@actionway/cli-dev 0.0.0-dev.32112453761.a2fa31914131

package/README.md

@@ -0,0 +1,91 @@
+# @actionway/cli — 本地端壳（bin: `actionway`）
+
+actionway CLI 的本地端壳（迁移文档 `docs/DL_TO_ACTIONWAY_CLI_MIGRATION.md` §3.2 / §3.4）：
+终端用户在自己机器上的 Coding Agent（Codex / Claude Code）通过它调用 Actionway 能力。
+
+## 安装
+
+要求 Node.js 20 或更新版本；CI 覆盖 Node.js 20 和 22。Windows 使用 npm 生成的 `.cmd` 入口，避免 PowerShell
+执行策略阻止 `.ps1` shim：
+
+```powershell
+npm.cmd install --global @actionway/cli@latest
+actionway.cmd doctor
+actionway.cmd init
+```
+
+macOS / Linux：
+
+```bash
+npm install --global @actionway/cli@latest
+actionway doctor
+actionway init
+```
+
+`doctor` 只输出脱敏后的 Node/npm、registry、global PATH、配置目录、loopback
+和 OAuth discovery 检查；它不会修改 npm、代理、CA、PATH 或 PowerShell policy。
+
+### Development 通道
+
+成功合并并部署 `dev` 后，workflow 从同一 bundle 生成独立公共包 `@actionway/cli-dev`。它只暴露 `actionway-dev`，固定连接 `https://dev.actionway.ai`，使用 `${HOME}/.actionway-dev` 和 `actionway-dev` Skill；不会安装或覆盖正式 `actionway`：
+
+```bash
+npm install --global @actionway/cli-dev@latest
+actionway-dev doctor
+actionway-dev init
+actionway-dev status
+```
+
+`actionway-dev update` 只读取和更新 `@actionway/cli-dev@latest`。每个 dev npm 版本包含不可变 source SHA 与 Actions run metadata；同一 tarball 也保存在私有 GitHub prerelease，后者仅用于内部审计和精确回滚，普通安装不需要 GitHub 账号。
+
+- **auth 唯一途径：Clerk OAuth（PKCE）**。issuer / client_id 运行时从
+  `{public origin}/api/auth/cli-config` 发现；浏览器授权走随机 `127.0.0.1` 回调端口；
+  凭据存 `~/.actionway/credentials.json`（POSIX 上为 0600 owner-only 文件；
+  Windows 上 chmod 无效，保密性依赖 `%USERPROFILE%` 的继承 ACL——不要把
+  `ACTIONWAY_CONFIG_DIR` 指到共享目录）。CLI 从不打印或存储 OAuth client secret。
+- **命令面 = 明码写出的注册表**（无 capability profile flag；production/development 只切换包、命令、状态、Skill、更新源与 Gateway）：
+  - `tools search / inspect / call` 是长尾 capability 的规范发现与执行面；
+  - 高频 typed command 继续提供参数与文件 UX，但投影到同一个 Tool Call；
+  - `account usage / wallet / transactions` 只读 Actionway Business 数据；
+  - 本壳另有 `init` / `doctor` / `update` / `login` / `logout` / `whoami`，cli-core
+  继续提供 wait/poll 与已冻结的共享 typed commands。
+
+- **账户响应无本地换算**：`account` 响应同时保留精确整数 micros 与可直接展示的 USD 十进制字符串；钱包包含快照更新时间，交易包含状态、说明、完成时间和 signed balance delta。Usage/Transactions 支持 ISO 时间窗口、领域筛选和 opaque cursor，返回的 summary 覆盖完整筛选集合而非当前页。CLI 不自行换算资金，也不改变服务端返回的字段语义。
+- **计费零逻辑**：报价、扣费、错误面裁剪全在 gateway；本壳只透传。旧
+  stock download 直连 CDN、Gateway 无法观察结局，因此在阶段二的
+  command-level 计费编排完成前明确 fail-closed，不把迁移缺口当免费能力。
+- **版本三链路**（与 pi-mono dl 的 actionway profile 同构）：
+  1. 输出注入 —— 每个成功 JSON 输出带 `cli_version` + `skill_source`，
+     本地缓存显示有新版时追加 `notes` 更新提示（update 命令自身输出带
+     `update_available` 时跳过，防更新循环）；
+  2. HTTP header —— 请求捎带 `x-actionway-cli-version`，响应的
+     `x-actionway-cli-latest` / `x-actionway-cli-min` 喂本地缓存；
+  3. registry —— `actionway update --check` 查 npm（24h 缓存），
+     `actionway update` 全局安装新版并 re-exec 刷新物化 skill。
+- **skill 物化**：`actionway init` 把 `assets/skill/actionway` 拷到
+  `~/.actionway/skill/actionway` 并把 CLI 版本盖进 SKILL.md frontmatter
+  `metadata.version`；
+  Agent 从该路径自取安装——CLI 从不写入任何 Agent 自己的配置目录。包内
+  Skill 不复制 capability catalog；未知或长尾需求走 Search → Inspect → Call，
+  `confirmation_required` 必须由用户确认后恢复同一个 `call_ref`。
+
+```bash
+pnpm cli init            # 浏览器授权 + 物化 skill（首次安装入口）
+pnpm cli whoami          # 用户友好登录摘要 + 本地凭据快照（不出网）
+pnpm cli logout          # 删除本机凭据；重复执行也是成功的幂等操作
+pnpm cli update --check  # 查新版（24h 缓存）
+pnpm cli -- tools search "generate a product image"
+pnpm cli -- tools inspect media.image.generate
+pnpm cli -- account usage
+pnpm cli -- account usage --from 2026-08-01 --to 2026-09-01 --service generate-image
+pnpm cli -- account transactions --from 2026-08-01 --kind top_up
+pnpm cli -- generate-video --print-schema
+```
+
+发布 bundle 会把 cli-core 打进带 shebang 的 `dist/index.js`；`pnpm build`
+生成该产物，`pnpm pack` 的 tarball 可由 Node 直接执行。手动发布由统一的
+`.github/workflows/release.yml` 负责：勾选 `actionway_cli`（可单独选择，也可与 Worker 组合）并选择版本 bump 后，
+workflow 以 npm 已发布的最高版本为基线生成下一版本，构建当前仓库的
+tarball，验证真实 npm install 后的 `.bin/actionway`、`--help`、`--version`
+和 `logout`，再发布到 `latest`。`@actionway/sandbox-cli` 继续独立于本地 CLI；
+其 iLands rollout 尚未接入 Production Release，保留单独的手动发布 workflow。

package/assets/dev/actionway-dev-entry.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+process.env.ACTIONWAY_CLI_CHANNEL = "development";
+process.env.ACTIONWAY_CONFIG_DIR ||= join(homedir(), ".actionway-dev");
+process.env.ACTIONWAY_GATEWAY_URL ||= "https://dev.actionway.ai";
+
+const executable = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "dist", "index.js");
+const result = spawnSync(process.execPath, [executable, ...process.argv.slice(2)], {
+  stdio: "inherit",
+  env: process.env,
+  windowsHide: true,
+});
+if (result.error) throw result.error;
+process.exit(result.status || 0);

package/assets/dev/actionway-dev-launcher.mjs

@@ -0,0 +1,370 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+
+const repository = (process.env.ACTIONWAY_DEV_REPOSITORY || "PawLogic/actionway").trim();
+const packageName = "@actionway/cli-dev";
+const devHome = resolve(process.env.ACTIONWAY_DEV_HOME || join(homedir(), ".actionway-dev"));
+const metadataPath = join(devHome, "current-cli.json");
+const updateIntervalMs = Number(process.env.ACTIONWAY_DEV_UPDATE_INTERVAL_MS || 300_000);
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+
+export function commandInvocation(command, args, platform = process.platform, env = process.env) {
+  if (platform === "win32" && /\.(?:cmd|bat)$/i.test(command)) {
+    const commandProcessor = (env.ComSpec ?? env.COMSPEC ?? "cmd.exe").trim().replace(/^"|"$/g, "") || "cmd.exe";
+    return {
+      command: commandProcessor,
+      args: ["/d", "/s", "/c", command, ...args],
+    };
+  }
+  return { command, args: [...args] };
+}
+
+function run(command, args, { capture = false, env = process.env } = {}) {
+  const invocation = commandInvocation(command, args, process.platform, env);
+  const result = spawnSync(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env,
+    stdio: capture ? ["ignore", "pipe", "pipe"] : "inherit",
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    if (capture && result.stderr) process.stderr.write(result.stderr);
+    const error = new Error(`${command} exited with status ${result.status}`);
+    error.exitCode = result.status || 1;
+    throw error;
+  }
+  return capture ? result.stdout.trim() : "";
+}
+
+function readMetadata() {
+  if (!existsSync(metadataPath)) return null;
+  return JSON.parse(readFileSync(metadataPath, "utf8"));
+}
+
+function writeMetadata(metadata) {
+  mkdirSync(devHome, { recursive: true, mode: 0o700 });
+  writeFileSync(metadataPath, `${JSON.stringify(metadata, null, 2)}\n`, { mode: 0o600 });
+}
+
+export function validateReleaseManifest(manifest, expectedRepository = repository) {
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    throw new Error("Development release manifest must be a JSON object.");
+  }
+  if (
+    manifest.schema_version !== 1 ||
+    manifest.channel !== "development" ||
+    manifest.distribution !== "github_release"
+  ) {
+    throw new Error("Development release manifest has an unsupported schema, channel, or distribution.");
+  }
+  if (manifest.repository !== expectedRepository) {
+    throw new Error("Development release manifest uses an unexpected repository.");
+  }
+  if (typeof manifest.source_sha !== "string" || !/^[0-9a-f]{40}$/.test(manifest.source_sha)) {
+    throw new Error("Development release manifest has an invalid source_sha.");
+  }
+  if (manifest.release_tag !== `actionway-dev-${manifest.source_sha}`) {
+    throw new Error("Development release manifest tag does not match source_sha.");
+  }
+  if (manifest.gateway_url !== "https://dev.actionway.ai") {
+    throw new Error("Development release manifest does not target the development Gateway.");
+  }
+  if (!manifest.archive || typeof manifest.archive !== "object" || Array.isArray(manifest.archive)) {
+    throw new Error("Development release manifest is missing archive metadata.");
+  }
+  if (typeof manifest.archive.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(manifest.archive.sha256)) {
+    throw new Error("Development release manifest has an invalid archive sha256.");
+  }
+  if (
+    manifest.archive.asset_name !==
+    `actionway-cli-${manifest.source_sha}-${manifest.archive.sha256}.tgz`
+  ) {
+    throw new Error("Development release archive asset does not match source_sha and sha256.");
+  }
+  if (!Number.isSafeInteger(manifest.archive.size_bytes) || manifest.archive.size_bytes <= 0) {
+    throw new Error("Development release manifest has an invalid archive size.");
+  }
+  if (!Number.isSafeInteger(manifest.run_id) || manifest.run_id <= 0) {
+    throw new Error("Development release manifest has an invalid run_id.");
+  }
+  if (
+    manifest.run_url !==
+    `https://github.com/${manifest.repository}/actions/runs/${manifest.run_id}`
+  ) {
+    throw new Error("Development release manifest has an invalid run_url.");
+  }
+  if (manifest.artifact_name !== `actionway-cli-dev-${manifest.source_sha}`) {
+    throw new Error("Development release manifest has an invalid artifact_name.");
+  }
+  if (typeof manifest.published_at !== "string" || !Number.isFinite(Date.parse(manifest.published_at))) {
+    throw new Error("Development release manifest has an invalid published_at timestamp.");
+  }
+
+  return {
+    headSha: manifest.source_sha,
+    runId: manifest.run_id,
+    runUrl: manifest.run_url,
+    artifact: manifest.artifact_name,
+    releaseTag: manifest.release_tag,
+    archiveAsset: manifest.archive.asset_name,
+    archiveSha256: manifest.archive.sha256,
+    archiveSize: manifest.archive.size_bytes,
+    archivePath: null,
+  };
+}
+
+function resolveLatestRelease() {
+  const localArchive = process.env.ACTIONWAY_DEV_ARCHIVE?.trim();
+  if (localArchive) {
+    return {
+      headSha: (process.env.ACTIONWAY_DEV_SOURCE_SHA || "local-development").trim(),
+      runId: null,
+      runUrl: null,
+      artifact: null,
+      releaseTag: null,
+      archiveAsset: null,
+      archiveSha256: null,
+      archiveSize: null,
+      archivePath: resolve(localArchive),
+    };
+  }
+
+  const manifest = JSON.parse(run(npmCommand, ["view", `${packageName}@latest`, "--json"], { capture: true }));
+  if (manifest?.name !== packageName || typeof manifest.version !== "string") {
+    throw new Error(`npm did not return a valid ${packageName}@latest manifest.`);
+  }
+  const metadata = manifest.actionway;
+  if (
+    metadata?.channel !== "development" ||
+    !/^[0-9a-f]{40}$/.test(metadata.source_sha || "") ||
+    !Number.isSafeInteger(metadata.run_id) ||
+    metadata.run_id <= 0 ||
+    metadata.run_url !== `https://github.com/${repository}/actions/runs/${metadata.run_id}` ||
+    metadata.gateway_url !== "https://dev.actionway.ai"
+  ) {
+    throw new Error(`The published ${packageName}@${manifest.version} metadata is invalid.`);
+  }
+  if (typeof manifest.dist?.integrity !== "string" || !manifest.dist.integrity.startsWith("sha512-")) {
+    throw new Error(`The published ${packageName}@${manifest.version} integrity is missing.`);
+  }
+  return {
+    headSha: metadata.source_sha,
+    runId: metadata.run_id,
+    runUrl: metadata.run_url,
+    artifact: `actionway-cli-dev-${metadata.source_sha}`,
+    releaseTag: `actionway-dev-${metadata.source_sha}`,
+    archiveAsset: null,
+    archiveSha256: null,
+    archiveSize: null,
+    archivePath: null,
+    packageVersion: manifest.version,
+    npmIntegrity: manifest.dist.integrity,
+  };
+}
+
+function installSkill(packageRoot) {
+  const source = join(packageRoot, "assets", "skill", "actionway-dev");
+  if (!existsSync(source)) throw new Error("The development CLI artifact is missing its actionway-dev Skill.");
+  const explicitTarget = process.env.ACTIONWAY_DEV_SKILL_DIR?.trim();
+  const officialRoot = join(homedir(), ".agents", "skills");
+  const legacyRoot = join(homedir(), ".codex", "skills");
+  const skillRoot = process.env.CODEX_HOME?.trim()
+    ? join(resolve(process.env.CODEX_HOME), "skills")
+    : existsSync(legacyRoot) && !existsSync(officialRoot)
+      ? legacyRoot
+      : officialRoot;
+  const target = explicitTarget ? resolve(explicitTarget) : join(skillRoot, "actionway-dev");
+  mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+  rmSync(target, { recursive: true, force: true });
+  cpSync(source, target, { recursive: true });
+  return target;
+}
+
+function refreshInstalledAssets(metadata) {
+  const packageRoot = join(metadata.runtime_dir, "node_modules", "@actionway", "cli-dev");
+  if (!existsSync(packageRoot)) throw new Error("The installed Actionway development CLI package is missing.");
+  const skillDir = installSkill(packageRoot);
+  const packagedLauncher = join(packageRoot, "assets", "dev", "actionway-dev-launcher.mjs");
+  const installedLauncher = join(devHome, "bin", "actionway-dev-launcher.mjs");
+  if (existsSync(packagedLauncher)) {
+    mkdirSync(dirname(installedLauncher), { recursive: true, mode: 0o700 });
+    cpSync(packagedLauncher, installedLauncher, { force: true });
+  }
+  return { ...metadata, skill_dir: skillDir };
+}
+
+export function verifyArchiveBytes(bytes, expectedSize, expectedSha256) {
+  const archive = Buffer.from(bytes);
+  if (archive.byteLength !== expectedSize) {
+    throw new Error(
+      `Development archive size mismatch: expected ${expectedSize}, received ${archive.byteLength}.`,
+    );
+  }
+  const actualSha256 = createHash("sha256").update(archive).digest("hex");
+  if (actualSha256 !== expectedSha256) throw new Error("Development archive checksum mismatch.");
+  return archive;
+}
+
+function installRelease(release) {
+  const downloadDir = mkdtempSync(join(tmpdir(), "actionway-dev-cli-"));
+  try {
+    let archivePath = release.archivePath;
+    if (!archivePath) {
+      const packed = JSON.parse(
+        run(npmCommand, ["pack", `${packageName}@${release.packageVersion}`, "--pack-destination", downloadDir, "--json"], {
+          capture: true,
+        }),
+      );
+      const filename = packed?.[0]?.filename;
+      if (typeof filename !== "string") throw new Error(`npm pack did not return ${packageName}@${release.packageVersion}.`);
+      archivePath = join(downloadDir, filename);
+      const actualIntegrity = `sha512-${createHash("sha512").update(readFileSync(archivePath)).digest("base64")}`;
+      if (actualIntegrity !== release.npmIntegrity) throw new Error("Development npm archive integrity mismatch.");
+    }
+    if (!existsSync(archivePath)) throw new Error(`Actionway development CLI archive not found: ${archivePath}`);
+
+    const runtimeDir = join(devHome, "runtimes", release.headSha);
+    mkdirSync(runtimeDir, { recursive: true, mode: 0o700 });
+    run(npmCommand, [
+      "install",
+      "--ignore-scripts",
+      "--no-audit",
+      "--no-fund",
+      "--prefix",
+      runtimeDir,
+      archivePath,
+    ]);
+
+    const packageRoot = join(runtimeDir, "node_modules", "@actionway", "cli-dev");
+    const executable = join(runtimeDir, "node_modules", ".bin", process.platform === "win32" ? "actionway-dev.cmd" : "actionway-dev");
+    if (!existsSync(executable)) throw new Error("The development CLI artifact did not install an actionway-dev executable.");
+    const skillDir = installSkill(packageRoot);
+
+    const packagedLauncher = join(packageRoot, "assets", "dev", "actionway-dev-launcher.mjs");
+    const installedLauncher = join(devHome, "bin", "actionway-dev-launcher.mjs");
+    if (existsSync(packagedLauncher)) {
+      mkdirSync(dirname(installedLauncher), { recursive: true, mode: 0o700 });
+      cpSync(packagedLauncher, installedLauncher, { force: true });
+    }
+
+    const now = new Date().toISOString();
+    const metadata = {
+      version: 1,
+      source_sha: release.headSha,
+      run_id: release.runId,
+      run_url: release.runUrl,
+      artifact: release.artifact,
+      release_tag: release.releaseTag,
+      archive_asset: release.archiveAsset,
+      archive_sha256: release.archiveSha256,
+      package: packageName,
+      package_version: release.packageVersion ?? null,
+      npm_integrity: release.npmIntegrity ?? null,
+      runtime_dir: runtimeDir,
+      skill_dir: skillDir,
+      gateway_url: "https://dev.actionway.ai",
+      installed_at: now,
+      last_checked_at: now,
+    };
+    writeMetadata(metadata);
+    return metadata;
+  } finally {
+    rmSync(downloadDir, { recursive: true, force: true });
+  }
+}
+
+function checkForUpdate({ install, skipInterval = false } = {}) {
+  const current = readMetadata();
+  if (!skipInterval && current?.last_checked_at) {
+    const age = Date.now() - Date.parse(current.last_checked_at);
+    if (Number.isFinite(age) && age >= 0 && age < updateIntervalMs) return current;
+  }
+
+  const latest = resolveLatestRelease();
+  const updateAvailable = current?.source_sha !== latest.headSha;
+  if (!install) {
+    process.stdout.write(
+      `${JSON.stringify({
+        ok: true,
+        update_available: updateAvailable,
+        installed_source_sha: current?.source_sha || null,
+        latest_source_sha: latest.headSha,
+      })}\n`,
+    );
+    return current;
+  }
+  if (!updateAvailable) {
+    const refreshed = refreshInstalledAssets(current);
+    refreshed.last_checked_at = new Date().toISOString();
+    writeMetadata(refreshed);
+    return refreshed;
+  }
+  return installRelease(latest);
+}
+
+function executableFor(metadata) {
+  return join(
+    metadata.runtime_dir,
+    "node_modules",
+    ".bin",
+    process.platform === "win32" ? "actionway-dev.cmd" : "actionway-dev",
+  );
+}
+
+function main(args = process.argv.slice(2)) {
+  if (args[0] === "status") {
+    process.stdout.write(`${JSON.stringify({ ok: true, channel: "development", ...readMetadata() }, null, 2)}\n`);
+    return 0;
+  }
+  if (args[0] === "update") {
+    const checkOnly = args.includes("--check");
+    const metadata = checkForUpdate({ install: !checkOnly, skipInterval: true });
+    if (!checkOnly && metadata) {
+      process.stdout.write(`Actionway development CLI is current at ${metadata.source_sha}.\n`);
+    }
+    return 0;
+  }
+
+  let metadata = readMetadata();
+  try {
+    metadata = checkForUpdate({ install: true }) || metadata;
+  } catch (error) {
+    if (!metadata) throw error;
+    process.stderr.write(`Actionway development update check failed; using ${metadata.source_sha}: ${error.message}\n`);
+  }
+  if (!metadata) throw new Error("Actionway development CLI is not installed. Run the installer first.");
+
+  const executable = executableFor(metadata);
+  if (!existsSync(executable)) throw new Error("The installed Actionway development CLI runtime is missing.");
+  const childEnv = {
+    ...process.env,
+    ACTIONWAY_CONFIG_DIR: devHome,
+    ACTIONWAY_GATEWAY_URL: "https://dev.actionway.ai",
+  };
+  const invocation = commandInvocation(executable, args.length > 0 ? args : ["--help"], process.platform, childEnv);
+  const result = spawnSync(invocation.command, invocation.args, {
+    stdio: "inherit",
+    env: childEnv,
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  return result.status || 0;
+}
+
+if (process.env.ACTIONWAY_DEV_ASSET_IMPORT_ONLY !== "1") {
+  process.exit(main());
+}

package/assets/dev/install-actionway-dev.mjs

@@ -0,0 +1,185 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  chmodSync,
+  constants,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const repository = (process.env.ACTIONWAY_DEV_REPOSITORY || "PawLogic/actionway").trim();
+const bootstrapRef = (process.env.ACTIONWAY_DEV_BOOTSTRAP_REF || "dev").trim();
+const devHome = resolve(process.env.ACTIONWAY_DEV_HOME || join(homedir(), ".actionway-dev"));
+const installedLauncher = join(devHome, "bin", "actionway-dev-launcher.mjs");
+const marker = "Actionway managed development launcher";
+
+export function commandInvocation(command, args, platform = process.platform, env = process.env) {
+  if (platform === "win32" && /\.(?:cmd|bat)$/i.test(command)) {
+    const commandProcessor = (env.ComSpec ?? env.COMSPEC ?? "cmd.exe").trim().replace(/^"|"$/g, "") || "cmd.exe";
+    return {
+      command: commandProcessor,
+      args: ["/d", "/s", "/c", command, ...args],
+    };
+  }
+  return { command, args: [...args] };
+}
+
+function run(command, args, { capture = false } = {}) {
+  const invocation = commandInvocation(command, args);
+  const result = spawnSync(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env: process.env,
+    stdio: capture ? ["ignore", "pipe", "pipe"] : "inherit",
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    if (capture && result.stderr) process.stderr.write(result.stderr);
+    throw new Error(`${command} exited with status ${result.status || 1}`);
+  }
+  return capture ? result.stdout : "";
+}
+
+function requireNode20() {
+  const major = Number(process.versions.node.split(".")[0]);
+  if (!Number.isInteger(major) || major < 20) {
+    throw new Error(`Actionway development requires Node.js 20 or newer; found ${process.version}.`);
+  }
+}
+
+function pathEntries() {
+  return (process.env.PATH || "")
+    .split(delimiter)
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+    .map((entry) => resolve(entry));
+}
+
+function samePath(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+
+function isOnPath(directory) {
+  const target = resolve(directory);
+  return pathEntries().some((entry) => samePath(entry, target));
+}
+
+function ensureWritable(directory) {
+  try {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    accessSync(directory, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function existingActionwayBin() {
+  const executableNames = process.platform === "win32" ? ["actionway.cmd", "actionway.exe", "actionway"] : ["actionway"];
+  for (const directory of pathEntries()) {
+    if (executableNames.some((name) => existsSync(join(directory, name))) && ensureWritable(directory)) return directory;
+  }
+  return null;
+}
+
+function npmGlobalBin() {
+  try {
+    const prefix = run(process.platform === "win32" ? "npm.cmd" : "npm", ["prefix", "--global"], {
+      capture: true,
+    }).trim();
+    if (!prefix) return null;
+    const directory = process.platform === "win32" ? resolve(prefix) : resolve(prefix, "bin");
+    return isOnPath(directory) && ensureWritable(directory) ? directory : null;
+  } catch {
+    return null;
+  }
+}
+
+function resolveBinDir() {
+  if (process.env.ACTIONWAY_DEV_BIN_DIR?.trim()) {
+    const explicit = resolve(process.env.ACTIONWAY_DEV_BIN_DIR.trim());
+    if (!ensureWritable(explicit)) throw new Error(`Development CLI bin directory is not writable: ${explicit}`);
+    return explicit;
+  }
+  return existingActionwayBin() || npmGlobalBin() || join(homedir(), ".local", "bin");
+}
+
+function localLauncherSource() {
+  const candidates = [
+    process.env.ACTIONWAY_DEV_LAUNCHER?.trim(),
+    join(dirname(fileURLToPath(import.meta.url)), "actionway-dev-launcher.mjs"),
+    join(process.cwd(), "packages", "cli", "assets", "dev", "actionway-dev-launcher.mjs"),
+  ].filter(Boolean);
+  return candidates.find((candidate) => existsSync(resolve(candidate))) || null;
+}
+
+function fetchLauncher() {
+  const endpoint = `repos/${repository}/contents/packages/cli/assets/dev/actionway-dev-launcher.mjs?ref=${encodeURIComponent(bootstrapRef)}`;
+  const source = run(
+    "gh",
+    ["api", "-H", "Accept: application/vnd.github.raw+json", endpoint],
+    { capture: true },
+  );
+  if (!source.startsWith("#!/usr/bin/env node")) {
+    throw new Error(`GitHub did not return the Actionway development launcher from ${repository}@${bootstrapRef}.`);
+  }
+  return source;
+}
+
+function installLauncher() {
+  mkdirSync(dirname(installedLauncher), { recursive: true, mode: 0o700 });
+  const localSource = localLauncherSource();
+  if (localSource) copyFileSync(resolve(localSource), installedLauncher);
+  else writeFileSync(installedLauncher, fetchLauncher(), { mode: 0o600 });
+  run(process.execPath, ["--check", installedLauncher], { capture: true });
+}
+
+function installShim(binDir) {
+  if (!ensureWritable(binDir)) throw new Error(`Development CLI bin directory is not writable: ${binDir}`);
+  const shimPath = join(binDir, process.platform === "win32" ? "actionway-dev.cmd" : "actionway-dev");
+  if (existsSync(shimPath) && !readFileSync(shimPath, "utf8").includes(marker)) {
+    throw new Error(`Refusing to overwrite unmanaged executable: ${shimPath}`);
+  }
+  const shim =
+    process.platform === "win32"
+      ? `@echo off\r\nrem ${marker}\r\nnode "${installedLauncher}" %*\r\n`
+      : `#!/usr/bin/env node\n// ${marker}\nimport(${JSON.stringify(pathToFileURL(installedLauncher).href)});\n`;
+  writeFileSync(shimPath, shim, { mode: 0o755 });
+  if (process.platform !== "win32") chmodSync(shimPath, 0o755);
+  return shimPath;
+}
+
+function main() {
+  requireNode20();
+  run(process.platform === "win32" ? "npm.cmd" : "npm", ["--version"], { capture: true });
+  if (!process.env.ACTIONWAY_DEV_ARCHIVE?.trim()) {
+    run("gh", ["auth", "status", "--hostname", "github.com"], { capture: true });
+  }
+  installLauncher();
+  const binDir = resolveBinDir();
+  const shimPath = installShim(binDir);
+  run(process.execPath, [installedLauncher, "update"]);
+
+  process.stdout.write(`Installed ${shimPath}.\n`);
+  if (!isOnPath(binDir)) {
+    process.stdout.write(`Add ${binDir} to PATH, then open a new terminal.\n`);
+  }
+  process.stdout.write("Stable command: actionway\nDevelopment command: actionway-dev\n");
+}
+
+if (process.env.ACTIONWAY_DEV_ASSET_IMPORT_ONLY !== "1") {
+  try {
+    main();
+  } catch (error) {
+    process.stderr.write(`Actionway development installation failed: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+  }
+}