@microck/canonfig 2.0.0 → 2.1.0

package/dist/harness-configuration/core/schema-runtime.js

@@ -0,0 +1,143 @@
+export class SchemaValidationError extends Error {
+    issues;
+    constructor(issues) {
+        super(issues
+            .map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`)
+            .join("\n"));
+        this.name = "SchemaValidationError";
+        this.issues = issues;
+    }
+}
+export class Validator {
+    issues = [];
+    issue(path, message) {
+        this.issues.push({ path: [...path], message });
+    }
+    finish(value) {
+        if (this.issues.length > 0)
+            throw new SchemaValidationError(this.issues);
+        return value;
+    }
+}
+export function schema(parser) {
+    return {
+        parse(input) {
+            const validator = new Validator();
+            return validator.finish(parser(input, validator, []));
+        },
+        safeParse(input) {
+            try {
+                return { success: true, data: this.parse(input) };
+            }
+            catch (error) {
+                if (error instanceof SchemaValidationError) {
+                    return { success: false, error };
+                }
+                throw error;
+            }
+        },
+    };
+}
+export function isRecord(input) {
+    return input !== null && typeof input === "object" && !Array.isArray(input);
+}
+export function objectValue(input, validator, path) {
+    if (!isRecord(input)) {
+        validator.issue(path, "Expected an object.");
+        return {};
+    }
+    return input;
+}
+export function stringValue(input, validator, path, options = {}) {
+    if (typeof input !== "string") {
+        validator.issue(path, "Expected a string.");
+        return "";
+    }
+    if (options.min !== undefined && input.length < options.min) {
+        validator.issue(path, `Expected at least ${options.min} character(s).`);
+    }
+    if (options.pattern && !options.pattern.test(input)) {
+        validator.issue(path, "Invalid format.");
+    }
+    return input;
+}
+export function optionalString(input, validator, path) {
+    return input === undefined ? undefined : stringValue(input, validator, path);
+}
+export function booleanValue(input, validator, path, fallback) {
+    if (input === undefined)
+        return fallback;
+    if (typeof input !== "boolean") {
+        validator.issue(path, "Expected a boolean.");
+        return fallback;
+    }
+    return input;
+}
+export function positiveInteger(input, validator, path, max) {
+    if (input === undefined)
+        return undefined;
+    if (typeof input !== "number"
+        || !Number.isInteger(input)
+        || input <= 0
+        || (max !== undefined && input > max)) {
+        validator.issue(path, max === undefined
+            ? "Expected a positive integer."
+            : `Expected a positive integer no greater than ${max}.`);
+        return undefined;
+    }
+    return input;
+}
+export function enumValue(input, values, validator, path, fallback) {
+    if (typeof input === "string" && values.includes(input)) {
+        return input;
+    }
+    validator.issue(path, `Expected one of: ${values.join(", ")}.`);
+    return fallback;
+}
+export function stringArray(input, validator, path, fallback = []) {
+    if (input === undefined)
+        return [...fallback];
+    if (!Array.isArray(input)) {
+        validator.issue(path, "Expected an array of strings.");
+        return [...fallback];
+    }
+    return input.map((value, index) => stringValue(value, validator, [...path, index], { min: 1 }));
+}
+export function relativePath(input, validator, path, fallback) {
+    if (input === undefined && fallback !== undefined)
+        return fallback;
+    const value = stringValue(input, validator, path, { min: 1 });
+    if (value.startsWith("/")
+        || value.startsWith("\\")
+        || /^[A-Za-z]:[\\/]/u.test(value)
+        || value.split(/[\\/]+/u).includes("..")) {
+        validator.issue(path, "Path must stay inside .canonfig/.");
+    }
+    return value;
+}
+const ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/u;
+export function idValue(input, validator, path) {
+    return stringValue(input, validator, path, {
+        min: 1,
+        pattern: ID_PATTERN,
+    });
+}
+export function secretValue(input, validator, path) {
+    if (typeof input === "string")
+        return input;
+    const value = objectValue(input, validator, path);
+    const fromEnv = stringValue(value.fromEnv, validator, [...path, "fromEnv"], { min: 1 });
+    const fallback = optionalString(value.default, validator, [...path, "default"]);
+    return fallback === undefined
+        ? { fromEnv }
+        : { fromEnv, default: fallback };
+}
+export function secretRecord(input, validator, path) {
+    if (input === undefined)
+        return {};
+    const value = objectValue(input, validator, path);
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        secretValue(item, validator, [...path, key]),
+    ]));
+}

package/dist/harness-configuration/core/schema-types.js

@@ -0,0 +1,8 @@
+export const HOOK_EVENTS = [
+    "session_start", "session_end", "prompt_submit", "before_agent", "after_agent",
+    "before_tool", "after_tool", "before_compact", "after_compact", "stop",
+    "subagent_start", "subagent_stop",
+];
+export const CAPABILITIES = [
+    "read", "write", "search", "shell", "web", "mcp", "subagent", "test", "git",
+];

package/dist/harness-configuration/core/schema.js

@@ -0,0 +1,13 @@
+import { TARGET_IDS } from "./types.js";
+import { enumValue, schema, } from "./schema-runtime.js";
+import { parseAgent, parseCommand, parseHook, parseMcpServer, parseRule, } from "./schema-components.js";
+import { parseConfig } from "./schema-config.js";
+export * from "./schema-types.js";
+export * from "./schema-runtime.js";
+export const TargetIdSchema = schema((input, validator, path) => enumValue(input, TARGET_IDS, validator, path, "codex"));
+export const McpServerSchema = schema(parseMcpServer);
+export const HookSchema = schema(parseHook);
+export const RuleSchema = schema(parseRule);
+export const AgentSchema = schema(parseAgent);
+export const CommandSchema = schema(parseCommand);
+export const CanonfigConfigSchema = schema(parseConfig);

package/dist/harness-configuration/core/state.js

@@ -0,0 +1,42 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { CANONFIG_DIR, STATE_FILENAME } from "./config.js";
+import { CanonfigError } from "./errors.js";
+import { assertNoSymlinkPathComponents, atomicWrite } from "./filesystem.js";
+export const HARNESS_CONFIGURATION_VERSION = "1";
+export function emptyState() {
+    return { version: 1, generatedAt: new Date(0).toISOString(), canonfigVersion: HARNESS_CONFIGURATION_VERSION, artifacts: {} };
+}
+export async function loadState(root) {
+    const statePath = path.join(root, CANONFIG_DIR, STATE_FILENAME);
+    try {
+        const raw = await fs.readFile(statePath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== 1 || !parsed.artifacts || typeof parsed.artifacts !== "object") {
+            throw new CanonfigError("STATE_INVALID", `Unsupported state file: ${path.relative(root, statePath)}`);
+        }
+        return parsed;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return emptyState();
+        if (error instanceof CanonfigError)
+            throw error;
+        throw new CanonfigError("STATE_INVALID", `Could not read ${path.relative(root, statePath)}: ${String(error)}`, error);
+    }
+}
+export async function writeState(root, state) {
+    const statePath = path.join(root, CANONFIG_DIR, STATE_FILENAME);
+    if (Object.keys(state.artifacts).length === 0) {
+        await assertNoSymlinkPathComponents(root, path.dirname(statePath));
+        try {
+            await fs.unlink(statePath);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        return;
+    }
+    await atomicWrite(statePath, `${JSON.stringify(state, null, 2)}\n`, 0o600, root);
+}

package/dist/harness-configuration/core/types.js

@@ -0,0 +1,5 @@
+export const TARGET_IDS = [
+    "codex", "claude-code", "amp", "oh-my-pi", "pi", "factory-droid",
+    "cursor", "devin", "opencode", "grok-build", "antigravity", "copilot-cli",
+    "kimi", "kilo", "hermes", "qwen",
+];

package/dist/harness-configuration/core/validation.js

@@ -0,0 +1,113 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { parseSkill } from "./frontmatter.js";
+import { walkFiles } from "./filesystem.js";
+import { assertSafeRelativePath } from "./path.js";
+async function exists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function validateProject(root, config) {
+    const diagnostics = [];
+    const canonfigDir = path.join(root, ".canonfig");
+    const referenced = [
+        { kind: "instruction", relative: config.instructions.root },
+        ...config.instructions.rules.map((rule) => ({ kind: `rule ${rule.id}`, relative: rule.file })),
+        ...config.agents.map((agent) => ({ kind: `agent ${agent.id}`, relative: agent.file })),
+        ...config.commands.map((command) => ({ kind: `command ${command.id}`, relative: command.file })),
+    ];
+    for (const item of referenced) {
+        const safe = assertSafeRelativePath(item.relative);
+        if (!await exists(path.join(canonfigDir, safe))) {
+            diagnostics.push({
+                level: "error",
+                code: "SOURCE_MISSING",
+                path: `.canonfig/${safe}`,
+                message: `Missing source for ${item.kind}: .canonfig/${safe}`,
+            });
+        }
+    }
+    const skillNames = new Map();
+    for (const rootRelative of config.skills.roots) {
+        const safeRoot = assertSafeRelativePath(rootRelative);
+        const absoluteRoot = path.join(canonfigDir, safeRoot);
+        if (!await exists(absoluteRoot)) {
+            diagnostics.push({
+                level: "info",
+                code: "SKILL_ROOT_MISSING",
+                path: `.canonfig/${safeRoot}`,
+                message: `Skill root .canonfig/${safeRoot} does not exist; it contributes no skills.`,
+            });
+            continue;
+        }
+        const manifests = (await walkFiles(absoluteRoot)).filter((file) => path.basename(file) === "SKILL.md");
+        for (const manifest of manifests.sort()) {
+            const relative = `.canonfig/${safeRoot}/${manifest}`;
+            try {
+                const source = await fs.readFile(path.join(absoluteRoot, manifest), "utf8");
+                const parsed = parseSkill(source);
+                const directoryName = path.basename(path.dirname(manifest));
+                if (parsed.data.name !== directoryName) {
+                    diagnostics.push({
+                        level: "warning",
+                        code: "SKILL_NAME_DIRECTORY_MISMATCH",
+                        path: relative,
+                        message: `Skill name ${parsed.data.name} does not match its directory ${directoryName}.`,
+                    });
+                }
+                const previous = skillNames.get(parsed.data.name);
+                if (previous) {
+                    diagnostics.push({
+                        level: "error",
+                        code: "SKILL_NAME_DUPLICATE",
+                        path: relative,
+                        message: `Skill name ${parsed.data.name} is duplicated by ${previous} and ${relative}.`,
+                    });
+                }
+                else {
+                    skillNames.set(parsed.data.name, relative);
+                }
+            }
+            catch (error) {
+                diagnostics.push({
+                    level: "error",
+                    code: "SKILL_INVALID",
+                    path: relative,
+                    message: `Invalid Agent Skill manifest ${relative}: ${error instanceof Error ? error.message : String(error)}`,
+                });
+            }
+        }
+    }
+    for (const hook of config.hooks) {
+        if (hook.matcher.inputRegex) {
+            try {
+                new RegExp(hook.matcher.inputRegex);
+            }
+            catch (error) {
+                diagnostics.push({
+                    level: "error",
+                    code: "HOOK_REGEX_INVALID",
+                    message: `Hook ${hook.id} has an invalid inputRegex: ${error instanceof Error ? error.message : String(error)}`,
+                });
+            }
+        }
+    }
+    for (const [name, server] of Object.entries(config.mcp.servers)) {
+        const values = server.transport === "stdio" ? Object.values(server.env) : Object.values(server.headers);
+        for (const value of values) {
+            if (typeof value !== "string" && value.default !== undefined) {
+                diagnostics.push({
+                    level: "warning",
+                    code: "SECRET_DEFAULT_PRESENT",
+                    message: `MCP server ${name} gives ${value.fromEnv} a default value. Generated files may therefore contain a credential-like literal.`,
+                });
+            }
+        }
+    }
+    return diagnostics;
+}

package/dist/harness-configuration/templates/runtime.js

@@ -0,0 +1,212 @@
+export const AMP_PLUGIN_EVENT_MAP = {
+    before_tool: "tool.call",
+    after_tool: "tool.result",
+    session_start: "session.start",
+    before_agent: "agent.start",
+    after_agent: "agent.end",
+};
+export const PI_PLUGIN_EVENT_MAP = {
+    before_tool: "tool_call",
+    after_tool: "tool_result",
+    session_start: "session_start",
+    session_end: "session_shutdown",
+    before_agent: "before_agent_start",
+    before_compact: "session_before_compact",
+    stop: "agent_end",
+};
+export function hookRegistryJson(hooks) {
+    return `${JSON.stringify({ version: 1, hooks }, null, 2)}\n`;
+}
+export function hookRunnerSource() {
+    return `#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const runtimeDir = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(runtimeDir, "../..");
+let registry;
+try { registry = JSON.parse(fs.readFileSync(path.join(runtimeDir, "hooks.json"), "utf8")); }
+catch { process.exit(0); }
+const hooks = Array.isArray(registry?.hooks) ? registry.hooks : [];
+const args = process.argv.slice(2);
+const arg = (name) => { const index = args.indexOf(name); return index >= 0 ? args[index + 1] : undefined; };
+const hookId = arg("--hook");
+const target = arg("--target") || "unknown";
+const event = arg("--event") || "unknown";
+const hook = hooks.find((candidate) => candidate.id === hookId && candidate.enabled !== false);
+if (!hook) process.exit(0);
+
+let rawText = "";
+try { rawText = fs.readFileSync(0, "utf8"); } catch { rawText = ""; }
+let raw;
+try { raw = rawText.trim() ? JSON.parse(rawText) : {}; } catch { raw = { raw: rawText }; }
+const toolName = String(raw.tool_name ?? raw.toolName ?? raw.tool ?? raw.name ?? raw.input?.tool ?? raw.input?.toolName ?? "");
+const toolInput = raw.tool_input ?? raw.toolInput ?? raw.input ?? raw.args ?? {};
+const serialized = JSON.stringify({ toolName, toolInput, raw });
+
+const capabilityPatterns = {
+  shell: /(bash|shell|terminal|execute|exec|command|run_command)/i,
+  read: /(read|view|cat|glob|grep|search|list|find)/i,
+  write: /(write|edit|patch|create|delete|move|replace)/i,
+  search: /(grep|glob|search|find|list)/i,
+  web: /(web|fetch|browser|http)/i,
+  mcp: /(mcp|server)/i,
+  subagent: /(task|agent|subagent)/i,
+  test: /(test|spec|check|verify)/i,
+  git: /(git|commit|branch|diff|push|pull)/i,
+};
+const matchesTool = !hook.matcher?.tools?.length || hook.matcher.tools.some((name) => {
+  if (name === toolName) return true;
+  try { return new RegExp(name).test(toolName); } catch { return false; }
+});
+const matchesCapability = !hook.matcher?.capabilities?.length || hook.matcher.capabilities.some((capability) => capabilityPatterns[capability]?.test(toolName));
+let matchesInput = true;
+if (hook.matcher?.inputRegex) {
+  try { matchesInput = new RegExp(hook.matcher.inputRegex).test(serialized); }
+  catch (error) { console.error(\`Invalid inputRegex for hook \${hook.id}: \${error.message}\`); process.exit(2); }
+}
+if (!matchesTool || !matchesCapability || !matchesInput) process.exit(0);
+
+const normalized = {
+  version: 1,
+  hookId: hook.id,
+  target,
+  event,
+  repositoryRoot: repoRoot,
+  toolName,
+  toolInput,
+  raw,
+};
+const [command, ...commandArgs] = hook.run;
+const result = spawnSync(command, commandArgs, {
+  cwd: repoRoot,
+  env: {
+    ...process.env,
+    CANONFIG_ROOT: repoRoot,
+    CANONFIG_HOOK_ID: hook.id,
+    CANONFIG_TARGET: target,
+    CANONFIG_EVENT: event,
+    CANONFIG_TOOL_NAME: toolName,
+  },
+  input: JSON.stringify(normalized),
+  encoding: "utf8",
+  timeout: hook.timeoutMs,
+  maxBuffer: 16 * 1024 * 1024,
+});
+
+let output;
+try { output = result.stdout?.trim() ? JSON.parse(result.stdout) : undefined; } catch { output = undefined; }
+const reason = String(output?.reason ?? result.stderr?.trim() ?? result.error?.message ?? \`Canonfig hook \${hook.id} failed\`);
+const denied = result.status === 2 || output?.decision === "deny" || output?.permission === "deny" || output?.block === true;
+const failed = result.error || result.status === null || (result.status !== 0 && result.status !== 2);
+if (denied || (failed && hook.onFailure === "block")) {
+  console.error(reason);
+  process.exit(2);
+}
+if (failed && hook.onFailure === "warn") console.error(reason);
+if (output?.message) console.log(String(output.message));
+else if (result.stdout && !output) process.stdout.write(result.stdout);
+process.exit(0);
+`;
+}
+function pluginPreamble(target) {
+    return `// Generated by Canonfig. Edit .canonfig/harness.yaml instead.
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFile } from "node:child_process";
+
+function findRoot() {
+  let current = path.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    if (fs.existsSync(path.join(current, ".canonfig", ".runtime", "hook-runner.mjs"))) return current;
+    const parent = path.dirname(current);
+    if (parent === current) return process.cwd();
+    current = parent;
+  }
+}
+const root = findRoot();
+function runCanonfig(hookId, event, payload, timeoutMs) {
+  return new Promise((resolve) => {
+    const runner = path.join(root, ".canonfig", ".runtime", "hook-runner.mjs");
+    const child = execFile(
+      process.execPath,
+      [runner, "--hook", hookId, "--target", "${target}", "--event", event],
+      {
+        cwd: root,
+        encoding: "utf8",
+        timeout: Math.max(1, timeoutMs + 1000),
+        maxBuffer: 16 * 1024 * 1024,
+      },
+      (error, stdout, stderr) => {
+        const reason = String(stderr || stdout || error?.message || "Blocked by Canonfig hook").trim();
+        resolve({ blocked: error !== null, reason });
+      },
+    );
+    child.stdin?.on("error", () => {});
+    child.stdin?.end(JSON.stringify(payload ?? {}));
+  });
+}
+`;
+}
+export function ampPluginSource(hooks, agents = []) {
+    const enabled = hooks.filter((hook) => hook.enabled);
+    const registrations = enabled.map((hook) => {
+        const event = AMP_PLUGIN_EVENT_MAP[hook.event];
+        if (!event)
+            return "";
+        const rejection = event === "tool.call"
+            ? "if (result.blocked) return { action: \"reject-and-continue\", message: result.reason };"
+            : "if (result.blocked) throw new Error(result.reason);";
+        return `  amp.on(${JSON.stringify(event)}, async (payload) => { const result = await runCanonfig(${JSON.stringify(hook.id)}, ${JSON.stringify(hook.event)}, payload, ${hook.timeoutMs}); ${rejection} });`;
+    }).filter(Boolean);
+    const agentRegistrations = agents.flatMap(({ agent, content, tools }) => {
+        const variable = `canonfigAgent_${agent.id.replaceAll(/[^A-Za-z0-9_$]/g, "_")}`;
+        const toolName = `canonfig_${agent.id.replaceAll(/[^A-Za-z0-9_]/g, "_")}_subagent`;
+        const definition = [
+            `  const ${variable} = amp.createAgent({`,
+            `    name: ${JSON.stringify(agent.id)},`,
+            ...(agent.model === "inherit" ? [] : [`    model: ${JSON.stringify(agent.model)},`]),
+            `    instructions: ${JSON.stringify(content.trim())},`,
+            `    tools: ${tools?.length ? JSON.stringify(tools) : JSON.stringify("all")},`,
+            `    display: { label: ${JSON.stringify(agent.id)} },`,
+            "  });",
+            "",
+            "  amp.registerTool({",
+            `    name: ${JSON.stringify(toolName)},`,
+            `    description: ${JSON.stringify(agent.description)},`,
+            "    inputSchema: { type: \"object\", properties: { request: { type: \"string\" } }, required: [\"request\"] },",
+            "    async execute(input, ctx) {",
+            "      const request = typeof input.request === \"string\" ? input.request : \"\";",
+            "      if (!request.trim()) return \"Missing subagent request.\";",
+            `      const result = await ${variable}.run(request, { parentThreadID: ctx.thread.id, timeoutMs: 10 * 60 * 1000 });`,
+            "      return result.text;",
+            "    },",
+            "  });",
+        ];
+        return definition;
+    });
+    return `${pluginPreamble("amp")}\nimport type { PluginAPI } from "@ampcode/plugin";\n\nexport default function canonfig(amp: PluginAPI) {\n${[...registrations, ...agentRegistrations].join("\n")}\n}\n`;
+}
+export function piPluginSource(target, hooks) {
+    const registrations = hooks.filter((hook) => hook.enabled).map((hook) => {
+        const event = PI_PLUGIN_EVENT_MAP[hook.event];
+        if (!event)
+            return "";
+        const result = hook.event === "before_tool"
+            ? "if (result.blocked) return { block: true, reason: result.reason };"
+            : "if (result.blocked) throw new Error(result.reason);";
+        return `  pi.on(${JSON.stringify(event)}, async (payload) => { const result = await runCanonfig(${JSON.stringify(hook.id)}, ${JSON.stringify(hook.event)}, payload, ${hook.timeoutMs}); ${result} });`;
+    }).filter(Boolean).join("\n");
+    const packageName = target === "pi" ? "@earendil-works/pi-coding-agent" : "@oh-my-pi/pi-coding-agent";
+    return `${pluginPreamble(target)}\nimport type { ExtensionAPI } from ${JSON.stringify(packageName)};\n\nexport default function canonfig(pi: ExtensionAPI) {\n${registrations}\n}\n`;
+}
+export function openCodePluginSource(target, hooks) {
+    const before = hooks.filter((hook) => hook.enabled && hook.event === "before_tool");
+    const after = hooks.filter((hook) => hook.enabled && hook.event === "after_tool");
+    const beforeBody = before.map((hook) => `      { const result = await runCanonfig(${JSON.stringify(hook.id)}, "before_tool", { ...input, ...output }, ${hook.timeoutMs}); if (result.blocked) throw new Error(result.reason); }`).join("\n");
+    const afterBody = after.map((hook) => `      { const result = await runCanonfig(${JSON.stringify(hook.id)}, "after_tool", { ...input, ...output }, ${hook.timeoutMs}); if (result.blocked) throw new Error(result.reason); }`).join("\n");
+    return `${pluginPreamble(target)}\nexport const CanonfigPlugin = async () => ({\n  "tool.execute.before": async (input, output) => {\n${beforeBody}\n  },\n  "tool.execute.after": async (input, output) => {\n${afterBody}\n  },\n});\n`;
+}

package/dist/runtime/main.js

@@ -2,6 +2,7 @@
 import { NodeRuntime } from "@effect/platform-node";
 import { Effect } from "effect";
 import { evaluateCli, runCli } from "../cli/cli.js";
+import { isHarnessConfigurationCommand, runHarnessConfigurationCli, } from "../harness-configuration/cli.js";
 const warningListeners = process.listeners("warning");
 process.removeAllListeners("warning");
 process.on("warning", (warning) => {
@@ -19,20 +20,25 @@ const nodeCliIo = {
     },
 };
 const arguments_ = process.argv.slice(2);
-const outcome = evaluateCli(arguments_);
-if (outcome._tag === "Command") {
-    NodeRuntime.runMain(Effect.promise(() => import("./layers.js")).pipe(Effect.flatMap(({ runtimeLayer }) => runCli(arguments_, nodeCliIo).pipe(Effect.andThen(outcome.command._tag === "SourceServe"
-        ? Effect.never
-        : Effect.void), Effect.provide(runtimeLayer())))));
+if (isHarnessConfigurationCommand(arguments_)) {
+    NodeRuntime.runMain(Effect.promise(() => runHarnessConfigurationCli(arguments_.slice(1), nodeCliIo)));
 }
 else {
-    NodeRuntime.runMain(Effect.sync(() => {
-        if (outcome._tag === "Help" || outcome._tag === "Version") {
-            nodeCliIo.writeStdout(`${outcome.text}\n`);
-        }
-        else {
-            nodeCliIo.writeStderr(`${outcome.message}\n`);
-        }
-        nodeCliIo.setExitCode(outcome.exitCode);
-    }));
+    const outcome = evaluateCli(arguments_);
+    if (outcome._tag === "Command") {
+        NodeRuntime.runMain(Effect.promise(() => import("./layers.js")).pipe(Effect.flatMap(({ runtimeLayer }) => runCli(arguments_, nodeCliIo).pipe(Effect.andThen(outcome.command._tag === "SourceServe"
+            ? Effect.never
+            : Effect.void), Effect.provide(runtimeLayer())))));
+    }
+    else {
+        NodeRuntime.runMain(Effect.sync(() => {
+            if (outcome._tag === "Help" || outcome._tag === "Version") {
+                nodeCliIo.writeStdout(`${outcome.text}\n`);
+            }
+            else {
+                nodeCliIo.writeStderr(`${outcome.message}\n`);
+            }
+            nodeCliIo.setExitCode(outcome.exitCode);
+        }));
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microck/canonfig",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "one-way configuration synchronizer: publish a canonical AI agent setup from one Source Machine and converge Linux, macOS, and Windows Follower Machines",
   "author": "Microck <contact@micr.dev>",
   "license": "MIT",
@@ -47,15 +47,15 @@
     "website:build": "npm run build --workspace @canonfig/website"
   },
   "dependencies": {
-    "@effect/platform-node": "4.0.0-rc.109",
-    "@effect/sql-sqlite-node": "4.0.0-rc.109",
-    "effect": "4.0.0-rc.109",
+    "@effect/platform-node": "4.0.0-rc.112",
+    "@effect/sql-sqlite-node": "4.0.0-rc.112",
+    "effect": "4.0.0-rc.112",
     "selfsigned": "^5.5.0",
     "smol-toml": "1.6.1",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@effect/vitest": "4.0.0-rc.109",
+    "@effect/vitest": "4.0.0-rc.112",
     "@oxlint/plugins": "1.78.0",
     "@types/node": "24.10.1",
     "oxlint": "1.78.0",