@noimosai/platform-mcp 0.1.3 → 0.1.5

package/dist/cli/project-sync.js

@@ -0,0 +1,265 @@
+import { createHash } from "node:crypto";
+import { realpath, unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+import { PlatformClient } from "../client/index.js";
+import { localProfilePath, readLocalProfile, readPrivateJson, writePrivateJson, runtimeConfig } from "../client/local-profile.js";
+import { localProjectProfile } from "../client/local-projects.js";
+import { platformTeamSkillSummarySchema, teamItemTargets, teamSkillKindNeedsAdmin } from "../schema/platformTeamSkills.js";
+import { withProfileLock } from "./setup-lock.js";
+import { syncTeamSkills, teamSkillsUseScripts } from "./team-skills.js";
+import { TEAM_HARNESSES, assertHarnessProjectSwitch, harnessRoots, harnessesPresent, readCustomHarnesses, syncTeamHarness, teamHarnessUsesScripts } from "./team-harness.js";
+import { harnessView } from "./team-harness-targets.js";
+const metadataSchema = platformTeamSkillSummarySchema.pick({ slug: true, name: true, kind: true, adminOnly: true, harnesses: true, version: true });
+const sha = z.string().regex(/^[a-f0-9]{64}$/);
+const receiptSchema = z.object({ client: z.string().min(1).max(32), projectId: z.string().min(1).max(256), roots: sha,
+    items: z.array(metadataSchema).max(10000), scriptsAllowed: z.boolean() }).strict();
+const stateSchema = z.object({ managedBy: z.literal("relvo-cli"), version: z.literal(1), installationId: z.string(), apiUrl: z.string(), consoleUrl: z.string(), local: z.boolean(),
+    enabled: z.boolean(), receipts: z.array(receiptSchema).max(32), dismissed: z.array(sha).max(50) }).strict();
+const statePath = (path) => join(dirname(path), "project-sync.json");
+const maximumBytes = 32 * 1024 * 1024;
+const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const metadata = (item) => {
+    const parsed = metadataSchema.parse(item);
+    return { ...parsed, harnesses: [...parsed.harnesses].sort() };
+};
+const missing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
+const binding = (profile) => ({ installationId: profile.installationId, apiUrl: profile.apiUrl, consoleUrl: profile.consoleUrl, local: profile.local });
+async function readState(path, profile) {
+    try {
+        const saved = stateSchema.parse(await readPrivateJson(statePath(path), maximumBytes));
+        const sameApi = saved.apiUrl === profile.apiUrl || !saved.local && !profile.local && /(^|\.)relvo\.si$/.test(new URL(profile.apiUrl).hostname);
+        if (saved.installationId !== profile.installationId || !sameApi || saved.consoleUrl !== profile.consoleUrl || saved.local !== profile.local)
+            throw new Error("Different installation");
+        if (new Set(saved.receipts.map(receipt => receipt.client)).size !== saved.receipts.length)
+            throw new Error("Duplicate targets");
+        return { ...saved, apiUrl: profile.apiUrl };
+    }
+    catch (error) {
+        if (missing(error))
+            return { managedBy: "relvo-cli", version: 1, ...binding(profile), enabled: true, receipts: [], dismissed: [] };
+        throw new Error("Relvo project sync state is unsafe, unreadable or belongs to another installation. No project files were changed.");
+    }
+}
+const writeState = (path, state) => writePrivateJson(statePath(path), stateSchema.parse(state), true, maximumBytes);
+export async function removeOwnedProjectSyncState(path, installationId) {
+    try {
+        const saved = stateSchema.parse(await readPrivateJson(statePath(path), maximumBytes));
+        if (saved.installationId !== installationId)
+            return "preserved";
+        await unlink(statePath(path));
+        return "removed";
+    }
+    catch (error) {
+        return missing(error) ? "missing" : "preserved";
+    }
+}
+export async function invalidateProjectSyncReceipts(path, targetProjectId) {
+    const profile = await readLocalProfile(path);
+    if (!profile || profile.state !== "ready")
+        return;
+    const state = await readState(path, profile);
+    const receipts = state.receipts.filter(receipt => receipt.projectId === targetProjectId);
+    if (receipts.length !== state.receipts.length)
+        await writeState(path, { ...state, receipts });
+}
+async function targets(roots, profile, selected = "all") {
+    const names = [...TEAM_HARNESSES, ...roots.custom.map(entry => entry.name)];
+    const clients = selected === "all" ? [...new Set([
+            ...profile.registrations.length ? profile.registrations.map(entry => entry.client) : ["claude", "codex"],
+            ...(await harnessesPresent(roots)).filter(name => name !== "claude" && name !== "codex"),
+        ])] : [...new Set(selected.split(",").map(name => name.trim()))];
+    const unknown = clients.filter(name => !names.includes(name));
+    if (!clients.length || unknown.length)
+        throw new Error(`Unknown agent ${unknown.join(", ") || "(none)"}. Use all or a comma list of ${names.join(", ")}.`);
+    return clients.sort();
+}
+const rootDigest = (roots, name) => {
+    const view = harnessView(roots, name);
+    return digest({ like: view.like, dir: view.roots.dirs[view.like], agents: view.roots.agents[view.like] });
+};
+const forTarget = (items, roots, name) => items.filter(item => teamItemTargets(item.harnesses, harnessView(roots, name).like));
+function reviewedReader(client, items) {
+    return {
+        teamSkills: async (kind) => ({ data: { skills: kind === "all" ? items : items.filter(item => item.kind === (kind ?? "skill")) } }),
+        teamSkill: async (slug) => {
+            const wanted = items.find(item => item.slug === slug);
+            if (!wanted)
+                throw new Error("This item was not in the approved snapshot. Check changes again before syncing.");
+            const value = await client.teamSkill(slug);
+            if (digest(metadata(value.data.skill)) !== digest(metadata(wanted)))
+                throw new Error("A project item changed during sync. Some earlier files may have been synced; check changes again and approve the new snapshot before retrying.");
+            return value;
+        },
+    };
+}
+async function synchronize(path, profile, roots, clients, client, items, allowScripts, state, env) {
+    const projectId = profile.grant.developerProjectId, reader = reviewedReader(client, items);
+    await assertHarnessProjectSwitch(roots, clients, projectId);
+    const skills = await syncTeamSkills(roots.home, clients, projectId, reader, allowScripts, roots);
+    const harness = await syncTeamHarness(roots, clients, projectId, reader, allowScripts, env);
+    const results = clients.map(name => {
+        const shared = skills.find(result => !result.root && (result.client === name || result.alsoFor?.includes(name)));
+        const own = skills.find(result => result.root && result.client === name), ownSkills = own ? { ownSkills: own } : {};
+        if (!shared)
+            return { client: name, ...ownSkills, harness: harness[name] };
+        return shared.client === name ? { ...shared, ...ownSkills, harness: harness[name] } : { client: name, skillsSharedWith: shared.client, ...ownSkills, harness: harness[name] };
+    });
+    const receipts = clients.map(name => ({ client: name, projectId, roots: rootDigest(roots, name), items: forTarget(items.map(metadata), roots, name), scriptsAllowed: allowScripts }));
+    const configured = [...TEAM_HARNESSES, ...roots.custom.map(entry => entry.name)];
+    await writeState(path, { ...state, receipts: [...state.receipts.filter(receipt => !clients.includes(receipt.client) && configured.includes(receipt.client)), ...receipts] });
+    const all = [...skills, ...Object.values(harness), ...Object.values(harness).flatMap(result => result.folders ? [result.folders] : [])];
+    const kept = [...skills.flatMap(result => result.kept.map(entry => ({ path: entry.folder, reason: entry.reason }))),
+        ...Object.values(harness).flatMap(result => [...result.kept, ...result.folders?.kept ?? []])];
+    const archived = [...skills.flatMap(result => (result.archived ?? []).map(entry => ({ path: entry.folder, backup: entry.backup }))),
+        ...Object.values(harness).flatMap(result => [...result.archived ?? [], ...result.folders?.archived ?? []])];
+    const notSupported = Object.values(harness).flatMap(result => result.notSupported ?? []);
+    return { results, summary: { projectId, clients, written: all.reduce((sum, result) => sum + result.written.length, 0), unchanged: all.reduce((sum, result) => sum + result.unchanged.length, 0),
+            removed: all.reduce((sum, result) => sum + result.removed.length, 0), keptCount: kept.length, kept: kept.slice(0, 10),
+            archivedCount: archived.length, archived: archived.slice(0, 10), archiveDirectory: join(dirname(path), "project-archives"),
+            notSupportedCount: notSupported.length, notSupported: notSupported.slice(0, 10),
+            scriptsWithheld: skills.flatMap(result => [...result.scriptsNotExecutable ?? [], ...result.settingsWithheld ?? []]).length
+                + Object.values(harness).reduce((sum, result) => sum + (result.settingsWithheld?.length ?? 0) + (result.notInstalled?.length ?? 0) + (result.folders?.scriptsNotExecutable?.length ?? 0), 0),
+            detailsTruncated: kept.length > 10 || archived.length > 10 || notSupported.length > 10, reloadRequired: true,
+            next: "Reload your agent's skills/settings or start a fresh session. Kept edits, unsupported items and withheld settings were not replaced. Archives remain in archiveDirectory." } };
+}
+async function context(path, env, options = {}) {
+    const home = await realpath(options.home ?? homedir()), now = options.now ?? Date.now;
+    if (path !== localProfilePath(home))
+        throw new Error("Use the managed profile belonging to this home directory before syncing files.");
+    let profile = await readLocalProfile(path);
+    if (!profile || profile.state !== "ready" || profile.pendingAck)
+        throw new Error("Complete or renew relvo setup before syncing project files.");
+    if (options.projectId)
+        profile = await localProjectProfile(path, options.projectId, env, options.transport, now());
+    else
+        await runtimeConfig(env, "cli", path, true);
+    if (Date.parse(profile.grant.expiresAt) <= now())
+        throw new Error("Complete or renew relvo setup before syncing project files.");
+    const roots = harnessRoots(home, env, await readCustomHarnesses(home));
+    return { profile, roots, clients: await targets(roots, profile, options.selected), state: await readState(path, profile) };
+}
+async function inspect(client, profile, verifyProject = true) {
+    if (verifyProject) {
+        const { data } = await client.project();
+        if (data.developerProjectId !== profile.grant.developerProjectId || data.developerOrganizationId !== profile.grant.developerOrganizationId)
+            throw new Error("The saved login does not match this project. No project files were changed.");
+    }
+    const items = (await client.teamSkills("all")).data.skills.sort((a, b) => a.slug.localeCompare(b.slug));
+    if (new Set(items.map(item => item.slug)).size !== items.length)
+        throw new Error("The project returned duplicate items. No project files were changed.");
+    return items;
+}
+export async function syncProjectFiles(path, env, options = {}) {
+    return withProfileLock(path, async () => {
+        const { profile, roots, clients, state } = await context(path, env, options);
+        const client = new PlatformClient({ apiUrl: profile.apiUrl, apiKey: profile.grant.apiKey, local: profile.local, source: "cli" }, options.transport);
+        const items = await inspect(client, profile);
+        return (await synchronize(path, profile, roots, clients, client, items, options.allowScripts === true, state, env)).results;
+    });
+}
+function review(profile, roots, clients, items, state, scriptsPreviouslyAllowed) {
+    const projectId = profile.grant.developerProjectId, changes = [];
+    for (const name of clients) {
+        const saved = state.receipts.find(receipt => receipt.client === name && receipt.projectId === projectId && receipt.roots === rootDigest(roots, name));
+        const previous = saved?.items ?? [], current = forTarget(items, roots, name);
+        for (const item of current) {
+            const before = previous.find(entry => entry.slug === item.slug);
+            if (!before || digest(before) !== digest(item))
+                changes.push({ slug: item.slug, kind: item.kind, version: item.version, requiresScriptApproval: item.adminOnly || teamSkillKindNeedsAdmin(item.kind), change: before ? "updated" : "added", clients: [name] });
+        }
+        for (const item of previous)
+            if (!current.some(entry => entry.slug === item.slug))
+                changes.push({ slug: item.slug, kind: item.kind, version: item.version, requiresScriptApproval: item.adminOnly || teamSkillKindNeedsAdmin(item.kind), change: "removed", clients: [name] });
+    }
+    const combined = new Map();
+    for (const change of changes) {
+        const key = `${change.slug}:${change.change}:${change.version}`, previous = combined.get(key);
+        if (previous)
+            previous.clients.push(...change.clients);
+        else
+            combined.set(key, change);
+    }
+    const receipts = clients.map(name => state.receipts.find(receipt => receipt.client === name) ?? null);
+    const snapshot = digest({ ...binding(profile), projectId, organizationId: profile.grant.developerOrganizationId, clients,
+        roots: clients.map(name => rootDigest(roots, name)), receipts, items, scriptsPreviouslyAllowed });
+    return { projectId, enabled: state.enabled, clients, snapshot, changes: [...combined.values()], dismissed: state.dismissed.includes(snapshot),
+        scriptsPreviouslyAllowed };
+}
+export function localProjectSync(path, env, options = {}) {
+    const prepare = async () => {
+        const ctx = await context(path, env, options);
+        if (options.connected && ctx.profile.grant.developerProjectId !== options.connected.projectId)
+            throw new Error("The selected project changed. Reconnect MCP before reviewing or importing local project files.");
+        if (!options.selected && options.connected) {
+            const host = options.connected.clientName()?.toLowerCase() ?? "";
+            const name = [...TEAM_HARNESSES, ...ctx.roots.custom.map(entry => entry.name)].find(candidate => host === candidate || host.startsWith(`${candidate}-`) || host.startsWith(`${candidate}_`));
+            if (name)
+                ctx.clients = await targets(ctx.roots, ctx.profile, name);
+        }
+        const client = options.connected?.client ?? new PlatformClient({ apiUrl: ctx.profile.apiUrl, apiKey: ctx.profile.grant.apiKey, local: ctx.profile.local, source: "cli" }, options.transport);
+        return { ...ctx, client };
+    };
+    let polledLogin;
+    const capture = async (ctx, poll = false) => {
+        const login = `${ctx.profile.grant.apiKey}\n${ctx.profile.grant.developerOrganizationId}\n${ctx.profile.grant.developerProjectId}`;
+        const items = (await inspect(ctx.client, ctx.profile, !poll || polledLogin !== login)).filter(item => ctx.clients.some(name => teamItemTargets(item.harnesses, harnessView(ctx.roots, name).like)));
+        if (poll)
+            polledLogin = login;
+        const scriptsPreviouslyAllowed = await teamSkillsUseScripts(ctx.roots, ctx.clients, ctx.profile.grant.developerProjectId)
+            || await teamHarnessUsesScripts(ctx.roots, ctx.clients, ctx.profile.grant.developerProjectId);
+        const current = await readLocalProfile(path);
+        if (!current || current.state !== "ready" || current.pendingAck || current.installationId !== ctx.profile.installationId || current.apiUrl !== ctx.profile.apiUrl
+            || current.consoleUrl !== ctx.profile.consoleUrl || current.local !== ctx.profile.local || current.grant.apiKey !== ctx.profile.grant.apiKey
+            || current.grant.developerProjectId !== ctx.profile.grant.developerProjectId || current.grant.developerOrganizationId !== ctx.profile.grant.developerOrganizationId)
+            throw new Error("The selected project changed during review. Reconnect MCP and check again before importing.");
+        return { items, review: review(ctx.profile, ctx.roots, ctx.clients, items.map(metadata), ctx.state, scriptsPreviouslyAllowed) };
+    };
+    const confirmed = (value) => { if (value !== true)
+        throw new Error("Ask the user for explicit approval before changing local project files or notification settings, then pass confirmedByUser:true (--yes on the CLI)."); };
+    const approvedSnapshot = (snapshot, current) => {
+        if (!sha.safeParse(snapshot).success || snapshot !== current.snapshot)
+            throw new Error("The reviewed project, versions or local targets changed. Check again and obtain approval of the new snapshot; no files were changed.");
+    };
+    return {
+        check: async () => (await capture(await prepare())).review,
+        poll: async () => {
+            if (env.RELVO_PROJECT_AUTO_SYNC === "0")
+                return undefined;
+            const ctx = await prepare();
+            return !ctx.state.enabled ? undefined : (await capture(ctx, true)).review;
+        },
+        apply: (snapshot, confirmedByUser, allowScripts, removeExecutableSettings = false) => withProfileLock(path, async () => {
+            confirmed(confirmedByUser);
+            if (allowScripts && removeExecutableSettings)
+                throw new Error("Choose whether to allow or remove executable settings, not both. No files were changed.");
+            const ctx = await prepare(), captured = await capture(ctx);
+            approvedSnapshot(snapshot, captured.review);
+            if (captured.review.scriptsPreviouslyAllowed && !allowScripts && !removeExecutableSettings)
+                throw new Error("This target was previously synced with executable settings. Read contents with platform operation:team_skill input:{slug} (full: platform_team_skill; CLI: relvo team-skills get <slug>), then separately approve allowScripts (--allow-scripts) to keep/update them or removeExecutableSettings (--remove-executable-settings) to remove the opt-in. No files were changed.");
+            return (await synchronize(path, ctx.profile, ctx.roots, ctx.clients, ctx.client, captured.items, allowScripts, ctx.state, env)).summary;
+        }),
+        dismiss: (snapshot, confirmedByUser) => withProfileLock(path, async () => {
+            confirmed(confirmedByUser);
+            const ctx = await prepare(), captured = await capture(ctx);
+            approvedSnapshot(snapshot, captured.review);
+            await writeState(path, { ...ctx.state, dismissed: [...ctx.state.dismissed.filter(value => value !== snapshot), snapshot].slice(-50) });
+            return { projectId: captured.review.projectId, snapshot, dismissed: true };
+        }),
+        configure: (enabled, confirmedByUser) => withProfileLock(path, async () => {
+            confirmed(confirmedByUser);
+            const ctx = await prepare();
+            await writeState(path, { ...ctx.state, enabled });
+            return { enabled, environmentDisabled: env.RELVO_PROJECT_AUTO_SYNC === "0", mode: "notify-and-ask", intervalSeconds: 60 };
+        }),
+    };
+}
+export const projectSyncFactory = (env = process.env, home = homedir()) => connected => localProjectSync(connected.path, env, { home, connected });
+export async function projectSyncStatus(path, env, home) {
+    return withProfileLock(path, async () => {
+        const ctx = await context(path, env, { home });
+        return { enabled: ctx.state.enabled, environmentDisabled: env.RELVO_PROJECT_AUTO_SYNC === "0", projectId: ctx.profile.grant.developerProjectId,
+            mode: "notify-and-ask", intervalSeconds: 60, reviewedClients: ctx.state.receipts.map(({ client, projectId }) => ({ client, projectId })) };
+    });
+}

package/dist/cli/setup-lock.js

@@ -0,0 +1 @@
+export { withLocalProfileLock as withProfileLock } from "../client/local-projects.js";

package/dist/cli/setup.js

@@ -0,0 +1,347 @@
+import { lstat, realpath } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+import { homedir } from "node:os";
+import { parseArgs, promisify } from "node:util";
+import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { PLATFORM_CLI_VERSION } from "./version.js";
+import { CliInputError } from "./input-error.js";
+import { PlatformClient } from "../client/index.js";
+import { LocalSetupClient, relvoApiUrl, verificationUrl } from "../client/local-setup.js";
+import { localProfilePath, readLocalProfile, readLocalInstallation, removeUnreadableProfile, windowsLocalSetupRefusal, writeLocalProfile, removeLocalProfile, runtimeConfig } from "../client/local-profile.js";
+import { completeProjectSetup, listLocalProjects, markProjectSetup, projectSetupInProgress, rememberLocalProject, removeLocalProjects, useLocalProject } from "../client/local-projects.js";
+import { agentNames, agentRegistration, preflightAgent, preflightAgents, registrationMatches, registerAgent, probeMcp, executable } from "./local-agents.js";
+import { installSkills, verifiedSkillBundle } from "./skills.js";
+import { pushTeamSkill } from "./team-skills.js";
+import { TEAM_HARNESSES, harnessKindOf, harnessRoots, pushTeamHarnessFile, readCustomHarnesses } from "./team-harness.js";
+import { withProfileLock } from "./setup-lock.js";
+import { removeOwnedUpdateState } from "./update-bootstrap.js";
+import { deactivateProjectFiles } from "./project-files.js";
+import { localProjectSync, projectSyncStatus, removeOwnedProjectSyncState, syncProjectFiles } from "./project-sync.js";
+const execute = promisify(execFile);
+const onRelvoDomain = (url) => /(^|\.)relvo\.si$/.test(new URL(url).hostname);
+async function browser(url, env) {
+    const command = process.platform === "darwin" ? "/usr/bin/open" : await executable("xdg-open", env);
+    try {
+        await execute(command, [url], { timeout: 10000, maxBuffer: 65536 });
+    }
+    catch {
+        throw new Error("Open the verification URL printed above in your browser.");
+    }
+}
+function choice(name, options, value) {
+    const chosen = options.find(option => option === value);
+    if (chosen === undefined)
+        throw new CliInputError(`--${name} takes ${options.join(", ")}`);
+    return chosen;
+}
+function uniqueOptions(tokens) {
+    const names = tokens.filter((token) => token.kind === "option").map((token) => token.name);
+    if (new Set(names).size !== names.length)
+        throw new Error("Duplicate local setup option.");
+}
+function clientFor(profile, transport) { return new PlatformClient({ apiUrl: profile.apiUrl, apiKey: profile.grant.apiKey, local: profile.local, source: "cli" }, transport); }
+async function inspectLogin(profile, transport, now) {
+    if (profile.pendingAck || Date.parse(profile.grant.expiresAt) <= now())
+        throw new Error("The saved login is incomplete or expired. Run setup to resume, or logout before starting another login.");
+    const client = clientFor(profile, transport), { data } = await client.project();
+    if (data.developerOrganizationId !== profile.grant.developerOrganizationId || data.developerProjectId !== profile.grant.developerProjectId)
+        throw new Error("The saved login does not match its approved project. No configuration was changed.");
+    await client.connections({ limit: 1 });
+    return client;
+}
+async function acknowledgeProfile(profile, setup, transport, now, path, deactivate) {
+    if (!profile.pendingAck)
+        return profile;
+    let ack;
+    try {
+        ack = await setup.acknowledge(profile.pendingAck);
+    }
+    catch (failure) {
+        if (now() <= Date.parse(profile.grant.expiresAt))
+            throw failure;
+        const observed = (await clientFor(profile, transport).project()).data;
+        if (observed.developerOrganizationId !== profile.grant.developerOrganizationId || observed.developerProjectId !== profile.grant.developerProjectId)
+            throw new Error("The saved approval could not be recovered for its original project.");
+        const { apiKey, status, ...metadata } = profile.grant;
+        void apiKey;
+        void status;
+        ack = { ...metadata, status: "acknowledged", expiresAt: metadata.approvedExpiresAt };
+    }
+    if (ack.apiKeyId !== profile.grant.apiKeyId || ack.developerProjectId !== profile.grant.developerProjectId || ack.developerOrganizationId !== profile.grant.developerOrganizationId ||
+        ack.approvedExpiresAt !== profile.grant.approvedExpiresAt || ack.expiresAt !== profile.grant.approvedExpiresAt || JSON.stringify([...ack.scopes].sort()) !== JSON.stringify([...profile.grant.scopes].sort()))
+        throw new Error("Relvo acknowledgement did not match the saved approval.");
+    const { pendingAck, ...saved } = profile;
+    void pendingAck;
+    const ready = { ...saved, grant: { ...saved.grant, expiresAt: ack.expiresAt, approvedExpiresAt: ack.approvedExpiresAt } };
+    const observed = (await clientFor(ready, transport).project()).data;
+    if (observed.developerOrganizationId !== ready.grant.developerOrganizationId || observed.developerProjectId !== ready.grant.developerProjectId)
+        throw new Error("The saved login does not match its approved project. No configuration was changed.");
+    await deactivate(ready.grant.developerProjectId);
+    await writeLocalProfile(path, ready);
+    return ready;
+}
+export async function runLocalCommand(args, env, output, transport, options = {}) {
+    if (process.platform === "win32")
+        throw new Error(windowsLocalSetupRefusal);
+    const home = await realpath(options.home ?? homedir()), path = localProfilePath(home), now = options.now ?? Date.now;
+    const deactivate = (id) => deactivateProjectFiles(id, env, home);
+    const wait = options.wait ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    if (args[0] === "project") {
+        if (args.length === 2 && args[1] === "list") {
+            output(JSON.stringify({ projects: await listLocalProjects(path, now()) }));
+            return;
+        }
+        if (args.length === 3 && args[1] === "use" && args[2].trim() && !args[2].startsWith("-")) {
+            const project = await useLocalProject(path, args[2], env, "cli", transport, now(), deactivate);
+            output(JSON.stringify({ project, restartMcp: true, next: "Previous managed project files were deactivated. Reconnect Relvo MCP and start a fresh agent session to avoid old project instructions. Run relvo team-skills sync when you approve importing the new project's files; executable files still require --allow-scripts." }));
+            return;
+        }
+        if (args[1] === "add") {
+            const { values, tokens } = parseArgs({ args: args.slice(2), tokens: true, options: { project: { type: "string" }, "no-browser": { type: "boolean" } } });
+            uniqueOptions(tokens);
+            if (values.project !== undefined && !values.project.trim())
+                throw new Error("Provide a project ID after --project.");
+            const saved = await readLocalProfile(path);
+            if (!saved)
+                throw new Error("Run relvo setup with your API and console URLs before adding another project.");
+            return runLocalCommand(["setup", "--api-url", saved.apiUrl, "--console-url", saved.consoleUrl, "--client", "terminal", "--new-project",
+                ...(values.project ? ["--project", values.project.trim()] : []), ...(saved.local ? ["--local"] : []), ...(values["no-browser"] ? ["--no-browser"] : [])], env, output, transport, options);
+        }
+        throw new Error("Usage: relvo project list | add [--project <project-id>] [--no-browser] | use <project-id>");
+    }
+    if (args[0] === "setup" || args[0] === "login") {
+        const { values, tokens } = parseArgs({ args: args.slice(1), tokens: true, options: { "api-url": { type: "string" }, "console-url": { type: "string" }, client: { type: "string" }, "mcp-runtime": { type: "string" }, local: { type: "boolean" }, "no-browser": { type: "boolean" }, "new-project": { type: "boolean" }, project: { type: "string" } } });
+        uniqueOptions(tokens);
+        const requested = choice("client", ["auto", "claude", "codex", "terminal"], values.client ?? "auto");
+        const runtime = choice("mcp-runtime", ["registry", "installed"], values["mcp-runtime"] ?? "registry");
+        let installedEntrypoint;
+        if (runtime === "installed") {
+            const entrypoint = options.installedMcpEntrypoint;
+            if (requested === "terminal" || !entrypoint || !isAbsolute(entrypoint))
+                throw new Error("Use --mcp-runtime installed with a packaged Relvo CLI and --client auto|claude|codex.");
+            const info = await lstat(entrypoint);
+            if (!info.isFile() || info.isSymbolicLink() || info.mode & 0o022 || typeof process.getuid === "function" && ![0, process.getuid()].includes(info.uid))
+                throw new Error("The installed MCP runtime has unsafe ownership or permissions.");
+            installedEntrypoint = await realpath(entrypoint);
+        }
+        const saved = values["api-url"] || values["console-url"] ? null : await readLocalProfile(path);
+        const local = values.local || saved?.local, requestedApi = values["api-url"] ?? saved?.apiUrl, requestedConsole = values["console-url"] ?? saved?.consoleUrl;
+        if (!requestedApi || !requestedConsole)
+            throw new Error("A first setup needs --api-url and --console-url. Copy the whole setup command from the Relvo console's onboarding page.");
+        const apiUrl = relvoApiUrl(requestedApi, local), consoleUrl = relvoApiUrl(requestedConsole, local);
+        if (new URL(consoleUrl).pathname !== "/")
+            throw new Error("--console-url must be the trusted Relvo console origin.");
+        if (local && [apiUrl, consoleUrl].some((url) => !["localhost", "127.0.0.1", "[::1]"].includes(new URL(url).hostname)))
+            throw new Error("--local requires loopback API and console URLs.");
+        const preparedVersion = options.version ?? PLATFORM_CLI_VERSION;
+        if (!/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(preparedVersion))
+            throw new Error("The prepared Relvo package version is invalid.");
+        output("[1/4] Check the local environment and existing connection.\nRerun the same setup command after an interruption to resume safely.");
+        const agents = await preflightAgents(requested, env, home, runtime === "registry", output);
+        if (installedEntrypoint && !agents.length)
+            throw new Error("Use --mcp-runtime installed with a packaged Relvo CLI and --client auto|claude|codex.");
+        const selected = agents.length > 1 ? "agents" : agents[0]?.client ?? "terminal";
+        await withProfileLock(path, async () => {
+            let profile = await readLocalProfile(path);
+            if (profile && ((profile.apiUrl !== apiUrl && (profile.local || !onRelvoDomain(apiUrl))) || profile.consoleUrl !== consoleUrl || profile.local !== Boolean(local)))
+                throw new Error("A different Relvo login already owns this local profile. Log out explicitly before changing servers.");
+            if (!profile)
+                await removeLocalProjects(path);
+            const installation = profile ?? await readLocalInstallation(path);
+            const installationId = installation?.installationId ?? randomBytes(12).toString("hex");
+            const plans = [];
+            for (const { client, agent, launcher } of agents) {
+                const recorded = installation?.registrations.find((entry) => entry.client === client);
+                const installed = installedEntrypoint ? { client, name: `relvo-${installationId}`, command: await realpath(process.execPath), args: [installedEntrypoint, "--profile", path] } : null;
+                if (installed && recorded && (recorded.command !== installed.command || JSON.stringify(recorded.args) !== JSON.stringify(installed.args)))
+                    throw new Error(`A different MCP runtime already owns the ${agentNames[client]} registration. It was preserved; use its original setup command.`);
+                const planned = recorded ?? installed ?? { client, name: `relvo-${installationId}`, command: launcher, args: ["--yes", "--ignore-scripts", "--registry=https://registry.npmjs.org", "--@relvo:registry=https://registry.npmjs.org", `--package=@relvo/cli@${preparedVersion}`, "relvo", "mcp", "--profile", path] };
+                if (await agentRegistration(client, agent, env, home, "relvo"))
+                    throw new Error(`An existing fixed-name Relvo MCP entry in ${agentNames[client]} was preserved. Remove or rename it explicitly before automatic setup to avoid duplicate connections.`);
+                const existing = await agentRegistration(client, agent, env, home, planned.name);
+                if (existing && (!recorded || !registrationMatches(existing, recorded)))
+                    throw new Error(`An unmanaged or changed relvo MCP server already exists in ${agentNames[client]}. Remove or rename it explicitly in your agent before setup.`);
+                plans.push({ agent, planned, existing });
+            }
+            if (profile && profile.apiUrl !== apiUrl) {
+                profile = { ...profile, apiUrl };
+                await writeLocalProfile(path, profile);
+            }
+            const setup = new LocalSetupClient(apiUrl, local, transport);
+            output("[2/4] Approve and verify the private login.");
+            if (profile?.state === "ready")
+                profile = await acknowledgeProfile(profile, setup, transport, now, path, deactivate);
+            const resumeProjectSetup = profile ? await projectSetupInProgress(path, profile) : false;
+            if (profile?.state === "pending" && profile.client !== selected)
+                throw new Error("The saved setup request belongs to another client. Resume that client or logout explicitly.");
+            const expired = profile && Date.parse(profile.state === "pending" ? profile.request.expiresAt : profile.grant.expiresAt) <= now();
+            if (expired)
+                output("The saved login or pairing request expired. A fresh browser approval is required; review the project and permissions before approving.");
+            if (profile?.state === "ready")
+                await rememberLocalProject(path, profile);
+            if (!profile || expired || values["new-project"] && profile.state === "ready" && !resumeProjectSetup) {
+                const request = await setup.start({ client: selected });
+                verificationUrl(request.verificationUri, consoleUrl, request.authorizationRequest, local);
+                if (Date.parse(request.expiresAt) <= now() || Date.parse(request.expiresAt) > now() + 601000)
+                    throw new Error("Relvo returned an invalid setup expiry.");
+                profile = { managedBy: "relvo-cli", version: 1, installationId, state: "pending", apiUrl, consoleUrl, local: Boolean(local), client: selected, request, registrations: installation?.registrations ?? [] };
+                await writeLocalProfile(path, profile);
+            }
+            if (profile.state === "pending") {
+                const url = verificationUrl(profile.request.verificationUri, consoleUrl, profile.request.authorizationRequest, profile.local, values.project);
+                output(`Approve Relvo in your browser. Enter code ${profile.request.userCode} when asked.\n${url}\nDo not approve a request you did not start.`);
+                if (!values["no-browser"]) {
+                    try {
+                        await (options.openBrowser ?? ((value) => browser(value, env)))(url);
+                    }
+                    catch {
+                        output("Open the verification URL above manually to continue.");
+                    }
+                }
+                const proof = { authorizationRequest: profile.request.authorizationRequest, deviceCode: profile.request.deviceCode };
+                const expires = Date.parse(profile.request.expiresAt);
+                for (;;) {
+                    if (now() + 5000 >= expires)
+                        throw new Error("This pairing window is ending. Rerun the same setup command; it resumes this request or renews it after expiry.");
+                    await wait(5000);
+                    const grant = await setup.poll(proof);
+                    if (grant.status === "pending")
+                        continue;
+                    if (grant.status === "acknowledged")
+                        throw new Error("Setup was acknowledged but its private key is missing locally. Revoke that key in the console, then run relvo logout and start setup again.");
+                    if (grant.expiresAt !== profile.request.expiresAt || Date.parse(grant.expiresAt) <= now() || Date.parse(grant.approvedExpiresAt) <= expires)
+                        throw new Error("Relvo returned an expired or inconsistent local approval. No new credentials were stored.");
+                    if (values["new-project"])
+                        await markProjectSetup(path, profile, grant.apiKeyId);
+                    profile = { managedBy: "relvo-cli", version: 1, installationId, state: "ready", apiUrl, consoleUrl, local: Boolean(local), grant, pendingAck: proof, registrations: profile.registrations };
+                    await writeLocalProfile(path, profile);
+                    break;
+                }
+            }
+            profile = await acknowledgeProfile(profile, setup, transport, now, path, deactivate);
+            const client = await inspectLogin(profile, transport, now);
+            await rememberLocalProject(path, profile, (await client.project()).data.name);
+            output(plans.length ? `[3/4] Install current guides and configure ${plans.map(({ planned }) => agentNames[planned.client]).join(" and ")}.` : "[3/4] Check the current guides for terminal use.");
+            const bundle = verifiedSkillBundle((await client.skills()).data);
+            const installFor = plans.map(({ planned }) => planned.client);
+            for (const { preserved } of await installSkills(home, installFor, bundle))
+                if (preserved.length)
+                    output(`Kept your own guide: ${preserved.join(", ")}. Delete its folder and run relvo skills update to get the current one.`);
+            for (const { agent, planned, existing } of plans) {
+                if (existing)
+                    continue;
+                profile.registrations = [...profile.registrations.filter((entry) => entry.client !== planned.client), planned];
+                await writeLocalProfile(path, profile);
+                await registerAgent(planned, agent, env, home);
+            }
+            output(plans.length ? "[4/4] Verify the bundled MCP runtime with read-only checks." : "[4/4] Verify CLI read-only access.");
+            for (const { planned } of plans)
+                await probeMcp(planned, env, home, profile.grant.developerProjectId);
+            if (!plans.length)
+                await inspectLogin(profile, transport, now);
+            const names = plans.map(({ planned }) => agentNames[planned.client]).join(" and ");
+            await completeProjectSetup(path, profile);
+            output(`Setup complete for project ${profile.grant.developerProjectId}. ${plans.length ? `${names} MCP ${plans.length > 1 ? "registrations" : "registration"} and current guides are prepared. Restart ${names} to load the connection and guides; host loading has not been verified.` : "CLI is ready."} No paid tools were run.`);
+        });
+        return;
+    }
+    if (args[0] === "logout") {
+        if (args.length !== 1)
+            throw new Error("Usage: relvo logout");
+        await withProfileLock(path, async () => {
+            const profile = await readLocalProfile(path).catch(async (error) => {
+                if (!(error instanceof Error && error.name === "LocalProfileError" && "reason" in error && error.reason === "unreadable"))
+                    throw error;
+                await removeUnreadableProfile(path);
+                output("Removed the unreadable login. Its key may still be active: revoke it in the Relvo console.");
+                return null;
+            });
+            await removeLocalProjects(path, profile?.installationId);
+            if (profile && await removeOwnedUpdateState(path, profile.installationId) === "preserved")
+                output("Foreign or unsafe Relvo update state was preserved; resolve it explicitly before configuring another installation.");
+            if (profile && await removeOwnedProjectSyncState(path, profile.installationId) === "preserved")
+                output("Foreign or unsafe Relvo project sync state was preserved; resolve it explicitly before configuring another installation.");
+            await removeLocalProfile(path);
+        });
+        output("Local Relvo login and saved project approvals removed. Revoke their keys in the Relvo console to disable server access. Installed guides and MCP registration remain.");
+        return;
+    }
+    if (args[0] === "team-skills" && args[1] === "auto-sync") {
+        if (args.length !== 3 || !["on", "off", "status"].includes(args[2]))
+            throw new Error("Usage: relvo team-skills auto-sync on|off|status");
+        output(JSON.stringify(args[2] === "status" ? await projectSyncStatus(path, env, home) : await localProjectSync(path, env, { home }).configure(args[2] === "on", true), null, 2));
+        return;
+    }
+    if (args[0] === "team-skills" && ["check", "apply", "dismiss"].includes(args[1])) {
+        const { values, positionals, tokens } = parseArgs({ args: args.slice(2), tokens: true, allowPositionals: true,
+            options: { client: { type: "string" }, yes: { type: "boolean" }, "allow-scripts": { type: "boolean" }, "remove-executable-settings": { type: "boolean" } } });
+        uniqueOptions(tokens);
+        const sync = localProjectSync(path, env, { home, selected: values.client, transport, now });
+        if (args[1] === "check" && !positionals.length)
+            output(JSON.stringify(await sync.check(), null, 2));
+        else if (args[1] !== "check" && positionals.length === 1)
+            output(JSON.stringify(args[1] === "apply" ? await sync.apply(positionals[0], values.yes === true, values["allow-scripts"] === true, values["remove-executable-settings"] === true)
+                : await sync.dismiss(positionals[0], values.yes === true), null, 2));
+        else
+            throw new Error("Usage: relvo team-skills check [--client <agents>] | apply|dismiss <snapshot> --yes [--client <agents>] [--allow-scripts | --remove-executable-settings]");
+        return;
+    }
+    if (args[0] === "team-skills" && args[1] === "sync") {
+        const { values, tokens } = parseArgs({ args: args.slice(2), tokens: true, options: { client: { type: "string" }, project: { type: "string" }, "allow-scripts": { type: "boolean" } } });
+        uniqueOptions(tokens);
+        if (values.project !== undefined && !values.project.trim())
+            throw new Error("Provide a project ID after --project.");
+        output(JSON.stringify(await syncProjectFiles(path, env, { home, selected: values.client, projectId: values.project, allowScripts: values["allow-scripts"], transport, now }), null, 2));
+        return;
+    }
+    const saved = await readLocalProfile(path);
+    if (!saved || saved.state !== "ready")
+        throw new Error("Run relvo setup to create or resume the local login.");
+    await runtimeConfig(env, "cli", path, true);
+    const profile = saved;
+    const client = await inspectLogin(profile, transport, now);
+    if (args[0] === "doctor") {
+        if (args.length !== 1)
+            throw new Error("Usage: relvo doctor");
+        await listLocalProjects(path, now());
+        for (const registration of profile.registrations) {
+            const { agent } = await preflightAgent(registration.client, env, home, false, "doctor");
+            if (!agent || !registrationMatches(await agentRegistration(registration.client, agent, env, home, registration.name), registration))
+                throw new Error("An owned Relvo MCP registration is missing or changed. Rerun setup after resolving the conflict.");
+            await probeMcp(registration, env, home, profile.grant.developerProjectId);
+        }
+        const bundle = verifiedSkillBundle((await client.skills()).data);
+        output(`Relvo login and tool access verified. Owned MCP registrations and bundled-runtime probes verified: ${profile.registrations.length}. Current distributed guide bundle: ${bundle.version}. Host loading and installed local guides were not checked. No paid tools were run.`);
+        return;
+    }
+    if (args[0] === "skills" && args[1] === "list" && args.length === 2) {
+        const bundle = verifiedSkillBundle((await client.skills()).data);
+        output(JSON.stringify({ version: bundle.version, skills: bundle.skills.map(({ name, description, sha256 }) => ({ name, description, sha256 })) }, null, 2));
+        return;
+    }
+    if (args[0] === "skills" && args[1] === "update") {
+        const { values, tokens } = parseArgs({ args: args.slice(2), tokens: true, options: { client: { type: "string" } } });
+        uniqueOptions(tokens);
+        const selected = choice("client", ["claude", "codex", "all"], values.client ?? "all");
+        const clients = selected === "all" ? profile.registrations.length ? profile.registrations.map((entry) => entry.client) : ["claude", "codex"] : [selected];
+        await withProfileLock(path, async () => { output(JSON.stringify(await installSkills(home, clients, (await client.skills()).data), null, 2)); });
+        return;
+    }
+    if (args[0] === "team-skills" && args[1] === "push") {
+        const { values, positionals, tokens } = parseArgs({ args: args.slice(2), tokens: true, allowPositionals: true, options: { slug: { type: "string" }, kind: { type: "string" } } });
+        uniqueOptions(tokens);
+        if (positionals.length !== 1)
+            throw new Error("Usage: relvo team-skills push <SKILL.md, folder, AGENTS.md, CLAUDE.md, agent or rule file> [--kind skill|instructions|agent|rule] [--slug <slug>]");
+        const kind = values.kind === undefined ? harnessKindOf(positionals[0]) ?? "skill" : choice("kind", ["skill", "instructions", "agent", "rule"], values.kind);
+        await withProfileLock(path, async () => {
+            const roots = harnessRoots(home, env, await readCustomHarnesses(home));
+            output(JSON.stringify(kind === "skill" ? await pushTeamSkill(home, profile.grant.developerProjectId, client, positionals[0], values.slug, roots)
+                : await pushTeamHarnessFile(roots, profile.grant.developerProjectId, client, positionals[0], kind, values.slug), null, 2));
+        });
+        return;
+    }
+    if (args[0] === "team-skills")
+        throw new Error(`Use relvo team-skills check, apply <snapshot> --yes, auto-sync on|off|status, sync [--client all|<${TEAM_HARNESSES.join("|")}>[,…]] [--project <id>] [--allow-scripts], or push <SKILL.md, folder, agent or rule file>.`);
+    throw new Error("Use relvo skills list or relvo skills update [--client claude|codex|all].");
+}