feat: add the agents and service-accounts command groups [NOTASK]

USAGE.md

@@ -709,6 +709,28 @@ $ tw data-links browse -w seqeralabs/showcase -i v1-user-6d8f44c239e2a098b3e02e9
  FOLDER | technical/                                 | 0        
 ```
 
+## Agents
+
+Run `tw agents -h` to view the supported operations: `list`, `view`, `add`, `update`, `delete`, `enable`, `disable`, `launch`, and `runs list|view`. Agents must be enabled for the organization.
+
+```bash
+tw agents add -w my-org/my-workspace -n triage --instructions-file triage.md
+tw agents launch -w my-org/my-workspace -n triage
+tw agents runs list -w my-org/my-workspace
+```
+
+## Service accounts
+
+Run `tw service-accounts -h` to view the supported operations: `list`, `add`, `view`, `update`, and `delete`. Service accounts are non-human organization members. Add one to a workspace with `tw participants add -t MEMBER -n <name>` (it gets the `VIEW` role; change it with `tw participants update -t MEMBER -n <name> -r <role>`), or set one as an agent's identity with `tw agents add|update --service-account <name>` or `--service-account-id <id>`.
+
+> **Note**: All `tw service-accounts` operations except `list -w` require the organization owner role. So does looking up a service account by name in `tw participants add` and `tw agents add|update --service-account`. A service account still bound to active agents can't be deleted: bind those agents to another service account or disable them first.
+
+```bash
+tw service-accounts add -o my-org -n ci-bot -d "CI pipeline launcher"
+tw service-accounts list -o my-org
+tw service-accounts list -w my-org/my-workspace
+```
+
 ## Organization administration
 
 These commands act on an organization (`-o`/`--organization`). Most require the organization `OWNER` role.

build.gradle

@@ -61,8 +61,13 @@ license {
     exclude('conf/**')
 }
 
+// Jersey's HttpURLConnection connector can only send PATCH by reflecting into these JDK internals
+// (HttpUrlConnectorProvider.SET_METHOD_WORKAROUND, enabled by the SDK's ApiClient)
+def jerseyPatchOpens = ['java.base/java.net', 'java.base/sun.net.www.protocol.https']
+
 application {
     mainClass.set('io.seqera.tower.cli.Tower')
+    applicationDefaultJvmArgs = jerseyPatchOpens.collect { "--add-opens=${it}=ALL-UNNAMED" }
 }
 
 java {
@@ -87,6 +92,8 @@ graalvmNative {
             buildArgs.add('-H:+AddAllCharsets')
             buildArgs.add('-H:EnableURLProtocols=https,http')
             buildArgs.add('-H:+ReportExceptionStackTraces')
+            // Native images enforce module encapsulation for setAccessible too, so the reflection entries alone are not enough
+            buildArgs.addAll(jerseyPatchOpens.collect { "--add-opens=${it}=ALL-UNNAMED" })
 
             javaLauncher = javaToolchains.launcherFor {
                 languageVersion = JavaLanguageVersion.of(25)
@@ -137,7 +144,7 @@ tasks.named('run') {
 
     // Run with GraalVM Tracing Agent enabled
     if (System.getProperty('tracing-agent')?.toBoolean()) {
-        jvmArgs = ["-agentlib:native-image-agent=access-filter-file=conf/access-filter-file.json,config-merge-dir=conf/"]
+        jvmArgs += ["-agentlib:native-image-agent=access-filter-file=conf/access-filter-file.json,config-merge-dir=conf/"]
     }
 }
 
@@ -150,6 +157,9 @@ tasks.register('runReflectionConfigGenerator', JavaExec) {
 }
 
 tasks.named('shadowJar') {
+    manifest {
+        attributes 'Add-Opens': jerseyPatchOpens.join(' ')
+    }
     archiveBaseName.set('tw')
     archiveClassifier.set('')
     archiveVersion.set('')
@@ -164,9 +174,10 @@ tasks.named('test') {
         events 'failed'
         exceptionFormat = 'full'
     }
+    jvmArgs jerseyPatchOpens.collect { "--add-opens=${it}=ALL-UNNAMED" }
     // Run tests with GraalVM Tracing Agent enabled
     if (System.getProperty('tracing-agent')?.toBoolean()) {
-        jvmArgs = ["-agentlib:native-image-agent=access-filter-file=conf/access-filter-file.json,config-merge-dir=conf/"]
+        jvmArgs += ["-agentlib:native-image-agent=access-filter-file=conf/access-filter-file.json,config-merge-dir=conf/"]
     }
 }