@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/fleet/src/scratch-reap.ts

@@ -0,0 +1,601 @@
+/**
+ * scratch-reap — reclaim disk from a repo's scratch worktrees, in two tiers.
+ *
+ * Measured on strato-vps-1 (2026-09-15): the holding directory under
+ * /root/enact-webview carried 32 GB across 19 registered worktrees plus a
+ * number of plain build directories. 31 GB of that was regenerable build
+ * output, and 18 GB of THAT was per-worktree copies of the same terraform
+ * provider binaries.
+ *
+ * TIER 1 — artifacts. Delete node_modules, infra/.terraform, dist, .svelte-kit
+ * and coverage from anything idle for `idleDays`. This touches no git state and
+ * everything it removes comes back from `bun install` / `terraform init`. It is
+ * where essentially all of the disk is, and it carries no risk of losing work.
+ *
+ * TIER 2 — the worktree itself, only when `removeWorktrees` is set AND every
+ * gate in judgeWorktree() passes. Age alone is NOT a gate that can stand on its
+ * own: on the same host, four worktrees had HEADs contained in zero remote
+ * branches, and an age-only reaper would have destroyed those commits silently.
+ *
+ * `git worktree prune` is not a substitute for any of this. It only clears
+ * metadata for worktrees whose directory has ALREADY been deleted.
+ *
+ * Invoked by reconcile's six-hourly pass (bin/reconcile), gated on
+ * config.scratch_reap.enabled and the per-device scratch_repos list. Devices
+ * that declare no scratch_repos are never touched — a developer machine's
+ * scratch worktrees are working state, not fleet state.
+ */
+
+import { existsSync, readdirSync, realpathSync, rmSync, statSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { basename, dirname, join, sep } from 'node:path'
+import { defaultAgentFilePath, type FleetPlatform } from './default-agent-file.ts'
+// The relative cross-package import below (not `@adl/azdo`) matches
+// apps/cli/src/commands/mcp.ts's own cross-package import of packages/azdo:
+// this workspace has no node_modules/@adl/* symlinks without `bun install`.
+// packages/azdo/src/lib/agent-identity.ts is now THE one place the
+// default-agent file is READ from (STATUS.md 12p,
+// W1); this package's own default-agent-file.ts keeps only the WRITE side
+// (`reconcileDefaultAgentFile`) plus the path computation both sides need.
+import { NO_AGENT_IDENTITY_MESSAGE, resolveAgentIdentity } from '../../azdo/src/lib/agent-identity.ts'
+
+export type Mode = 'plan' | 'apply'
+
+export type GitResult = { ok: boolean; stdout: string; stderr: string }
+export type Git = (args: string[], cwd: string) => GitResult
+
+/**
+ * Directories deleted by tier 1. Relative to a worktree root, never absolute:
+ * these are joined onto a caller-supplied path, so an absolute entry or a `..`
+ * segment would escape the scratch directory entirely.
+ */
+export const REGENERABLE_ARTIFACTS = [
+  'node_modules',
+  'infra/.terraform',
+  'dist',
+  '.svelte-kit',
+  'coverage',
+] as const
+
+/**
+ * Tracked files that are GENERATED rather than authored, so a modification to
+ * one is not evidence that someone has unsaved work here.
+ *
+ * Without this, tier 2 fires on nothing real: 8 of the 19 worktrees measured
+ * were held back purely by a re-resolved terraform lock file and by probe
+ * output (`.json` results and `.webm` videos) that every probe run rewrites.
+ */
+const GENERATED_TRACKED = /^(?:infra\/\.terraform\.lock\.hcl$|live-probes\/[^/]+\/output\/)/
+
+export function isGeneratedTracked(path: string): boolean {
+  return GENERATED_TRACKED.test(path)
+}
+
+export type WorktreeFacts = {
+  name: string
+  path: string
+  idleDays: number
+  locked: boolean
+  /** null when the directory is not a git worktree at all — a holder carries both. */
+  head: string | null
+  publishedOnRemote: boolean
+  modifiedTracked: string[]
+}
+
+export type Verdict = { action: 'reap' | 'keep'; reason: string }
+
+/**
+ * Pure. Every gate below can deny on its own, and denial is always the
+ * fallback: a fact we could not establish reads as "keep", never as "reap".
+ */
+export function judgeWorktree(facts: WorktreeFacts, reapDays: number): Verdict {
+  if (facts.idleDays < reapDays) {
+    return { action: 'keep', reason: `too new (${facts.idleDays}d < ${reapDays}d)` }
+  }
+  if (facts.locked) return { action: 'keep', reason: 'locked' }
+  if (facts.head === null) return { action: 'keep', reason: 'not a git worktree' }
+  if (!facts.publishedOnRemote) {
+    return { action: 'keep', reason: `unpublished head ${facts.head.slice(0, 8)}` }
+  }
+  const authored = facts.modifiedTracked.filter((p) => !isGeneratedTracked(p))
+  if (authored.length > 0) {
+    return { action: 'keep', reason: `${authored.length} modified tracked file(s)` }
+  }
+  return { action: 'reap', reason: `idle ${facts.idleDays}d` }
+}
+
+export type WorktreeList = {
+  /** Every path git considers a registered worktree of this repo. */
+  registered: Set<string>
+  locked: Set<string>
+}
+
+/**
+ * Parse `git worktree list --porcelain`.
+ *
+ * `registered` is load-bearing, not informational. A directory that is merely
+ * INSIDE the repo — a plain CI build directory, say — answers every git
+ * question with the MAIN repo's state, because git walks up to the enclosing
+ * .git. `git -C build-dir rev-parse HEAD` returns the main
+ * checkout's HEAD, which is published, and `git diff` there reports the main
+ * checkout's modifications. Only this list tells the two apart.
+ *
+ * Records are blank-line separated and the `locked` attribute has no fixed
+ * position within one — reading a fixed number of lines after the `worktree`
+ * line (what `grep -A2` does) misses a lock recorded after `HEAD` and `branch`.
+ */
+export function parseWorktreeList(porcelain: string): WorktreeList {
+  const registered = new Set<string>()
+  const locked = new Set<string>()
+  let current: string | null = null
+  for (const raw of porcelain.split('\n')) {
+    const line = raw.trimEnd()
+    if (line.startsWith('worktree ')) {
+      current = line.slice('worktree '.length)
+      registered.add(current)
+    } else if (line === '') current = null
+    else if (current !== null && (line === 'locked' || line.startsWith('locked '))) locked.add(current)
+  }
+  return { registered, locked }
+}
+
+/** Symlinked roots (/tmp -> /private/tmp) make a plain string compare miss. */
+function realPath(path: string): string {
+  try {
+    return realpathSync(path)
+  } catch {
+    return path
+  }
+}
+
+/**
+ * Human-readable size. A log line reading "reclaimed 0.00 GB" after freeing
+ * 900 MB is a false report, so the unit follows the number.
+ */
+export function formatBytes(bytes: number): string {
+  if (bytes >= 1024 ** 3) return `${(bytes / 1024 ** 3).toFixed(2)} GB`
+  if (bytes >= 1024 ** 2) return `${(bytes / 1024 ** 2).toFixed(1)} MB`
+  if (bytes >= 1024) return `${(bytes / 1024).toFixed(1)} KB`
+  return `${bytes} B`
+}
+
+/** Absolute paths of the regenerable directories that actually exist here. */
+export function planArtifactPurge(worktree: string): string[] {
+  return REGENERABLE_ARTIFACTS.map((rel) => join(worktree, rel)).filter(
+    (p) => existsSync(p) && statSync(p).isDirectory(),
+  )
+}
+
+function directorySizeBytes(dir: string): number {
+  let total = 0
+  const stack = [dir]
+  while (stack.length > 0) {
+    const next = stack.pop()!
+    let entries
+    try {
+      entries = readdirSync(next, { withFileTypes: true })
+    } catch {
+      continue
+    }
+    for (const entry of entries) {
+      const path = join(next, entry.name)
+      if (entry.isDirectory()) stack.push(path)
+      else if (entry.isFile()) {
+        try {
+          total += statSync(path).size
+        } catch {
+          // A file that vanished mid-walk contributes nothing; it is already gone.
+        }
+      }
+    }
+  }
+  return total
+}
+
+/**
+ * Newest of three independent "someone was here" signals, so a directory reads
+ * as idle only when ALL of them are old:
+ *   - the directory's own mtime (the only signal a non-git build dir has, and
+ *     on its own a weak one: it does not move when a file in a subdirectory is
+ *     edited)
+ *   - the git index mtime, which moves on status/add/checkout
+ *   - the HEAD commit date
+ */
+function lastActivityMs(dir: string, git: Git, isWorktree: boolean): number {
+  let newest = statSync(dir).mtimeMs
+  // The index and HEAD signals are asked only of a REGISTERED worktree. Asked
+  // of a plain directory inside the repo they answer with the main checkout's
+  // index and HEAD, so every such directory inherits the main repo's activity
+  // and never reads as idle — which is exactly the case tier 1 exists for.
+  if (!isWorktree) return newest
+
+  const gitDir = git(['rev-parse', '--absolute-git-dir'], dir)
+  if (gitDir.ok) {
+    const index = join(gitDir.stdout.trim(), 'index')
+    try {
+      newest = Math.max(newest, statSync(index).mtimeMs)
+    } catch {
+      // No index yet; the other two signals stand.
+    }
+  }
+
+  const committed = git(['log', '-1', '--format=%ct', 'HEAD'], dir)
+  if (committed.ok) {
+    const seconds = Number.parseInt(committed.stdout.trim(), 10)
+    if (Number.isFinite(seconds)) newest = Math.max(newest, seconds * 1000)
+  }
+
+  return newest
+}
+
+function collectFacts(
+  worktree: string,
+  name: string,
+  repo: string,
+  list: WorktreeList,
+  isWorktree: boolean,
+  idleDays: number,
+  git: Git,
+): WorktreeFacts {
+  if (!isWorktree) {
+    return { name, path: worktree, idleDays, locked: false, head: null, publishedOnRemote: false, modifiedTracked: [] }
+  }
+
+  const headResult = git(['rev-parse', 'HEAD'], worktree)
+  const head = headResult.ok && /^[0-9a-f]{40}$/.test(headResult.stdout.trim())
+    ? headResult.stdout.trim()
+    : null
+
+  let publishedOnRemote = false
+  if (head !== null) {
+    // Asked of the MAIN repo, which is where the remote-tracking refs live.
+    const contains = git(['branch', '-r', '--contains', head], repo)
+    publishedOnRemote = contains.ok && contains.stdout.trim().length > 0
+  }
+
+  // Staged DELETIONS are excluded (--diff-filter=AM): a worktree left mid-clean
+  // showed 2167 "dirty" entries that were all deletions of files still present
+  // in its published HEAD, which is not unsaved work.
+  const unstaged = git(['diff', '--name-only'], worktree)
+  const staged = git(['diff', '--cached', '--diff-filter=AM', '--name-only'], worktree)
+  const modifiedTracked = [unstaged.stdout, staged.stdout]
+    .join('\n')
+    .split('\n')
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0)
+
+  return {
+    name,
+    path: worktree,
+    idleDays,
+    locked: list.locked.has(realPath(worktree)),
+    head,
+    publishedOnRemote,
+    modifiedTracked,
+  }
+}
+
+export type RunOptions = {
+  repos: string[]
+  mode: Mode
+  idleDays: number
+  reapDays: number
+  removeWorktrees: boolean
+  now: number
+  /**
+   * Set only by bin/reconcile, only in plan mode, only when the manifest
+   * declares a non-empty default_agent for this device -- i.e. an apply run
+   * WOULD install the default-agent file via its own earlier default-agent
+   * step (which runs before this one; default-agent-file.ts's own --mode
+   * plan never writes). On a first-time host, a plan run reaches this step
+   * before that file has ever been written for real, so the fetch this
+   * needs for tier 2 fails with the specific "default-agent file missing or
+   * empty" message from realGit's identity resolution -- a false-negative
+   * "the fleet is broken" signal for what is really just bootstrap
+   * ordering. When set, that ONE specific fetch failure is reported and
+   * treated as remotes-not-yet-checked rather than a hard refusal; any
+   * OTHER fetch failure (a real network/auth problem) still refuses tier 2
+   * exactly as before, and apply mode is never affected (the file already
+   * exists there, since default-agent-file.ts --mode apply already ran).
+   */
+  defaultAgentPending?: boolean
+}
+
+export type Deps = { git: Git; log: (line: string) => void }
+
+export type Report = {
+  purged: { worktree: string; artifact: string; bytes: number }[]
+  verdicts: { name: string; path: string; verdict: Verdict }[]
+  removed: string[]
+  /** Repos whose fetch failed, so their published-HEAD gate could not be trusted. */
+  fetchFailed: string[]
+  skipped: string[]
+  bytesReclaimed: number
+}
+
+export function run(options: RunOptions, deps: Deps): Report {
+  const { git, log } = deps
+  const report: Report = {
+    purged: [],
+    verdicts: [],
+    removed: [],
+    fetchFailed: [],
+    skipped: [],
+    bytesReclaimed: 0,
+  }
+
+  for (const repo of options.repos) {
+    // A declared repo that is not on this host is nothing to do, not a failure:
+    // the manifest names the same repo for every device in a group, and one of
+    // them not having it must not fail that host's whole reconciliation. It is
+    // logged rather than passed over, so a typo'd path is still visible.
+    if (!existsSync(repo)) {
+      log(`scratch-reap: ${repo}: not present on this host; skipped`)
+      report.skipped.push(repo)
+      continue
+    }
+
+    // The published-HEAD gate is only as fresh as the remote-tracking refs. A
+    // stale set makes a just-pushed commit read as unpublished — which spares
+    // the worktree, so nothing ever fails, and the gate rots unnoticed. Refuse
+    // tier 2 loudly instead. Tier 1 reads no git state and still runs.
+    let remotesFresh = true
+    if (options.removeWorktrees) {
+      const fetched = git(['fetch', '--quiet', '--all', '--prune'], repo)
+      if (!fetched.ok) {
+        const isMissingDefaultAgent = fetched.stderr.includes('default-agent file missing or empty')
+        if (options.mode === 'plan' && options.defaultAgentPending && isMissingDefaultAgent) {
+          // First-time host, plan mode: this exact run's own default-agent
+          // step would install the file before scratch-reap ever runs for
+          // real (apply mode) -- report the deferral instead of refusing
+          // the whole plan over a file this run is about to create.
+          log(`scratch-reap: ${repo}: default-agent file not installed yet -- this run's default-agent step would install it first; would verify remotes after that`)
+        } else {
+          remotesFresh = false
+          report.fetchFailed.push(repo)
+          log(`scratch-reap: ${repo}: fetch failed, refusing worktree removal: ${fetched.stderr.trim()}`)
+        }
+      }
+    }
+
+    const listed = git(['worktree', 'list', '--porcelain'], repo)
+    if (!listed.ok) {
+      log(`scratch-reap: ${repo}: worktree list failed, skipped: ${listed.stderr.trim()}`)
+      report.skipped.push(repo)
+      continue
+    }
+    const list = parseWorktreeList(listed.stdout)
+    const repoRoot = realPath(repo)
+    const linked = [...list.registered].map(realPath).filter((p) => p !== repoRoot)
+    if (linked.length === 0) {
+      log(`scratch-reap: ${repo}: no linked worktrees; skipped`)
+      report.skipped.push(repo)
+      continue
+    }
+
+    // Where the scratch worktrees live is git's answer, not a hardcoded
+    // convention: the directories holding them come from the worktree registry,
+    // so renaming or moving the holding directory needs no change here.
+    //
+    // Their siblings are swept too, because a holding directory accumulates
+    // plain build directories that were never worktrees and hold the same
+    // regenerable output. A holding directory qualifies only when it sits
+    // INSIDE the repo -- a worktree checked out elsewhere (say straight under
+    // /root) must not turn its parent into a purge target.
+    const holders = new Set(
+      linked.map(dirname).filter((d) => d !== repoRoot && d.startsWith(repoRoot + sep)),
+    )
+    const linkedSet = new Set(linked)
+    const candidates = new Set(linked)
+    for (const holder of holders) {
+      for (const entry of readdirSync(holder, { withFileTypes: true })) {
+        if (entry.isDirectory()) candidates.add(realPath(join(holder, entry.name)))
+      }
+    }
+
+    for (const worktree of [...candidates].sort()) {
+      const name = basename(worktree)
+      const isWorktree = linkedSet.has(worktree)
+      // Clamped at zero: mtimeMs carries sub-millisecond precision that Date.now()
+      // does not, so a directory touched this instant can read a fraction into the
+      // future, and Math.floor turns that into -1 days.
+      const idleDays = Math.max(0, Math.floor((options.now - lastActivityMs(worktree, git, isWorktree)) / 86_400_000))
+
+      if (idleDays >= options.idleDays) {
+        for (const artifact of planArtifactPurge(worktree)) {
+          const bytes = directorySizeBytes(artifact)
+          const rel = artifact.slice(worktree.length + 1)
+          log(`scratch-reap: PURGE ${name} ${rel} (${formatBytes(bytes)})`)
+          report.purged.push({ worktree: name, artifact: rel, bytes })
+          report.bytesReclaimed += bytes
+          if (options.mode === 'apply') rmSync(artifact, { recursive: true, force: true })
+        }
+      }
+
+      if (!options.removeWorktrees || !remotesFresh) continue
+
+      const facts = collectFacts(worktree, name, repo, list, isWorktree, idleDays, git)
+      const verdict = judgeWorktree(facts, options.reapDays)
+      report.verdicts.push({ name, path: worktree, verdict })
+      log(`scratch-reap: ${verdict.action === 'reap' ? 'REAP' : 'KEEP'} ${name}: ${verdict.reason}`)
+
+      if (verdict.action === 'reap' && options.mode === 'apply') {
+        const removed = git(['worktree', 'remove', '--force', worktree], repo)
+        if (!removed.ok) {
+          log(`scratch-reap: ${name}: worktree remove failed: ${removed.stderr.trim()}`)
+          continue
+        }
+        report.removed.push(worktree)
+      }
+    }
+
+    if (options.mode === 'apply' && report.removed.length > 0) git(['worktree', 'prune'], repo)
+  }
+
+  return report
+}
+
+/**
+ * Verbs that reach the network. Everything else is local git and must not pay
+ * the cost of minting a token.
+ */
+const NETWORK_VERBS = new Set(['fetch', 'pull', 'clone', 'ls-remote', 'push'])
+
+/**
+ * Network git goes through git-ado, as the machine's default agent; local
+ * git does not.
+ *
+ * This job fetches to decide whether a worktree's HEAD is published, and an
+ * Azure DevOps https remote needs an Entra token to answer that. Without one
+ * the fetch fails, `remotesFresh` goes false, and tier 2 refuses every worktree
+ * removal -- safe, but the job silently stops doing its job. Observed on
+ * strato-vps-1, 2026-09-16: `fetch failed, refusing worktree removal`.
+ *
+ * 2026-09-27 decision 5: host automation is not one of the three named
+ * coding-agent identities and not a human terminal, but it now authenticates
+ * through git-ado's ordinary named-agent path -- the same path an
+ * interactive `adl run -- claude` session uses -- as the machine's own
+ * default agent, read from the same default-agent file reconcile writes
+ * (default-agent-file.ts). The retired host-only credentialed path
+ * (git-ado-host) is gone: the enact-devops vault credentials it used were
+ * deleted, so it was dead regardless. git-ado passes non-ADO and ssh remotes
+ * straight through, so this stays a drop-in rather than a special case for
+ * one host.
+ */
+const GIT_ADO = new URL('../../../bin/git-ado', import.meta.url).pathname
+
+export function scratchReapPlatform(): FleetPlatform {
+  return process.platform === 'darwin' ? 'mac' : 'linux'
+}
+
+function nodePlatformFor(platform: FleetPlatform): NodeJS.Platform {
+  return platform === 'mac' ? 'darwin' : 'linux'
+}
+
+export const realGit: Git = (args, cwd) => {
+  const network = args.length > 0 && NETWORK_VERBS.has(args[0] as string)
+  if (!network) {
+    const result = spawnSync('git', ['-C', cwd, ...args], { encoding: 'utf8' })
+    return {
+      ok: result.status === 0,
+      stdout: result.stdout ?? '',
+      stderr: result.stderr ?? (result.error ? String(result.error.message) : ''),
+    }
+  }
+  // ADL_DEFAULT_AGENT_FILE_ROOT is a test-only seam (like RECONCILE_SOURCE_ONLY
+  // and friends elsewhere in this repo): unset in production, so the real
+  // system path is always read; a hermetic test points it at a disposable
+  // fixture root instead of ever touching /Library or /etc for real.
+  //
+  // The env handed to `resolveAgentIdentity` deliberately carries nothing
+  // but that file override (never this process's own `ADL_AGENT_ID_AGENT`):
+  // host automation has no session of its own to inherit an identity from,
+  // and always wants the machine's own default agent -- never whatever the
+  // cron/launchd environment happens to carry.
+  const root = process.env.ADL_DEFAULT_AGENT_FILE_ROOT ?? ''
+  const resolveEnv: NodeJS.ProcessEnv = root
+    ? { ADL_DEFAULT_AGENT_FILE: defaultAgentFilePath(scratchReapPlatform(), root) }
+    : {}
+  let agent: string
+  try {
+    agent = resolveAgentIdentity(resolveEnv, nodePlatformFor(scratchReapPlatform())).agent
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    // "no identity resolvable at all" keeps this job's own long-standing
+    // wording; any OTHER failure (an invalid name in the file, a file that
+    // exists but cannot be read) is named verbatim rather than folded into
+    // that same generic text (AGENTS.md: "no silent fallback or degrade").
+    const stderr =
+      message === NO_AGENT_IDENTITY_MESSAGE
+        ? 'scratch-reap: default-agent file missing or empty; run reconcile once to install it before fetching'
+        : `scratch-reap: ${message}`
+    return { ok: false, stdout: '', stderr }
+  }
+  const result = spawnSync(GIT_ADO, [cwd, ...args], {
+    encoding: 'utf8',
+    env: { ...process.env, ADL_AGENT_ID_AGENT: agent },
+  })
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? (result.error ? String(result.error.message) : ''),
+  }
+}
+
+function usage(): never {
+  console.error(
+    'usage: scratch-reap --repo PATH [--repo PATH ...] [--mode plan|apply] ' +
+      '[--idle-days N] [--reap-days N] [--remove-worktrees] [--default-agent-pending]',
+  )
+  process.exit(2)
+}
+
+export function main(argv: string[]): number {
+  const repos: string[] = []
+  let mode: Mode = 'plan'
+  let idleDays = 1
+  let reapDays = 7
+  let removeWorktrees = false
+  let defaultAgentPending = false
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    const value = argv[i + 1]
+    switch (arg) {
+      case '--repo':
+        if (value === undefined) usage()
+        repos.push(value)
+        i++
+        break
+      case '--mode':
+        if (value !== 'plan' && value !== 'apply') usage()
+        mode = value
+        i++
+        break
+      case '--idle-days':
+        if (value === undefined) usage()
+        idleDays = Number.parseInt(value, 10)
+        i++
+        break
+      case '--reap-days':
+        if (value === undefined) usage()
+        reapDays = Number.parseInt(value, 10)
+        i++
+        break
+      case '--remove-worktrees':
+        removeWorktrees = true
+        break
+      case '--default-agent-pending':
+        defaultAgentPending = true
+        break
+      default:
+        usage()
+    }
+  }
+
+  if (repos.length === 0) usage()
+  if (!Number.isFinite(idleDays) || idleDays < 0) usage()
+  if (!Number.isFinite(reapDays) || reapDays < 1) usage()
+
+  const report = run(
+    { repos, mode, idleDays, reapDays, removeWorktrees, now: Date.now(), defaultAgentPending },
+    { git: realGit, log: (line) => console.log(line) },
+  )
+
+  console.log(
+    `scratch-reap: mode=${mode} ${mode === 'apply' ? 'reclaimed' : 'reclaimable'}=` +
+      `${formatBytes(report.bytesReclaimed)} artifacts=${report.purged.length} ` +
+      `worktrees_removed=${report.removed.length}`,
+  )
+
+  if (report.fetchFailed.length > 0) {
+    console.error(
+      `scratch-reap: worktree removal REFUSED for ${report.fetchFailed.length} repo(s) ` +
+        `with stale remotes: ${report.fetchFailed.join(', ')}`,
+    )
+    return 1
+  }
+  return 0
+}
+
+if (import.meta.main) process.exit(main(process.argv.slice(2)))