feat: add the agents and service-accounts command groups

USAGE.md

@@ -709,6 +709,26 @@ $ tw data-links browse -w seqeralabs/showcase -i v1-user-6d8f44c239e2a098b3e02e9
  FOLDER | technical/                                 | 0        
 ```
 
+## Agents
+
+Run `tw agents -h` to view the supported operations: `list`, `view`, `add`, `update`, `delete`, `enable`, `disable`, `launch`, and `runs list|view`. Agents must be enabled for the organization.
+
+```bash
+tw agents add -w my-org/my-workspace -n triage --instructions-file triage.md
+tw agents launch -w my-org/my-workspace -n triage
+tw agents runs list -w my-org/my-workspace
+```
+
+## Service accounts
+
+Run `tw service-accounts -h` to view the supported operations: `list`, `add`, `view`, `update`, and `delete`. Service accounts are non-human organization members. Add one to a workspace with `tw participants add -t MEMBER -n <name>`, or set one as an agent's identity with `tw agents add|update --service-account-id`.
+
+```bash
+tw service-accounts add -o my-org -n ci-bot -d "CI pipeline launcher"
+tw service-accounts list -o my-org
+tw service-accounts list -w my-org/my-workspace
+```
+
 [compute-envs]: https://docs.seqera.io/platform/latest/compute-envs/overview
 [credentials]: https://docs.seqera.io/platform/latest/credentials/overview
 [git-integration]: https://docs.seqera.io/platform/latest/git/overview

build.gradle

@@ -82,8 +82,13 @@ license {
     exclude('conf/**')
 }
 
+// Jersey's HttpURLConnection connector can only send PATCH by reflecting into these JDK internals
+// (HttpUrlConnectorProvider.SET_METHOD_WORKAROUND, enabled by the SDK's ApiClient)
+def jerseyPatchOpens = ['java.base/java.net', 'java.base/sun.net.www.protocol.https']
+
 application {
     mainClass.set('io.seqera.tower.cli.Tower')
+    applicationDefaultJvmArgs = jerseyPatchOpens.collect { "--add-opens=${it}=ALL-UNNAMED" }
 }
 
 java {
@@ -108,6 +113,8 @@ graalvmNative {
             buildArgs.add('-H:+AddAllCharsets')
             buildArgs.add('-H:EnableURLProtocols=https,http')
             buildArgs.add('-H:+ReportExceptionStackTraces')
+            // Native images enforce module encapsulation for setAccessible too, so the reflection entries alone are not enough
+            buildArgs.addAll(jerseyPatchOpens.collect { "--add-opens=${it}=ALL-UNNAMED" })
 
             javaLauncher = javaToolchains.launcherFor {
                 languageVersion = JavaLanguageVersion.of(25)
@@ -158,7 +165,7 @@ tasks.named('run') {
 
     // Run with GraalVM Tracing Agent enabled
     if (System.getProperty('tracing-agent')?.toBoolean()) {
-        jvmArgs = ["-agentlib:native-image-agent=access-filter-file=conf/access-filter-file.json,config-merge-dir=conf/"]
+        jvmArgs += ["-agentlib:native-image-agent=access-filter-file=conf/access-filter-file.json,config-merge-dir=conf/"]
     }
 }
 
@@ -171,6 +178,9 @@ tasks.register('runReflectionConfigGenerator', JavaExec) {
 }
 
 tasks.named('shadowJar') {
+    manifest {
+        attributes 'Add-Opens': jerseyPatchOpens.join(' ')
+    }
     archiveBaseName.set('tw')
     archiveClassifier.set('')
     archiveVersion.set('')
@@ -180,9 +190,10 @@ tasks.named('test') {
     // Use junit platform for unit tests
     useJUnitPlatform()
     dependsOn tasks.named('checkLicenses')
+    jvmArgs jerseyPatchOpens.collect { "--add-opens=${it}=ALL-UNNAMED" }
     // Run tests with GraalVM Tracing Agent enabled
     if (System.getProperty('tracing-agent')?.toBoolean()) {
-        jvmArgs = ["-agentlib:native-image-agent=access-filter-file=conf/access-filter-file.json,config-merge-dir=conf/"]
+        jvmArgs += ["-agentlib:native-image-agent=access-filter-file=conf/access-filter-file.json,config-merge-dir=conf/"]
     }
 }