function parseTargetSpec(spec) {
+  const sep = spec.lastIndexOf(":");
+  if (sep === -1) return { name: spec };
+  const name = spec.slice(0, sep);
+  const tier = spec.slice(sep + 1);
+  if (!name) die(`target must look like <runner>[:tier], got "${spec}"`);
+  if (!MODEL_TIERS.includes(tier)) {
+    die(`unknown tier "${tier}" in "${spec}" (tiers: ${MODEL_TIERS.join(", ")})`);
+  }
+  return { name, tier };
+}
+function runnerStatusLabel(runner) {
+  if (runner.status === "paused") return "paused";
+  return runner.online ? "online" : "offline";
+}
+var runners = program.command("runners").description("Manage the runner registry");
+withCommon(runners.command("list").description("List runners")).action(async (opts) => {
+  const res = await client(opts).listRunners();
+  if (opts.json) return printJson(res);
+  if (res.items.length === 0) return console.log("no runners");
+  table([
+    ["NAME", "TYPE", "STATUS", "RUNS", "TIER", "LAST SEEN"],
+    ...res.items.map((r) => [
+      r.name,
+      r.type,
+      runnerStatusLabel(r),
+      `${r.active_runs}/${r.max_concurrent}`,
+      r.default_tier,
+      r.last_seen_at ? timestamp(r.last_seen_at) : "\u2014"
+    ])
+  ]);
+});
+withCommon(runners.command("show <name>").description("Show a runner")).action(
+  async (ref, opts) => {
+    const runner = await resolveRunner(client(opts), ref);
+    if (opts.json) return printJson(runner);
+    console.log(`${runner.name}  (${runner.type})  [${runner.id}]  ${runnerStatusLabel(runner)}`);
+    console.log(
+      `active runs: ${runner.active_runs}/${runner.max_concurrent}  timeout: ${runner.max_run_minutes}m  default tier: ${runner.default_tier}`
+    );
+    if (runner.last_seen_at) console.log(`last seen: ${timestamp(runner.last_seen_at)}`);
+    if (runner.launch_failures > 0) {
+      console.log(
+        `launch failures: ${runner.launch_failures}${runner.backoff_until ? ` (backing off until ${timestamp(runner.backoff_until)})` : ""}`
+      );
+    }
+    const harness = runner.config.harness;
+    if (typeof harness === "string") console.log(`harness: ${harness}`);
+  }
+);
+withCommon(
+  runners.command("pause <name>").description("Pause a runner (stops new assignments; identity and rules stay)")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const runner = await resolveRunner(api, ref);
+  const updated = await api.updateRunner(runner.id, { status: "paused" });
+  if (opts.json) return printJson(updated);
+  console.log(`paused runner "${updated.name}"`);
+});
+withCommon(runners.command("resume <name>").description("Resume a paused runner")).action(
+  async (ref, opts) => {
+    const api = client(opts);
+    const runner = await resolveRunner(api, ref);
+    const updated = await api.updateRunner(runner.id, { status: "active" });
+    if (opts.json) return printJson(updated);
+    console.log(`resumed runner "${updated.name}"`);
+  }
+);
+withCommon(
+  runners.command("remove <name>").description("Remove a runner (refused while routing rules or pins reference it, unless --force)").option("--force", "strip the runner from routing rules and clear issue pins (emptied rules are kept, flagged)")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const runner = await resolveRunner(api, ref);
+  await api.deleteRunner(runner.id, opts.force ? { force: true } : void 0);
+  console.log(`removed runner "${runner.name}"${opts.force ? " (references stripped)" : ""}`);
+});
+withCommon(
+  runners.command("rotate-token <name>").description("Invalidate a local runner's token and mint a fresh one (shown once)")
+).action(async (ref, opts) => {
+  const api = client(opts);
+  const runner = await resolveRunner(api, ref);
+  const rotated = await api.rotateRunnerToken(runner.id);
+  if (opts.json) return printJson(rotated);
+  const url = resolveUrl(opts);
+  console.log(`rotated the token for runner "${rotated.runner.name}" \u2014 the old token is dead.`);
+  console.log(`new token (shown once): ${rotated.runner_token}`);
+  if (hasRunnerCredentials(defaultConfigDir(), url, rotated.runner.name)) {
+    saveRunnerCredentials(defaultConfigDir(), url, rotated.runner.name, {
+      runner_id: rotated.runner.id,
+      token: rotated.runner_token
+    });
+    console.log(`stored it for the daemon on this machine (${defaultConfigDir()}); restart the daemon to adopt it.`);
+  } else {
+    console.log("drop it into the daemon machine's config \u2014 its next poll gets a 401 until it adopts the new token.");
+  }
+});
+var runnerCmd = program.command("runner").description("The local runner daemon");
+withCommon(
+  runnerCmd.command("daemon").description("Run the local runner daemon: register/reconnect, poll for assigned runs, execute them").option("--name <name>", "runner name, unique per user (default: this hostname)").option("--harness <harness>", "claude-code | codex | custom", "claude-code").option("--command <template>", "custom harness command template ({prompt_file}, {workspace}, {model})").option("--max-concurrent <n>", "maximum simultaneous runs", (v) => Number.parseInt(v, 10), 1).option("--poll-interval <seconds>", "seconds between polls", (v) => Number.parseInt(v, 10), 15)
+).action(
+  async (opts) => {
+    const harness = opts.harness.replaceAll("-", "_");
+    if (!HARNESS_KINDS.includes(harness)) {
+      die(`--harness must be claude-code, codex, or custom, got "${opts.harness}"`);
+    }
+    if (harness === "custom" && !opts.command) {
+      die('the custom harness needs --command "<template>" ({prompt_file}, {workspace}, {model})');
+    }
+    if (harness !== "custom" && opts.command) die("--command only applies to --harness custom");
+    if (!Number.isInteger(opts.maxConcurrent) || opts.maxConcurrent < 1 || opts.maxConcurrent > 100) {
+      die("--max-concurrent must be an integer between 1 and 100");
+    }
+    if (!Number.isInteger(opts.pollInterval) || opts.pollInterval < 1) {
+      die("--poll-interval must be a positive number of seconds");
+    }
+    await runDaemon({
+      url: resolveUrl(opts).replace(/\/+$/, ""),
+      apiKey: resolveApiKey(opts),
+      name: opts.name ?? hostname2(),
+      harness,
+      command: opts.command,
+      maxConcurrent: opts.maxConcurrent,
+      pollIntervalMs: opts.pollInterval * 1e3,
+      configDir: defaultConfigDir()
+    });
+  }
+);
+var runsCmd = program.command("runs").description("Agent runs: attempts at issues by runners");
+function runRow(run) {
+  return [
+    run.id,
+    run.issue_ref ? issueRef(run.issue_ref) : run.issue_id,
+    run.runner_name,
+    `${run.tier}${run.model ? ` (${run.model})` : ""}`,
+    run.status,
+    runDurationLabel(run),
+    timestamp(run.created_at)
+  ];
+}
+withList(
+  runsCmd.command("list").description("List runs, newest first").option("-i, --issue <ref>", "filter to one issue (<project>/<number>)").option("-r, --runner <name>", "filter by runner name").option("--active", "only runs holding a claim (assigned/launching/running)")
+).action(async (opts) => {
+  const api = client(opts);
+  const issueId = opts.issue ? (await resolveIssue(api, opts.issue)).id : void 0;
+  const runnerId = opts.runner ? (await resolveRunner(api, opts.runner)).id : void 0;
+  const res = await api.listRuns({
+    issue: issueId,
+    runner: runnerId,
+    active: opts.active ? true : void 0,
+    limit: opts.limit,
+    cursor: opts.cursor
+  });
+  printList(res, opts, (items) => {
+    if (items.length === 0) return console.log(opts.active ? "no active runs" : "no runs");
+    table([["ID", "ISSUE", "RUNNER", "TIER", "STATUS", "DURATION", "CREATED"], ...items.map(runRow)]);
+  });
+});
+withCommon(
+  runsCmd.command("show <id>").description("Show a run; --logs prints the captured log tail").option("--logs", "print the log tail")
+).action(async (id, opts) => {
+  const api = client(opts);
+  const run = await api.getRun(id);
+  if (opts.json) return printJson(run);
+  console.log(`${run.id}  ${run.status}  on ${run.runner_name}`);
+  if (run.issue_ref) console.log(`issue: ${issueRef(run.issue_ref)} \u2014 ${run.issue_ref.title}`);
+  console.log(`tier: ${run.tier}  model: ${run.model ?? "(n/a)"}`);
+  console.log(
+    `states: ${run.state_at_start_name ?? run.state_id_at_start} \u2192 ${run.state_at_end_name ?? run.state_id_at_end ?? "\u2026"}`
+  );
+  console.log(
+    `created: ${timestamp(run.created_at)}  started: ${run.started_at ? timestamp(run.started_at) : "\u2014"}  ended: ${run.ended_at ? timestamp(run.ended_at) : "\u2014"}  duration: ${runDurationLabel(run)}`
+  );
+  if (run.provider_session_id) console.log(`provider session: ${run.provider_session_id}`);
+  if (run.provider_url) console.log(`provider console: ${run.provider_url}`);
+  if (run.error) console.log(`error: ${run.error}`);
+  if (opts.logs) {
+    console.log("");
+    if (run.log_bytes_dropped > 0) {
+      console.log(`[${Math.round(run.log_bytes_dropped / 1024)} KB truncated from the head]`);
+    }
+    console.log(run.log || "(no log output captured)");
+  }
+});
+withCommon(
+  runsCmd.command("cancel <id>").description("Cancel a run (judged like any other end: usually a strike)")
+).action(async (id, opts) => {
+  const api = client(opts);
+  const run = await api.cancelRun(id);
+  if (opts.json) return printJson(run);
+  console.log(
+    `canceled ${run.id}${run.issue_ref ? ` on ${issueRef(run.issue_ref)}` : ""} (was on ${run.runner_name})`
+  );
+});
+var routing = program.command("routing").description("Scoped routing rules: which runner takes which issues (most specific scope wins)");
+async function resolveRoutingScope(api, opts) {
+  const projectId = opts.project !== void 0 ? (await resolveProject(api, opts.project)).id : null;
+  const stateId = opts.state !== void 0 ? (await resolveStateFlag(api, opts.state)).state.id : null;
+  const parts = [];
+  if (opts.project) parts.push(`project ${opts.project}`);
+  if (opts.state) parts.push(`state ${opts.state}`);
+  return { projectId, stateId, label: parts.length > 0 ? parts.join(" \xB7 ") : "global" };
+}
+function ruleTargetsLabel(rule) {
+  if (rule.targets.length === 0) return "(no targets)";
+  return rule.targets.map((t) => `${t.runner_name}${t.tier ? `:${t.tier}` : ""}${t.runner_status === "paused" ? " (paused)" : ""}`).join(" \u2192 ");
+}
+withCommon(routing.command("list").description("List routing rules, most specific first")).action(
+  async (opts) => {
+    const res = await client(opts).listRoutingRules();
+    if (opts.json) return printJson(res);
+    if (res.items.length === 0) return console.log("no routing rules \u2014 nothing will dispatch");
+    table([
+      ["SCOPE", "TARGETS", "ID"],
+      ...res.items.map((r) => [r.scope.label, ruleTargetsLabel(r), r.id])
+    ]);
+  }
+);
+withCommon(
+  routing.command("set <target...>").description("Create or replace the rule at a scope: an ordered list of <runner>[:tier] targets").option("-p, --project <name>", "scope: project name or id").option("-s, --state <workflow/state>", "scope: workflow-qualified state")
+).action(async (targetSpecs, opts) => {
+  const api = client(opts);
+  const scope = await resolveRoutingScope(api, opts);
+  const targets = [];
+  for (const spec of targetSpecs) {
+    const { name, tier } = parseTargetSpec(spec);
+    const runner = await resolveRunner(api, name);
+    targets.push(tier ? { runner_id: runner.id, tier } : { runner_id: runner.id });
+  }
+  const { items } = await api.listRoutingRules();
+  const existing = items.find(
+    (r) => r.scope.project_id === scope.projectId && r.scope.workflow_state_id === scope.stateId
+  );
+  const rule = existing ? await api.updateRoutingRule(existing.id, { targets }) : await api.createRoutingRule({ project_id: scope.projectId, workflow_state_id: scope.stateId, targets });
+  if (opts.json) return printJson(rule);
+  console.log(
+    `${existing ? "updated" : "created"} the ${rule.scope.label} rule: ${ruleTargetsLabel(rule)}`
+  );
+  for (const warning of rule.warnings) console.log(`warning: ${warning.message}`);
+});
+withCommon(
+  routing.command("clear").description("Delete the rule at a scope (issues it matched stop dispatching)").option("-p, --project <name>", "scope: project name or id").option("-s, --state <workflow/state>", "scope: workflow-qualified state")
+).action(async (opts) => {
+  const api = client(opts);
+  const scope = await resolveRoutingScope(api, opts);
+  const { items } = await api.listRoutingRules();
+  const existing = items.find(
+    (r) => r.scope.project_id === scope.projectId && r.scope.workflow_state_id === scope.stateId
+  );
+  if (!existing) die(`no routing rule at scope ${scope.label}`);
+  await api.deleteRoutingRule(existing.id);
+  console.log(`cleared the ${existing.scope.label} rule`);
+});
+var supervisor = program.command("supervisor").description("The automation kill switch, quota policy, and attempt limit");
+function quotaLabel(quota2, stateName) {
+  if (quota2.type === "global_cap") return `global cap: at most ${quota2.limit} concurrent runs`;
+  const overrides = Object.entries(quota2.overrides).map(
+    ([id, limit]) => `${stateName ? stateName(id) : id}=${limit}`
+  );
+  return `state roster: default ${quota2.default_limit} per state${overrides.length > 0 ? `, overrides: ${overrides.join(", ")}` : ""}`;
+}
+withCommon(supervisor.command("status").description("One-screen overview: kill switch, quota, utilization, runners")).action(
+  async (opts) => {
+    const api = client(opts);
+    const [settings, runnersRes, workflows2, activeRuns] = await Promise.all([
+      api.getSupervisorSettings(),
+      api.listRunners(),
+      api.listWorkflows({ limit: 100 }),
+      api.listRuns({ active: true, limit: 100 })
+    ]);
+    if (opts.json) {
+      return printJson({ settings, runners: runnersRes.items, active_runs: activeRuns.items });
+    }
+    const stateNames = /* @__PURE__ */ new Map();
+    for (const wf of workflows2.items) {
+      for (const s of wf.states) stateNames.set(s.id, `${wf.name}/${s.name}`);
+    }
+    console.log(`automation: ${settings.enabled ? "ON" : "OFF (kill switch \u2014 nothing dispatches)"}`);
+    console.log(quotaLabel(settings.quota, (id) => stateNames.get(id) ?? id));
+    console.log(`utilization: ${utilizationLabel(settings.quota, activeRuns.items, (id) => stateNames.get(id) ?? id)}`);
+    console.log(`attempt limit: ${settings.attempt_limit} strikes, then the issue parks`);
+    if (runnersRes.items.length === 0) {
+      console.log("runners: none");
+    } else {
+      console.log("runners:");
+      table(
+        runnersRes.items.map((r) => [
+          `  ${r.name}`,
+          r.type,
+          runnerStatusLabel(r),
+          `${r.active_runs}/${r.max_concurrent}`
+        ])
+      );
+    }
+  }
+);
+withCommon(supervisor.command("enable").description("Arm automation (the kill switch on)")).action(
+  async (opts) => {
+    const settings = await client(opts).updateSupervisorSettings({ enabled: true });
+    if (opts.json) return printJson(settings);
+    console.log("automation is ON \u2014 eligible issues with a matching rule will dispatch");
+  }
+);
+withCommon(supervisor.command("disable").description("Pause all automation at once (the kill switch off)")).action(
+  async (opts) => {
+    const settings = await client(opts).updateSupervisorSettings({ enabled: false });
+    if (opts.json) return printJson(settings);
+    console.log("automation is OFF \u2014 nothing new dispatches until re-enabled");
+  }
+);
+var quota = supervisor.command("quota").description("Pick and configure the quota policy");
+withCommon(
+  quota.command("global <n>").description("Use the global cap: at most <n> concurrent runs in total")
+).action(async (n, opts) => {
+  const limit = Number.parseInt(n, 10);
+  const settings = await client(opts).updateSupervisorSettings({
+    quota: { type: "global_cap", limit }
+  });
+  if (opts.json) return printJson(settings);
+  console.log(quotaLabel(settings.quota));
+});
+withCommon(
+  quota.command("roster").description("Use the per-state roster: at most N concurrent runs per workflow state").requiredOption("--default <n>", "limit for states without an override", (v) => Number.parseInt(v, 10)).option(
+    "--state <workflow/state=n>",
+    "per-state override (repeatable), counted by the state a run started in",
+    collect,
+    []
+  )
+).action(async (opts) => {
+  const api = client(opts);
+  const overrides = {};
+  for (const spec of opts.state) {
+    const sep = spec.lastIndexOf("=");
+    if (sep < 1 || sep === spec.length - 1) {
+      die(`--state must look like <workflow>/<state>=<n>, got "${spec}"`);
+    }
+    const limit = Number.parseInt(spec.slice(sep + 1), 10);
+    const { state } = await resolveStateFlag(api, spec.slice(0, sep));
+    overrides[state.id] = limit;
+  }
+  const settings = await api.updateSupervisorSettings({
+    quota: { type: "state_roster", default_limit: opts.default, overrides }
+  });
+  if (opts.json) return printJson(settings);
+  const workflows2 = await api.listWorkflows({ limit: 100 });
+  const stateNames = /* @__PURE__ */ new Map();
+  for (const wf of workflows2.items) {
+    for (const s of wf.states) stateNames.set(s.id, `${wf.name}/${s.name}`);
+  }
+  console.log(quotaLabel(settings.quota, (id) => stateNames.get(id) ?? id));
+});
+var events = program.command("events").description("Read the activity log");
+withList(
+  events.command("list").description("List activity events, newest first").option("-i, --issue <ref>", "filter to one issue (<project>/<number>)").option("-p, --project <name>", "filter by project name or id").option("-t, --type <type>", "filter by event type (e.g. issue.transitioned)")
+).action(async (opts) => {
+  const api = client(opts);
+  const issueId = opts.issue ? (await resolveIssue(api, opts.issue)).id : void 0;
+  const res = await api.listEvents({
+    issue: issueId,
+    project: opts.project,
+    type: opts.type,
+    limit: opts.limit,
+    cursor: opts.cursor
+  });
+  printList(res, opts, (items) => {
+    if (items.length === 0) return console.log("no events");
+    table([
+      ["WHEN", "ACTOR", "EVENT"],
+      ...items.map((ev) => [timestamp(ev.created_at), actorLabel(ev.actor), eventSummary(ev)])
+    ]);
+  });
+});
+try {
+  await program.parseAsync();
+} catch (err) {
+  reportError(err);
+}