@longleash/cli 0.1.0-rc.1

package/bin/longleash.mjs

@@ -0,0 +1,821 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { delimiter, dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+
+// src/config.ts
+import {
+  closeSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+var HOSTED_RELAY = "wss://app.longleash.dev/ws";
+function dataDir(env = process.env) {
+  return resolve(env.LONGLEASH_DATA ?? join(homedir(), ".longleash"));
+}
+function configPath(env = process.env) {
+  return join(dataDir(env), "config.json");
+}
+function loadConfig(path = configPath()) {
+  if (!pathExists(path)) return {};
+  if (lstatSync(path).isSymbolicLink()) {
+    throw new Error(`Refusing to read symlinked configuration: ${path}`);
+  }
+  const parsed = JSON.parse(readFileSync(path, "utf8"));
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`Configuration is not a JSON object: ${path}`);
+  }
+  return parsed;
+}
+function normalizeRoots(values) {
+  const roots = [...new Set(values.map((value) => realpathSync(resolve(value))))];
+  if (roots.length === 0) throw new Error("At least one allowed project directory is required.");
+  for (const root of roots) {
+    if (!lstatSync(root).isDirectory()) throw new Error(`Allowed root is not a directory: ${root}`);
+    if (root === "/") throw new Error("Refusing to allow the entire filesystem. Choose project folders instead.");
+  }
+  return roots;
+}
+function normalizeRelay(value) {
+  const normalized = value.trim();
+  if (normalized === "" || normalized === "hosted") return HOSTED_RELAY;
+  if (normalized.toLowerCase() === "off" || normalized.toLowerCase() === "lan") return null;
+  const url = new URL(normalized);
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "wss:" && !(url.protocol === "ws:" && loopback)) {
+    throw new Error("Relay URLs must use wss://. Plain ws:// is accepted only for loopback development.");
+  }
+  url.hash = "";
+  url.search = "";
+  if (url.pathname === "/" || url.pathname === "") url.pathname = "/ws";
+  if (url.pathname !== "/ws") throw new Error("Relay URL path must be /ws.");
+  return url.toString().replace(/\/$/, "");
+}
+function saveConfig(next, path = configPath()) {
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  if (pathExists(path) && lstatSync(path).isSymbolicLink()) {
+    throw new Error(`Refusing to overwrite symlinked configuration: ${path}`);
+  }
+  const temp = createTemporaryFile(path, `${JSON.stringify(next, null, 2)}
+`, 384, "tmp");
+  try {
+    if (pathExists(path)) {
+      const backup = `${path}.previous`;
+      if (pathExists(backup) && lstatSync(backup).isSymbolicLink()) {
+        throw new Error(`Refusing to overwrite symlinked configuration backup: ${backup}`);
+      }
+      writeBytesAtomically(backup, readFileSync(path), statSync(path).mode & 511);
+    }
+    renameSync(temp, path);
+  } catch (error) {
+    try {
+      unlinkSync(temp);
+    } catch {
+    }
+    throw error;
+  }
+}
+function captureConfigSnapshot(path = configPath()) {
+  return {
+    path,
+    config: captureFile(path),
+    previous: captureFile(`${path}.previous`)
+  };
+}
+function restoreConfigSnapshot(snapshot) {
+  const previous = `${snapshot.path}.previous`;
+  assertNotSymlink(snapshot.path);
+  assertNotSymlink(previous);
+  restoreFile(previous, snapshot.previous);
+  restoreFile(snapshot.path, snapshot.config);
+}
+function configuredRoots(config) {
+  return Array.isArray(config.allowedRoots) ? config.allowedRoots.filter((root) => typeof root === "string" && root !== "") : [];
+}
+function captureFile(path) {
+  if (!pathExists(path)) return { content: null, mode: 384 };
+  assertNotSymlink(path);
+  return { content: readFileSync(path), mode: statSync(path).mode & 511 };
+}
+function assertNotSymlink(path) {
+  if (pathExists(path) && lstatSync(path).isSymbolicLink()) {
+    throw new Error(`Refusing symlinked configuration transaction path: ${path}`);
+  }
+}
+function pathExists(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+function restoreFile(path, snapshot) {
+  if (snapshot.content === null) {
+    rmSync(path, { force: true });
+    return;
+  }
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeBytesAtomically(path, snapshot.content, snapshot.mode);
+}
+function writeBytesAtomically(path, content, mode) {
+  const temp = createTemporaryFile(path, content, mode, "atomic");
+  try {
+    renameSync(temp, path);
+  } catch (error) {
+    try {
+      unlinkSync(temp);
+    } catch {
+    }
+    throw error;
+  }
+}
+function createTemporaryFile(path, content, mode, suffix) {
+  const temp = `${path}.${randomUUID()}.${suffix}`;
+  const fd = openSync(temp, "wx", mode);
+  try {
+    writeFileSync(fd, content);
+    fsyncSync(fd);
+    closeSync(fd);
+    return temp;
+  } catch (error) {
+    try {
+      closeSync(fd);
+    } catch {
+    }
+    try {
+      unlinkSync(temp);
+    } catch {
+    }
+    throw error;
+  }
+}
+
+// src/install.ts
+import {
+  chmodSync,
+  closeSync as closeSync2,
+  existsSync,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  readlinkSync,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  symlinkSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { basename, dirname as dirname2, join as join2, relative, resolve as resolve2, sep } from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { spawnSync } from "node:child_process";
+var PACKAGE_NAME = "@longleash/cli";
+var MARKER = ".longleash-managed-install.json";
+var WRAPPER_MARKER = "# Managed by @longleash/cli";
+function installPaths(env = process.env) {
+  const home = resolve2(env.LONGLEASH_INSTALL_HOME ?? join2(homedir2(), ".local", "share", "longleash"));
+  const bin = resolve2(env.LONGLEASH_BIN_DIR ?? join2(homedir2(), ".local", "bin"));
+  assertSafeInstallHome(home, env.LONGLEASH_INSTALL_HOME !== void 0);
+  assertSafeInstallPath(bin, env.LONGLEASH_BIN_DIR !== void 0, "binary directory");
+  return { home, releases: join2(home, "releases"), current: join2(home, "current"), bin, wrapper: join2(bin, "longleash") };
+}
+function assertVersion(value) {
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value)) {
+    throw new Error(`Invalid LongLeash version: ${value}`);
+  }
+  return value;
+}
+function packageLocation(prefix) {
+  return join2(prefix, "node_modules", "@longleash", "cli");
+}
+function verifyInstalledPackage(prefix, expectedVersion) {
+  const root = packageLocation(prefix);
+  const manifest2 = JSON.parse(readFileSync2(join2(root, "package.json"), "utf8"));
+  if (manifest2.name !== PACKAGE_NAME || manifest2.version !== expectedVersion) {
+    throw new Error(`Installed package identity mismatch: expected ${PACKAGE_NAME}@${expectedVersion}.`);
+  }
+  const cli = join2(root, "bin", "longleash.mjs");
+  const daemon = join2(root, "runtime", "daemon", "bin", "longleashd.mjs");
+  const app = join2(root, "runtime", "app", "dist", "index.html");
+  for (const path of [cli, daemon, app]) {
+    if (!existsSync(path)) throw new Error(`Installed package is incomplete: missing ${path}`);
+  }
+  return cli;
+}
+function prepareManagedInstall(version, env = process.env) {
+  assertVersion(version);
+  const paths = installPaths(env);
+  const localPackage = env.LONGLEASH_PACKAGE_SPEC;
+  if (localPackage !== void 0 && env.LONGLEASH_ALLOW_LOCAL_PACKAGE !== "1") {
+    throw new Error("A local package override requires LONGLEASH_ALLOW_LOCAL_PACKAGE=1. It is intended only for isolated release tests.");
+  }
+  const packageSpec = localPackage ?? `${PACKAGE_NAME}@${version}`;
+  if (localPackage !== void 0 && (!localPackage.endsWith(".tgz") || !existsSync(resolve2(localPackage)))) {
+    throw new Error("The local package override must point to an existing .tgz tarball.");
+  }
+  mkdirSync2(paths.releases, { recursive: true, mode: 448 });
+  const releaseLock = acquireInstallLock(paths.home);
+  const release = join2(paths.releases, version);
+  try {
+    let installedThisRun = false;
+    const releaseExists = pathExists2(release);
+    if (releaseExists && lstatSync2(release).isSymbolicLink()) {
+      throw new Error(`Refusing symlinked LongLeash release: ${release}`);
+    }
+    let needsInstall = !releaseExists;
+    if (!needsInstall) {
+      try {
+        verifyInstalledPackage(release, version);
+      } catch (error) {
+        if (isCurrentRelease(paths.current, release)) {
+          throw new Error(`The active LongLeash release is incomplete and was preserved for diagnosis: ${String(error)}`);
+        }
+        safeRemoveRelease(release, paths.releases);
+        needsInstall = true;
+      }
+    }
+    if (needsInstall) {
+      const stage = join2(paths.releases, `.${version}-${process.pid}-${randomUUID2()}.stage`);
+      mkdirSync2(stage, { recursive: false, mode: 448 });
+      const installArgs = [
+        "install",
+        "--prefix",
+        stage,
+        "--omit=dev",
+        "--no-audit",
+        "--no-fund",
+        "--package-lock=false",
+        "--registry=https://registry.npmjs.org/",
+        packageSpec
+      ];
+      const installed = spawnSync(
+        "npm",
+        installArgs,
+        { stdio: "inherit", env }
+      );
+      if (installed.error || installed.status !== 0) {
+        safeRemoveStage(stage, paths.releases);
+        throw new Error(`npm could not stage ${PACKAGE_NAME}@${version}. The active version was not changed.`);
+      }
+      try {
+        verifyInstalledPackage(stage, version);
+        renameSync2(stage, release);
+        installedThisRun = true;
+      } catch (error) {
+        safeRemoveStage(stage, paths.releases);
+        throw error;
+      }
+    }
+    const cli = verifyInstalledPackage(release, version);
+    let activated = false;
+    let lockHeld = true;
+    const unlock = () => {
+      if (!lockHeld) return;
+      lockHeld = false;
+      releaseLock();
+    };
+    return {
+      cli,
+      activate() {
+        const marker = join2(paths.home, MARKER);
+        const hadWrapper = pathExists2(paths.wrapper);
+        const hadMarker = pathExists2(marker);
+        let previousWrapper;
+        let previousMarker;
+        let wrapperWritten = false;
+        let markerWritten = false;
+        const tempLink = join2(paths.home, `.current-${process.pid}-${randomUUID2()}`);
+        try {
+          mkdirSync2(paths.bin, { recursive: true, mode: 448 });
+          if (hadWrapper) {
+            if (lstatSync2(paths.wrapper).isSymbolicLink()) throw new Error(`Refusing symlinked executable: ${paths.wrapper}`);
+            previousWrapper = readFileSync2(paths.wrapper, "utf8");
+            if (!previousWrapper.includes(WRAPPER_MARKER)) {
+              throw new Error(`Refusing to replace an unmanaged executable: ${paths.wrapper}`);
+            }
+          }
+          if (hadMarker) {
+            if (lstatSync2(marker).isSymbolicLink()) throw new Error(`Refusing symlinked install marker: ${marker}`);
+            previousMarker = readFileSync2(marker, "utf8");
+          }
+          const activeCli = join2(paths.current, "node_modules", "@longleash", "cli", "bin", "longleash.mjs");
+          writeExecutableAtomically(paths.wrapper, wrapper(activeCli));
+          wrapperWritten = true;
+          writeFileAtomically(marker, `${JSON.stringify({ schema: 1, package: PACKAGE_NAME }, null, 2)}
+`, 384);
+          markerWritten = true;
+          symlinkSync(release, tempLink, "dir");
+          if (pathExists2(paths.current) && !lstatSync2(paths.current).isSymbolicLink()) {
+            throw new Error(`Refusing to replace non-symlink path: ${paths.current}`);
+          }
+          renameSync2(tempLink, paths.current);
+          activated = true;
+        } catch (error) {
+          try {
+            rmSync2(tempLink, { force: true });
+          } catch {
+          }
+          const restorationFailures = [];
+          if (wrapperWritten) {
+            try {
+              restoreManagedFile(paths.wrapper, hadWrapper ? previousWrapper : void 0, 448);
+            } catch (restoreError) {
+              restorationFailures.push(`executable: ${String(restoreError)}`);
+            }
+          }
+          if (markerWritten) {
+            try {
+              restoreManagedFile(marker, hadMarker ? previousMarker : void 0, 384);
+            } catch (restoreError) {
+              restorationFailures.push(`marker: ${String(restoreError)}`);
+            }
+          }
+          if (restorationFailures.length > 0) {
+            throw new Error(
+              `Activation failed (${String(error)}) and automatic restoration was incomplete (${restorationFailures.join("; ")}). Inspect ${paths.home} before retrying.`
+            );
+          }
+          throw error;
+        } finally {
+          unlock();
+        }
+      },
+      rollback() {
+        try {
+          if (installedThisRun && !activated && !isCurrentRelease(paths.current, release)) {
+            safeRemoveRelease(release, paths.releases);
+          }
+        } finally {
+          unlock();
+        }
+      }
+    };
+  } catch (error) {
+    releaseLock();
+    throw error;
+  }
+}
+function uninstallManagedRuntime(env = process.env) {
+  const paths = installPaths(env);
+  const marker = join2(paths.home, MARKER);
+  if (!pathExists2(marker)) return { removed: false, configPreserved: resolve2(env.LONGLEASH_DATA ?? join2(homedir2(), ".longleash")) };
+  if (lstatSync2(marker).isSymbolicLink()) throw new Error(`Refusing symlinked install marker: ${marker}`);
+  const parsed = JSON.parse(readFileSync2(marker, "utf8"));
+  if (parsed.package !== PACKAGE_NAME) throw new Error(`Refusing to remove unrecognized install directory: ${paths.home}`);
+  if (pathExists2(paths.wrapper)) {
+    if (lstatSync2(paths.wrapper).isSymbolicLink()) throw new Error(`Refusing symlinked executable: ${paths.wrapper}`);
+    const wrapperText = readFileSync2(paths.wrapper, "utf8");
+    if (!wrapperText.includes(WRAPPER_MARKER)) throw new Error(`Refusing to remove an unmanaged executable: ${paths.wrapper}`);
+    rmSync2(paths.wrapper);
+  }
+  rmSync2(paths.home, { recursive: true });
+  return { removed: true, configPreserved: resolve2(env.LONGLEASH_DATA ?? join2(homedir2(), ".longleash")) };
+}
+function wrapper(cli) {
+  return `#!/bin/sh
+${WRAPPER_MARKER}
+exec node ${shellQuote(cli)} "$@"
+`;
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function writeExecutableAtomically(path, content) {
+  const temp = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+  try {
+    writeFileSync2(temp, content, { encoding: "utf8", mode: 448, flag: "wx" });
+    chmodSync(temp, 448);
+    renameSync2(temp, path);
+  } catch (error) {
+    try {
+      rmSync2(temp, { force: true });
+    } catch {
+    }
+    throw error;
+  }
+}
+function writeFileAtomically(path, content, mode) {
+  const temp = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+  try {
+    writeFileSync2(temp, content, { encoding: "utf8", mode, flag: "wx" });
+    renameSync2(temp, path);
+  } catch (error) {
+    try {
+      rmSync2(temp, { force: true });
+    } catch {
+    }
+    throw error;
+  }
+}
+function restoreManagedFile(path, content, mode) {
+  if (content === void 0) rmSync2(path, { force: true });
+  else writeFileAtomically(path, content, mode);
+}
+function pathExists2(path) {
+  try {
+    lstatSync2(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+function assertSafeInstallHome(path, explicitlyConfigured) {
+  assertSafeInstallPath(path, explicitlyConfigured, "install directory");
+}
+function assertSafeInstallPath(path, explicitlyConfigured, label) {
+  const home = resolve2(homedir2());
+  const resolved = resolve2(path);
+  if (resolved === "/" || resolved === home || resolved === dirname2(home)) {
+    throw new Error(`Unsafe LongLeash ${label}: ${resolved}`);
+  }
+  if (relative(home, resolved).startsWith(`..${sep}`) && !explicitlyConfigured) {
+    throw new Error(`Default ${label} escaped the user home: ${resolved}`);
+  }
+}
+function safeRemoveStage(path, releases) {
+  const rel = relative(releases, path);
+  if (!rel.startsWith(".") || rel.includes(sep)) throw new Error(`Refusing unsafe stage cleanup: ${path}`);
+  rmSync2(path, { recursive: true, force: true });
+}
+function safeRemoveRelease(path, releases) {
+  const rel = relative(releases, path);
+  if (rel === "" || rel.startsWith("..") || basename(path) !== rel) throw new Error(`Refusing unsafe release cleanup: ${path}`);
+  rmSync2(path, { recursive: true, force: true });
+}
+function isCurrentRelease(current, release) {
+  try {
+    return resolve2(dirname2(current), readlinkSync(current)) === release;
+  } catch {
+    return false;
+  }
+}
+function acquireInstallLock(home) {
+  const path = join2(home, ".install.lock");
+  const token = randomUUID2();
+  const create = () => {
+    const fd = openSync2(path, "wx", 384);
+    try {
+      writeFileSync2(fd, `${JSON.stringify({ package: PACKAGE_NAME, pid: process.pid, token })}
+`);
+    } finally {
+      closeSync2(fd);
+    }
+  };
+  try {
+    create();
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    if (lstatSync2(path).isSymbolicLink()) throw new Error(`Refusing symlinked install lock: ${path}`);
+    let owner = {};
+    try {
+      owner = JSON.parse(readFileSync2(path, "utf8"));
+    } catch {
+    }
+    if (owner.package !== PACKAGE_NAME || !Number.isSafeInteger(owner.pid)) {
+      throw new Error(`Unrecognized install lock requires manual inspection: ${path}`);
+    }
+    if (processAlive(owner.pid)) throw new Error(`Another LongLeash setup is already running as process ${owner.pid}.`);
+    rmSync2(path);
+    create();
+  }
+  return () => {
+    try {
+      const owner = JSON.parse(readFileSync2(path, "utf8"));
+      if (owner.token === token) rmSync2(path);
+    } catch {
+    }
+  };
+}
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+
+// src/cli.ts
+var here = dirname3(fileURLToPath(import.meta.url));
+var packageRoot = resolve3(here, "..");
+var manifest = JSON.parse(readFileSync3(join3(packageRoot, "package.json"), "utf8"));
+var VERSION = manifest.version;
+var runtime = join3(packageRoot, "runtime", "daemon");
+var daemonEntry = join3(runtime, "bin", "longleashd.mjs");
+var hooks = join3(runtime, "hooks");
+var devicesEntry = join3(runtime, "bin", "longleash-devices.mjs");
+async function main() {
+  const args = process.argv.slice(2);
+  const command = args[0];
+  if (command === "--version" || command === "-v" || command === "version") {
+    console.log(VERSION);
+    return 0;
+  }
+  if (command === "--help" || command === "-h" || command === "help") {
+    help();
+    return 0;
+  }
+  if (command === "where") {
+    console.log(packageRoot);
+    return 0;
+  }
+  if (command === "setup") return setup(parseSetup(args.slice(1)));
+  if (command === "doctor") return doctor(args.includes("--json"));
+  if (command === "hooks") return runHooks(args.slice(1));
+  if (command === "devices") return runNode(devicesEntry, []);
+  if (command === "revoke") return runNode(devicesEntry, ["revoke", ...args.slice(1)]);
+  if (command === "update") return update(args[1] ?? "latest");
+  if (command === "uninstall") return uninstall();
+  if (command === "run") return runDaemon(args.slice(1));
+  if (command?.startsWith("-")) {
+    console.error(`Unknown option: ${command}
+`);
+    help();
+    return 2;
+  }
+  return runDaemon(args);
+}
+function help() {
+  console.log(`LongLeash ${VERSION}
+
+Usage:
+  longleash setup                 configure a stable user-local installation
+  longleash run [folders...]      run in the foreground (terminal stays open)
+  longleash [folders...]          shorthand for run
+  longleash doctor [--json]       report package, config, and daemon health
+  longleash hooks [--remove]      install or remove supported provider hooks
+  longleash devices               list paired phones
+  longleash revoke <id|--all>     revoke paired phone access
+  longleash update [version]      atomically install latest or an exact version
+  longleash uninstall             remove runtime and hooks; preserve user data
+  longleash where                 print the active npm package directory
+
+Setup never starts the daemon. Background service commands arrive in Workstream C.`);
+}
+function parseSetup(args) {
+  const options = { roots: [], relay: "", yes: false, reuse: false, configureOnly: false, skipHooks: false };
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--root") {
+      const value = args[++i];
+      if (!value) throw new Error("--root requires a directory.");
+      options.roots.push(value);
+    } else if (arg === "--relay") {
+      const value = args[++i];
+      if (!value) throw new Error("--relay requires hosted, off, or a wss:// URL.");
+      options.relay = value;
+    } else if (arg === "--yes") options.yes = true;
+    else if (arg === "--reuse-config") options.reuse = true;
+    else if (arg === "--configure-only") options.configureOnly = true;
+    else if (arg === "--skip-hooks") options.skipHooks = true;
+    else throw new Error(`Unknown setup option: ${arg}`);
+  }
+  return options;
+}
+async function setup(options) {
+  if (options.configureOnly && process.env.LONGLEASH_INTERNAL_CONFIGURE !== VERSION) {
+    throw new Error("--configure-only is an internal transaction step and cannot be invoked directly.");
+  }
+  let existing;
+  try {
+    existing = loadConfig();
+  } catch (error) {
+    throw new Error(`${message(error)} Fix or move ${configPath()} before setup.`);
+  }
+  if (options.reuse) {
+    options.roots = configuredRoots(existing);
+    options.relay = typeof existing.relayUrl === "string" ? existing.relayUrl : "off";
+    options.yes = true;
+  }
+  if (options.roots.length === 0 && options.yes) {
+    throw new Error("Non-interactive setup requires at least one explicit --root, or --reuse-config.");
+  }
+  if (!options.yes) {
+    if (!input.isTTY || !output.isTTY) {
+      throw new Error("Interactive setup needs a terminal. Use --yes with explicit --root and --relay values.");
+    }
+    const prompt = createInterface({ input, output });
+    try {
+      console.log("\nLongLeash setup\n");
+      console.log("Agents remain on this laptop. Choose only folders where they may work.");
+      const rootAnswer = await prompt.question(`Allowed project folder [${process.cwd()}]: `);
+      options.roots = [rootAnswer.trim() || process.cwd()];
+      console.log("\nConnectivity: hosted works away from home; LAN-only has no internet relay.");
+      const relayAnswer = await prompt.question("Relay [hosted / lan / wss://your-relay/ws] (hosted): ");
+      options.relay = relayAnswer.trim() || "hosted";
+      const roots2 = normalizeRoots(options.roots);
+      const relay2 = normalizeRelay(options.relay);
+      console.log("\nReview before anything changes:");
+      for (const root of roots2) console.log(`  allowed root  ${root}`);
+      console.log(`  connectivity  ${relay2 ?? "LAN-only (no relay)"}`);
+      console.log("  service       not installed or started in this workstream");
+      const accepted = await prompt.question("\nApply this setup? [y/N] ");
+      if (!/^y(?:es)?$/i.test(accepted.trim())) {
+        console.log("Nothing changed.");
+        return 1;
+      }
+    } finally {
+      prompt.close();
+    }
+  }
+  const roots = normalizeRoots(options.roots);
+  const relay = normalizeRelay(options.relay || "hosted");
+  if (!options.configureOnly) {
+    const configSnapshot = captureConfigSnapshot();
+    const prepared = prepareManagedInstall(VERSION);
+    const forwarded = [
+      "setup",
+      "--configure-only",
+      "--yes",
+      ...roots.flatMap((root) => ["--root", root]),
+      "--relay",
+      relay ?? "off",
+      "--skip-hooks"
+    ];
+    const configured = spawnSync2(process.execPath, [prepared.cli, ...forwarded], {
+      stdio: "inherit",
+      env: { ...process.env, LONGLEASH_INTERNAL_CONFIGURE: VERSION }
+    });
+    if (configured.error || configured.status !== 0) {
+      prepared.rollback();
+      restoreConfigSnapshot(configSnapshot);
+      throw new Error("The staged package could not be configured. The active version was not changed.");
+    }
+    try {
+      prepared.activate();
+    } catch (error) {
+      prepared.rollback();
+      restoreConfigSnapshot(configSnapshot);
+      throw error;
+    }
+    console.log(`
+Activated @longleash/cli ${VERSION}.`);
+    if (!options.skipHooks) {
+      const hooked = spawnSync2(process.execPath, [prepared.cli, "hooks"], { stdio: "inherit", env: process.env });
+      if (hooked.error || hooked.status !== 0) {
+        console.error("Provider hook setup needs attention. The runtime is installed; run `longleash hooks` after fixing the message above.");
+      }
+    }
+    const paths = installPaths();
+    if (pathDirectories().includes(paths.bin)) {
+      console.log("Open a new terminal if `longleash` is not yet visible in this shell.");
+    } else {
+      console.log(`
+The executable is installed at ${paths.wrapper}, but ${paths.bin} is not on PATH.`);
+      console.log("Add this line to your shell profile, then open a new terminal:");
+      console.log(`  export PATH=${quoteForShell(paths.bin)}:"$PATH"`);
+      console.log(`You can use ${paths.wrapper} immediately.`);
+    }
+    return 0;
+  }
+  const next = { ...existing, cliSchemaVersion: 1, allowedRoots: roots };
+  if (relay === null) delete next.relayUrl;
+  else next.relayUrl = relay;
+  saveConfig(next);
+  console.log(`Saved configuration to ${configPath()}`);
+  console.log("LongLeash was not started. Run `longleash run` when you are ready.");
+  return 0;
+}
+async function runDaemon(explicitRoots) {
+  if (!existsSync2(daemonEntry)) throw new Error("The npm package is incomplete: daemon runtime is missing.");
+  const config = loadConfig();
+  const roots = normalizeRoots(explicitRoots.length > 0 ? explicitRoots : configuredRoots(config));
+  const child = spawn(process.execPath, [daemonEntry, ...roots], { stdio: "inherit", env: process.env });
+  return await new Promise((resolveExit, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolveExit(code ?? (signal ? 1 : 0)));
+  });
+}
+async function doctor(json) {
+  let config = {};
+  let configError = null;
+  try {
+    config = loadConfig();
+  } catch (error) {
+    configError = message(error);
+  }
+  const endpointPath = join3(process.env.LONGLEASH_DATA ?? join3(homedir3(), ".longleash"), "hook-endpoint.json");
+  let daemon = { reachable: false };
+  try {
+    const endpoint = JSON.parse(readFileSync3(endpointPath, "utf8"));
+    if (endpoint.url && endpoint.secret) {
+      const response = await fetch(endpoint.url.replace(/\/hook$/, "/health"), {
+        headers: { "x-longleash-hook": endpoint.secret },
+        signal: AbortSignal.timeout(1500)
+      });
+      if (response.ok) {
+        const health = await response.json();
+        daemon = { reachable: true, ...health.build ? { build: health.build } : {} };
+      }
+    }
+  } catch {
+  }
+  const report = {
+    package: { name: "@longleash/cli", version: VERSION, root: packageRoot },
+    runtime: { node: process.version, platform: process.platform, architecture: process.arch },
+    config: {
+      path: configPath(),
+      valid: configError === null,
+      error: configError,
+      allowedRoots: configuredRoots(config),
+      relay: typeof config.relayUrl === "string" ? config.relayUrl : "off"
+    },
+    daemon
+  };
+  if (json) console.log(JSON.stringify(report, null, 2));
+  else {
+    console.log(`
+LongLeash ${VERSION}`);
+    console.log(`  package      ${packageRoot}`);
+    console.log(`  node         ${process.version} (${process.platform} ${process.arch})`);
+    console.log(`  config       ${configError ?? (configuredRoots(config).length > 0 ? "valid" : "not configured")}`);
+    console.log(`  relay        ${report.config.relay}`);
+    console.log(`  daemon       ${daemon.reachable ? `reachable \xB7 build ${daemon.build ?? "unknown"}` : "not running"}`);
+    console.log("");
+  }
+  return configError === null ? 0 : 1;
+}
+async function runHooks(args) {
+  const remove = args.includes("--remove");
+  let failed = false;
+  if (commandAvailable("claude") || remove) failed = await runNode(join3(hooks, "install-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
+  if (commandAvailable("codex") || remove) failed = await runNode(join3(hooks, "install-codex-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
+  return failed ? 1 : 0;
+}
+async function update(target) {
+  const spec = target === "latest" ? "@longleash/cli@latest" : `@longleash/cli@${assertVersion(target)}`;
+  const child = spawn("npm", [
+    "exec",
+    "--yes",
+    "--registry=https://registry.npmjs.org/",
+    `--package=${spec}`,
+    "--",
+    "longleash",
+    "setup",
+    "--reuse-config",
+    "--yes"
+  ], {
+    stdio: "inherit",
+    env: process.env
+  });
+  return await new Promise((resolveExit, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code) => resolveExit(code ?? 1));
+  });
+}
+async function uninstall() {
+  const hooksRemoved = await runHooks(["--remove"]);
+  if (hooksRemoved !== 0) throw new Error("Provider hooks could not be removed safely. The managed runtime was preserved.");
+  const result = uninstallManagedRuntime();
+  console.log(result.removed ? "Removed the managed LongLeash runtime and executable." : "No managed LongLeash runtime was installed.");
+  console.log(`Preserved settings, paired devices, and audit data in ${result.configPreserved}.`);
+  return 0;
+}
+function commandAvailable(command) {
+  return spawnSync2(command, ["--version"], { stdio: "ignore", timeout: 3e3 }).status === 0;
+}
+function pathDirectories() {
+  return (process.env.PATH ?? "").split(delimiter).filter(Boolean).map((path) => resolve3(path));
+}
+function quoteForShell(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+async function runNode(entry, args) {
+  const child = spawn(process.execPath, [entry, ...args], { stdio: "inherit", env: process.env });
+  return await new Promise((resolveExit, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code) => resolveExit(code ?? 1));
+  });
+}
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+try {
+  process.exitCode = await main();
+} catch (error) {
+  console.error(`
+LongLeash: ${message(error)}
+`);
+  process.exitCode = 1;
+}