@devlab.group/agent-commerce 0.1.0-alpha.0 → 0.2.0-beta.0

package/dist/cli/index.js

@@ -267,6 +267,54 @@ var init_core = __esm({
   }
 });
 
+// src/payments/x402/networks.ts
+function findNetworkProfile(id) {
+  return BY_ID.get(id);
+}
+function requireNetworkProfile(id, path2) {
+  const profile = BY_ID.get(id);
+  if (!profile) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `${path2}: "${id}" is not a supported network. Supported CAIP-2 identifiers: ${SUPPORTED_NETWORK_IDS.join(", ")}`,
+      { details: { path: path2, network: id } }
+    );
+  }
+  return profile;
+}
+function resolveDeploymentMode(profile, facilitatorMode) {
+  if (facilitatorMode === "local") return "local";
+  return profile.kind;
+}
+function describeDeploymentMode(mode) {
+  return mode === "mainnet" ? LIVE_MAINNET_BANNER : mode.toUpperCase();
+}
+var PROFILES, BY_ID, SUPPORTED_NETWORK_IDS, LIVE_MAINNET_BANNER;
+var init_networks = __esm({
+  "src/payments/x402/networks.ts"() {
+    init_core();
+    PROFILES = [
+      {
+        id: "eip155:84532",
+        chainId: 84532,
+        displayName: "Base Sepolia",
+        kind: "testnet",
+        canonicalAsset: { symbol: "USDC", address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e" }
+      },
+      {
+        id: "eip155:8453",
+        chainId: 8453,
+        displayName: "Base",
+        kind: "mainnet",
+        canonicalAsset: { symbol: "USDC", address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" }
+      }
+    ];
+    BY_ID = new Map(PROFILES.map((profile) => [profile.id, profile]));
+    SUPPORTED_NETWORK_IDS = PROFILES.map((p) => p.id);
+    LIVE_MAINNET_BANNER = "LIVE MAINNET MODE \u2014 REAL FUNDS";
+  }
+});
+
 // src/config/env.ts
 function substituteEnv(value, env, path2 = "$") {
   if (typeof value === "string") {
@@ -329,6 +377,142 @@ var init_env = __esm({
     PLACEHOLDER_PATTERN = /\$\{([A-Za-z_][A-Za-z0-9_]*)(:-([^}]*))?\}/g;
   }
 });
+
+// src/payments/x402/local-chain/accounts.ts
+var ANVIL_WELL_KNOWN_ACCOUNTS;
+var init_accounts = __esm({
+  "src/payments/x402/local-chain/accounts.ts"() {
+    ANVIL_WELL_KNOWN_ACCOUNTS = [
+      {
+        address: "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
+        privateKey: "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
+      },
+      {
+        address: "0x70997970C51812dc3A010C7d01b50e0d17dc79C8",
+        privateKey: "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d"
+      },
+      {
+        address: "0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC",
+        privateKey: "0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a"
+      }
+    ];
+    ANVIL_WELL_KNOWN_ACCOUNTS[0];
+    ANVIL_WELL_KNOWN_ACCOUNTS[1];
+    ANVIL_WELL_KNOWN_ACCOUNTS[2];
+  }
+});
+
+// src/payments/x402/dev-key-guard.ts
+function isWellKnownDevAddress(address) {
+  return WELL_KNOWN_DEV_ADDRESSES.has(address.toLowerCase());
+}
+function isLikelyLocalOrPrivateHost(hostname) {
+  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "localhost" || h === "127.0.0.1" || h === "::1") return true;
+  if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
+  if (/^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
+  if (/^192\.168\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
+  if (!h.includes(".") && !h.includes(":")) return true;
+  return false;
+}
+var WELL_KNOWN_DEV_ADDRESSES;
+var init_dev_key_guard = __esm({
+  "src/payments/x402/dev-key-guard.ts"() {
+    init_core();
+    init_accounts();
+    new Set(
+      ANVIL_WELL_KNOWN_ACCOUNTS.map((a) => a.privateKey.toLowerCase())
+    );
+    WELL_KNOWN_DEV_ADDRESSES = new Set(
+      ANVIL_WELL_KNOWN_ACCOUNTS.map((a) => a.address.toLowerCase())
+    );
+  }
+});
+
+// src/payments/x402/guardrails.ts
+function invalid(message, path2) {
+  return new CommerceError("CONFIG_INVALID", message, { details: { path: path2 } });
+}
+function resolveX402Deployment(input) {
+  const profile = requireNetworkProfile(input.network, "payments.x402.network");
+  const mode = resolveDeploymentMode(profile, input.facilitator.mode);
+  if (profile.kind === "mainnet" && input.facilitator.mode === "local") {
+    throw invalid(
+      `payments.x402: network "${profile.id}" (${profile.displayName}) is a mainnet and cannot be served by facilitator.mode "local". A mainnet deployment must settle through a remote facilitator.`,
+      "payments.x402.facilitator.mode"
+    );
+  }
+  if (mode === "mainnet" && input.allowMainnet !== true) {
+    throw invalid(
+      `payments.x402: network "${profile.id}" (${profile.displayName}) settles real funds. Set payments.x402.allowMainnet: true to acknowledge this explicitly \u2014 it is never the default.`,
+      "payments.x402.allowMainnet"
+    );
+  }
+  if (input.facilitator.mode === "remote") {
+    assertFacilitatorUrlIsSafe(input.facilitator.url, mode);
+    if (mode === "mainnet" && input.facilitator.auth.type === "none") {
+      throw invalid(
+        "payments.x402: a mainnet facilitator must be authenticated. Set payments.x402.facilitator.auth to a supported type \u2014 an unauthenticated production facilitator is refused.",
+        "payments.x402.facilitator.auth"
+      );
+    }
+    if (input.facilitator.auth.type === "bearer" && input.facilitator.auth.token.trim() === "") {
+      throw invalid(
+        'payments.x402: facilitator.auth.type is "bearer" but the token is empty. An empty credential is refused rather than sent.',
+        "payments.x402.facilitator.auth.token"
+      );
+    }
+  }
+  if (mode !== "local" && isWellKnownDevAddress(input.payTo)) {
+    throw invalid(
+      `payments.x402: "payTo" (${input.payTo}) is a well-known Anvil development address and this is a ${mode} deployment. Anyone can spend what settles there. Set payTo to your own merchant wallet.`,
+      "payments.x402.payTo"
+    );
+  }
+  const canonical = profile.canonicalAsset;
+  if (mode === "mainnet" && canonical && !sameAddress(input.asset, canonical.address)) {
+    throw invalid(
+      `payments.x402: asset ${input.asset} is not ${canonical.symbol} on ${profile.displayName} (expected ${canonical.address}). Settling a mainnet payment in an unintended token is refused.`,
+      "payments.x402.asset"
+    );
+  }
+  return { profile, mode };
+}
+function assertFacilitatorUrlIsSafe(url, mode) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch (cause) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `payments.x402: facilitator.url "${url}" is not a valid URL`,
+      { cause, details: { path: "payments.x402.facilitator.url" } }
+    );
+  }
+  if (parsed.protocol === "https:") return;
+  if (parsed.protocol !== "http:") {
+    throw invalid(
+      `payments.x402: facilitator.url must be https (or http on a local/private host); got "${parsed.protocol}//"`,
+      "payments.x402.facilitator.url"
+    );
+  }
+  if (mode !== "mainnet" && isLikelyLocalOrPrivateHost(parsed.hostname)) return;
+  throw invalid(
+    `payments.x402: facilitator.url "${url}" uses plain HTTP. Payment authorisations and settlement results would travel unencrypted. Use https, or point at a local/private host on a non-mainnet deployment.`,
+    "payments.x402.facilitator.url"
+  );
+}
+function sameAddress(a, b) {
+  return a.toLowerCase() === b.toLowerCase();
+}
+var init_guardrails = __esm({
+  "src/payments/x402/guardrails.ts"() {
+    init_core();
+    init_dev_key_guard();
+    init_networks();
+  }
+});
 function parseConfig(raw, env) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new CommerceError(
@@ -435,14 +619,12 @@ function normalise(raw) {
     }
   };
   const x402Raw = raw.payments.x402;
-  if (x402Raw?.facilitator.mode === "remote") {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      'payments.x402.facilitator.mode "remote" is not supported in v0.1.0-alpha; use "local" (the deterministic dev-chain facilitator)',
-      { details: { path: "payments.x402.facilitator.mode" } }
-    );
-  }
-  const x402 = x402Raw ? {
+  const facilitator = x402Raw === void 0 ? void 0 : x402Raw.facilitator.mode === "local" ? { mode: "local", signerPrivateKey: x402Raw.facilitator.signerPrivateKey } : {
+    mode: "remote",
+    url: x402Raw.facilitator.url,
+    auth: x402Raw.facilitator.auth ?? { type: "none" }
+  };
+  const x402 = x402Raw && facilitator ? {
     enabled: toBoolean(x402Raw.enabled, "payments.x402.enabled"),
     network: x402Raw.network,
     rpcUrl: x402Raw.rpcUrl,
@@ -454,18 +636,26 @@ function normalise(raw) {
       max: 36
     }),
     payTo: x402Raw.payTo,
-    maxTimeoutSeconds: toNumber(x402Raw.maxTimeoutSeconds, "payments.x402.maxTimeoutSeconds", {
-      min: 1
-    }),
-    // Only "local" can reach here — "remote" was rejected above.
-    facilitator: {
-      mode: "local",
-      signerPrivateKey: x402Raw.facilitator.signerPrivateKey
-    }
+    maxTimeoutSeconds: toNumber(
+      x402Raw.maxTimeoutSeconds,
+      "payments.x402.maxTimeoutSeconds",
+      {
+        min: 1
+      }
+    ),
+    facilitator,
+    ...x402Raw.allowMainnet !== void 0 ? { allowMainnet: toBoolean(x402Raw.allowMainnet, "payments.x402.allowMainnet") } : {}
   } : void 0;
   if (x402) {
     validateAddress("payments.x402.payTo", x402.payTo);
     validateAddress("payments.x402.asset", x402.asset);
+    resolveX402Deployment({
+      network: x402.network,
+      payTo: x402.payTo,
+      asset: x402.asset,
+      facilitator: x402.facilitator,
+      ...x402.allowMainnet !== void 0 ? { allowMainnet: x402.allowMainnet } : {}
+    });
   }
   const resources = Object.entries(raw.resources).map(
     ([id, entry]) => normaliseResource(id, entry, protocols, x402)
@@ -510,7 +700,7 @@ function normaliseResource(id, entry, protocols, x402) {
   }
   for (const protocol of entry.expose) {
     if (!SUPPORTED_PROTOCOLS.has(protocol)) {
-      const hint = protocol === "ucp" ? " (UCP is planned, not supported in v0.1.0-alpha)" : "";
+      const hint = protocol === "ucp" ? " (UCP is planned, not supported in this release)" : "";
       throw new CommerceError(
         "CONFIG_INVALID",
         `Resource "${id}" exposes unsupported protocol "${protocol}"${hint}. Supported: http, mcp.`,
@@ -546,7 +736,7 @@ function normaliseResource(id, entry, protocols, x402) {
   if (entry.pricing.type === "dynamic") {
     throw new CommerceError(
       "CONFIG_INVALID",
-      `Resource "${id}" uses pricing.type "dynamic", which is not supported in v0.1.0-alpha`,
+      `Resource "${id}" uses pricing.type "dynamic", which is not supported in this release`,
       { details: { path: `resources.${id}.pricing.type`, resourceId: id } }
     );
   }
@@ -778,11 +968,12 @@ function validateAddress(path2, value) {
     );
   }
 }
-var SUPPORTED_CONFIG_VERSION, ADDRESS_PATTERN, ZERO_ADDRESS_PATTERN, MCP_TOOL_NAME_PATTERN, NumberOrString, BooleanOrString, MerchantSchema, ServerSchema, StorageSchema, ProtocolsSchema, BackendMethodSchema, BackendHandlerSchema, PricingSchema, JsonSchemaValueSchema, ResourceEntrySchema, ResourcesMapSchema, FacilitatorSchema, X402Schema, PaymentsSchema, RawConfigSchema, SUPPORTED_PROTOCOLS, SUPPORTED_PAYMENT_METHODS, EMPTY_CLOSED_OBJECT_SCHEMA, UNSUPPORTED_SCHEMA_KEYWORDS, PRICING_AMOUNT_PATTERN, ZERO_AMOUNT_PATTERN;
+var SUPPORTED_CONFIG_VERSION, ADDRESS_PATTERN, ZERO_ADDRESS_PATTERN, MCP_TOOL_NAME_PATTERN, NumberOrString, BooleanOrString, MerchantSchema, ServerSchema, StorageSchema, ProtocolsSchema, BackendMethodSchema, BackendHandlerSchema, PricingSchema, JsonSchemaValueSchema, ResourceEntrySchema, ResourcesMapSchema, FacilitatorAuthSchema, FacilitatorSchema, X402Schema, PaymentsSchema, RawConfigSchema, SUPPORTED_PROTOCOLS, SUPPORTED_PAYMENT_METHODS, EMPTY_CLOSED_OBJECT_SCHEMA, UNSUPPORTED_SCHEMA_KEYWORDS, PRICING_AMOUNT_PATTERN, ZERO_AMOUNT_PATTERN;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     init_execution();
     init_core();
+    init_guardrails();
     init_env();
     SUPPORTED_CONFIG_VERSION = 1;
     ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
@@ -859,6 +1050,10 @@ var init_schema = __esm({
       payments: z.array(z.string().min(1)).optional()
     }).strict();
     ResourcesMapSchema = z.record(z.string().min(1), ResourceEntrySchema);
+    FacilitatorAuthSchema = z.discriminatedUnion("type", [
+      z.object({ type: z.literal("none") }).strict(),
+      z.object({ type: z.literal("bearer"), token: z.string().min(1) }).strict()
+    ]);
     FacilitatorSchema = z.discriminatedUnion("mode", [
       z.object({
         mode: z.literal("local"),
@@ -866,7 +1061,12 @@ var init_schema = __esm({
       }).strict(),
       z.object({
         mode: z.literal("remote"),
-        url: z.string().min(1)
+        url: z.string().min(1),
+        // Absent means "this facilitator takes no credential" — an explicit
+        // statement, normalised to `{ type: 'none' }` below. On a mainnet that
+        // combination is refused outright, so the default can never quietly
+        // become an unauthenticated production facilitator.
+        auth: FacilitatorAuthSchema.optional()
       }).strict()
     ]);
     X402Schema = z.object({
@@ -879,7 +1079,9 @@ var init_schema = __esm({
       assetDecimals: NumberOrString,
       payTo: z.string().min(1),
       maxTimeoutSeconds: NumberOrString,
-      facilitator: FacilitatorSchema
+      facilitator: FacilitatorSchema,
+      /** Real funds. Never defaulted — see src/payments/x402/guardrails.ts. */
+      allowMainnet: BooleanOrString.optional()
     }).strict();
     PaymentsSchema = z.object({
       x402: X402Schema.optional()
@@ -1080,10 +1282,11 @@ async function execCommand(command, args) {
 // src/cli/commands/doctor.ts
 init_execution();
 init_core();
+init_networks();
 
 // src/storage/receipts/store.ts
 init_core();
-var PACKAGE_VERSION = "0.1.0-alpha.0" ;
+var PACKAGE_VERSION = "0.2.0-beta.0" ;
 
 // src/storage/receipts/redact.ts
 var SECRET_KEY_PATTERN = /private[-_ ]?key|secret|password|mnemonic|seed[-_ ]?phrase|api[-_ ]?key|authoriz(e|ation)|^auth$|auth[-_]?header|payment[-_ ]?proof|^proof$|x-payment|signature|signed[-_ ]?message|token|bearer|credential|cookie|session|jwt/i;
@@ -1598,23 +1801,8 @@ async function fetchJson(fetchImpl, url, timeoutMs = 1500) {
   }
 }
 
-// src/payments/x402/local-chain/accounts.ts
-var ANVIL_WELL_KNOWN_ACCOUNTS = [
-  {
-    address: "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
-    privateKey: "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
-  },
-  {
-    address: "0x70997970C51812dc3A010C7d01b50e0d17dc79C8",
-    privateKey: "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d"
-  },
-  {
-    address: "0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC",
-    privateKey: "0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a"
-  }
-];
-
 // src/cli/lib/init-config.ts
+init_accounts();
 var LOCAL_DEV_MERCHANT_ADDRESS = ANVIL_WELL_KNOWN_ACCOUNTS[1].address;
 var LOCAL_DEV_FACILITATOR_PRIVATE_KEY = ANVIL_WELL_KNOWN_ACCOUNTS[0].privateKey;
 var PLACEHOLDER_ASSET_ADDRESS = "0x000000000000000000000000000000000000dEaD";
@@ -1692,7 +1880,7 @@ function buildInitConfigObject(answers) {
     payments: answers.x402Enabled ? {
       x402: {
         enabled: true,
-        network: "base-sepolia",
+        network: "eip155:84532",
         rpcUrl: "http://127.0.0.1:8545",
         asset: PLACEHOLDER_ASSET_ADDRESS,
         assetName: "MockUSDC",
@@ -1845,7 +2033,7 @@ function maskMiddle(value, keep = 6) {
 }
 createRequire(import.meta.url);
 function readVersionReport() {
-  const injected = '{"cliVersion":"0.1.0-alpha.0","pinned":[{"name":"@modelcontextprotocol/sdk","version":"1.30.0","via":"@devlab.group/agent-commerce"},{"name":"x402","version":"1.2.0","via":"@devlab.group/agent-commerce"},{"name":"viem","version":"2.55.18","via":"@devlab.group/agent-commerce"},{"name":"better-sqlite3","version":"13.0.3","via":"@devlab.group/agent-commerce"},{"name":"fastify","version":"5.12.0","via":"@devlab.group/agent-commerce"},{"name":"pino","version":"10.3.1","via":"@devlab.group/agent-commerce"},{"name":"zod","version":"3.25.76","via":"@devlab.group/agent-commerce"}]}' ;
+  const injected = '{"cliVersion":"0.2.0-beta.0","pinned":[{"name":"@modelcontextprotocol/sdk","version":"1.30.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/core","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/evm","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"viem","version":"2.55.18","via":"@devlab.group/agent-commerce"},{"name":"better-sqlite3","version":"13.0.3","via":"@devlab.group/agent-commerce"},{"name":"fastify","version":"5.12.0","via":"@devlab.group/agent-commerce"},{"name":"pino","version":"10.3.1","via":"@devlab.group/agent-commerce"},{"name":"zod","version":"3.25.76","via":"@devlab.group/agent-commerce"}]}' ;
   {
     return JSON.parse(injected);
   }
@@ -1884,12 +2072,12 @@ function extractWellKnownX402(body) {
   }
   return { asset, network, payTo };
 }
-function sameAddress(a, b) {
+function sameAddress2(a, b) {
   return a.toLowerCase() === b.toLowerCase();
 }
 function findX402Mismatch(configured, live) {
   const diffs = [];
-  if (!sameAddress(configured.asset, live.asset)) {
+  if (!sameAddress2(configured.asset, live.asset)) {
     diffs.push(
       `asset: gateway is using ${live.asset} but local config resolves to ${configured.asset}`
     );
@@ -1899,7 +2087,7 @@ function findX402Mismatch(configured, live) {
       `network: gateway is using "${live.network}" but local config resolves to "${configured.network}"`
     );
   }
-  if (!sameAddress(configured.payTo, live.payTo)) {
+  if (!sameAddress2(configured.payTo, live.payTo)) {
     diffs.push(
       `payTo: gateway is using ${live.payTo} but local config resolves to ${configured.payTo}`
     );
@@ -1994,9 +2182,13 @@ async function runDoctor(options, deps = {}) {
   if (x402 === void 0 || !x402.enabled) {
     checks.push({ name: "Payments", status: "INFO", detail: "x402 not configured" });
   } else {
-    const summary = `x402 enabled \u2014 network=${x402.network}, destination=${maskMiddle(x402.payTo)}, facilitator=${x402.facilitator.mode}`;
+    const profile = findNetworkProfile(x402.network);
+    const mode = profile ? resolveDeploymentMode(profile, x402.facilitator.mode) : void 0;
+    const where = profile === void 0 || mode === void 0 ? `unknown network ${x402.network}` : mode === "local" ? `LOCAL dev chain (${x402.network}, chain id shared with ${profile.displayName})` : `${describeDeploymentMode(mode)} on ${profile.displayName} (${x402.network})`;
+    const facilitatorDetail = x402.facilitator.mode === "local" ? "local" : `remote (auth=${x402.facilitator.auth.type})`;
+    const summary = `x402 v2 (scheme=exact) enabled \u2014 ${where}, destination=${maskMiddle(x402.payTo)}, facilitator=${facilitatorDetail}`;
     const live = wellKnown?.ok ? extractWellKnownX402(wellKnown.body) : void 0;
-    if (sameAddress(x402.asset, PLACEHOLDER_ASSET_ADDRESS)) {
+    if (sameAddress2(x402.asset, PLACEHOLDER_ASSET_ADDRESS)) {
       checks.push({
         name: "Payments",
         status: "WARN",
@@ -2020,11 +2212,18 @@ async function runDoctor(options, deps = {}) {
         mismatch === void 0 ? { name: "Payments", status: "PASS", detail: summary } : { name: "Payments", status: "FAIL", detail: mismatch }
       );
     }
+    if (mode === "mainnet") {
+      checks.push({
+        name: "Mainnet safety",
+        status: "INFO",
+        detail: `${describeDeploymentMode("mainnet")} \u2014 enforced at config load: explicit allowMainnet opt-in, remote facilitator over HTTPS with a credential, non-development payTo, and the canonical asset for this network. Payments are fail-closed.`
+      });
+    }
   }
   checks.push({
     name: "Payments (MPP)",
     status: "INFO",
-    detail: "planned \u2014 not implemented in v0.1"
+    detail: "planned \u2014 not implemented in this release"
   });
   if (config === void 0) {
     checks.push({ name: "Storage", status: "WARN", detail: "skipped \u2014 config invalid" });
@@ -2034,9 +2233,8 @@ async function runDoctor(options, deps = {}) {
     // from the host) silently produces a fresh empty database and a false
     // "healthy, receipts=0" PASS — a read-only command must not have this
     // side effect, and it shadows the real store's real receipts entirely.
-    //. `:memory:` never exists on disk by
-    // definition, so it always falls through to the real open/health/count
-    // branch below, same as today.
+    // `:memory:` never exists on disk by definition, so it always falls
+    // through to the real open/health/count branch below, same as today.
     config.storage.receipts.path !== ":memory:" && !existsSync(config.storage.receipts.path)
   ) {
     checks.push({
@@ -2379,6 +2577,12 @@ function buildProgram(io = processIo) {
 }
 
 // src/cli/index.ts
+for (const stream of [process.stdout, process.stderr]) {
+  stream.on("error", (err) => {
+    if (err.code === "EPIPE") process.exit(0);
+    throw err;
+  });
+}
 async function main() {
   const program = buildProgram();
   try {