@kodycodes/cli 3.2.0 → 3.3.1

package/dist/commands-RPUZAOAB.js

@@ -0,0 +1,806 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  classifyFrameText,
+  decodeEnvelopePayload,
+  ecpContextKeyId,
+  ecpPingFrame,
+  ecpProtocolVersion,
+  ecpRunHeader,
+  ecpSignatureHeader,
+  ed25519JwkThumbprint,
+  formatEcpSignatureHeader,
+  importEd25519PrivateKey,
+  importEd25519PublicKey,
+  publishedKeyJwk,
+  signEcpHttpRequest,
+  signFrame,
+  verifyFrame,
+  verifyServerKeySet
+} from "./chunk-AED3YBAI.js";
+import {
+  apiTokenFileStorePath
+} from "./chunk-S3KLKZ4C.js";
+import {
+  secretServiceKeyringOptions
+} from "./chunk-CMIH7XDH.js";
+import {
+  keyringService
+} from "./chunk-V7P2QDVU.js";
+import "./chunk-UW6AWLXX.js";
+
+// src/execution-context/commands.ts
+import { readdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { cpus, platform, totalmem } from "node:os";
+
+// src/execution-context/client.ts
+var executionContextsPath = "/v1/execution-contexts";
+var reloginMessage = "Your Kody login predates execution context permissions, so it cannot register a machine. Run `kody login` again, then retry `kody context register`.";
+var ExecutionContextApiError = class extends Error {
+  constructor(message, status, code) {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+};
+async function readError(response) {
+  const text = await response.text();
+  let code = null;
+  let message = text || `HTTP ${response.status}`;
+  try {
+    const body = JSON.parse(text);
+    if (typeof body.error === "string") {
+      code = body.error;
+      message = body.message ?? body.error;
+    } else if (body.error) {
+      code = body.error.code ?? null;
+      message = body.error.message ?? message;
+    }
+  } catch {
+  }
+  return new ExecutionContextApiError(message, response.status, code);
+}
+async function signedFetch(input) {
+  const body = input.body ?? "";
+  const signature = await signEcpHttpRequest({
+    ec: input.ecid,
+    method: input.method,
+    pathAndQuery: input.pathAndQuery,
+    body,
+    privateKey: input.privateKey
+  });
+  return (input.fetchFn ?? fetch)(new URL(input.pathAndQuery, input.apiUrl), {
+    method: input.method,
+    headers: {
+      ...input.headers,
+      [ecpSignatureHeader]: formatEcpSignatureHeader(signature),
+      ...input.runId ? { [ecpRunHeader]: input.runId } : {}
+    },
+    ...input.method === "GET" || input.method === "HEAD" ? {} : { body: typeof body === "string" ? body : Buffer.from(body) }
+  });
+}
+async function generateContextKey() {
+  const pair = await crypto.subtle.generateKey({ name: "Ed25519" }, true, [
+    "sign",
+    "verify"
+  ]);
+  const privateJwk = await crypto.subtle.exportKey(
+    "jwk",
+    pair.privateKey
+  );
+  const publicKeyJwk = {
+    kty: "OKP",
+    crv: "Ed25519",
+    x: String(privateJwk.x)
+  };
+  const privateKeyJwk = {
+    ...publicKeyJwk,
+    d: String(privateJwk.d)
+  };
+  return { publicKeyJwk, privateKeyJwk };
+}
+function importContextKey(privateJwk) {
+  return importEd25519PrivateKey(privateJwk);
+}
+async function registerContext(input) {
+  const fetchFn = input.fetchFn ?? fetch;
+  const query = input.org ? `?org=${encodeURIComponent(input.org)}` : "";
+  const auth = { authorization: `Bearer ${input.token}` };
+  const challengeResponse = await fetchFn(
+    new URL(
+      `${executionContextsPath}/registration-challenge${query}`,
+      input.apiUrl
+    ),
+    { method: "POST", headers: auth }
+  );
+  if (!challengeResponse.ok) throw await registrationError(challengeResponse);
+  const { challenge } = await challengeResponse.json();
+  const body = JSON.stringify({
+    name: input.name,
+    publicKeyJwk: input.publicKeyJwk,
+    challenge,
+    capabilities: input.capabilities,
+    client: input.client
+  });
+  const response = await signedFetch({
+    apiUrl: input.apiUrl,
+    ecid: input.thumbprint,
+    privateKey: input.privateKey,
+    method: "POST",
+    pathAndQuery: `${executionContextsPath}${query}`,
+    body,
+    headers: { ...auth, "content-type": "application/json" },
+    fetchFn
+  });
+  if (!response.ok) throw await registrationError(response);
+  return await response.json();
+}
+async function registrationError(response) {
+  const error = await readError(response);
+  if (error.code === "credential_scope" || error.message.includes("predates execution context permissions")) {
+    return new ExecutionContextApiError(
+      reloginMessage,
+      error.status,
+      error.code
+    );
+  }
+  return error;
+}
+async function requestConnectTicket(input) {
+  const response = await signedFetch({
+    ...input,
+    method: "POST",
+    pathAndQuery: `${executionContextsPath}/connect-ticket`,
+    body: "{}",
+    headers: { "content-type": "application/json" }
+  });
+  if (!response.ok) throw await readError(response);
+  return await response.json();
+}
+async function fetchServerKeys(input) {
+  const response = await (input.fetchFn ?? fetch)(
+    new URL(`${executionContextsPath}/server-keys`, input.apiUrl)
+  );
+  if (!response.ok) throw await readError(response);
+  const set = await verifyServerKeySet({ document: await response.json() });
+  if (!set) {
+    throw new Error(
+      "Kody server keys failed root signature verification. Refusing to connect."
+    );
+  }
+  const now = input.now ?? Date.now();
+  return set.keys.filter((key) => key.notAfter > now);
+}
+async function apiJson(input) {
+  const url = new URL(input.path, input.apiUrl);
+  if (input.org) url.searchParams.set("org", input.org);
+  const response = await (input.fetchFn ?? fetch)(url, {
+    method: input.method,
+    headers: {
+      authorization: `Bearer ${input.token}`,
+      ...input.body === void 0 ? {} : { "content-type": "application/json" }
+    },
+    ...input.body === void 0 ? {} : { body: JSON.stringify(input.body) }
+  });
+  if (!response.ok) throw await readError(response);
+  return await response.json();
+}
+
+// src/execution-context/daemon.ts
+function runScopedFetch(input) {
+  const apiOrigin = new URL(input.apiUrl).origin;
+  const base = input.fetchFn ?? fetch;
+  return async (resource, init) => {
+    const request = new Request(resource, init);
+    const url = new URL(request.url);
+    if (url.origin !== apiOrigin) return base(request);
+    const body = new Uint8Array(await request.arrayBuffer());
+    const headers = {};
+    request.headers.forEach((value, name) => {
+      if (name !== "authorization") headers[name] = value;
+    });
+    return signedFetch({
+      apiUrl: input.apiUrl,
+      ecid: input.ecid,
+      privateKey: input.privateKey,
+      method: request.method,
+      pathAndQuery: `${url.pathname}${url.search}`,
+      body,
+      runId: input.runId,
+      headers,
+      fetchFn: base
+    });
+  };
+}
+async function runDaemonConnection(input) {
+  const Socket = input.WebSocketImpl ?? globalThis.WebSocket;
+  if (!Socket) {
+    throw new Error(
+      "This Node.js has no global WebSocket. Use Node 22 or newer."
+    );
+  }
+  const { ticket } = await requestConnectTicket(input);
+  const url = new URL(`${executionContextsPath}/connect`, input.apiUrl);
+  url.protocol = url.protocol === "http:" ? "ws:" : "wss:";
+  url.searchParams.set("ticket", ticket);
+  const ws = new Socket(url.toString());
+  const serverKeys = new Map(input.serverKeys.map((key) => [key.kid, key]));
+  let sid = "";
+  let inSeq = 0;
+  let outSeq = 0;
+  const runs = /* @__PURE__ */ new Map();
+  const send = async (t, body, re) => {
+    outSeq += 1;
+    const payload = {
+      v: 1,
+      t,
+      ec: input.ecid,
+      sid,
+      seq: outSeq,
+      ts: Date.now(),
+      ...re === void 0 ? {} : { re },
+      body
+    };
+    ws.send(
+      await signFrame({
+        privateKey: input.privateKey,
+        kid: ecpContextKeyId,
+        payload
+      })
+    );
+  };
+  const status = () => ({
+    running: runs.size,
+    maxConcurrent: input.maxConcurrent,
+    acceptingRuns: runs.size < input.maxConcurrent
+  });
+  const startRun = async (run) => {
+    const startedAt = Date.now();
+    const timer = setTimeout(
+      () => run.abort.abort(),
+      Math.max(0, run.request.deadline - Date.now())
+    );
+    let result;
+    try {
+      result = await input.execute({
+        request: run.request,
+        signal: run.abort.signal,
+        fetchFn: runScopedFetch({
+          apiUrl: input.apiUrl,
+          ecid: input.ecid,
+          runId: run.request.runId,
+          privateKey: input.privateKey,
+          ...input.fetchFn ? { fetchFn: input.fetchFn } : {}
+        })
+      });
+    } catch (error) {
+      result = {
+        isError: true,
+        content: [
+          {
+            type: "text",
+            text: error instanceof Error ? error.message : String(error)
+          }
+        ]
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+    const endedAt = Date.now();
+    const resultBytes = new TextEncoder().encode(
+      JSON.stringify(result)
+    ).byteLength;
+    runs.delete(run.request.runId);
+    await send("run.result", {
+      runId: run.request.runId,
+      ...result,
+      startedAt,
+      endedAt,
+      resultBytes
+    });
+    await send("status", status());
+  };
+  const handle = async (frame) => {
+    const body = frame.body;
+    const runId = typeof body.runId === "string" ? body.runId : "";
+    switch (frame.t) {
+      case "welcome":
+        await send("hello", {
+          protocol: { min: ecpProtocolVersion, max: ecpProtocolVersion },
+          client: input.client,
+          capabilities: input.capabilities,
+          grantVersion: body.grantVersion,
+          status: status(),
+          pendingResults: []
+        });
+        input.log("Connected. Waiting for runs.");
+        return;
+      case "run.request": {
+        const request = body;
+        if (runs.size >= input.maxConcurrent) {
+          await send("run.reject", { runId, code: "busy" }, frame.seq);
+          return;
+        }
+        if (Date.now() > request.acceptBy || request.apiUrl !== input.apiUrl) {
+          await send(
+            "run.reject",
+            {
+              runId,
+              code: request.apiUrl !== input.apiUrl ? "grant_mismatch" : "deadline_passed"
+            },
+            frame.seq
+          );
+          return;
+        }
+        runs.set(runId, {
+          request,
+          abort: new AbortController(),
+          committed: false
+        });
+        await send("run.accept", { runId }, frame.seq);
+        return;
+      }
+      case "run.commit": {
+        const run = runs.get(runId);
+        if (!run || run.committed) return;
+        run.committed = true;
+        input.log(
+          `Running ${runId} for ${run.request.requestedBy.handle ?? run.request.requestedBy.userId}.`
+        );
+        void startRun(run);
+        return;
+      }
+      case "run.abort":
+      case "run.cancel": {
+        const run = runs.get(runId);
+        run?.abort.abort();
+        if (!run?.committed) runs.delete(runId);
+        if (frame.t === "run.cancel")
+          await send("run.cancel.ack", { runId }, frame.seq);
+        return;
+      }
+      case "grant.update":
+        await send("grant.ack", { grantVersion: body.grantVersion }, frame.seq);
+        return;
+      case "revoke":
+        input.log(
+          `This context was revoked (${String(body.reason ?? "revoked")}).`
+        );
+        ws.close(1e3, "revoked");
+        return;
+      case "error":
+        input.log(`Kody: ${String(body.code)} ${String(body.message ?? "")}`);
+        return;
+      default:
+        return;
+    }
+  };
+  return await new Promise((resolve) => {
+    const ping = setInterval(() => {
+      if (ws.readyState === ws.OPEN) ws.send(ecpPingFrame);
+    }, 3e4);
+    input.signal?.addEventListener("abort", () => ws.close(1e3, "shutdown"));
+    ws.addEventListener("message", (event) => {
+      const text = typeof event.data === "string" ? event.data : "";
+      void (async () => {
+        const classified = classifyFrameText(text);
+        if (classified.kind !== "frame") return;
+        const key = serverKeys.get(classified.envelope.k);
+        if (!key) {
+          ws.close(1008, "unknown server key");
+          return;
+        }
+        if (!sid) {
+          sid = peekSid(classified.envelope.p);
+        }
+        const verified = await verifyFrame({
+          envelope: classified.envelope,
+          publicKey: await importEd25519PublicKey(publishedKeyJwk(key)),
+          expect: { ec: input.ecid, sid, lastSeq: inSeq },
+          now: Date.now()
+        });
+        if (!verified.ok) {
+          ws.close(1008, verified.code);
+          return;
+        }
+        inSeq = verified.frame.seq;
+        await handle(verified.frame);
+      })().catch((error) => input.log(`Frame error: ${String(error)}`));
+    });
+    ws.addEventListener("close", (event) => {
+      clearInterval(ping);
+      for (const run of runs.values()) run.abort.abort();
+      resolve({ code: event.code, reason: event.reason });
+    });
+  });
+}
+function peekSid(p) {
+  try {
+    const decoded = decodeEnvelopePayload(p);
+    return decoded?.t === "welcome" && typeof decoded.body?.sid === "string" ? decoded.body.sid : "";
+  } catch {
+    return "";
+  }
+}
+async function runDaemon(input) {
+  let attempt = 0;
+  while (!input.signal?.aborted) {
+    const startedAt = Date.now();
+    try {
+      const closed = await runDaemonConnection(input);
+      if (closed.reason === "revoked") return;
+      input.log(`Disconnected (${closed.code}). Reconnecting.`);
+    } catch (error) {
+      input.log(
+        `Connect failed: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    if (Date.now() - startedAt > 6e4) attempt = 0;
+    attempt += 1;
+    const delay = Math.min(6e4, 1e3 * 2 ** Math.min(attempt, 6));
+    await new Promise(
+      (resolve) => setTimeout(resolve, delay * (0.5 + Math.random() / 2))
+    );
+  }
+}
+
+// src/execution-context/keystore.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+  scryptSync
+} from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { Entry } from "@napi-rs/keyring";
+var contextKeyPassphraseEnvVar = "KODY_CONTEXT_KEY_PASSPHRASE";
+function contextsDir(apiUrl) {
+  return join(dirname(apiTokenFileStorePath(apiUrl)), "contexts");
+}
+function contextDir(apiUrl, ecid) {
+  if (!/^ec_[A-Za-z0-9_-]+$/.test(ecid)) {
+    throw new Error(`Not an execution context id: ${ecid}`);
+  }
+  return join(contextsDir(apiUrl), ecid);
+}
+function resolveWrappingKey(input) {
+  const env = input.env ?? process.env;
+  const passphrase = env[contextKeyPassphraseEnvVar];
+  if (passphrase) {
+    return {
+      kind: "passphrase",
+      key: (salt) => scryptSync(passphrase, salt ?? Buffer.alloc(16), 32, {
+        N: 1 << 15,
+        r: 8,
+        p: 1,
+        maxmem: 64 * 1024 * 1024
+      })
+    };
+  }
+  const account = `execution-context:${input.ecid}`;
+  let entry;
+  try {
+    entry = input.keyringFactory ? input.keyringFactory(account) : new Entry(keyringService, account, secretServiceKeyringOptions);
+  } catch {
+    throw noWrappingKeyError();
+  }
+  return {
+    kind: "keyring",
+    key: () => {
+      let stored = null;
+      try {
+        stored = entry.getPassword();
+      } catch {
+        stored = null;
+      }
+      if (stored) return Buffer.from(stored, "base64url");
+      if (!input.create) {
+        throw new Error(
+          "The key for this execution context is missing from the OS keyring. Re-register the machine with `kody context register`."
+        );
+      }
+      const fresh = randomBytes(32);
+      try {
+        entry.setPassword(fresh.toString("base64url"));
+      } catch {
+        throw noWrappingKeyError();
+      }
+      return fresh;
+    }
+  };
+}
+function noWrappingKeyError() {
+  return new Error(
+    `No OS keyring is available to protect this machine's execution context key. Set ${contextKeyPassphraseEnvVar} to a strong passphrase and retry.`
+  );
+}
+function encryptPrivateKey(privateJwk, wrapping) {
+  const salt = wrapping.kind === "passphrase" ? randomBytes(16) : null;
+  const key = wrapping.key(salt);
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const data = Buffer.concat([
+    cipher.update(JSON.stringify(privateJwk), "utf8"),
+    cipher.final()
+  ]);
+  return {
+    version: 1,
+    wrap: wrapping.kind,
+    ...salt ? { salt: salt.toString("base64url") } : {},
+    iv: iv.toString("base64url"),
+    tag: cipher.getAuthTag().toString("base64url"),
+    data: data.toString("base64url")
+  };
+}
+function decryptPrivateKey(file, wrapping) {
+  if (file.wrap !== wrapping.kind) {
+    throw new Error(
+      file.wrap === "passphrase" ? `This context key is protected by a passphrase. Set ${contextKeyPassphraseEnvVar}.` : `This context key is protected by the OS keyring. Unset ${contextKeyPassphraseEnvVar}.`
+    );
+  }
+  const key = wrapping.key(
+    file.salt ? Buffer.from(file.salt, "base64url") : null
+  );
+  const decipher = createDecipheriv(
+    "aes-256-gcm",
+    key,
+    Buffer.from(file.iv, "base64url")
+  );
+  decipher.setAuthTag(Buffer.from(file.tag, "base64url"));
+  try {
+    const plain = Buffer.concat([
+      decipher.update(Buffer.from(file.data, "base64url")),
+      decipher.final()
+    ]);
+    return JSON.parse(plain.toString("utf8"));
+  } catch {
+    throw new Error(
+      "Could not decrypt the execution context key. The passphrase or keyring entry does not match."
+    );
+  }
+}
+function saveContext(input) {
+  const dir = contextDir(input.context.apiUrl, input.context.ecid);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const keyPath = join(dir, "key.enc");
+  writeFileSync(
+    keyPath,
+    JSON.stringify(encryptPrivateKey(input.privateJwk, input.wrapping)),
+    { mode: 384 }
+  );
+  chmodSync(keyPath, 384);
+  writeFileSync(
+    join(dir, "context.json"),
+    `${JSON.stringify(input.context, null, 2)}
+`,
+    { mode: 384 }
+  );
+}
+function loadContext(input) {
+  const dir = contextDir(input.apiUrl, input.ecid);
+  const context = JSON.parse(
+    readFileSync(join(dir, "context.json"), "utf8")
+  );
+  const file = JSON.parse(readFileSync(join(dir, "key.enc"), "utf8"));
+  return { context, privateJwk: decryptPrivateKey(file, input.wrapping) };
+}
+
+// src/execution-context/commands.ts
+function localCapabilities() {
+  return {
+    runtime: "workerd",
+    node: process.versions.node,
+    os: platform(),
+    cpuCount: cpus().length,
+    memoryMb: Math.round(totalmem() / (1024 * 1024)),
+    maxConcurrent: 1,
+    features: []
+  };
+}
+function storedContextIds(apiUrl) {
+  try {
+    return readdirSync(contextsDir(apiUrl)).filter(
+      (entry) => entry.startsWith("ec_")
+    );
+  } catch {
+    return [];
+  }
+}
+function out(input, value, text) {
+  input.write(
+    input.values.json ? `${JSON.stringify(value, null, 2)}
+` : `${text}
+`
+  );
+}
+async function runExecutionContextCommand(input) {
+  const [sub, ...rest] = input.positionals;
+  const base = {
+    apiUrl: input.apiUrl,
+    ...input.org ? { org: input.org } : {},
+    ...input.fetchFn ? { fetchFn: input.fetchFn } : {}
+  };
+  if (input.command === "context" && sub === "register") {
+    const name = input.values.name ?? rest[0];
+    if (!name) throw new Error("Pass --name <name> for this machine.");
+    const { publicKeyJwk, privateKeyJwk } = await generateContextKey();
+    const privateKey = await importContextKey(privateKeyJwk);
+    const thumbprint = await ed25519JwkThumbprint(publicKeyJwk);
+    const registered = await registerContext({
+      ...base,
+      token: await input.token(),
+      name,
+      publicKeyJwk,
+      privateKey,
+      thumbprint,
+      capabilities: localCapabilities(),
+      client: { name: "kody-cli", version: input.clientVersion }
+    });
+    saveContext({
+      context: {
+        version: 1,
+        ecid: registered.ecid,
+        name: registered.name,
+        apiUrl: input.apiUrl,
+        orgSlug: registered.owner.orgSlug,
+        publicKeyJwk
+      },
+      privateJwk: privateKeyJwk,
+      wrapping: resolveWrappingKey({ ecid: registered.ecid, create: true })
+    });
+    const steps = (registered.nextSteps ?? []).map(
+      (step) => `  ${step.text ?? ""}${step.cli ? `
+    ${step.cli}` : ""}`
+    ).join("\n");
+    out(
+      input,
+      registered,
+      [
+        registered.notice ?? `Registered ${registered.name} (${registered.ecid}).`,
+        steps ? `Next steps:
+${steps}` : "",
+        "Start it with: kody daemon"
+      ].filter(Boolean).join("\n")
+    );
+    return 0;
+  }
+  if (input.command === "context" && (sub === "list" || sub === void 0)) {
+    const body = await apiJson({
+      ...base,
+      token: await input.token(),
+      method: "GET",
+      path: "/v1/execution-contexts"
+    });
+    const contexts = body.contexts ?? [];
+    out(
+      input,
+      body,
+      contexts.length === 0 ? "No execution contexts yet. Register this machine with `kody context register --name <name>`." : contexts.map(
+        (c) => `${c.name} (${c.id}) ${c.status}${c.usable ? "" : `, not usable: ${c.unusableReason}`}`
+      ).join("\n")
+    );
+    return 0;
+  }
+  if (input.command === "chain") {
+    const token = await input.token();
+    const read = await apiJson({
+      ...base,
+      token,
+      method: "GET",
+      path: "/v1/execution-chain"
+    });
+    const current = chainOf(read);
+    if (sub === "show" || sub === void 0) {
+      out(input, read, describeChain(current));
+      return 0;
+    }
+    if (sub !== "add" && sub !== "remove") {
+      throw new Error("Usage: kody chain show | add <name> | remove <name>");
+    }
+    const ref = rest[0];
+    if (!ref) throw new Error(`Pass the context name: kody chain ${sub} <name>`);
+    const id = await resolveContextId({
+      ...base,
+      token,
+      ref
+    });
+    const entries = (current.entries ?? []).map(
+      (entry) => entry.kind === "cloud" ? { kind: "cloud" } : { kind: "context", id: entry.id }
+    ).filter((entry) => !(entry.kind === "context" && entry.id === id));
+    if (sub === "add") {
+      const cloudAt = entries.findIndex((entry) => entry.kind === "cloud");
+      entries.splice(cloudAt === -1 ? entries.length : cloudAt, 0, {
+        kind: "context",
+        id
+      });
+    }
+    const updated = await apiJson({
+      ...base,
+      token,
+      method: "PUT",
+      path: "/v1/execution-chain",
+      body: {
+        entries,
+        strict: !entries.some((entry) => entry.kind === "cloud"),
+        ifMatch: current.updatedAt ?? null
+      }
+    });
+    out(input, updated, describeChain(chainOf(updated)));
+    return 0;
+  }
+  if (input.command === "daemon") {
+    const ids = input.values.context ? [input.values.context] : storedContextIds(input.apiUrl);
+    const ecid = ids[0];
+    if (!ecid) {
+      throw new Error(
+        "This machine has no registered execution context. Run `kody context register --name <name>` first."
+      );
+    }
+    const { context, privateJwk } = loadContext({
+      apiUrl: input.apiUrl,
+      ecid,
+      wrapping: resolveWrappingKey({ ecid, create: false })
+    });
+    const privateKey = await importContextKey(privateJwk);
+    const serverKeys = await fetchServerKeys({ apiUrl: input.apiUrl });
+    const { runContextRun } = await import("./run-executor-VXPFKJ3K.js");
+    const abort = new AbortController();
+    process.once("SIGINT", () => abort.abort());
+    process.once("SIGTERM", () => abort.abort());
+    input.write(
+      `Starting ${context.name} (${context.ecid}) against ${input.apiUrl}.
+`
+    );
+    await runDaemon({
+      apiUrl: input.apiUrl,
+      ecid: context.ecid,
+      privateKey,
+      serverKeys,
+      maxConcurrent: 1,
+      client: { name: "kody-cli", version: input.clientVersion },
+      capabilities: localCapabilities(),
+      execute: (run) => runContextRun({ ...run, apiUrl: input.apiUrl }),
+      log: (line) => input.write(`${line}
+`),
+      signal: abort.signal
+    });
+    return 0;
+  }
+  throw new Error(
+    "Usage: kody context register --name <name> [--org <slug>] | kody context list | kody chain show | add <name> | remove <name> | kody daemon [--context <ec id>]"
+  );
+}
+async function resolveContextId(input) {
+  if (input.ref.startsWith("ec_")) return input.ref;
+  const body = await apiJson({
+    ...input,
+    method: "GET",
+    path: "/v1/execution-contexts"
+  });
+  const match = (body.contexts ?? []).find((c) => c.name === input.ref);
+  if (!match)
+    throw new Error(`No execution context named ${input.ref} in this org.`);
+  return match.id;
+}
+function chainOf(body) {
+  return body.chain ?? {};
+}
+function describeChain(chain) {
+  const entries = chain.entries ?? [];
+  const lines = entries.map(
+    (entry, index) => entry.kind === "cloud" ? `${index + 1}. Kody cloud (always last)` : `${index + 1}. ${entry.id}${entry.usable === false ? ` (skipped: ${entry.unusableReason})` : ""}`
+  );
+  if (chain.strict) lines.push("Strict: Kody cloud is not in this chain.");
+  return lines.join("\n") || "Empty chain.";
+}
+function readCodeFile(path) {
+  return readFileSync2(path, "utf8");
+}
+export {
+  localCapabilities,
+  readCodeFile,
+  runExecutionContextCommand
+};
+//# sourceMappingURL=commands-RPUZAOAB.js.map