@atolis-hq/wake 0.2.96 → 0.3.0

package/dist/src/main.js

@@ -1,1063 +1,170 @@
-#!/usr/bin/env node
 import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { access, chmod, copyFile, mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
-import { dirname, join, resolve } from 'node:path';
-import { createInterface } from 'node:readline/promises';
-import { fileURLToPath } from 'node:url';
-import { createDockerCli, } from './adapters/docker/docker-cli.js';
-import { createFileBackedFakeTicketingSystem } from './adapters/fake/fake-ticketing-system.js';
-import { createFakeWorkspaceManager } from './adapters/fake/fake-workspace-manager.js';
-import { createGitWorkspaceManager } from './adapters/git/git-workspace-manager.js';
-import { createRunnerCliAdapter } from './adapters/runner/runner-cli-adapter.js';
-import { createRegistryRunner, runnerKindForOverride } from './adapters/runner/runner-registry.js';
-import { createResourceIndex } from './adapters/fs/resource-index.js';
-import { createStateStore } from './adapters/fs/state-store.js';
-import { readSelfUpdateLedger, writeSelfUpdateLedger, } from './adapters/fs/self-update-ledger.js';
-import { resolveGitHubToken } from './adapters/github/github-auth.js';
-import { createGitHubArtifactVerifier } from './adapters/github/github-artifact-verifier.js';
-import { createGitHubClient } from './adapters/github/github-client.js';
-import { createGitHubIssuesWorkSource } from './adapters/github/github-issues-work-source.js';
-import { createGitHubPullRequestActivitySource } from './adapters/github/github-pull-request-activity-source.js';
-import { createGitHubPullRequestMergeActor } from './adapters/github/github-pull-request-merge-actor.js';
-import { runAuditCommand } from './cli/audit-command.js';
-import { runCorrelateCommand } from './cli/correlate-command.js';
-import { runDoctorCommand } from './cli/doctor-command.js';
-import { runInitCommand } from './cli/init-command.js';
-import { runSandboxCommand } from './cli/sandbox-command.js';
-import { runSandboxEntrypointCommand } from './cli/sandbox-entrypoint-command.js';
-import { runSandboxSetupCommand } from './cli/sandbox-setup-command.js';
-import { collectStartupPreflightFailures, runStartupPreflight } from './cli/startup-preflight.js';
-import { runUiCommand } from './cli/ui-command.js';
-import { loadWakeConfig } from './config/load-config.js';
-import { createActiveRunRecovery } from './core/active-run-recovery.js';
-import { createControlPlane } from './core/control-plane.js';
-import { createOutboundSinkRouter, createWorkSourceFanIn } from './core/sink-router.js';
-import { createScheduledWorkflowSource } from './core/scheduled-workflow-source.js';
-import { createTickRunner } from './core/tick-runner.js';
-import { systemClock } from './lib/clock.js';
-import { createDetachedProcessLogSink } from './lib/detached-process-logging.js';
-import { readJsonFile } from './lib/json-file.js';
-import { resolveLogMaxBytes, resolveLogRotateCheckIntervalMs } from './lib/log-rotation.js';
-import { StateHealthError } from './lib/state-health.js';
-import { configuredTicketSource } from './domain/sources.js';
-import { wakeVersion } from './version.js';
-function commandArgsBeforeTerminator(args) {
-    const terminatorIndex = args.indexOf('--');
-    if (terminatorIndex === -1) {
-        return args;
-    }
-    return args.slice(0, terminatorIndex);
-}
-export function readFlagBeforeCommandTerminator(name, args) {
-    const scopedArgs = commandArgsBeforeTerminator(args);
-    const index = scopedArgs.indexOf(name);
-    if (index === -1) {
-        return undefined;
-    }
-    return scopedArgs[index + 1];
-}
-// Walks up from this file's own directory until it finds a package.json,
-// rather than assuming a fixed number of directory levels — the file
-// running is `dist/src/main.js` for a built/packaged install (two levels
-// below the package root) but `src/main.ts` for a `tsx` dev invocation
-// (only one level below), so a fixed `resolve(..., '..', '..')` overshoots
-// the root by one directory in the latter case.
-function resolvePackageRoot() {
-    let dir = dirname(fileURLToPath(import.meta.url));
-    for (;;) {
-        if (existsSync(join(dir, 'package.json'))) {
-            return dir;
-        }
-        const parent = dirname(dir);
-        if (parent === dir) {
-            throw new Error(`Could not locate package root (no package.json found above ${dir})`);
-        }
-        dir = parent;
-    }
-}
-export async function hasDockerfile(wakeRoot) {
-    try {
-        await access(resolve(wakeRoot, 'docker', 'Dockerfile'));
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function routesOnlyToFake(config) {
-    return Object.values(config.tiers).every((candidates) => {
-        const first = candidates[0];
-        return first !== undefined && config.runners[first]?.kind === 'fake';
-    });
-}
-async function resolveSelfLogin(githubClient) {
-    if (githubClient === undefined) {
-        return undefined;
-    }
-    try {
-        return await githubClient.getAuthenticatedLogin();
-    }
-    catch (error) {
-        console.error(`wake: failed to resolve authenticated GitHub login; continuing without self-login bot detection: ${String(error)}`);
-        return undefined;
-    }
-}
-export function formatTickFailureDetails(runRecord) {
-    if (runRecord === null) {
-        return null;
-    }
-    const summary = runRecord.summary?.trim();
-    const exitCode = runRecord.metadata !== undefined && typeof runRecord.metadata.exitCode === 'number'
-        ? runRecord.metadata.exitCode
-        : undefined;
-    const stderr = runRecord.metadata !== undefined && typeof runRecord.metadata.stderr === 'string'
-        ? runRecord.metadata.stderr.trim()
-        : '';
-    if (summary === undefined && exitCode === undefined && stderr.length === 0) {
-        return null;
-    }
-    const lines = ['Tick failure details:', `runId: ${runRecord.runId}`];
-    if (exitCode !== undefined) {
-        lines.push(`exitCode: ${exitCode}`);
-    }
-    if (summary !== undefined) {
-        lines.push('', 'Summary:', summary);
-    }
-    if (stderr.length > 0) {
-        lines.push('', 'stderr:', stderr);
+import { access } from 'node:fs/promises';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { createCompositionRoot, createSurfaceApplications, initialiseWakeRoot, loadConfig, wakeVersion, } from './bootstrap/index.js';
+import { parseWakeCommand, runWakeCommand, sandboxUsage, usage, } from './surfaces/index.js';
+export async function main(argv = process.argv.slice(2), dependencies) {
+    const suppliedArguments = normalizeDeveloperAlias(argv);
+    const output = dependencies?.output ?? productionOutput();
+    if (writePrecompositionCommand(suppliedArguments, output))
+        return;
+    const resolvedDependencies = dependencies ?? productionDependencies();
+    const bypassSandbox = suppliedArguments.includes('--no-sandbox');
+    const command = parseWakeCommand(suppliedArguments.filter((argument) => argument !== '--no-sandbox'));
+    const wakeRoot = resolveWakeRoot(command);
+    if (command.kind === 'init') {
+        const result = await (resolvedDependencies.initialise ?? initialiseWakeRoot)(wakeRoot);
+        resolvedDependencies.output.write(`${JSON.stringify(result)}\n`);
+        return;
     }
-    return lines.join('\n');
-}
-async function runCommand(command, args, env = process.env) {
-    await new Promise((resolveRun, reject) => {
-        const child = spawn(command, args, {
-            cwd: process.cwd(),
-            env,
-            stdio: 'inherit',
-        });
-        child.on('error', reject);
-        child.on('close', (exitCode) => {
-            if (exitCode === 0) {
-                resolveRun();
-                return;
-            }
-            reject(new Error(`${command} ${args.join(' ')} failed with exit code ${exitCode ?? 1}`));
+    if (resolvedDependencies.sandboxRuntime !== undefined) {
+        const sandboxRuntime = resolvedDependencies.sandboxRuntime;
+        const ranInSandbox = await runInSandboxIfAvailable({
+            commandKind: command.kind,
+            bypassSandbox,
+            hasDockerfile: () => sandboxRuntime.hasDockerfile(wakeRoot),
+            exec: () => sandboxRuntime.exec(wakeRoot, rewriteSandboxArguments(suppliedArguments)),
         });
-    });
-}
-function parseGithubRepoSlug(remoteUrl) {
-    const match = /github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/.exec(remoteUrl.trim());
-    if (match === null) {
-        throw new Error(`Could not parse a GitHub owner/repo from origin remote: ${remoteUrl}`);
+        if (ranInSandbox)
+            return;
     }
-    return match[1];
-}
-async function runCommandCapture(command, args) {
-    return await new Promise((resolveRun, reject) => {
-        const child = spawn(command, args, {
-            cwd: process.cwd(),
-            env: process.env,
-            stdio: ['ignore', 'pipe', 'inherit'],
-        });
-        let stdout = '';
-        child.stdout.on('data', (chunk) => {
-            stdout += chunk.toString();
+    const applications = await resolvedDependencies.compose(wakeRoot);
+    if (applications.sandboxRuntime !== undefined) {
+        const sandboxRuntime = applications.sandboxRuntime;
+        const ranInSandbox = await runInSandboxIfAvailable({
+            commandKind: command.kind,
+            bypassSandbox,
+            hasDockerfile: () => sandboxRuntime.hasDockerfile(),
+            exec: () => sandboxRuntime.exec(rewriteSandboxArguments(suppliedArguments)),
         });
-        child.on('error', reject);
-        child.on('close', (exitCode) => {
-            if (exitCode === 0) {
-                resolveRun(stdout);
-                return;
-            }
-            reject(new Error(`${command} ${args.join(' ')} failed with exit code ${exitCode ?? 1}`));
-        });
-    });
-}
-const codexBootstrapHome = '/home/wake/.codex';
-const codexRuntimeHome = '/home/wake/.codex-runtime';
-const sshHome = '/home/wake/.ssh';
-const sshKeyPath = join(sshHome, 'id_ed25519');
-async function prepareCodexHome() {
-    await mkdir(codexRuntimeHome, { recursive: true });
-    const bootstrapConfig = join(codexBootstrapHome, 'config.toml');
-    if (existsSync(bootstrapConfig)) {
-        await copyFile(bootstrapConfig, join(codexRuntimeHome, 'config.toml'));
-    }
-    const bootstrapAuth = join(codexBootstrapHome, 'auth.json');
-    const runtimeAuth = join(codexRuntimeHome, 'auth.json');
-    if (existsSync(bootstrapAuth) && !existsSync(runtimeAuth)) {
-        await copyFile(bootstrapAuth, runtimeAuth);
-    }
-    process.env.CODEX_HOME = codexRuntimeHome;
-}
-async function ensureSshKey() {
-    if (!existsSync(sshKeyPath)) {
-        await mkdir(sshHome, { recursive: true, mode: 0o700 });
-        await chmod(sshHome, 0o700);
-        await runCommand('ssh-keygen', ['-t', 'ed25519', '-f', sshKeyPath, '-N', '']);
-    }
-    // Display the public key to the user
-    const publicKeyPath = join(sshHome, 'id_ed25519.pub');
-    const publicKey = await readFile(publicKeyPath, 'utf-8');
-    console.log(publicKey);
-}
-async function promptYesNo(message) {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    try {
-        const answer = (await rl.question(`${message} `)).trim().toLowerCase();
-        return answer === 'y' || answer === 'yes';
-    }
-    finally {
-        rl.close();
+        if (ranInSandbox)
+            return;
     }
+    await runWakeCommand(command, applications, resolvedDependencies.output, resolvedDependencies.signal);
 }
-async function runSandboxSetup() {
-    await runSandboxSetupCommand({
-        prompt: promptYesNo,
-        runInteractive: (command, args) => runCommand(command, args),
-        ensureSshKey,
-        prepareCodexHome,
-        log: (message) => console.log(message),
-    });
-}
-const NGROK_TUNNELS_URL = 'http://127.0.0.1:4040/api/tunnels';
-const NGROK_DISCOVERY_ATTEMPTS = 30;
-const NGROK_DISCOVERY_INTERVAL_MS = 1000;
-async function discoverNgrokUrl() {
-    for (let attempt = 0; attempt < NGROK_DISCOVERY_ATTEMPTS; attempt++) {
-        try {
-            const response = await fetch(NGROK_TUNNELS_URL, { signal: AbortSignal.timeout(1000) });
-            if (response.ok) {
-                const body = (await response.json());
-                const tunnels = body.tunnels ?? [];
-                const httpsTunnel = tunnels.find((tunnel) => typeof tunnel.public_url === 'string' && tunnel.public_url.startsWith('https://'));
-                const anyTunnel = httpsTunnel ?? tunnels.find((tunnel) => typeof tunnel.public_url === 'string');
-                if (typeof anyTunnel?.public_url === 'string') {
-                    return anyTunnel.public_url;
-                }
-            }
-        }
-        catch {
-            // ignore and retry
-        }
-        await new Promise((resolveSleep) => setTimeout(resolveSleep, NGROK_DISCOVERY_INTERVAL_MS));
-    }
-    return undefined;
+function normalizeDeveloperAlias(arguments_) {
+    if (arguments_[0] !== 'dev' || arguments_[1] !== 'sandbox')
+        return arguments_;
+    return ['sandbox', ...arguments_.slice(2)];
 }
-function createSandboxEntrypointDeps() {
-    const children = new Map();
-    return {
-        env: process.env,
-        spawnDetached: (command, args, options) => {
-            const logSink = options?.logFile !== undefined
-                ? createDetachedProcessLogSink(options.logFile, {
-                    maxBytes: resolveLogMaxBytes(process.env),
-                    rotateCheckIntervalMs: resolveLogRotateCheckIntervalMs(process.env),
-                })
-                : undefined;
-            const child = spawn(command, args, {
-                cwd: process.cwd(),
-                env: process.env,
-                stdio: ['ignore', 'pipe', 'pipe'],
-                detached: true,
-            });
-            if (typeof child.pid === 'number') {
-                children.set(child.pid, child);
-            }
-            const forwardOutput = (chunk) => {
-                logSink?.write(chunk);
-            };
-            child.stdout?.on('data', forwardOutput);
-            child.stderr?.on('data', forwardOutput);
-            // Registered here (at spawn time) so it runs before any exit listener
-            // waitForExit attaches later — though it wouldn't matter either way:
-            // waitForExit captures the ChildProcess reference synchronously from
-            // `children` when it's called (before the child can possibly have
-            // exited) and attaches its own listener directly to that reference,
-            // so it never re-reads `children` inside the exit callback. Deleting
-            // the map entry here is therefore safe regardless of ordering.
-            child.on('exit', () => {
-                if (typeof child.pid === 'number') {
-                    children.delete(child.pid);
-                }
-                logSink?.close().catch(() => { });
-            });
-            return { pid: child.pid ?? -1 };
-        },
-        waitForExit: (pid) => new Promise((resolveExit) => {
-            const child = children.get(pid);
-            if (child === undefined) {
-                resolveExit(1);
-                return;
-            }
-            child.on('exit', (code) => resolveExit(code ?? 1));
-        }),
-        writeFile: (path, content) => writeFile(path, content, 'utf-8'),
-        sleep: (ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)),
-        discoverNgrokUrl,
-        log: (message) => console.log(message),
-        ensureDir: async (path) => {
-            await mkdir(path, { recursive: true });
-        },
-        removeFile: (path) => rm(path, { force: true }),
-    };
+function writePrecompositionCommand(arguments_, output) {
+    return writeMetaCommand(arguments_, output) || writeSandboxHelpCommand(arguments_, output);
 }
-async function runSandboxEntrypoint() {
-    await runSandboxEntrypointCommand(createSandboxEntrypointDeps());
-}
-async function readTickRequestId(path) {
-    try {
-        const request = await readJsonFile(path);
-        return typeof request.requestId === 'string' && request.requestId.length > 0
-            ? request.requestId
-            : null;
+function writeMetaCommand(arguments_, output) {
+    if (isHelpCommand(arguments_)) {
+        output.write(`${usage}\n`);
+        return true;
     }
-    catch {
-        return null;
+    if (isVersionCommand(arguments_)) {
+        output.write(`${wakeVersion}\n`);
+        return true;
     }
+    return false;
 }
-async function inspectDockerImage(image) {
-    return await new Promise((resolveInspect, reject) => {
-        const child = spawn('docker', ['image', 'inspect', image], {
-            cwd: process.cwd(),
-            env: process.env,
-            stdio: 'ignore',
-        });
-        child.on('error', reject);
-        child.on('close', (exitCode) => {
-            resolveInspect(exitCode === 0);
-        });
-    });
-}
-async function inspectDockerContainer(containerName) {
-    return await new Promise((resolveInspect, reject) => {
-        const child = spawn('docker', ['container', 'inspect', '-f', '{{.State.Running}}', containerName], {
-            cwd: process.cwd(),
-            env: process.env,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        let stdout = '';
-        child.stdout.on('data', (chunk) => {
-            stdout += chunk.toString();
-        });
-        child.on('error', reject);
-        child.on('close', (exitCode) => {
-            if (exitCode !== 0) {
-                resolveInspect(null);
-                return;
-            }
-            resolveInspect(stdout.trim() === 'true' ? 'running' : 'stopped');
-        });
-    });
-}
-async function inspectDockerContainerImage(containerName) {
-    return await new Promise((resolveInspect, reject) => {
-        const child = spawn('docker', ['container', 'inspect', '-f', '{{.Config.Image}}', containerName], {
-            cwd: process.cwd(),
-            env: process.env,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        let stdout = '';
-        child.stdout.on('data', (chunk) => {
-            stdout += chunk.toString();
-        });
-        child.on('error', reject);
-        child.on('close', (exitCode) => {
-            if (exitCode !== 0) {
-                resolveInspect(null);
-                return;
-            }
-            const image = stdout.trim();
-            resolveInspect(image.length > 0 ? image : null);
-        });
-    });
-}
-async function dockerDaemonReachable() {
-    return await new Promise((resolveReachable) => {
-        const child = spawn('docker', ['info'], {
-            cwd: process.cwd(),
-            env: process.env,
-            stdio: 'ignore',
-        });
-        child.on('error', () => resolveReachable(false));
-        child.on('close', (exitCode) => resolveReachable(exitCode === 0));
-    });
+function writeSandboxHelpCommand(arguments_, output) {
+    if (arguments_[0] !== 'sandbox')
+        return false;
+    if (arguments_.length !== 1 && !['--help', '-h', 'help'].includes(arguments_[1] ?? ''))
+        return false;
+    output.write(`${sandboxUsage}\n`);
+    return true;
 }
-/**
- * Builds the same `DockerCli` client the `sandbox` command path uses, so
- * `wake doctor`'s Docker/sandbox reachability checks reuse one Docker CLI
- * invocation implementation instead of duplicating it.
- */
-function createHostDockerCli() {
-    return createDockerCli({
-        // BuildKit is required for the Dockerfile's cache-mount syntax
-        // (`RUN --mount=type=cache`), which keeps `npm`/`apt` package
-        // caches warm across builds even when a layer above them changes.
-        run: (dockerArgs) => runCommand('docker', dockerArgs, { ...process.env, DOCKER_BUILDKIT: '1' }),
-        inspectImage: inspectDockerImage,
-        inspectContainer: inspectDockerContainer,
-        inspectContainerImage: inspectDockerContainerImage,
-        spawnExec: (dockerArgs) => {
-            const child = spawn('docker', dockerArgs, {
-                cwd: process.cwd(),
-                env: process.env,
-                stdio: ['inherit', 'pipe', 'pipe'],
-            });
-            // stdio: ['inherit', 'pipe', 'pipe'] guarantees stdout/stderr are
-            // non-null pipes; child_process's types don't encode that.
-            return child;
-        },
-    });
+function isHelpCommand(arguments_) {
+    return arguments_.length === 0 || ['--help', '-h', 'help'].includes(arguments_[0] ?? '');
 }
-/**
- * Runs `wake --version` inside the sandbox container via `docker exec` and
- * returns the trimmed stdout, so `wake doctor` can compare it against the
- * installed host CLI version. Stderr is discarded (surfaced only as an
- * empty/mismatched version, which the caller already treats as a notice).
- */
-async function execVersionInContainer(docker, containerName, devMode) {
-    let stdout = '';
-    const command = devMode === 'source' ? ['node', '/app/dist/src/main.js', '--version'] : ['wake', '--version'];
-    await docker.execCaptured(containerName, command, {
-        onStdout: (line) => {
-            stdout += line;
-        },
-        onStderr: () => { },
-    });
-    return stdout.trim();
+function isVersionCommand(arguments_) {
+    return ['--version', '-v'].includes(arguments_[0] ?? '');
 }
-async function readFileIfExists(path) {
-    try {
-        return await readFile(path, 'utf8');
-    }
-    catch {
-        return null;
+function resolveWakeRoot(command) {
+    if ('wakeRoot' in command && command.wakeRoot !== undefined)
+        return command.wakeRoot;
+    if ('arguments' in command) {
+        const explicitWakeRoot = operationalWakeRoot(command.arguments);
+        if (explicitWakeRoot !== undefined)
+            return explicitWakeRoot;
+        if (command.kind === 'init')
+            return initWakeRoot(command.arguments) ?? process.cwd();
     }
+    return process.cwd();
 }
-/**
- * Compares the wake-home's `prompts/*.md` and `docker/Dockerfile` (both
- * user-owned files, never auto-overwritten after scaffolding — see
- * `scaffold-assets.ts`/`sandbox-command.ts`'s `ensureDockerfile`) against the
- * currently-shipped defaults under `resolvePackageRoot()`, byte-for-byte.
- * Only files present in *both* locations are compared: a prompt file the
- * user hasn't customized locally, or one only shipped in a newer/older CLI
- * version, is not drift.
- */
-async function diffPromptsAndDockerfile(input) {
-    const drifted = [];
-    let promptFileNames;
-    try {
-        promptFileNames = (await readdir(resolve(input.wakeRoot, 'prompts'))).filter((name) => name.endsWith('.md'));
-    }
-    catch {
-        promptFileNames = [];
-    }
-    for (const fileName of promptFileNames) {
-        const local = await readFileIfExists(resolve(input.wakeRoot, 'prompts', fileName));
-        const shipped = await readFileIfExists(resolve(input.packageRoot, 'prompts', fileName));
-        if (local !== null && shipped !== null && local !== shipped) {
-            drifted.push(`prompts/${fileName}`);
-        }
-    }
-    // Mirrors ensureDockerfile's template selection in sandbox-command.ts: a
-    // "source" dev mode wake-home was seeded from docker/Dockerfile, a
-    // "packaged" one from docker/Dockerfile.packaged.
-    const dockerfileTemplateName = (input.devMode ?? 'packaged') === 'source' ? 'Dockerfile' : 'Dockerfile.packaged';
-    const localDockerfile = await readFileIfExists(resolve(input.wakeRoot, 'docker', 'Dockerfile'));
-    const shippedDockerfile = await readFileIfExists(resolve(input.packageRoot, 'docker', dockerfileTemplateName));
-    if (localDockerfile !== null &&
-        shippedDockerfile !== null &&
-        localDockerfile !== shippedDockerfile) {
-        drifted.push('docker/Dockerfile');
-    }
-    return drifted;
+function initWakeRoot(arguments_) {
+    const positional = arguments_[0];
+    return positional !== undefined && !positional.startsWith('--') ? positional : undefined;
 }
-export async function buildRuntime(args) {
-    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
-    const stateStore = createStateStore({ wakeRoot });
-    await stateStore.ensureWakeRoot();
-    const config = await loadWakeConfig({
-        wakeRoot,
-    });
-    const resourceIndex = createResourceIndex({ paths: stateStore.paths });
-    const prTrackingEnabled = config.sources.github.enabled && config.sources.github.pullRequests.enabled;
-    // Resolved once and shared: resolveGitHubToken shells out to `gh auth
-    // token`, so building a separate client per consumer would triple that
-    // subprocess spawn on every startup for no benefit — all three consumers
-    // talk to the same GitHub account under the same config.
-    const githubClient = config.sources.github.enabled
-        ? createGitHubClient(await resolveGitHubToken())
-        : undefined;
-    // Resolved once alongside the client: the login Wake itself posts as, so
-    // both GitHub work sources can recognize a comment Wake's own agent posted
-    // by direct API/CLI call (not through formatWakeComment, so it never
-    // carries the wake:agent marker) as bot-authored instead of a fresh human
-    // reply that would re-trigger another run against itself.
-    const selfLogin = await resolveSelfLogin(githubClient);
-    const artifactVerifier = prTrackingEnabled && githubClient !== undefined
-        ? createGitHubArtifactVerifier({ client: githubClient })
-        : undefined;
-    const prMergeActor = prTrackingEnabled && githubClient !== undefined
-        ? createGitHubPullRequestMergeActor({ client: githubClient })
-        : undefined;
-    const ticketingSystem = githubClient !== undefined
-        ? createGitHubIssuesWorkSource({
-            client: githubClient,
-            stateStore,
-            config,
-            resourceIndex,
-            now: () => systemClock.now(),
-            ...(selfLogin === undefined ? {} : { selfLogin }),
-        })
-        : await createFileBackedFakeTicketingSystem({
-            fixturePath: stateStore.paths.issueFixtureFile,
-            now: () => systemClock.now(),
-        });
-    const sourceName = configuredTicketSource(config);
-    const sinkName = sourceName;
-    const pullRequestActivitySource = prTrackingEnabled && githubClient !== undefined
-        ? createGitHubPullRequestActivitySource({
-            client: githubClient,
-            stateStore,
-            config,
-            resourceIndex,
-            now: () => systemClock.now(),
-            ...(selfLogin === undefined ? {} : { selfLogin }),
-        })
-        : null;
-    const workSource = createWorkSourceFanIn([
-        {
-            source: 'wake-schedule',
-            pollEvents: createScheduledWorkflowSource({
-                config,
-                stateStore,
-                now: () => systemClock.now(),
-            }).pollEvents,
-        },
-        {
-            source: sourceName,
-            pollEvents: ticketingSystem.pollEvents,
-        },
-        ...(pullRequestActivitySource === null
-            ? []
-            : [{ source: 'github-pr', pollEvents: pullRequestActivitySource.pollEvents }]),
-    ]);
-    const outboundSink = createOutboundSinkRouter({
-        sinks: [
-            {
-                sink: sinkName,
-                deliverIntent: ticketingSystem.deliverIntent,
-            },
-            ...(pullRequestActivitySource === null
-                ? []
-                : [{ sink: 'github-pr', deliverIntent: pullRequestActivitySource.deliverIntent }]),
-        ],
-        config,
-    });
-    const runnerOverride = readFlagBeforeCommandTerminator('--runner', args);
-    if (runnerOverride !== undefined &&
-        runnerOverride !== 'fake' &&
-        config.runners[runnerOverride] === undefined) {
-        throw new Error(`Unsupported runner override: ${runnerOverride}`);
-    }
-    const runner = createRegistryRunner({
-        config,
-        cwd: process.cwd(),
-        ...(runnerOverride === undefined ? {} : { override: runnerOverride }),
-    });
-    const workspaceManager = (runnerOverride !== undefined
-        ? runnerKindForOverride(config, runnerOverride) === 'fake'
-        : routesOnlyToFake(config))
-        ? createFakeWorkspaceManager(stateStore.paths.workspaceRoot)
-        : createGitWorkspaceManager({ wakeRoot });
-    const tickRunner = createTickRunner({
-        clock: systemClock,
-        config,
-        stateStore,
-        workSource,
-        outboundSink,
-        runner,
-        workspaceManager,
-        resourceIndex,
-        ...(artifactVerifier === undefined ? {} : { artifactVerifier }),
-        ...(prMergeActor === undefined ? {} : { prMergeActor }),
-    });
+async function runInSandboxIfAvailable(input) {
+    if (input.bypassSandbox || !isRuntimeCommand(input.commandKind))
+        return false;
+    if (!(await input.hasDockerfile()))
+        return false;
+    await input.exec();
+    return true;
+}
+function isRuntimeCommand(kind) {
+    return ['tick', 'start', 'ui', 'smoke', 'audit', 'correlate', 'validate-state'].includes(kind);
+}
+function rewriteSandboxArguments(arguments_) {
+    const withoutBypass = arguments_.filter((argument) => argument !== '--no-sandbox');
+    const wakeRootIndex = withoutBypass.indexOf('--wake-root');
+    const rewritten = wakeRootIndex === -1
+        ? [...withoutBypass, '--wake-root', '/wake']
+        : withoutBypass.map((argument, index) => (index === wakeRootIndex + 1 ? '/wake' : argument));
+    return [...rewritten, '--no-sandbox'];
+}
+function operationalWakeRoot(arguments_) {
+    const index = arguments_.indexOf('--wake-root');
+    return index === -1 ? undefined : arguments_[index + 1];
+}
+function productionDependencies() {
+    const controller = new AbortController();
+    process.once('SIGINT', () => controller.abort());
+    process.once('SIGTERM', () => controller.abort());
     return {
-        config,
-        runnerAdapter: null,
-        runner,
-        stateStore,
-        tickRunner,
-        workspaceManager,
-    };
-}
-async function runTick(args) {
-    const runtime = await buildRuntime(args);
-    await runtime.stateStore.assertStateHealthy();
-    const outcome = await runtime.tickRunner.runTick();
-    console.log(JSON.stringify(outcome, null, 2));
-    if (outcome.status !== 'processed' ||
-        outcome.sentinel !== 'FAILED' ||
-        outcome.runId === undefined) {
-        return;
-    }
-    const runRecord = await runtime.stateStore.readRunRecord(outcome.runId);
-    const details = formatTickFailureDetails(runRecord);
-    if (details !== null) {
-        console.error(details);
-    }
-}
-export function createResidentControlPlane(runtime) {
-    return createControlPlane({
-        tickRunner: runtime.tickRunner,
-        intervalMs: runtime.config.scheduler.intervalMs,
-        maxIntervalMs: runtime.config.scheduler.maxIntervalMs,
-        isPaused: () => runtime.stateStore.isPaused(),
-        logger: {
-            info(message) {
-                console.log(message);
-            },
-            error(message) {
-                console.error(message);
-            },
-        },
-        sleep(ms) {
-            return new Promise((resolveSleep) => {
-                setTimeout(resolveSleep, ms);
-            });
+        initialise: initialiseWakeRoot,
+        sandboxRuntime: productionSandboxRuntime(),
+        async compose(wakeRoot) {
+            const root = await createCompositionRoot(wakeRoot);
+            return createSurfaceApplications(root).cli;
         },
-        readTickRequest() {
-            return readTickRequestId(runtime.stateStore.paths.tickRequestFile);
-        },
-    });
-}
-async function runStart(args) {
-    const runtime = await buildRuntime(args);
-    await runtime.stateStore.assertStateHealthy();
-    const runnerOverride = readFlagBeforeCommandTerminator('--runner', args);
-    await runStartupPreflight(runtime.config, {
-        ...(runnerOverride === undefined ? {} : { runnerOverride }),
-        workspaceManager: runtime.workspaceManager,
-    });
-    const controlPlane = createResidentControlPlane(runtime);
-    const stop = () => controlPlane.stop();
-    process.on('SIGINT', stop);
-    process.on('SIGTERM', stop);
-    await controlPlane.start();
-}
-function printStateHealthReport(report) {
-    if (report.healthy) {
-        console.log('wake validate-state: control-plane state is healthy');
-        return;
-    }
-    console.error('wake validate-state: control-plane state is unhealthy');
-    for (const issue of report.issues) {
-        console.error(`  - ${issue.surface} ${issue.kind}: ${issue.path}: ${issue.message}`);
-    }
-}
-async function runValidateState(args) {
-    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
-    const stateStore = createStateStore({ wakeRoot });
-    await stateStore.ensureWakeRoot();
-    const report = await stateStore.validateStateHealth();
-    printStateHealthReport(report);
-    if (!report.healthy) {
-        process.exitCode = 1;
-    }
-}
-function resolveSmokEntry(config, kind) {
-    for (const entry of Object.values(config.runners)) {
-        if (entry.kind === 'fake') {
-            continue;
-        }
-        if (kind === undefined || entry.kind === kind) {
-            return entry;
-        }
-    }
-    return null;
-}
-async function runUi(args) {
-    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
-    const stateStore = createStateStore({ wakeRoot });
-    await stateStore.ensureWakeRoot();
-    const config = await loadWakeConfig({
-        wakeRoot,
-    });
-    const server = await runUiCommand({
-        args,
-        stateStore,
-        resourceIndex: createResourceIndex({ paths: stateStore.paths }),
-        config,
-        readFlag: readFlagBeforeCommandTerminator,
-    });
-    const stop = () => {
-        void server.close().then(() => process.exit(0));
+        output: productionOutput(),
+        signal: controller.signal,
     };
-    process.on('SIGINT', stop);
-    process.on('SIGTERM', stop);
-    await new Promise(() => { });
-}
-async function runCorrelate(args) {
-    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
-    const stateStore = createStateStore({ wakeRoot });
-    await stateStore.ensureWakeRoot();
-    await runCorrelateCommand({
-        args,
-        stateStore,
-        resourceIndex: createResourceIndex({ paths: stateStore.paths }),
-        clock: systemClock,
-        readFlag: readFlagBeforeCommandTerminator,
-    });
 }
-async function runAudit(args) {
-    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
-    const stateStore = createStateStore({ wakeRoot });
-    await stateStore.ensureWakeRoot();
-    await runAuditCommand({
-        args,
-        stateStore,
-    });
+function productionOutput() {
+    return { write: (value) => process.stdout.write(value) };
 }
-async function runSmoke(args) {
-    const runtime = await buildRuntime(args);
-    const explicitKind = args[0] === 'claude' || args[0] === 'codex' || args[0] === 'cursor' ? args[0] : undefined;
-    const smokeArgs = explicitKind === undefined ? args : args.slice(1);
-    const entry = resolveSmokEntry(runtime.config, explicitKind);
-    if (entry === null) {
-        throw new Error('Smoke tests require a real runner entry (`claude`, `codex`, or `cursor`) in config.runners.');
-    }
-    const runnerAdapter = createRunnerCliAdapter({
-        entry,
-        cwd: process.cwd(),
-    });
-    const result = await runnerAdapter.smoke(smokeArgs);
-    console.log(JSON.stringify(result, null, 2));
-}
-async function runDoctor(args) {
-    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
-    const stateStore = createStateStore({ wakeRoot });
-    await stateStore.ensureWakeRoot();
-    const config = await loadWakeConfig({
-        wakeRoot,
-    });
-    const docker = createHostDockerCli();
-    const packageRoot = resolvePackageRoot();
-    const containerName = config.sandbox.containerName;
-    const image = config.sandbox.image;
-    const workspaceManager = createGitWorkspaceManager({ wakeRoot });
-    const deps = {
-        collectPreflightFailures: (doctorConfig) => collectStartupPreflightFailures(doctorConfig, { workspaceManager }),
-        resolveGitHubToken,
-        hasDockerfile,
-        dockerReachable: dockerDaemonReachable,
-        inspectImage: async (imageToInspect) => {
+function productionSandboxRuntime() {
+    return {
+        async hasDockerfile(wakeRoot) {
             try {
-                return await inspectDockerImage(imageToInspect);
+                await access(join(wakeRoot, 'docker', 'Dockerfile'));
+                return true;
             }
             catch {
                 return false;
             }
         },
-        wakeRoot,
-        image,
-        containerRunning: async () => (await inspectDockerContainer(containerName)) === 'running',
-        execVersionInContainer: () => execVersionInContainer(docker, containerName, config.dev?.mode),
-        installedVersion: wakeVersion,
-        diffPromptsAndDockerfile: () => diffPromptsAndDockerfile({ wakeRoot, packageRoot, devMode: config.dev?.mode }),
+        async exec(wakeRoot, arguments_) {
+            const config = await loadConfig(wakeRoot);
+            const invocation = config.host.development.mode === 'source' ? ['node', '/app/dist/src/main.js'] : ['wake'];
+            await runDocker([
+                'exec',
+                '-i',
+                config.host.sandbox.containerName,
+                ...invocation,
+                ...arguments_,
+            ]);
+        },
     };
-    const report = await runDoctorCommand(config, deps);
-    if (report.failures.length > 0) {
-        console.log('Failures:');
-        for (const failure of report.failures) {
-            console.log(`  - ${failure}`);
-        }
-    }
-    if (report.notices.length > 0) {
-        console.log('Notices:');
-        for (const notice of report.notices) {
-            console.log(`  - ${notice}`);
-        }
-    }
-    if (report.failures.length === 0 && report.notices.length === 0) {
-        console.log('wake doctor: no issues found');
-    }
-    if (report.failures.length > 0) {
-        process.exitCode = 1;
-    }
 }
-export class CliUsageError extends Error {
-}
-export function printUsage(stream) {
-    stream.write([
-        'Wake — an autonomous agent control plane for software development.',
-        '',
-        'Usage:',
-        '  wake init <path>           Scaffold a new Wake home directory',
-        '  wake sandbox <subcommand>  Build/run/manage the Docker sandbox (build, up, update, down, stop, self-update, setup, exec, logs, resume)',
-        '  wake tick                  Run one control-plane tick',
-        '  wake start                 Run the resident loop',
-        '  wake validate-state        Validate .wake/ control-plane state health',
-        '  wake stop                  Stop the sandbox container gracefully',
-        '  wake smoke                 Smoke-test the configured runner',
-        '  wake ui                    Run the control-plane UI server',
-        '  wake audit                 Show autonomous decision audit history',
-        '  wake correlate             Manually correlate a resource to a work item',
-        '  wake doctor                Diagnose config/GitHub/Docker/sandbox setup problems',
-        '  wake --version             Print the installed Wake version',
-        '  wake --help                Show this message',
-        '',
-        'Getting started:',
-        '  1. wake init ./wake-home',
-        '  2. cd wake-home && wake start',
-        '',
-        'Runtime commands (tick/start/ui/smoke/audit/correlate/validate-state) auto-delegate into the sandbox',
-        'when docker/Dockerfile exists at --wake-root (i.e. after `wake sandbox build`),',
-        'defaulting --wake-root to the current directory. Pass --no-sandbox to run',
-        'directly on the host instead.',
-        '',
-    ].join('\n'));
-}
-const runtimeCommands = new Set([
-    'tick',
-    'start',
-    'ui',
-    'smoke',
-    'audit',
-    'correlate',
-    'validate-state',
-]);
-export async function dispatchMainCommand(input) {
-    const command = input.args[0] ?? 'help';
-    if (command === '--version' || command === '-v') {
-        console.log(wakeVersion);
-        return;
-    }
-    if (command === '--help' || command === '-h' || command === 'help') {
-        printUsage(process.stdout);
-        return;
-    }
-    if (command === 'init') {
-        await input.runInit(input.args.slice(1));
-        return;
-    }
-    if (command === 'sandbox') {
-        await input.runSandbox(input.args.slice(1));
-        return;
-    }
-    if (command === 'sandbox-setup') {
-        await input.runSandboxSetup(input.args.slice(1));
-        return;
-    }
-    if (command === 'sandbox-entrypoint') {
-        await input.runSandboxEntrypoint(input.args.slice(1));
-        return;
-    }
-    if (command === 'stop') {
-        await input.runSandbox(['stop', ...input.args.slice(1)]);
-        return;
-    }
-    if (command === 'doctor') {
-        // Host-only, like init/sandbox/stop above: doctor's job is to report on
-        // sandbox reachability from the outside, so it must never auto-delegate
-        // into the sandbox the way runtimeCommands below does.
-        await input.runDoctor(input.args.slice(1));
-        return;
-    }
-    if (runtimeCommands.has(command)) {
-        const commandArgs = input.args.slice(1);
-        const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', commandArgs) ?? process.cwd());
-        const host = commandArgs.includes('--no-sandbox');
-        if (!host && (await hasDockerfile(wakeRoot))) {
-            await input.execIntoSandbox(input.args);
-            return;
-        }
-        const hostArgs = commandArgs.filter((arg) => arg !== '--no-sandbox');
-        if (command === 'tick') {
-            await input.runTick(hostArgs);
-        }
-        else if (command === 'start') {
-            await input.runStart(hostArgs);
-        }
-        else if (command === 'ui') {
-            await input.runUi(hostArgs);
-        }
-        else if (command === 'audit') {
-            if (input.runAudit === undefined) {
-                throw new CliUsageError('audit command is not available in this runtime');
-            }
-            await input.runAudit(hostArgs);
-        }
-        else if (command === 'smoke') {
-            await input.runSmoke(hostArgs);
-        }
-        else if (command === 'correlate') {
-            await input.runCorrelate(hostArgs);
-        }
-        else {
-            if (input.runValidateState === undefined) {
-                throw new CliUsageError('validate-state command is not available in this runtime');
-            }
-            await input.runValidateState(hostArgs);
-        }
-        return;
-    }
-    printUsage(process.stderr);
-    throw new CliUsageError(`Unknown command: ${input.args.join(' ')}`);
-}
-async function main() {
-    const args = process.argv.slice(2);
-    const runSandbox = async (commandArgs) => {
-        const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', commandArgs) ?? process.cwd());
-        const stateStore = createStateStore({ wakeRoot });
-        await stateStore.ensureWakeRoot();
-        const config = await loadWakeConfig({
-            wakeRoot,
-        });
-        const docker = createHostDockerCli();
-        const recoverActiveRuns = createActiveRunRecovery({
-            clock: systemClock,
-            config,
-            stateStore,
-            resourceIndex: createResourceIndex({ paths: stateStore.paths }),
-        }).recoverActiveRuns;
-        const repoRoot = config.dev?.repoRoot;
-        const selfUpdate = commandArgs[0] === 'self-update' &&
-            config.dev?.mode === 'source' &&
-            repoRoot !== undefined &&
-            repoRoot.length > 0
-            ? {
-                git: {
-                    latestTag: async () => {
-                        await runCommand('git', ['-C', repoRoot, 'fetch', '--tags']);
-                        const output = await runCommandCapture('git', [
-                            '-C',
-                            repoRoot,
-                            'tag',
-                            '--list',
-                            'v*',
-                            '--sort=-v:refname',
-                        ]);
-                        const [latest] = output.split('\n').filter((line) => line.trim().length > 0);
-                        if (latest === undefined) {
-                            throw new Error('No version tags found in repo');
-                        }
-                        return latest.trim();
-                    },
-                    isWorkingTreeClean: async () => {
-                        const output = await runCommandCapture('git', [
-                            '-C',
-                            repoRoot,
-                            'status',
-                            '--porcelain',
-                        ]);
-                        return output.trim().length === 0;
-                    },
-                    checkoutTag: async (tag) => {
-                        await runCommand('git', ['-C', repoRoot, 'checkout', tag]);
-                    },
-                },
-                issueReporter: {
-                    createIssue: async (issue) => {
-                        const remoteUrl = await runCommandCapture('git', [
-                            '-C',
-                            repoRoot,
-                            'remote',
-                            'get-url',
-                            'origin',
-                        ]);
-                        const repoSlug = parseGithubRepoSlug(remoteUrl);
-                        await runCommand('gh', [
-                            'issue',
-                            'create',
-                            '--repo',
-                            repoSlug,
-                            '--title',
-                            issue.title,
-                            '--body',
-                            issue.body,
-                        ]);
-                    },
-                },
-                readLedger: () => readSelfUpdateLedger(resolve(wakeRoot, 'self-update-ledger.json')),
-                writeLedger: (ledger) => writeSelfUpdateLedger(resolve(wakeRoot, 'self-update-ledger.json'), ledger),
-            }
-            : undefined;
-        await runSandboxCommand({
-            args: commandArgs,
-            config,
-            wakeRoot,
-            containerHomeRoot: stateStore.paths.containerHomeRoot,
-            docker,
-            packagedTemplatesRoot: resolve(resolvePackageRoot(), 'docker'),
-            stateStore,
-            recoverActiveRuns,
-            sleep: (ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)),
-            logger: {
-                info(message) {
-                    console.log(message);
-                },
-                error(message) {
-                    console.error(message);
-                },
-            },
-            selfUpdate,
-        });
-    };
-    await dispatchMainCommand({
-        args,
-        runInit: async (commandArgs) => {
-            await runInitCommand({
-                cwd: process.cwd(),
-                args: commandArgs,
-                repoRoot: resolvePackageRoot(),
-            });
-        },
-        runSandbox,
-        runSandboxSetup: async () => {
-            await runSandboxSetup();
-        },
-        runSandboxEntrypoint: async () => {
-            await runSandboxEntrypoint();
-        },
-        runTick,
-        runStart,
-        runSmoke,
-        runUi,
-        runAudit,
-        runCorrelate,
-        runValidateState,
-        execIntoSandbox: async (commandArgs) => {
-            const withoutBypassFlag = commandArgs.filter((arg) => arg !== '--no-sandbox');
-            const wakeRootIndex = withoutBypassFlag.indexOf('--wake-root');
-            const rewritten = wakeRootIndex === -1
-                ? [...withoutBypassFlag, '--wake-root', '/wake']
-                : withoutBypassFlag.map((arg, index) => (index === wakeRootIndex + 1 ? '/wake' : arg));
-            const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', commandArgs) ?? process.cwd());
-            const stateStore = createStateStore({ wakeRoot });
-            await stateStore.ensureWakeRoot();
-            const config = await loadWakeConfig({
-                wakeRoot,
-            });
-            const wakeInvocation = config.dev?.mode === 'source' ? ['node', '/app/dist/src/main.js'] : ['wake'];
-            await runSandbox(['exec', '--', ...wakeInvocation, ...rewritten]);
-        },
-        runDoctor,
+function runDocker(arguments_) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('docker', arguments_, { stdio: 'inherit' });
+        child.once('error', reject);
+        child.once('close', (code) => code === 0
+            ? resolve()
+            : reject(new Error('docker ' + arguments_.join(' ') + ' exited with code ' + String(code))));
     });
 }
-main().catch((error) => {
-    if (error instanceof CliUsageError) {
-        console.error(error.message);
-    }
-    else if (error instanceof StateHealthError) {
-        console.error(error.message);
-        for (const issue of error.issues) {
-            console.error(`  - ${issue.surface} ${issue.kind}: ${issue.path}: ${issue.message}`);
-        }
-        process.exitCode = 1;
-    }
-    else {
-        console.error(error);
-    }
-    process.exitCode = 1;
-});
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href)
+    await main();