command: panoptis
    help: AgentWatch — Reliability, Safety, and Observability Layer for AI Agents
    short_help: 
    param install_completion kind=TyperOption type=boolean required=False default=None flags=--install-completion help='Install completion for the current shell.'
    param show_completion kind=TyperOption type=boolean required=False default=None flags=--show-completion help='Show completion for the current shell, to copy it or customize the installation.'
    param version kind=TyperOption type=boolean required=False default=False flags=--version,-V help='Show version and exit.'

command: panoptis branch
    help: Create (and execute) a [bold]branch[/bold]: fork a run at an event with a substituted result.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param at kind=TyperOption type=str required=True default=None flags=--at help='event id/prefix of an instrumented call'
    param execute kind=TyperOption type=boolean required=False default=True flags=--execute help=''
    param level kind=TyperOption type=str required=False default='L3' flags=--level help='L2 (mock everything) | L3 (changed inputs run live)'
    param run kind=TyperArgument type=str required=True default=None flags=run help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param substitute kind=TyperOption type=str required=True default=None flags=--substitute help='JSON (or plain string) result to substitute'

command: panoptis branches
    help: Branch history of a run.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param run kind=TyperArgument type=str required=False default='latest' flags=run help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis causes
    help: What may have influenced an event — dependency, correlation, hypothesis, intervention kept separate.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param event kind=TyperArgument type=str required=True default=None flags=event help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis check-env
    help: [bold]Verify[/bold] local developer environment variables and dependencies.
    short_help: 

command: panoptis compare
    help: [bold]Compare[/bold] two runs: earliest divergence, structure, resources, information flow.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param run_a kind=TyperArgument type=str required=True default=None flags=run_a help=''
    param run_b kind=TyperArgument type=str required=True default=None flags=run_b help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis compliance
    help: Compliance audit log export and reporting.
    short_help: 

command: panoptis compliance export-csv
    help: Export compliance audit log as CSV from the running API server.
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param include_allowed kind=TyperOption type=boolean required=False default=False flags=--include-allowed help='Include allowed actions (denials only by default)'
    param output kind=TyperOption type=path required=False default='compliance-audit.csv' flags=--output,-o help='Output CSV file path'

command: panoptis compliance export-local
    help: Export compliance audit log from a local JSONL file as CSV.
    short_help: 
    param audit_log kind=TyperOption type=path required=False default='data/audit-log.jsonl' flags=--audit-log help='Path to the persisted audit log JSONL file'
    param include_allowed kind=TyperOption type=boolean required=False default=False flags=--include-allowed help='Include allowed actions (denials only by default)'
    param output kind=TyperOption type=path required=False default='compliance-audit.csv' flags=--output,-o help='Output CSV file path'

command: panoptis cost
    help: AgentWatch FinOps. Report token usage and API spend across agents and frameworks.
    short_help: 

command: panoptis cost report
    help: [bold]Report[/bold] token usage, USD cost, and cost-per-successful-goal.

Aggregates recent sessions from the AgentWatch API over the last [b]--days[/b],
grouped by [b]--group-by[/b].

[b]Example Usage:[/b]
[dim]python -m panoptis.cli.main cost report --days 30 --group-by framework[/dim]
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Emit JSON instead of a table.'
    param days kind=TyperOption type=int required=False default=30 flags=--days help='Reporting window in days (must be >= 1).'
    param group_by kind=TyperOption type=str required=False default='framework' flags=--group-by help='Group by: framework, agent, or status.'

command: panoptis counterfactual
    help: EXPERIMENTAL: what might have happened if an event had produced a different result?
    short_help: 
    param alternative kind=TyperOption type=str required=True default=None flags=--alternative help='JSON value'
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param at kind=TyperOption type=str required=True default=None flags=--at help=''
    param execute kind=TyperOption type=boolean required=False default=True flags=--execute help=''
    param run kind=TyperArgument type=str required=True default=None flags=run help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis dependents
    help: Which later events and outputs depend on this node?
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param node kind=TyperArgument type=str required=True default=None flags=node help=''
    param run kind=TyperOption type=str required=False default=None flags=--run help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis doctor
    help: [bold]Doctor[/bold]: Check AgentWatch installation health and manage schema migrations.
    short_help: 
    param downgrade_schema kind=TyperOption type=int required=False default=None flags=--downgrade-schema help='Roll back schema to a specific prior version (e.g., 1).'
    param rollback_derived kind=TyperOption type=boolean required=False default=False flags=--rollback-derived help='Safely roll back derived interpretation tables without touching raw evidence.'
    param seal_pending kind=TyperOption type=boolean required=False default=False flags=--seal-pending help='Seal all pending unsealed observations into hash-chained segments.'
    param test_alert kind=TyperOption type=boolean required=False default=False flags=--test-alert help='Send a diagnostic test alert to configured Slack/PagerDuty channels.'
    param upgrade_schema kind=TyperOption type=boolean required=False default=False flags=--upgrade-schema help='Apply pending schema upgrades to target version.'

command: panoptis drift
    help: Behavioural [bold]drift[/bold] between two scopes of runs. EXPERIMENTAL.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param baseline kind=TyperArgument type=str required=True default=None flags=baseline help='scope, e.g. variant:normal'
    param candidate kind=TyperArgument type=str required=True default=None flags=candidate help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis effects
    help: What depends on an event, and what changed when it was intervened on.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param event kind=TyperArgument type=str required=True default=None flags=event help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis eval
    help: AgentWatch Evaluation. Run an agent against a dataset and score the batch.
    short_help: 

command: panoptis eval run
    help: [bold]Run[/bold] a batch evaluation of an agent against a dataset of prompts.

[b]Example Usage:[/b]
[dim]python -m panoptis.cli.main eval run dataset.json --agent my_agent.py[/dim]
    short_help: 
    param agent kind=TyperOption type=path required=True default=None flags=--agent help='Path to an agent script exposing run(prompt) -> list[AgentEvent].'
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Emit JSON instead of a table.'
    param dataset kind=TyperArgument type=path required=True default=None flags=dataset help='Path to the dataset JSON: a list of {id, prompt, expected?}.'
    param threshold kind=TyperOption type=float range required=False default=0.5 flags=--threshold help='Minimum confidence for a case to pass.'

command: panoptis events
    help: List a run's normalized [bold]events[/bold].
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param kind kind=TyperOption type=str required=False default=None flags=--kind help=''
    param run kind=TyperArgument type=str required=False default='latest' flags=run help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis evidence
    help: Verify, seal and manage immutable evidence.
    short_help: 

command: panoptis evidence erase-subject
    help: Crypto-shred a data subject: destroy its key and purge derived copies (irreversible).
    short_help: 
    param reason kind=TyperOption type=str required=True default=None flags=--reason help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param subject kind=TyperArgument type=str required=True default=None flags=subject help='value of the declared subject_id'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''
    param yes kind=TyperOption type=boolean required=False default=False flags=--yes help=''

command: panoptis evidence export
    help: Export sealed evidence for independent verification (panoptis/evidence/verifier.py).
    short_help: 
    param output kind=TyperOption type=path required=True default=None flags=--output,-o help='bundle file to write'
    param seal kind=TyperOption type=boolean required=False default=True flags=--seal help='seal pending observations first'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis evidence proof
    help: The inclusion proof of one sealed record (verify with verifier.py --proof).
    short_help: 
    param obs_id kind=TyperArgument type=str required=True default=None flags=obs_id help="the record's observation id"
    param output kind=TyperOption type=path required=False default=None flags=--output,-o help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis evidence purge
    help: Retention: remove sealed segments older than N days, their payload files and derived copies (chain preserved).
    short_help: 
    param older_than_days kind=TyperOption type=int required=True default=None flags=--older-than-days help=''
    param reason kind=TyperOption type=str required=True default=None flags=--reason help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''
    param yes kind=TyperOption type=boolean required=False default=False flags=--yes help=''

command: panoptis evidence seal
    help: Seal pending observations into hash-chained segments.
    short_help: 
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis evidence show
    help: Show a raw observation exactly as stored, with its inclusion proof.
    short_help: 
    param obs_id kind=TyperArgument type=str required=True default=None flags=obs_id help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis evidence verify
    help: Verify the hash chain, Merkle roots, envelopes and index of all sealed evidence.
    short_help: 
    param anchor kind=TyperOption type=boolean required=False default=True flags=--anchor help='check against, then update, the locally kept head'
    param expect_head kind=TyperOption type=str required=False default=None flags=--expect-head help='SEQ:SEGMENT_HASH known from elsewhere (truncation check)'
    param seal kind=TyperOption type=boolean required=False default=True flags=--seal help='seal pending observations first'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis evidence verify-bundle
    help: Verify an exported bundle with the standalone verifier (no store access).
    short_help: 
    param bundle kind=TyperArgument type=path required=True default=None flags=bundle help="bundle written by 'evidence export'"
    param expect_head kind=TyperOption type=str required=False default=None flags=--expect-head help='SEQ:SEGMENT_HASH'

command: panoptis forecast
    help: EXPERIMENTAL outcome forecast for a (partial) run, with calibration evidence.
    short_help: 
    param evaluate_only kind=TyperOption type=boolean required=False default=False flags=--evaluate help=''
    param run kind=TyperArgument type=str required=False default='latest' flags=run help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis genome
    help: Behavioural [bold]genome[/bold] (aggregate profile) for a scope of runs. EXPERIMENTAL.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param scope kind=TyperArgument type=str required=False default='all' flags=scope help='all | name:<run name> | version:<v> | runs:<a>,<b> | variant:<v> | <run>'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis graph
    help: Print a run's [bold]graph[/bold] (execution, information or causal view).
    short_help: 
    param fmt kind=TyperOption type=str required=False default='text' flags=--format help='text | dot | json'
    param run kind=TyperArgument type=str required=False default='latest' flags=run help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param view kind=TyperOption type=str required=False default='execution' flags=--view help='execution | information | causal | all'

command: panoptis help
    help: Show help for AgentWatch / Panoptis or a specific command.
    short_help: 
    param command kind=TyperArgument type=str required=False default=None flags=command help='The command to show help for.'

command: panoptis ingest
    help: [bold]Ingest[/bold] observations from a file into the evidence store.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param fmt kind=TyperOption type=str required=False default='auto' flags=--format help='auto | ndjson | otlp-json | claude-code | legacy-jsonl'
    param path kind=TyperArgument type=path required=True default=None flags=path help='File to import'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis inspect
    help: [bold]Inspect[/bold] a run: reconstructed execution tree, graph statistics, motifs.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param run kind=TyperArgument type=str required=False default='latest' flags=run help="run id/prefix, name, 'latest' or 'latest~N'"
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis legacy
    help: v0.2 commands kept for compatibility (superseded by v3 commands).
    short_help: 

command: panoptis legacy compare
    help: [bold]Compare[/bold] confidence and quality metrics across two sessions.
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param session_id_1 kind=TyperArgument type=str required=True default=None flags=session_id_1 help='ID of the first session to compare'
    param session_id_2 kind=TyperArgument type=str required=True default=None flags=session_id_2 help='ID of the second session to compare'

command: panoptis mcp
    help: Run the AgentWatch MCP server over stdio.
    short_help: 

command: panoptis motifs
    help: Behavioural [bold]motifs[/bold] detected in a run (or registry statistics).
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param run kind=TyperArgument type=str required=False default=None flags=run help='run reference; omit for registry statistics over all runs'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis observe
    help: [bold]Observe[/bold] a program: run it under the v3 sensors and reconstruct the run.
    short_help: 
    param command kind=TyperArgument type=str required=True default=None flags=command help='Program to run, e.g. python app.py --flag'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param system kind=TyperOption type=str required=False default=None flags=--system help='System name recorded on the run.'

command: panoptis protect
    help: AgentWatch security engine, guardrails, compliance, and evidence.
    short_help: 

command: panoptis protect agents
    help: Agents and sessions seen, with counts and suspension state (seen is not protected: see 'discover').
    short_help: 
    param api kind=TyperOption type=str required=False default=None flags=--api help='AgentWatch API URL (default: AGENTWATCH_API_URL; omit for local mode).'
    param key kind=TyperOption type=str required=False default=None flags=--key help='API key (default: AGENTWATCH_API_KEY). Never printed.'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store for local mode (default: AGENTWATCH_STORE).'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help='Tenant (local mode; in API mode the key decides).'

command: panoptis protect approvals
    help: List and decide escalated tool calls.
    short_help: 

command: panoptis protect approvals approve
    help: Approve exactly the action with this digest.
    short_help: 
    param api kind=TyperOption type=str required=False default=None flags=--api help='AgentWatch API URL (default: AGENTWATCH_API_URL; omit for local mode).'
    param by kind=TyperOption type=str required=False default=None flags=--by help=''
    param comment kind=TyperOption type=str required=False default=None flags=--comment help=''
    param digest kind=TyperOption type=str required=True default=None flags=--digest help="the action_digest shown by 'approvals list' (what you approve)"
    param key kind=TyperOption type=str required=False default=None flags=--key help='API key (default: AGENTWATCH_API_KEY). Never printed.'
    param request_id kind=TyperArgument type=str required=True default=None flags=request_id help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store for local mode (default: AGENTWATCH_STORE).'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help='Tenant (local mode; in API mode the key decides).'

command: panoptis protect approvals list
    help: Approval requests of the tenant.
    short_help: 
    param api kind=TyperOption type=str required=False default=None flags=--api help='AgentWatch API URL (default: AGENTWATCH_API_URL; omit for local mode).'
    param key kind=TyperOption type=str required=False default=None flags=--key help='API key (default: AGENTWATCH_API_KEY). Never printed.'
    param state kind=TyperOption type=str required=False default='pending' flags=--state help='pending | approved | rejected | expired | cancelled | all'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store for local mode (default: AGENTWATCH_STORE).'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help='Tenant (local mode; in API mode the key decides).'

command: panoptis protect approvals reject
    help: Reject the escalated call; it never runs.
    short_help: 
    param api kind=TyperOption type=str required=False default=None flags=--api help='AgentWatch API URL (default: AGENTWATCH_API_URL; omit for local mode).'
    param by kind=TyperOption type=str required=False default=None flags=--by help=''
    param comment kind=TyperOption type=str required=False default=None flags=--comment help=''
    param digest kind=TyperOption type=str required=True default=None flags=--digest help=''
    param key kind=TyperOption type=str required=False default=None flags=--key help='API key (default: AGENTWATCH_API_KEY). Never printed.'
    param request_id kind=TyperArgument type=str required=True default=None flags=request_id help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store for local mode (default: AGENTWATCH_STORE).'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help='Tenant (local mode; in API mode the key decides).'

command: panoptis protect check
    help: [bold]Score[/bold] the risk level of a shell command.

[b]Example Usage:[/b]
[dim]python -m panoptis.cli.main safety check "rm -rf /var/log"[/dim]
    short_help: 
    param command kind=TyperArgument type=str required=True default=None flags=command help='Command to risk-score'
    param verbose kind=TyperOption type=boolean required=False default=False flags=--verbose,-v help=''

command: panoptis protect claude-hook
    help: Enforce on Claude Code: install the PreToolUse/PostToolUse hook.
    short_help: 

command: panoptis protect claude-hook install
    help: Merge the AgentWatch hook into a Claude Code settings file.
    short_help: 
    param on_failure_block kind=TyperOption type=boolean required=False default=False flags=--on-failure-block help='Add "onFailure": "block" so a hook that cannot start blocks the call (needs Claude Code 2.1.295 or later).'
    param settings kind=TyperOption type=path required=False default='.claude/settings.local.json' flags=--settings help='Claude Code settings file (default: ./.claude/settings.local.json).'
    param timeout kind=TyperOption type=int required=False default=30 flags=--timeout help='Hook timeout in seconds.'

command: panoptis protect claude-hook print
    help: Print the settings JSON (for `claude --settings`).
    short_help: 
    param on_failure_block kind=TyperOption type=boolean required=False default=False flags=--on-failure-block help=''

command: panoptis protect claude-hook uninstall
    help: Remove the AgentWatch hook from a Claude Code settings file.
    short_help: 
    param settings kind=TyperOption type=path required=False default='.claude/settings.local.json' flags=--settings help='Claude Code settings file (default: ./.claude/settings.local.json).'

command: panoptis protect compliance
    help: Compliance audit log export and reporting.
    short_help: 

command: panoptis protect compliance export-csv
    help: Export compliance audit log as CSV from the running API server.
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param include_allowed kind=TyperOption type=boolean required=False default=False flags=--include-allowed help='Include allowed actions (denials only by default)'
    param output kind=TyperOption type=path required=False default='compliance-audit.csv' flags=--output,-o help='Output CSV file path'

command: panoptis protect compliance export-local
    help: Export compliance audit log from a local JSONL file as CSV.
    short_help: 
    param audit_log kind=TyperOption type=path required=False default='data/audit-log.jsonl' flags=--audit-log help='Path to the persisted audit log JSONL file'
    param include_allowed kind=TyperOption type=boolean required=False default=False flags=--include-allowed help='Include allowed actions (denials only by default)'
    param output kind=TyperOption type=path required=False default='compliance-audit.csv' flags=--output,-o help='Output CSV file path'

command: panoptis protect config
    help: Manage the local safety policy file.
    short_help: 

command: panoptis protect config generate
    help: [bold]Generate[/bold] a starter .agentwatch-safety.yml policy file.
    short_help: 
    param force kind=TyperOption type=boolean required=False default=False flags=--force help='Overwrite an existing file.'
    param path kind=TyperOption type=path required=False default='.agentwatch-safety.yml' flags=--path help='Where to write the policy file.'

command: panoptis protect control
    help: Emergency stop and agent/session suspension for protected agents.
    short_help: 

command: panoptis protect control history
    help: The control audit trail, newest first.
    short_help: 
    param limit kind=TyperOption type=int required=False default=50 flags=--limit help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store shared with the agents (default: AGENTWATCH_STORE).'

command: panoptis protect control kill
    help: Stop every protected agent before its next tool call (this host at once; others via the store).
    short_help: 
    param actor kind=TyperOption type=str required=False default=None flags=--actor help='Who (default: the OS user).'
    param reason kind=TyperOption type=str required=True default=None flags=--reason help='Why (recorded).'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store shared with the agents (default: AGENTWATCH_STORE).'

command: panoptis protect control reset
    help: Lift the emergency stop.
    short_help: 
    param actor kind=TyperOption type=str required=False default=None flags=--actor help='Who (default: the OS user).'
    param reason kind=TyperOption type=str required=True default=None flags=--reason help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store shared with the agents (default: AGENTWATCH_STORE).'

command: panoptis protect control resume-agent
    help: Resume an agent: its tool calls are allowed again.
    short_help: 
    param actor kind=TyperOption type=str required=False default=None flags=--actor help='Who (default: the OS user).'
    param reason kind=TyperOption type=str required=True default=None flags=--reason help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store shared with the agents (default: AGENTWATCH_STORE).'
    param target kind=TyperArgument type=str required=True default=None flags=target help='The agent id.'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis protect control resume-session
    help: Resume a session: its tool calls are allowed again.
    short_help: 
    param actor kind=TyperOption type=str required=False default=None flags=--actor help='Who (default: the OS user).'
    param reason kind=TyperOption type=str required=True default=None flags=--reason help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store shared with the agents (default: AGENTWATCH_STORE).'
    param target kind=TyperArgument type=str required=True default=None flags=target help='The session id.'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis protect control status
    help: Show the kill switch and the suspended agents and sessions.
    short_help: 
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store shared with the agents (default: AGENTWATCH_STORE).'
    param tenant kind=TyperOption type=str required=False default=None flags=--tenant help="Only this tenant's suspensions."

command: panoptis protect control suspend-agent
    help: Suspend an agent: its tool calls are blocked.
    short_help: 
    param actor kind=TyperOption type=str required=False default=None flags=--actor help='Who (default: the OS user).'
    param reason kind=TyperOption type=str required=True default=None flags=--reason help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store shared with the agents (default: AGENTWATCH_STORE).'
    param target kind=TyperArgument type=str required=True default=None flags=target help='The agent id.'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis protect control suspend-session
    help: Suspend a session: its tool calls are blocked.
    short_help: 
    param actor kind=TyperOption type=str required=False default=None flags=--actor help='Who (default: the OS user).'
    param reason kind=TyperOption type=str required=True default=None flags=--reason help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store shared with the agents (default: AGENTWATCH_STORE).'
    param target kind=TyperArgument type=str required=True default=None flags=target help='The session id.'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis protect decisions
    help: Recent protection decisions, newest first.
    short_help: 
    param agent kind=TyperOption type=str required=False default=None flags=--agent help=''
    param api kind=TyperOption type=str required=False default=None flags=--api help='AgentWatch API URL (default: AGENTWATCH_API_URL; omit for local mode).'
    param key kind=TyperOption type=str required=False default=None flags=--key help='API key (default: AGENTWATCH_API_KEY). Never printed.'
    param limit kind=TyperOption type=int required=False default=20 flags=--limit help=''
    param stage kind=TyperOption type=str required=False default=None flags=--stage help='threat | rbac | loop | intent | hitl | killswitch | …'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store for local mode (default: AGENTWATCH_STORE).'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help='Tenant (local mode; in API mode the key decides).'
    param tool kind=TyperOption type=str required=False default=None flags=--tool help=''
    param verdict kind=TyperOption type=str required=False default=None flags=--verdict help='allow | block | escalate_hitl | mutate_and_allow'

command: panoptis protect discover
    help: Find local agent runtimes and MCP servers, and whether AgentWatch enforces on them.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Print the inventory as JSON.'
    param processes kind=TyperOption type=boolean required=False default=True flags=--processes help='Also scan running processes (needs psutil).'
    param project kind=TyperOption type=path required=False default=[] flags=--project help='Project roots to check (.mcp.json, .claude/, .cursor/, .vscode/).'
    param record kind=TyperOption type=boolean required=False default=False flags=--record help='Store the inventory in the evidence store for the dashboard.'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store URL (default: AGENTWATCH_STORE).'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis protect discover wrap
    help: Rewrite one configured stdio MCP server to run behind the AgentWatch gateway.
    short_help: 
    param apply kind=TyperOption type=boolean required=False default=False flags=--apply help='Write the change (a .agentwatch.bak backup is kept). Without it, only show it.'
    param config kind=TyperOption type=path required=True default=None flags=--config help='The MCP config file (mcpServers).'
    param server kind=TyperOption type=str required=True default=None flags=--server help='The server entry to put behind the gateway.'

command: panoptis protect doctor
    help: Diagnose the protection setup (store, evidence, policy, kill switch, hook). Exit 1 on a failure.
    short_help: 
    param policy kind=TyperOption type=path required=False default=None flags=--policy help='default: AGENTWATCH_POLICY_FILE'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store for local mode (default: AGENTWATCH_STORE).'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help='Tenant (local mode; in API mode the key decides).'

command: panoptis protect evidence
    help: Verify, seal and manage immutable evidence.
    short_help: 

command: panoptis protect evidence erase-subject
    help: Crypto-shred a data subject: destroy its key and purge derived copies (irreversible).
    short_help: 
    param reason kind=TyperOption type=str required=True default=None flags=--reason help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param subject kind=TyperArgument type=str required=True default=None flags=subject help='value of the declared subject_id'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''
    param yes kind=TyperOption type=boolean required=False default=False flags=--yes help=''

command: panoptis protect evidence export
    help: Export sealed evidence for independent verification (panoptis/evidence/verifier.py).
    short_help: 
    param output kind=TyperOption type=path required=True default=None flags=--output,-o help='bundle file to write'
    param seal kind=TyperOption type=boolean required=False default=True flags=--seal help='seal pending observations first'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis protect evidence proof
    help: The inclusion proof of one sealed record (verify with verifier.py --proof).
    short_help: 
    param obs_id kind=TyperArgument type=str required=True default=None flags=obs_id help="the record's observation id"
    param output kind=TyperOption type=path required=False default=None flags=--output,-o help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis protect evidence purge
    help: Retention: remove sealed segments older than N days, their payload files and derived copies (chain preserved).
    short_help: 
    param older_than_days kind=TyperOption type=int required=True default=None flags=--older-than-days help=''
    param reason kind=TyperOption type=str required=True default=None flags=--reason help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''
    param yes kind=TyperOption type=boolean required=False default=False flags=--yes help=''

command: panoptis protect evidence seal
    help: Seal pending observations into hash-chained segments.
    short_help: 
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis protect evidence show
    help: Show a raw observation exactly as stored, with its inclusion proof.
    short_help: 
    param obs_id kind=TyperArgument type=str required=True default=None flags=obs_id help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis protect evidence verify
    help: Verify the hash chain, Merkle roots, envelopes and index of all sealed evidence.
    short_help: 
    param anchor kind=TyperOption type=boolean required=False default=True flags=--anchor help='check against, then update, the locally kept head'
    param expect_head kind=TyperOption type=str required=False default=None flags=--expect-head help='SEQ:SEGMENT_HASH known from elsewhere (truncation check)'
    param seal kind=TyperOption type=boolean required=False default=True flags=--seal help='seal pending observations first'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis protect evidence verify-bundle
    help: Verify an exported bundle with the standalone verifier (no store access).
    short_help: 
    param bundle kind=TyperArgument type=path required=True default=None flags=bundle help="bundle written by 'evidence export'"
    param expect_head kind=TyperOption type=str required=False default=None flags=--expect-head help='SEQ:SEGMENT_HASH'

command: panoptis protect mcp-gateway
    help: Run the enforcing MCP gateway: stdio | http | config | status (see --help of each).


panoptis protect mcp-gateway stdio --server-name fs -- npx -y @modelcontextprotocol/server-filesystem .
panoptis protect mcp-gateway http --upstream http://127.0.0.1:9000/mcp --port 8765
panoptis protect mcp-gateway config --server-name fs -- npx -y @modelcontextprotocol/server-filesystem .
panoptis protect mcp-gateway status
    short_help: 

command: panoptis protect policies
    help: Inspect the effective safety policy set.
    short_help: 

command: panoptis protect policies list
    help: [bold]List[/bold] the effective safety policy set: builtin patterns + local rules.
    short_help: 

command: panoptis protect rbac
    help: Validate RBAC policies and explain effective permissions.
    short_help: 

command: panoptis protect rbac check
    help: Would this call be authorized? Exit 1 if not (a dry run: no rate budget used).
    short_help: 
    param agent kind=TyperArgument type=str required=True default=None flags=agent help=''
    param api kind=TyperOption type=str required=False default=None flags=--api help='AgentWatch API URL (default: AGENTWATCH_API_URL; omit for local mode).'
    param arguments kind=TyperOption type=str required=False default='{}' flags=--args help='tool arguments as JSON'
    param key kind=TyperOption type=str required=False default=None flags=--key help='API key (default: AGENTWATCH_API_KEY). Never printed.'
    param policy kind=TyperOption type=path required=False default=None flags=--policy help=''
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help='Tenant (local mode; in API mode the key decides).'
    param tool kind=TyperArgument type=str required=True default=None flags=tool help=''

command: panoptis protect rbac permissions
    help: What an agent may do (roles, tools, restrictions, rate limits).
    short_help: 
    param agent kind=TyperArgument type=str required=True default=None flags=agent help=''
    param api kind=TyperOption type=str required=False default=None flags=--api help='AgentWatch API URL (default: AGENTWATCH_API_URL; omit for local mode).'
    param key kind=TyperOption type=str required=False default=None flags=--key help='API key (default: AGENTWATCH_API_KEY). Never printed.'
    param policy kind=TyperOption type=path required=False default=None flags=--policy help=''
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help='Tenant (local mode; in API mode the key decides).'

command: panoptis protect rbac validate
    help: Validate a policy file; lists every problem. Exit 1 if invalid.
    short_help: 
    param file kind=TyperArgument type=path required=True default=None flags=file help='policy YAML/JSON'

command: panoptis protect redteam
    help: [bold]Red-team[/bold] the safety engine with simulated attacks and score resilience.
    short_help: 
    param json_output kind=TyperOption type=boolean required=False default=False flags=--json help='Emit the report as JSON'

command: panoptis protect status
    help: Protection summary: verdicts, kill switch, suspensions, policy, evidence head.
    short_help: 
    param api kind=TyperOption type=str required=False default=None flags=--api help='AgentWatch API URL (default: AGENTWATCH_API_URL; omit for local mode).'
    param key kind=TyperOption type=str required=False default=None flags=--key help='API key (default: AGENTWATCH_API_KEY). Never printed.'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Evidence store for local mode (default: AGENTWATCH_STORE).'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help='Tenant (local mode; in API mode the key decides).'

command: panoptis protect support
    help: What each integration does to a tool call: enforced before execution, or only observed.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help=''

command: panoptis provenance
    help: [bold]Provenance[/bold]: where did this information come from?
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param node kind=TyperArgument type=str required=True default=None flags=node help='artifact label (e.g. report.md), artifact:<content id>, inst:<instance>, or event id'
    param run kind=TyperOption type=str required=False default=None flags=--run help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis query
    help: [bold]Query[/bold] system behaviour; answers cite the evidence they rest on.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param text kind=TyperArgument type=str required=True default=None flags=text help="structured query (e.g. 'compare A B') or a question"

command: panoptis replay
    help: [bold]Replay[/bold] a run at an explicit level; reports reproduction confidence and what was mocked or live.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param level kind=TyperOption type=str required=False default='L1' flags=--level help='L0 | L1 | L2 | L3'
    param live kind=TyperOption type=str required=False default=[] flags=--live help='operation to run live at L3 (repeatable)'
    param run kind=TyperArgument type=str required=False default='latest' flags=run help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis reprocess
    help: Rebuild the current interpretation from raw evidence (evidence is never modified).
    short_help: 
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param tenant kind=TyperOption type=str required=False default='default' flags=--tenant help=''

command: panoptis runs
    help: List reconstructed [bold]runs[/bold].
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param limit kind=TyperOption type=int required=False default=20 flags=--limit help=''
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis safety
    help: AgentWatch Safety & Risk Engine. Analyze shell commands against security policies.
    short_help: 

command: panoptis safety check
    help: [bold]Score[/bold] the risk level of a shell command.

[b]Example Usage:[/b]
[dim]python -m panoptis.cli.main safety check "rm -rf /var/log"[/dim]
    short_help: 
    param command kind=TyperArgument type=str required=True default=None flags=command help='Command to risk-score'
    param verbose kind=TyperOption type=boolean required=False default=False flags=--verbose,-v help=''

command: panoptis safety config
    help: Manage the local safety policy file.
    short_help: 

command: panoptis safety config generate
    help: [bold]Generate[/bold] a starter .agentwatch-safety.yml policy file.
    short_help: 
    param force kind=TyperOption type=boolean required=False default=False flags=--force help='Overwrite an existing file.'
    param path kind=TyperOption type=path required=False default='.agentwatch-safety.yml' flags=--path help='Where to write the policy file.'

command: panoptis safety policies
    help: Inspect the effective safety policy set.
    short_help: 

command: panoptis safety policies list
    help: [bold]List[/bold] the effective safety policy set: builtin patterns + local rules.
    short_help: 

command: panoptis safety redteam
    help: [bold]Red-team[/bold] the safety engine with simulated attacks and score resilience.
    short_help: 
    param json_output kind=TyperOption type=boolean required=False default=False flags=--json help='Emit the report as JSON'

command: panoptis server
    help: Manage the AgentWatch API server
    short_help: 

command: panoptis server start
    help: [bold]Start[/bold] the AgentWatch API server.
    short_help: 
    param dry_run kind=TyperOption type=boolean required=False default=False flags=--dry-run help='Preview what would happen without starting the server'
    param host kind=TyperOption type=str required=False default='127.0.0.1' flags=--host help=''
    param port kind=TyperOption type=int required=False default=8000 flags=--port help=''
    param reload kind=TyperOption type=boolean required=False default=False flags=--reload help=''

command: panoptis server status
    help: [bold]Show[/bold] a real-time live dashboard of AgentWatch runtime status.
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param refresh_rate kind=TyperOption type=float range required=False default=1.0 flags=--refresh help='Refresh rate in seconds (must be >= 0.1)'

command: panoptis server top
    help: [bold]Live Process Monitor[/bold] showing executing agent loops, active tools, and token burn rate.
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param cooldown kind=TyperOption type=int range required=False default=60 flags=--cooldown help='Seconds the circuit breaker stays OPEN before probing recovery (0 = manual resume only)'
    param max_failures kind=TyperOption type=int range required=False default=3 flags=--max-failures help='Consecutive failures that trip the circuit breaker'
    param refresh_rate kind=TyperOption type=float range required=False default=1.0 flags=--refresh help='Refresh rate in seconds'

command: panoptis session
    help: Manage and inspect agent sessions
    short_help: 

command: panoptis session export
    help: [bold]Export[/bold] a session replay to a portable JSON, Markdown, JSONL or CSV file.
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param format kind=TyperOption type=choice required=False default=<ExportFormat.json: 'json'> flags=--format help='Export format: json, md, jsonl or csv'
    param output kind=TyperOption type=path required=False default=None flags=--output,-o help='Custom output file path'
    param session_id kind=TyperArgument type=str required=True default=None flags=session_id help='ID of the session to export'

command: panoptis session export-csv
    help: [bold]Export-csv[/bold] a session replay to a CSV file.
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param out kind=TyperOption type=str required=False default='report.csv' flags=--out help='Custom output file path'
    param session_id kind=TyperArgument type=str required=True default=None flags=session_id help='ID of the session to export'

command: panoptis session list
    help: [bold]List[/bold] recent agent sessions from the AgentWatch API.
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param framework kind=TyperOption type=str required=False default=None flags=--framework help=''
    param limit kind=TyperOption type=int required=False default=20 flags=--limit,-n help=''

command: panoptis session prune
    help: [bold]Prune[/bold] old sessions, traces, and checkpoints to free up disk space.
    short_help: 
    param api_key kind=TyperOption type=str required=False default=None flags=--api-key help='API key for protected endpoints (or set AGENTWATCH_API_KEY).'
    param api_url kind=TyperOption type=str required=False default='http://localhost:8000' flags=--api help=''
    param dry_run kind=TyperOption type=boolean required=False default=False flags=--dry-run help='Preview what would be deleted without taking action'
    param older_than kind=TyperOption type=str required=True default=None flags=--older-than help='Age of sessions to prune (e.g. 30d, 12h)'

command: panoptis session replay
    help: [bold]Replay[/bold] a captured session step-by-step.
    short_help: 
    param failure_only kind=TyperOption type=boolean required=False default=False flags=--failures,-f help='Show only failure points'
    param from_step kind=TyperOption type=int required=False default=0 flags=--from help='Start from step N'
    param session_file kind=TyperArgument type=path required=True default=None flags=session_file help='Path to session JSON file'
    param show_all kind=TyperOption type=boolean required=False default=False flags=--all help='Show all events including metadata'
    param speed kind=TyperOption type=str required=False default='instant' flags=--speed,-s help='instant|fast|normal|slow'
    param to_step kind=TyperOption type=int required=False default=None flags=--to help='End at step N'

command: panoptis session rollback
    help: [bold]Rollback[/bold] a session to a specific step.
    short_help: 
    param session_id kind=TyperArgument type=str required=True default=None flags=session_id help='Session ID to rollback'
    param to_step kind=TyperOption type=int range required=True default=None flags=--to-step help='Step number to rollback to'

command: panoptis session score
    help: [bold]Score[/bold] execution confidence and detect anomalies for a session.
    short_help: 
    param session_file kind=TyperArgument type=path required=True default=None flags=session_file help='Path to session JSON file'

command: panoptis session watch
    help: [bold]Watch[/bold] an agent execution (Claude Code, ollama, antigravity) with full observability and safety.
    short_help: 
    param agent kind=TyperOption type=str required=False default='claude' flags=--agent,-a help='Agent to use: claude|ollama|opencode|antigravity'
    param dry_run kind=TyperOption type=boolean required=False default=False flags=--dry-run help='Preview what would happen without executing or writing to disk'
    param max_turns kind=TyperOption type=int required=False default=50 flags=--max-turns help=''
    param model kind=TyperOption type=str required=False default='claude-opus-4-5' flags=--model,-m help=''
    param no_safety kind=TyperOption type=boolean required=False default=False flags=--no-safety help='Disable safety checks (dangerous)'
    param output kind=TyperOption type=path required=False default=None flags=--output,-o help='Save session to file'
    param policy kind=TyperOption type=str required=False default='default' flags=--policy help='Safety policy: default|strict|permissive'
    param prompt kind=TyperArgument type=str required=False default=None flags=prompt help='Prompt to run with the agent'

command: panoptis share
    help: [bold]Share[/bold] a trace via a temporary public link (PII/secrets redacted).
    short_help: 
    param dry_run kind=TyperOption type=boolean required=False default=False flags=--dry-run help='Sanitize and preview the payload locally without uploading.'
    param expires_days kind=TyperOption type=int range required=False default=7 flags=--expires-days help='Days before the shared link expires.'
    param session_file kind=TyperArgument type=path required=True default=None flags=session_file help='Path to the trace/session JSON file to share'
    param share_url kind=TyperOption type=str required=False default=None flags=--share-url help='Base URL of the share service (or set AGENTWATCH_SHARE_URL).'

command: panoptis show
    help: [bold]Show[/bold] an event: normalized form, raw evidence, parents and children.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param event kind=TyperArgument type=str required=True default=None flags=event help='event id or prefix'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis states
    help: EXPERIMENTAL latent behavioural states (interpretable baseline).
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param runs_ kind=TyperArgument type=str required=False default=None flags=runs_ help='runs (default: all)'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'
    param window kind=TyperOption type=int required=False default=4 flags=--window help=''

command: panoptis status
    help: v3 store status, interpretation and capability maturity.
    short_help: 
    param as_json kind=TyperOption type=boolean required=False default=False flags=--json help='Machine-readable JSON output.'
    param store kind=TyperOption type=str required=False default=None flags=--store help='Store URL (sqlite:///path or postgresql+psycopg://…). Default: ~/.agentwatch/agentwatch.db'

command: panoptis tui
    help: Launch the interactive terminal command center.
    short_help: 

command: panoptis upgrade
    help: [bold]Upgrade[/bold] to AgentWatch Premium via the secure web checkout.
    short_help: 
    param activate kind=TyperOption type=str required=False default=None flags=--activate help='Store the entitlement token returned by the checkout page.'
    param base_url kind=TyperOption type=str required=False default=None flags=--checkout-url help='Override the checkout portal base URL.'
    param dry_run kind=TyperOption type=boolean required=False default=False flags=--dry-run help='Preview the handoff without opening a browser.'
    param no_browser kind=TyperOption type=boolean required=False default=False flags=--no-browser help='Print the checkout URL instead of opening a browser.'
    param show_status kind=TyperOption type=boolean required=False default=False flags=--status help='Show the current entitlement status and exit.'

command: panoptis version
    help: Show AgentWatch version and diagnostics.
    short_help: 

command: panoptis watch
    help: [bold]Watch[/bold] an agent execution (Claude Code, ollama, antigravity) with full observability and safety.
    short_help: 
    param agent kind=TyperOption type=str required=False default='claude' flags=--agent,-a help='Agent to use: claude|ollama|opencode|antigravity'
    param dry_run kind=TyperOption type=boolean required=False default=False flags=--dry-run help='Preview what would happen without executing or writing to disk'
    param max_turns kind=TyperOption type=int required=False default=50 flags=--max-turns help=''
    param model kind=TyperOption type=str required=False default='claude-opus-4-5' flags=--model,-m help=''
    param no_safety kind=TyperOption type=boolean required=False default=False flags=--no-safety help='Disable safety checks (dangerous)'
    param output kind=TyperOption type=path required=False default=None flags=--output,-o help='Save session to file'
    param policy kind=TyperOption type=str required=False default='default' flags=--policy help='Safety policy: default|strict|permissive'
    param prompt kind=TyperArgument type=str required=False default=None flags=prompt help='Prompt to run with the agent'

