@gatebolt/cli 0.3.1 → 0.5.0

package/dist/commands/observe.js

@@ -1,10 +1,10 @@
 import { parseArgs } from "node:util";
 import { resolveConnection } from "../config.js";
-import { OBSERVED_FILES_MAX } from "../contracts.js";
+import { isUuid, OBSERVED_FILES_MAX } from "../contracts.js";
 import { observedFilesFromGit } from "../diff.js";
-import { commitExists, diffNameStatus, diffNumstat, isReconcilableBase, listUntracked, repoContext, } from "../git.js";
+import { commitExists, commitsSinceBase, diffNameStatus, diffNumstat, isAncestor, isReconcilableBase, listUntracked, mergeInProgress, repoContext, } from "../git.js";
 import { isRecord } from "../json.js";
-import { profileLoader } from "../profiles.js";
+import { profileLoader, readRepoLink } from "../profiles.js";
 import { clearPendingDeclare, clearSession, readSession } from "../session.js";
 import { postChange } from "../transport.js";
 function resolveTarget(values, session) {
@@ -23,6 +23,11 @@ function resolveTarget(values, session) {
     }
     return { changeId, base, observingSessionChange };
 }
+export function sessionProfileName(values, session) {
+    if (values["change-id"])
+        return undefined;
+    return session?.profile;
+}
 export async function runObserve(argv) {
     const { values } = parseArgs({
         args: argv,
@@ -39,9 +44,16 @@ export async function runObserve(argv) {
         throw new Error("Not inside a git repository.");
     }
     const dir = repo.gitDir;
-    const loadProfile = profileLoader({ name: values.profile, root: repo.root });
-    const connection = await resolveConnection({ key: values.key, url: values.url }, loadProfile);
+    // Called for its throw: a malformed .gatebolt must fail here, not silently
+    // resolve to the wrong profile.
+    await readRepoLink(repo.root);
     const session = await readSession(dir);
+    const loadProfile = profileLoader({
+        name: values.profile,
+        preferred: sessionProfileName(values, session),
+        root: repo.root,
+    });
+    const connection = await resolveConnection({ key: values.key, url: values.url }, loadProfile);
     const { changeId, base, observingSessionChange } = resolveTarget(values, session);
     if (!(await commitExists(base))) {
         throw new Error(`Base commit ${base} no longer exists. Re-run \`gatebolt declare\`.`);
@@ -50,7 +62,8 @@ export async function runObserve(argv) {
     if (!(await isReconcilableBase(base, declaredBranch))) {
         throw new Error("The working tree has moved off the declared base (branch switch or divergent rebase?). Re-run `gatebolt declare`.");
     }
-    const [nameStatus, numstat, untracked] = await Promise.all([
+    const [notes, nameStatus, numstat, untracked] = await Promise.all([
+        attributionNotes(base),
         diffNameStatus(base),
         diffNumstat(base),
         listUntracked(),
@@ -64,18 +77,12 @@ export async function runObserve(argv) {
     if (!isReconciliation(result)) {
         throw new Error("Unexpected response from server.");
     }
-    printVerdict(result);
+    printVerdict(result, notes);
     if (observingSessionChange) {
         await clearSession(dir);
         await clearPendingDeclare(dir);
     }
 }
-// Mirrors z.uuid() in @gatebolt/validators; keep in sync by hand (the CLI
-// takes no dependency on the validators package).
-const SERVER_UUID = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
-export function isUuid(value) {
-    return SERVER_UUID.test(value);
-}
 export function isReconciliation(value) {
     if (!isRecord(value))
         return false;
@@ -87,7 +94,26 @@ export function isReconciliation(value) {
         Array.isArray(value.missing) &&
         Array.isArray(value.reasons));
 }
-function printVerdict(result) {
+// Never blocked on: observe is advisory, and only the person at the keyboard
+// knows whose commits these are.
+export async function attributionNotes(base) {
+    const notes = [];
+    if (await mergeInProgress()) {
+        notes.push("A merge is in progress; the diff includes the merged branch.");
+    }
+    // isReconcilableBase also accepts an in-place amend/squash, where base shares
+    // HEAD's parent but isn't its ancestor — and there base..HEAD would count the
+    // agent's own rewritten commit (the very work being reconciled) as foreign.
+    if (await isAncestor(base)) {
+        const commits = await commitsSinceBase(base);
+        if (commits > 0) {
+            const plural = commits === 1 ? "commit" : "commits";
+            notes.push(`${commits} ${plural} landed since declare; GateBolt cannot tell whose.`);
+        }
+    }
+    return notes;
+}
+function printVerdict(result, notes) {
     const lines = [
         `Change  ${result.changeId}`,
         `Drift   ${result.driftLevel} (${result.driftScore})`,
@@ -96,5 +122,11 @@ function printVerdict(result) {
     for (const reason of result.reasons) {
         lines.push(`  ${reason}`);
     }
+    for (const note of notes) {
+        lines.push(`Note    ${note}`);
+    }
+    if (notes.length > 0) {
+        lines.push("        Files above may include work from elsewhere.");
+    }
     process.stdout.write(`${lines.join("\n")}\n`);
 }

package/dist/config.js

@@ -1,32 +1,68 @@
 export const DEFAULT_BASE_URL = "https://api.gatebolt.com";
 export async function resolveConnection(flags, loadProfile) {
-    const key = flags.key ?? process.env.GBOLT_KEY;
-    const url = flags.url ?? process.env.GBOLT_URL;
+    const key = flags.key ?? process.env.GATEBOLT_KEY;
+    const url = flags.url ?? process.env.GATEBOLT_URL;
     const profile = key && url ? null : await loadProfile();
     const resolvedKey = key ?? profile?.key;
     const baseUrl = (url ?? profile?.url ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
     if (!resolvedKey) {
-        throw new Error("Missing API key. Set GBOLT_KEY, pass --key, or run `gatebolt configure`.");
+        throw new Error("Missing API key. Set GATEBOLT_KEY, pass --key, or run `gatebolt configure`.");
     }
-    return { key: resolvedKey, baseUrl };
+    const connection = { key: resolvedKey, baseUrl };
+    const profileName = connectionProfileName(key, profile);
+    if (profileName)
+        connection.profileName = profileName;
+    return connection;
 }
-export async function resolveRepoSlug(flags, loadProfile) {
-    const raw = flags.repo ?? process.env.GBOLT_REPO ?? (await loadProfile())?.repo;
-    if (!raw) {
-        throw new Error("Missing repository slug. Set GBOLT_REPO, pass --repo, or run `gatebolt configure`.");
-    }
-    return slugifyRepo(raw);
+function connectionProfileName(key, profile) {
+    if (key || !profile)
+        return undefined;
+    return profile.name;
 }
 const SLUG_MAX_LENGTH = 48;
-export function slugifyRepo(value) {
+function toSlug(value) {
     const slug = value
         .toLowerCase()
         .trim()
         .replace(/[^a-z0-9]+/g, "-")
-        .slice(0, SLUG_MAX_LENGTH)
         .replace(/^-+|-+$/g, "");
     if (!slug) {
         throw new Error(`Could not derive a repository slug from "${value}".`);
     }
+    if (slug.length > SLUG_MAX_LENGTH) {
+        throw new Error(`"${value}" makes a ${slug.length}-character slug, over the ${SLUG_MAX_LENGTH} limit. ` +
+            "Run `gatebolt link --name <shorter-name>` to name this repository yourself.");
+    }
     return slug;
 }
+export function repoIdentityFromName(name) {
+    return { slug: toSlug(name), name };
+}
+const REMOTE_SCHEMES = new Set(["ssh:", "https:", "http:", "git:"]);
+const HAS_SCHEME = /^[a-z][a-z0-9+.-]*:\/\//i;
+const SCP_LIKE = /^(?:[^@]+@)?[^:/]{2,}:(.+)$/;
+function remotePath(url) {
+    const trimmed = url.trim();
+    if (!HAS_SCHEME.test(trimmed)) {
+        return SCP_LIKE.exec(trimmed)?.[1] ?? null;
+    }
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    return REMOTE_SCHEMES.has(parsed.protocol) ? parsed.pathname : null;
+}
+export function parseRemoteUrl(url) {
+    const path = remotePath(url);
+    if (!path)
+        return null;
+    const segments = path.split("/").filter(Boolean);
+    const repo = segments.pop()?.replace(/\.git$/i, "");
+    if (!repo || segments.length === 0)
+        return null;
+    const name = `${segments.join("/")}/${repo}`;
+    return { slug: toSlug(name), name };
+}

package/dist/contracts.js

@@ -12,3 +12,9 @@ export const AGENT_VENDORS = [
 export function isAgentVendor(value) {
     return AGENT_VENDORS.includes(value);
 }
+// Mirrors z.uuid() in @gatebolt/validators; keep in sync by hand (the CLI
+// takes no dependency on the validators package).
+const SERVER_UUID = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
+export function isUuid(value) {
+    return SERVER_UUID.test(value);
+}

package/dist/diff.js

@@ -1,3 +1,5 @@
+import { REPO_LINK_FILE } from "./profiles.js";
+const PARSER_BUG_HINT = "This is likely a GateBolt bug — please report it.";
 export function observedFilesFromGit(nameStatusOutput, numstatOutput, untrackedOutput) {
     const counts = parseNumstat(numstatOutput);
     const observed = parseNameStatus(nameStatusOutput).map((entry) => {
@@ -17,7 +19,7 @@ export function observedFilesFromGit(nameStatusOutput, numstatOutput, untrackedO
             continue;
         observed.push({ path, action: "added" });
     }
-    return observed;
+    return observed.filter((file) => file.path !== REPO_LINK_FILE);
 }
 function parseNameStatus(output) {
     const reader = createReader(splitFields(output));
@@ -44,7 +46,7 @@ function parseNumstat(output) {
         const firstTab = head.indexOf("\t");
         const secondTab = head.indexOf("\t", firstTab + 1);
         if (firstTab < 0 || secondTab < 0) {
-            throw new Error(`malformed numstat record: ${head}`);
+            throw new Error(`Could not read the line counts in this repository's diff — git returned an unexpected record: "${head}". ${PARSER_BUG_HINT}`);
         }
         const additions = head.slice(0, firstTab);
         const deletions = head.slice(firstTab + 1, secondTab);
@@ -72,7 +74,7 @@ function statusToAction(status) {
         case "D":
             return "deleted";
         default:
-            throw new Error(`unsupported git status: ${status}`);
+            throw new Error(`Could not read this repository's diff — git reported the file status "${status}", which GateBolt does not recognise. ${PARSER_BUG_HINT}`);
     }
 }
 function splitFields(output) {
@@ -89,7 +91,7 @@ function createReader(fields) {
         take: () => {
             const value = fields[index];
             if (value === undefined) {
-                throw new Error("unexpected end of git output");
+                throw new Error(`Could not read this repository's diff — git's output ended sooner than expected. ${PARSER_BUG_HINT}`);
             }
             index += 1;
             return value;

package/dist/errors.js

@@ -0,0 +1,35 @@
+import { RequestError } from "./transport.js";
+const STATUS_BAD_REQUEST = 400;
+const STATUS_UNAUTHORIZED = 401;
+const STATUS_NOT_FOUND = 404;
+const STATUS_CONFLICT = 409;
+const WRONG_WIRE_MESSAGE = "Not found — no GateBolt agent wire answered. Check the URL points at your GateBolt instance.";
+const NOT_FOUND_MESSAGE = {
+    "change.declare": "Not found — the repository id in .gatebolt is not one this API key can record against. The repository may have been deleted, or the file may have come from another workspace. Run `gatebolt link` from the repo root to re-establish it, then commit the .gatebolt it writes.",
+    "change.observe": "Not found — no change matches this API key. `observe` must use the same key that ran `declare`; if the key was rotated in between, re-run `gatebolt declare`.",
+    "repository.link": WRONG_WIRE_MESSAGE,
+    "agentKey.create": WRONG_WIRE_MESSAGE,
+};
+export function formatError(error) {
+    if (error instanceof RequestError) {
+        return messageForStatus(error);
+    }
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return "Unexpected error.";
+}
+export function messageForStatus(error) {
+    switch (error.status) {
+        case STATUS_BAD_REQUEST:
+            return `Invalid request — ${error.fieldErrors.join(" ") || "check the declared values and try again."}`;
+        case STATUS_UNAUTHORIZED:
+            return "Unauthorized — check the API key. Run `gatebolt configure` to set a valid key for this repo.";
+        case STATUS_NOT_FOUND:
+            return NOT_FOUND_MESSAGE[error.procedure];
+        case STATUS_CONFLICT:
+            return "Conflict — this change was already observed with different files.";
+        default:
+            return error.message;
+    }
+}

package/dist/git.js

@@ -1,4 +1,5 @@
 import { execFile } from "node:child_process";
+import { resolve } from "node:path";
 import { promisify } from "node:util";
 const run = promisify(execFile);
 const MAX_GIT_OUTPUT_BYTES = 67_108_864;
@@ -28,6 +29,22 @@ export async function repoContext() {
         return null;
     return { gitDir: dir, root };
 }
+// --git-path resolves the shared hooks dir — correct even inside a linked worktree.
+export async function hooksPath() {
+    const output = await git(["rev-parse", "--git-path", "hooks"]);
+    return resolve(output.trim());
+}
+export async function remoteOriginUrl() {
+    try {
+        const output = await git(["remote", "get-url", "origin"]);
+        return output.trim() || null;
+    }
+    catch (error) {
+        if (gitExitedNonZero(error))
+            return null;
+        throw gitFailure(error);
+    }
+}
 export async function currentHead() {
     const output = await git(["rev-parse", "HEAD"]);
     return output.trim();
@@ -85,7 +102,8 @@ export async function isReconcilableBase(base, declaredBranch) {
         return true;
     // An in-place amend/squash shares HEAD's parent — but so does a sibling branch
     // cut from that parent, and only the amend is safe to diff. Require the branch
-    // to distinguish them.
+    // to distinguish them. A same-branch reset onto a sibling still passes: it is
+    // shaped exactly like an amend, and git records nothing that separates them.
     if (!declaredBranch || (await currentBranch()) !== declaredBranch) {
         return false;
     }
@@ -95,6 +113,13 @@ export async function isReconcilableBase(base, declaredBranch) {
     ]);
     return baseParent !== null && baseParent === headParent;
 }
+export async function commitsSinceBase(base) {
+    const output = await git(["rev-list", "--count", `${base}..HEAD`]);
+    return Number(output.trim());
+}
+export function mergeInProgress() {
+    return commitExists("MERGE_HEAD");
+}
 export function diffNameStatus(base) {
     return git(["diff", "--name-status", "-M", "-z", base]);
 }

package/dist/help.js

@@ -0,0 +1,161 @@
+import { readFile } from "node:fs/promises";
+import { DEFAULT_BASE_URL } from "./config.js";
+import { AGENT_VENDORS } from "./contracts.js";
+import { isRecord } from "./json.js";
+export const USAGE = "Usage: gatebolt <login|init|declare|observe|configure|link> [options]";
+const ROOT_HELP = `gatebolt — the GateBolt agent client. An agent declares the files it intends to
+touch before it edits, then observes the actual diff when the work lands;
+GateBolt reconciles the two and scores the drift.
+
+${USAGE}
+
+Commands:
+  login       Sign in through your browser and save an agent key for this machine.
+  init        Set up GateBolt in a repository: link it and wire the agent hooks.
+  declare     Record the files the agent intends to touch, before it edits.
+  observe     Derive the diff from git and reconcile it against the declaration.
+  configure   Save a profile (url, key) to ~/.gatebolt/config.json.
+  link        Record which repository this checkout is, in a committable file.
+  hook        Internal — the declare/observe hook commands gatebolt init wires up.
+
+Options:
+  -h, --help    Show this help, or the help of a command.
+  --version     Print the version of this CLI.
+
+Run \`gatebolt <command> --help\` for the options of a command.
+`;
+const LOGIN_HELP = `Usage: gatebolt login [options]
+
+Signs in through your browser and saves an agent API key for this machine.
+Opens a GateBolt page to approve the device, then mints an org-scoped key and
+writes a profile to ~/.gatebolt/config.json. Run once per machine; the profile
+is named after the organization you pick.
+
+Options:
+  --key-name <name>   Label for the key in the dashboard. Defaults to
+                      "gatebolt-cli (<hostname>)".
+  --url <url>         GateBolt URL. Defaults to ${DEFAULT_BASE_URL}.
+  -h, --help          Show this help.
+`;
+const DECLARE_HELP = `Usage: gatebolt declare --task <text> --vendor <vendor> --name <name>
+                        --model <id> --file <path> [--file <path> ...] [options]
+       gatebolt declare --abort
+
+Records the files the agent intends to touch, before it edits. Reads the
+repository id from .gatebolt, or establishes it from the \`origin\` remote when
+the file is absent. Snapshots the current commit as the base and writes the
+change id under <git-dir>/gatebolt/ for \`gatebolt observe\` to pick up. The
+repository must have at least one commit.
+
+Required:
+  --task <text>           What the agent is doing.
+  --vendor <vendor>       One of: ${AGENT_VENDORS.join(", ")}.
+  --name <name>           Agent name, e.g. "Claude Code".
+  --model <id>            Agent model id.
+  --file <path>           A file the agent plans to touch. Repeat for each file.
+
+Options:
+  --agent-version <ver>   Version of the agent — not of this CLI.
+  --launched-by <email>   Email of the person who launched the agent.
+  --profile <name>        Profile to read url and key from.
+  --key <key>             API key. Overrides the profile.
+  --url <url>             GateBolt URL. Overrides the profile.
+  --abort                 Clear the open declaration for this repo (local only;
+                          use it to unstick a declaration that can no longer be
+                          reconciled), then declare again. Ignores other flags.
+  -h, --help              Show this help.
+`;
+const OBSERVE_HELP = `Usage: gatebolt observe [options]
+
+Derives the diff from git since the declared base commit and posts it to
+GateBolt, which reconciles it against the declaration and scores the drift.
+Observes the change recorded by \`gatebolt declare\` unless --change-id is given.
+
+Options:
+  --change-id <uuid>   Change to observe. Defaults to the declared change.
+  --base <commit>      Commit to diff against. Defaults to the declared base.
+  --profile <name>     Profile to read url and key from.
+  --key <key>          API key. Overrides the profile.
+  --url <url>          GateBolt URL. Overrides the profile.
+  -h, --help           Show this help.
+`;
+const CONFIGURE_HELP = `Usage: gatebolt configure [options]
+
+Saves a profile to ~/.gatebolt/config.json, owner-readable only. Prompts for the
+API key unless --key is given; what you type is not echoed. Run \`gatebolt link\`
+in a repo to record which repository it is.
+
+Options:
+  --profile <name>   Profile name. Defaults to "default".
+  --url <url>        GateBolt URL. Defaults to ${DEFAULT_BASE_URL}.
+  --key <key>        API key. Skips the prompt, for scripting.
+  -h, --help         Show this help.
+
+Set GATEBOLT_CONFIG to keep the config somewhere other than the default path.
+`;
+const LINK_HELP = `Usage: gatebolt link [options]
+
+Records which repository this checkout is, so every clone, worktree and CI job
+resolves the same one. Derives the name from the \`origin\` remote unless --name
+is given, then writes the repository id to a .gatebolt file at the repo root —
+commit that file.
+
+Options:
+  --name <name>      Name this repository yourself. Required when there is no
+                     \`origin\` remote to derive from.
+  --profile <name>   Profile to read url and key from. Recorded in .gatebolt.
+  --key <key>        API key. Overrides the profile.
+  --url <url>        GateBolt URL. Overrides the profile.
+  -h, --help         Show this help.
+`;
+const INIT_HELP = `Usage: gatebolt init [options]
+
+Sets up GateBolt in this repository: links it (writing a committable .gatebolt),
+wires your agent's declare → observe hooks into the repo, and installs a pre-push
+backstop. Reuses a saved profile, so run \`gatebolt login\` or \`gatebolt configure\`
+first. Safe to re-run.
+
+Options:
+  --name <name>      Name this repository yourself. Required when there is no
+                     \`origin\` remote to derive it from.
+  --enforce <mode>   \`strict\` blocks edits until you declare; \`lenient\` keeps
+                     it advisory. Omit to leave a repo's current mode unchanged
+                     (a fresh repo stays advisory).
+  --no-hooks         Only link the repository; don't wire the agent hooks.
+  --no-pre-push      Don't install the pre-push backstop.
+  --force            Replace an existing, non-GateBolt pre-push hook.
+  --profile <name>   Profile to read url and key from.
+  -h, --help         Show this help.
+`;
+const HOOK_HELP = `Usage: gatebolt hook <guard|post-turn|pre-push>
+
+Internal subcommands the hooks installed by \`gatebolt init\` invoke — you don't run
+these by hand. \`guard\` denies an edit until a declaration exists (strict mode only),
+\`post-turn\` reconciles the diff when a turn ends, and \`pre-push\` reconciles an open
+declaration before a push.
+
+Options:
+  -h, --help   Show this help.
+`;
+const COMMAND_HELP = new Map([
+    ["login", LOGIN_HELP],
+    ["init", INIT_HELP],
+    ["declare", DECLARE_HELP],
+    ["observe", OBSERVE_HELP],
+    ["configure", CONFIGURE_HELP],
+    ["link", LINK_HELP],
+    ["hook", HOOK_HELP],
+]);
+export function isCommand(command) {
+    return COMMAND_HELP.has(command);
+}
+export function helpFor(command) {
+    return COMMAND_HELP.get(command) ?? ROOT_HELP;
+}
+export async function cliVersion() {
+    const raw = await readFile(new URL("../package.json", import.meta.url), "utf8");
+    const pkg = JSON.parse(raw);
+    return isRecord(pkg) && typeof pkg.version === "string"
+        ? pkg.version
+        : "unknown";
+}

package/dist/index.js

@@ -1,62 +1,61 @@
 #!/usr/bin/env node
 import { runConfigure } from "./commands/configure.js";
 import { runDeclare } from "./commands/declare.js";
+import { runHook } from "./commands/hook.js";
+import { runInit } from "./commands/init.js";
+import { runLink } from "./commands/link.js";
+import { runLogin } from "./commands/login.js";
 import { runObserve } from "./commands/observe.js";
-import { RequestError } from "./transport.js";
-const STATUS_BAD_REQUEST = 400;
-const STATUS_UNAUTHORIZED = 401;
-const STATUS_FORBIDDEN = 403;
-const STATUS_NOT_FOUND = 404;
-const STATUS_CONFLICT = 409;
-const STATUS_RATE_LIMITED = 429;
+import { formatError } from "./errors.js";
+import { cliVersion, helpFor, isCommand, USAGE } from "./help.js";
 async function main() {
     const [, , command = "", ...argv] = process.argv;
     try {
-        switch (command) {
-            case "declare":
-                await runDeclare(argv);
-                break;
-            case "observe":
-                await runObserve(argv);
-                break;
-            case "configure":
-                await runConfigure(argv);
-                break;
-            default:
-                process.stderr.write("Usage: gatebolt <declare|observe|configure> [options]\n");
-                process.exitCode = 1;
-        }
+        await dispatch(command, argv);
     }
     catch (error) {
         process.stderr.write(`${formatError(error)}\n`);
         process.exitCode = 1;
     }
 }
-function formatError(error) {
-    if (error instanceof RequestError) {
-        return messageForStatus(error);
+async function dispatch(command, argv) {
+    // The commands' parseArgs is strict, so it would reject these as unknown
+    // options: they have to be answered before argv reaches one.
+    if (wantsHelp(command, argv)) {
+        process.stdout.write(helpFor(command));
+        return;
     }
-    if (error instanceof Error) {
-        return error.message;
+    if (command === "--version") {
+        process.stdout.write(`${await cliVersion()}\n`);
+        return;
     }
-    return "Unexpected error.";
-}
-function messageForStatus(error) {
-    switch (error.status) {
-        case STATUS_BAD_REQUEST:
-            return "Invalid request — check the declared values and try again.";
-        case STATUS_UNAUTHORIZED:
-            return "Unauthorized — the API key is invalid or has hit its rate limit.";
-        case STATUS_FORBIDDEN:
-            return "Forbidden — the repository slug does not match this API key.";
-        case STATUS_NOT_FOUND:
-            return "Not found — no matching change for this key and repository.";
-        case STATUS_CONFLICT:
-            return "Conflict — this change was already observed with different files.";
-        case STATUS_RATE_LIMITED:
-            return "Rate limited — try again later.";
+    switch (command) {
+        case "login":
+            return runLogin(argv);
+        case "declare":
+            return runDeclare(argv);
+        case "observe":
+            return runObserve(argv);
+        case "configure":
+            return runConfigure(argv);
+        case "link":
+            return runLink(argv);
+        case "init":
+            return runInit(argv);
+        case "hook":
+            return runHook(argv);
         default:
-            return error.message;
+            process.stderr.write(`${USAGE}\nRun \`gatebolt --help\` for details.\n`);
+            process.exitCode = 1;
+            return;
     }
 }
+function wantsHelp(command, argv) {
+    if (isHelpFlag(command))
+        return true;
+    return isCommand(command) && argv.some(isHelpFlag);
+}
+function isHelpFlag(arg) {
+    return arg === "--help" || arg === "-h";
+}
 void main();