@cairnkeep/cli 2.3.0 → 2.4.0

package/mcp-memory-server/dist/capability-adapter.js

@@ -0,0 +1,286 @@
+import { randomUUID } from "node:crypto";
+import { performance } from "node:perf_hooks";
+import { z } from "zod";
+import { isCapabilityContractEnabled, resolveCapabilityStatus, } from "./capability-config.js";
+import { isTrajectoryCaptureEnabled } from "./trajectory-schema.js";
+import { CAPABILITY_CALLBACK_SCHEMA_VERSION, appendCapabilityRecord, issueOperatingCapability, settleOperatingCapability, } from "./capability-store.js";
+import { capabilityIdSchema, capabilitySourceSchema, } from "./capability-schema.js";
+const MAX_TRACKED_OPERATING_INVOCATIONS = 10_000;
+const correlationIdSchema = z.string()
+    .min(1)
+    .max(256)
+    .regex(/^(?:cairn:)?[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/)
+    .refine((value) => value !== "unknown");
+const invocationIdSchema = z.string().regex(/^cap:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i);
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/);
+export const capabilityAdapterClassificationSchema = z.strictObject({
+    harness: z.enum(["claude-code", "opencode", "pi", "other"]),
+    source: z.enum(["mcp", "notes-cli", "audit-timer", "operating-command", "operating-workflow"]),
+    transport: z.enum(["stdio", "http", "local-process", "harness-command"]),
+});
+export const operatingCapabilityHandleSchema = z.strictObject({
+    schema_version: z.literal(CAPABILITY_CALLBACK_SCHEMA_VERSION),
+    capability_id: capabilityIdSchema,
+    invocation_id: invocationIdSchema,
+    correlation_id: correlationIdSchema,
+    harness: capabilityAdapterClassificationSchema.shape.harness,
+    source: capabilityAdapterClassificationSchema.shape.source,
+    transport: capabilityAdapterClassificationSchema.shape.transport,
+    started_at: z.iso.datetime(),
+    state_source: capabilitySourceSchema,
+    configuration_digest: digestSchema,
+});
+export const operatingCapabilityDisabledResultSchema = z.strictObject({
+    schema_version: z.literal(CAPABILITY_CALLBACK_SCHEMA_VERSION),
+    capability_id: capabilityIdSchema,
+    disabled: z.literal(true),
+    measured: z.literal(false),
+});
+export const operatingCapabilityBypassResultSchema = z.strictObject({
+    schema_version: z.literal(CAPABILITY_CALLBACK_SCHEMA_VERSION),
+    capability_id: capabilityIdSchema,
+    disabled: z.literal(false),
+    measured: z.literal(false),
+});
+export const operatingCapabilityFinishInputSchema = z.strictObject({
+    outcome: z.enum(["success", "error", "timeout"]),
+});
+export const operatingCapabilityFinishResultSchema = z.strictObject({
+    schema_version: z.literal(CAPABILITY_CALLBACK_SCHEMA_VERSION),
+    invocation_id: invocationIdSchema,
+    finalized: z.boolean(),
+});
+let fallbackCorrelationId;
+const operatingStarts = new Map();
+function resolvedCapability(options) {
+    return options.snapshot.capabilities.find(({ id }) => id === options.capabilityId);
+}
+function hasLoggingConsent(options) {
+    return options.snapshot.contract_enabled
+        && options.snapshot.logging.enabled
+        && options.classification.transport !== "http"
+        && isTrajectoryCaptureEnabled();
+}
+function isMeasuredCapabilityEnabled(options) {
+    return resolvedCapability(options)?.enabled === true;
+}
+function correlationId(explicit) {
+    const parsed = correlationIdSchema.safeParse(explicit);
+    if (parsed.success)
+        return parsed.data;
+    fallbackCorrelationId ??= `cairn:${randomUUID()}`;
+    return fallbackCorrelationId;
+}
+function invocationId() {
+    return `cap:${randomUUID()}`;
+}
+function rememberOperatingStart(id, monotonicStart) {
+    operatingStarts.set(id, monotonicStart);
+    while (operatingStarts.size > MAX_TRACKED_OPERATING_INVOCATIONS) {
+        const oldest = operatingStarts.keys().next().value;
+        if (!oldest)
+            break;
+        operatingStarts.delete(oldest);
+    }
+}
+function returnedOutcome(result) {
+    if (!result || typeof result !== "object" || Array.isArray(result))
+        return { outcome: "success" };
+    const root = result;
+    const structured = root.structuredContent;
+    const value = structured && typeof structured === "object" && !Array.isArray(structured)
+        ? structured
+        : root;
+    if (value.timedOut === true || value.timed_out === true) {
+        return { outcome: "timeout", errorCode: "result-timeout" };
+    }
+    if (value.ok === false)
+        return { outcome: "error", errorCode: "result-error" };
+    return { outcome: "success" };
+}
+function thrownOutcome(error) {
+    const name = error && typeof error === "object" && "name" in error
+        ? error.name
+        : undefined;
+    if (name === "TimeoutError" || name === "AbortError") {
+        return { outcome: "timeout", errorCode: "callback-timeout" };
+    }
+    return { outcome: "error", errorCode: "callback-error" };
+}
+function finalRecord(options, handle, finishedAt, durationMs, outcome, errorCode) {
+    return {
+        schema_version: CAPABILITY_CALLBACK_SCHEMA_VERSION,
+        capability_id: handle.capability_id,
+        invocation_id: handle.invocation_id,
+        correlation_id: handle.correlation_id,
+        harness: handle.harness,
+        source: handle.source,
+        transport: handle.transport,
+        started_at: handle.started_at,
+        finished_at: finishedAt,
+        duration_ms: durationMs,
+        outcome,
+        ...(errorCode === undefined ? {} : { error_code: errorCode }),
+        state_source: handle.state_source,
+        configuration_digest: handle.configuration_digest,
+    };
+}
+async function persistFinal(options, record) {
+    try {
+        await appendCapabilityRecord(options.projectRoot, record, {
+            ...(options.testStoreFault === undefined ? {} : { testStoreFault: options.testStoreFault }),
+        });
+    }
+    catch {
+        // Callback measurement is fail-open by contract.
+    }
+}
+function createHandle(options, startedAt) {
+    const classification = capabilityAdapterClassificationSchema.parse(options.classification);
+    const state = resolvedCapability(options);
+    if (!state)
+        throw new Error("Capability state is missing from the resolved snapshot.");
+    return operatingCapabilityHandleSchema.parse({
+        schema_version: CAPABILITY_CALLBACK_SCHEMA_VERSION,
+        capability_id: options.capabilityId,
+        invocation_id: invocationId(),
+        correlation_id: correlationId(options.correlationId),
+        ...classification,
+        started_at: startedAt,
+        state_source: state.source,
+        configuration_digest: options.snapshot.configuration_digest,
+    });
+}
+export function withCapability(options, callback) {
+    if (!options.snapshot.contract_enabled
+        || !options.snapshot.logging.enabled
+        || options.classification.transport === "http"
+        || !isMeasuredCapabilityEnabled(options)) {
+        return callback;
+    }
+    return async function measuredCallback(...args) {
+        if (!isTrajectoryCaptureEnabled())
+            return callback.apply(this, args);
+        const monotonicStart = performance.now();
+        const startedAt = new Date().toISOString();
+        const handle = createHandle(options, startedAt);
+        try {
+            const result = await callback.apply(this, args);
+            const finishedAt = new Date().toISOString();
+            const durationMs = Math.max(0, performance.now() - monotonicStart);
+            const classified = returnedOutcome(result);
+            await persistFinal(options, finalRecord(options, handle, finishedAt, durationMs, classified.outcome, classified.errorCode));
+            return result;
+        }
+        catch (error) {
+            const finishedAt = new Date().toISOString();
+            const durationMs = Math.max(0, performance.now() - monotonicStart);
+            const classified = thrownOutcome(error);
+            await persistFinal(options, finalRecord(options, handle, finishedAt, durationMs, classified.outcome, classified.errorCode));
+            throw error;
+        }
+    };
+}
+export async function startOperatingCapability(options) {
+    const state = resolvedCapability(options);
+    const disabled = options.snapshot.contract_enabled && state?.enabled === false;
+    if (disabled) {
+        const result = operatingCapabilityDisabledResultSchema.parse({
+            schema_version: CAPABILITY_CALLBACK_SCHEMA_VERSION,
+            capability_id: options.capabilityId,
+            disabled: true,
+            measured: false,
+        });
+        if (!hasLoggingConsent(options))
+            return result;
+        const monotonicStart = performance.now();
+        const startedAt = new Date().toISOString();
+        const handle = createHandle(options, startedAt);
+        const finishedAt = new Date().toISOString();
+        await persistFinal(options, finalRecord(options, handle, finishedAt, Math.max(0, performance.now() - monotonicStart), "disabled", "capability-disabled"));
+        return result;
+    }
+    if (!hasLoggingConsent(options) || !isMeasuredCapabilityEnabled(options)) {
+        return operatingCapabilityBypassResultSchema.parse({
+            schema_version: CAPABILITY_CALLBACK_SCHEMA_VERSION,
+            capability_id: options.capabilityId,
+            disabled: false,
+            measured: false,
+        });
+    }
+    const monotonicStart = performance.now();
+    const handle = createHandle(options, new Date().toISOString());
+    const issued = await issueOperatingCapability(options.projectRoot, handle, {
+        ...(options.testStoreFault === undefined ? {} : { testStoreFault: options.testStoreFault }),
+    });
+    if (!issued) {
+        return operatingCapabilityBypassResultSchema.parse({
+            schema_version: CAPABILITY_CALLBACK_SCHEMA_VERSION,
+            capability_id: options.capabilityId,
+            disabled: false,
+            measured: false,
+        });
+    }
+    rememberOperatingStart(handle.invocation_id, monotonicStart);
+    return handle;
+}
+function operatingFinishResult(invocationIdValue, finalized) {
+    return operatingCapabilityFinishResultSchema.parse({
+        schema_version: CAPABILITY_CALLBACK_SCHEMA_VERSION,
+        invocation_id: invocationIdValue,
+        finalized,
+    });
+}
+export async function finishOperatingCapability(projectRoot, rawHandle, rawFinish) {
+    const handle = operatingCapabilityHandleSchema.parse(rawHandle);
+    const finish = operatingCapabilityFinishInputSchema.parse(rawFinish);
+    try {
+        if (!isCapabilityContractEnabled()
+            || !isTrajectoryCaptureEnabled()
+            || handle.transport === "http") {
+            await settleOperatingCapability(projectRoot, handle);
+            operatingStarts.delete(handle.invocation_id);
+            return operatingFinishResult(handle.invocation_id, false);
+        }
+        const current = await resolveCapabilityStatus({ projectRoot });
+        const capability = current.capabilities.find(({ id }) => id === handle.capability_id);
+        const eligible = current.contract_enabled
+            && current.logging.enabled
+            && capability?.enabled === true
+            && capability.source === handle.state_source
+            && current.configuration_digest === handle.configuration_digest;
+        if (!eligible) {
+            await settleOperatingCapability(projectRoot, handle);
+            operatingStarts.delete(handle.invocation_id);
+            return operatingFinishResult(handle.invocation_id, false);
+        }
+        const finishedAt = new Date().toISOString();
+        const monotonicStart = operatingStarts.get(handle.invocation_id);
+        operatingStarts.delete(handle.invocation_id);
+        const durationMs = monotonicStart === undefined
+            ? Math.max(0, Date.parse(finishedAt) - Date.parse(handle.started_at))
+            : Math.max(0, performance.now() - monotonicStart);
+        const errorCode = finish.outcome === "error"
+            ? "callback-error"
+            : finish.outcome === "timeout"
+                ? "callback-timeout"
+                : undefined;
+        const options = {
+            projectRoot,
+            snapshot: current,
+            capabilityId: handle.capability_id,
+            classification: {
+                harness: handle.harness,
+                source: handle.source,
+                transport: handle.transport,
+            },
+            correlationId: handle.correlation_id,
+        };
+        const finalized = await settleOperatingCapability(projectRoot, handle, finalRecord(options, handle, finishedAt, durationMs, finish.outcome, errorCode));
+        return operatingFinishResult(handle.invocation_id, finalized);
+    }
+    catch {
+        operatingStarts.delete(handle.invocation_id);
+        return operatingFinishResult(handle.invocation_id, false);
+    }
+}

package/mcp-memory-server/dist/capability-cli.js

@@ -0,0 +1,361 @@
+#!/usr/bin/env node
+import { lstat } from "node:fs/promises";
+import { join } from "node:path";
+import { capabilityAdapterClassificationSchema, finishOperatingCapability, operatingCapabilityBypassResultSchema, operatingCapabilityHandleSchema, startOperatingCapability, } from "./capability-adapter.js";
+import { readCapabilityConfig, resetCapabilityLogging, resetCapabilityOverride, resolveCapabilityStatus, setCapabilityLogging, setCapabilityOverride, } from "./capability-config.js";
+import { CAPABILITY_CALLBACK_SCHEMA_VERSION, doctorCapabilityRecords, } from "./capability-store.js";
+import { CAPABILITY_SCHEMA_VERSION, capabilityIdSchema, } from "./capability-schema.js";
+import { beginHarnessCapability, finishHarnessCapability, harnessCapabilityBeforeInputSchema, harnessCapabilityTerminalInputSchema, observeHarnessCwdChanged, recoverHarnessCapabilities, } from "./capability-harness.js";
+process.stdout.on("error", (error) => {
+    if (error.code === "EPIPE")
+        process.exit(0);
+    throw error;
+});
+const sessionSchemaPattern = /^(?:cairn:)?[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
+const configName = ".ai/capabilities.json";
+const callbackStoreName = ".agentfs/trajectory.db";
+const MAX_HARNESS_INPUT_BYTES = 8 * 1024;
+function usage() {
+    return `cairn capabilities — managed capability state
+
+Usage:
+  cairn capabilities list [--json]
+  cairn capabilities status [--json]
+  cairn capabilities enable <capability-id> [--json]
+  cairn capabilities disable <capability-id> [--json]
+  cairn capabilities reset <capability-id>|--all [--json]
+  cairn capabilities logging <enable|disable|reset> [--json]
+
+MCP capability changes require a memory-server restart. Operating capability
+changes apply on the next invocation.
+`;
+}
+function parseOutputArgs(args, positionalCount) {
+    const jsonCount = args.filter((arg) => arg === "--json").length;
+    const positional = args.filter((arg) => arg !== "--json");
+    if (jsonCount > 1 || positional.length !== positionalCount) {
+        throw new Error("invalid-arguments");
+    }
+    return { positional, mode: jsonCount === 1 ? "json" : "human" };
+}
+function requireCapabilityId(value) {
+    const parsed = capabilityIdSchema.safeParse(value);
+    if (!parsed.success)
+        throw new Error("invalid-capability-id");
+    return parsed.data;
+}
+function humanList(status) {
+    const heading = status.contract_enabled
+        ? "Capability contract: enabled"
+        : "Capability contract: disabled (showing staged state; legacy behavior remains active)";
+    const rows = status.capabilities.map((row) => [
+        row.id,
+        row.kind,
+        row.enabled ? "enabled" : "disabled",
+        row.source,
+        row.restart_required ? "restart required" : "next invocation",
+    ].join("\t"));
+    return [heading, ...rows].join("\n");
+}
+function humanStatus(status) {
+    const issues = status.issues.length === 0
+        ? ["Issues: none"]
+        : ["Issues:", ...status.issues.map((issue) => {
+                const subject = issue.capability_id ?? issue.setting;
+                return `  ${issue.code}${subject === undefined ? "" : ` (${subject})`}`;
+            })];
+    return [
+        humanList(status),
+        `Logging callbacks: ${status.logging.enabled ? "enabled" : "disabled"} (${status.logging.source})`,
+        `Configuration digest: ${status.configuration_digest}`,
+        ...issues,
+    ].join("\n");
+}
+function writeStatus(status, mode, compact) {
+    process.stdout.write(`${mode === "json" ? JSON.stringify(status) : compact ? humanList(status) : humanStatus(status)}\n`);
+}
+async function currentStatus() {
+    return resolveCapabilityStatus({ projectRoot: process.cwd() });
+}
+async function assertConfigCanMutate(allowInvalidReset) {
+    if (allowInvalidReset)
+        return;
+    const { issues } = await readCapabilityConfig({ projectRoot: process.cwd() });
+    if (issues.some(({ code }) => code === "invalid-config"))
+        throw new Error("invalid-config");
+}
+function parsePrivateStartArgs(args) {
+    const capabilityId = requireCapabilityId(args[0]);
+    const values = new Map();
+    for (let index = 1; index < args.length; index += 2) {
+        const name = args[index];
+        const value = args[index + 1];
+        if (!name || !value || !["--harness", "--source", "--transport", "--session"].includes(name)
+            || values.has(name)) {
+            throw new Error("invalid-private-arguments");
+        }
+        values.set(name, value);
+    }
+    if (values.size < 3 || !values.has("--harness") || !values.has("--source") || !values.has("--transport")) {
+        throw new Error("invalid-private-arguments");
+    }
+    const classification = capabilityAdapterClassificationSchema.parse({
+        harness: values.get("--harness"),
+        source: values.get("--source"),
+        transport: values.get("--transport"),
+    });
+    const correlationId = values.get("--session");
+    if (correlationId !== undefined
+        && (!sessionSchemaPattern.test(correlationId) || correlationId === "unknown")) {
+        throw new Error("invalid-session");
+    }
+    return { capabilityId, classification, ...(correlationId === undefined ? {} : { correlationId }) };
+}
+async function operatingOptions(args) {
+    const parsed = parsePrivateStartArgs(args);
+    return {
+        projectRoot: process.cwd(),
+        snapshot: await currentStatus(),
+        capabilityId: parsed.capabilityId,
+        classification: parsed.classification,
+        ...(parsed.correlationId === undefined ? {} : { correlationId: parsed.correlationId }),
+    };
+}
+async function privateGuard(args) {
+    const options = await operatingOptions(args);
+    const state = options.snapshot.capabilities.find(({ id }) => id === options.capabilityId);
+    const result = options.snapshot.contract_enabled && state?.enabled === false
+        ? await startOperatingCapability(options)
+        : operatingCapabilityBypassResultSchema.parse({
+            schema_version: CAPABILITY_CALLBACK_SCHEMA_VERSION,
+            capability_id: options.capabilityId,
+            disabled: false,
+            measured: false,
+        });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+async function privateStart(args) {
+    const result = await startOperatingCapability(await operatingOptions(args));
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+async function privateFinish(args) {
+    if (args.length !== 4 || args[0] !== "--handle" || args[2] !== "--outcome") {
+        throw new Error("invalid-private-arguments");
+    }
+    const handle = operatingCapabilityHandleSchema.parse(JSON.parse(args[1]));
+    if (!["success", "error", "timeout"].includes(args[3])) {
+        throw new Error("invalid-outcome");
+    }
+    const result = await finishOperatingCapability(process.cwd(), handle, {
+        outcome: args[3],
+    });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+async function readBoundedHarnessInput() {
+    const chunks = [];
+    let total = 0;
+    for await (const rawChunk of process.stdin) {
+        const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
+        total += chunk.byteLength;
+        if (total > MAX_HARNESS_INPUT_BYTES)
+            throw new Error("invalid-harness-input");
+        chunks.push(chunk);
+    }
+    if (total === 0)
+        throw new Error("invalid-harness-input");
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+async function privateHarnessBefore(args) {
+    if (args.length !== 0)
+        throw new Error("invalid-private-arguments");
+    let result = {
+        schema_version: 1,
+        decision: "allow",
+    };
+    try {
+        const input = harnessCapabilityBeforeInputSchema.parse(await readBoundedHarnessInput());
+        result = await beginHarnessCapability(input);
+    }
+    catch {
+        // Native bridges validate their harness event before this fail-open local seam.
+    }
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+async function privateHarnessTerminal(args) {
+    if (args.length !== 0)
+        throw new Error("invalid-private-arguments");
+    let result = { schema_version: 1, finalized: false };
+    try {
+        const input = harnessCapabilityTerminalInputSchema.parse(await readBoundedHarnessInput());
+        result = await finishHarnessCapability(input);
+    }
+    catch {
+        // Terminal failures cannot change owner results or disclose rejected input.
+    }
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+async function privateHarnessCwd(args) {
+    if (args.length !== 0)
+        throw new Error("invalid-private-arguments");
+    let result = { schema_version: 1, observed: false };
+    try {
+        const input = await readBoundedHarnessInput();
+        result = await observeHarnessCwdChanged(input);
+    }
+    catch {
+        // CWD observations never rebind identity and remain fail-open.
+    }
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+async function privateHarnessRecover(args) {
+    if (args.length !== 0)
+        throw new Error("invalid-private-arguments");
+    let result = { schema_version: 1, recovered: 0, pruned: 0, pending: 0 };
+    try {
+        result = await recoverHarnessCapabilities();
+    }
+    catch {
+        // Recovery is local, value-free, and fail-open.
+    }
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+async function configDoctor() {
+    const path = join(process.cwd(), configName);
+    let exists = false;
+    let unsafePermissions = false;
+    try {
+        const info = await lstat(path);
+        exists = true;
+        unsafePermissions = info.isSymbolicLink() || !info.isFile() || (info.mode & 0o077) !== 0;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            unsafePermissions = true;
+    }
+    const { issues: configIssues } = await readCapabilityConfig({ projectRoot: process.cwd() });
+    const issues = [
+        ...configIssues,
+        ...(unsafePermissions ? [{ code: "unsafe-permissions" }] : []),
+    ];
+    const state = issues.some(({ code }) => code === "invalid-config" || code === "unsafe-permissions")
+        ? "FAIL"
+        : issues.length > 0 ? "WARN" : "PASS";
+    return { name: configName, state, exists, issues };
+}
+async function callbackDoctor() {
+    try {
+        const result = await doctorCapabilityRecords(process.cwd());
+        return {
+            name: callbackStoreName,
+            state: result.ok ? "PASS" : "FAIL",
+            exists: result.exists,
+            issues: result.issues,
+        };
+    }
+    catch {
+        return {
+            name: callbackStoreName,
+            state: "FAIL",
+            exists: true,
+            issues: ["diagnostic-failed"],
+        };
+    }
+}
+async function privateDoctor(args) {
+    if (args.length !== 1 || args[0] !== "--json")
+        throw new Error("invalid-private-arguments");
+    const [configuration, callbacks] = await Promise.all([configDoctor(), callbackDoctor()]);
+    const value = {
+        schema_version: CAPABILITY_SCHEMA_VERSION,
+        ok: configuration.state !== "FAIL" && callbacks.state !== "FAIL",
+        configuration,
+        callbacks,
+    };
+    process.stdout.write(`${JSON.stringify(value)}\n`);
+    if (!value.ok)
+        process.exitCode = 2;
+}
+async function main() {
+    const [command = "help", ...args] = process.argv.slice(2);
+    try {
+        if (command === "list" || command === "status") {
+            const { mode } = parseOutputArgs(args, 0);
+            writeStatus(await currentStatus(), mode, command === "list");
+            return;
+        }
+        if (command === "enable" || command === "disable") {
+            const { positional, mode } = parseOutputArgs(args, 1);
+            const id = requireCapabilityId(positional[0]);
+            await assertConfigCanMutate(false);
+            await setCapabilityOverride({ projectRoot: process.cwd(), id, enabled: command === "enable" });
+            writeStatus(await currentStatus(), mode, false);
+            return;
+        }
+        if (command === "reset") {
+            const { positional, mode } = parseOutputArgs(args, 1);
+            const id = positional[0] === "--all" ? "all" : requireCapabilityId(positional[0]);
+            await assertConfigCanMutate(id === "all");
+            await resetCapabilityOverride({ projectRoot: process.cwd(), id });
+            writeStatus(await currentStatus(), mode, false);
+            return;
+        }
+        if (command === "logging") {
+            const { positional, mode } = parseOutputArgs(args, 1);
+            const operation = positional[0];
+            if (!operation || !["enable", "disable", "reset"].includes(operation)) {
+                throw new Error("invalid-logging-operation");
+            }
+            await assertConfigCanMutate(false);
+            if (operation === "reset")
+                await resetCapabilityLogging({ projectRoot: process.cwd() });
+            else
+                await setCapabilityLogging({ projectRoot: process.cwd(), enabled: operation === "enable" });
+            writeStatus(await currentStatus(), mode, false);
+            return;
+        }
+        if (command === "guard") {
+            await privateGuard(args);
+            return;
+        }
+        if (command === "start") {
+            await privateStart(args);
+            return;
+        }
+        if (command === "finish") {
+            await privateFinish(args);
+            return;
+        }
+        if (command === "doctor") {
+            await privateDoctor(args);
+            return;
+        }
+        if (command === "harness-before") {
+            await privateHarnessBefore(args);
+            return;
+        }
+        if (command === "harness-terminal") {
+            await privateHarnessTerminal(args);
+            return;
+        }
+        if (command === "harness-cwd") {
+            await privateHarnessCwd(args);
+            return;
+        }
+        if (command === "harness-recover" || command === "harness-prune") {
+            await privateHarnessRecover(args);
+            return;
+        }
+        if (command === "help" || command === "--help" || command === "-h") {
+            if (args.length !== 0)
+                throw new Error("invalid-arguments");
+            process.stdout.write(usage());
+            return;
+        }
+        throw new Error("unknown-command");
+    }
+    catch {
+        process.stderr.write("cairn capabilities: invalid command, arguments, or managed state.\n");
+        process.exitCode = 2;
+    }
+}
+await main();