@r1z4x/tezgah 1.0.0

package/bin/tezgah-mcp

@@ -0,0 +1,322 @@
+#!/usr/bin/env python3
+"""tezgah-mcp - tezgah's own MCP surface, one stdio server for every host.
+
+A host draws a collapsed tool-call card for its own tools and for MCP tools, and
+nothing else: tezgah's actions ran as `bash` calls, so the whole command line and
+its output landed in the transcript. This server is the same work behind a tool
+call - `initialize`, `tools/list`, `tools/call` over newline-delimited JSON-RPC
+2.0, the framing `bin/tezgah-setup --mcp-schemas` probes with, so the server and
+the probe agree by construction.
+
+Five tools, one leg of tezgah's CLI each: the server never re-implements a rule,
+it runs the installed command and returns its output as text - one summary line,
+then the log line by line, so the collapsed card and its expanded body are the
+same data. A tool that fails is the tool's own exit status (`isError`), not a
+hidden error: what the command said is the answer.
+
+A malformed line is answered with a JSON-RPC parse error and the loop keeps
+reading, because a host writing one bad frame must not end the session.
+"""
+import json
+import os
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.dirname(os.path.realpath(__file__)))
+sys.path.insert(0, os.path.join(HERE, "hooks"))
+import tezgah_paths as tp  # noqa: E402
+
+PROTOCOL_VERSION = "2024-11-05"
+SERVER_VERSION = "1"
+# A delegate that never returns would hang the host's tool call: the ceiling is
+# per tool, because `consult` waits on remote models and the rest do not.
+TIMEOUT = 120
+CONSULT_TIMEOUT = 600
+
+
+def tool_status(args):
+    """`tezgah-status`: no argument, an optional directory to report on, after
+    `--` so a caller's string can never be read as a flag (audit L-7)."""
+    path = args.get("path")
+    return [tp.tool("tezgah-status")] + (["--", path] if path else []), None, None
+
+
+def refuse_status(args):
+    """The refusal for a `path` that is not an existing directory, or one that
+    starts with a dash: `--` already keeps it a positional, and this refuses the
+    value outright so the report never runs on a string that is not a place."""
+    path = args.get("path")
+    if path and (path.startswith("-") or not os.path.isdir(path)):
+        return "property 'path' must be an existing directory"
+    return None
+
+
+def tool_gate_check(args):
+    """`tezgah-gate check`: the call a host would gate, as its stdin JSON."""
+    call = {"tool": "Bash", "input": {"command": args["command"]},
+            "cwd": args.get("path") or os.getcwd()}
+    return [tp.tool("tezgah-gate"), "check"], json.dumps(call), None
+
+
+def tool_features(args):
+    """`tezgah-setup --features`: the feature table and this run's selection."""
+    return [tp.tool("tezgah-setup"), "--features"], None, None
+
+
+def tool_consult(args):
+    """`consult`: the question the external models answer, then the referee;
+    with `use`, the members the user picked are recorded first (`--use`)."""
+    use = args.get("use")
+    return [tp.tool("consult"), args["question"]] + (["--use", use] if use else []), None, None
+
+
+def tool_research_check(args):
+    """`tezgah-research check`: the line's citations, in the repo asked about;
+    with `slug`, that one line, after `--` so it can never be read as a flag."""
+    path, slug = args.get("path"), args.get("slug")
+    return ([tp.tool("tezgah-research"), "check"] + (["--", slug] if slug else []),
+            None, path or None)
+
+
+def refuse_research_check(args):
+    """The refusal for a `slug` that is not a research line name (`valid_slug`:
+    lowercase letters, digits and dashes, never a leading dash)."""
+    slug = args.get("slug")
+    if slug is None:
+        return None
+    import tezgah_research as tr  # deferred: only this tool reads it
+    return None if tr.valid_slug(slug) else (
+        "property 'slug' must be a research line name (lowercase letters, digits, "
+        "dashes)")
+
+
+# The surface. `properties` is both the schema and the list `arguments` is
+# validated against, so a property the tool does not read cannot be declared
+# here and a property declared here cannot arrive unread. `delegate` is the
+# tezgah command the tool answers from, and it is what the summary line names.
+SPECS = (
+    {"name": "tezgah_status",
+     "description": "Which tezgah contracts are armed in a directory, which "
+                    "were used this session, and which are off. Answers from "
+                    "`tezgah-status` - one segment per line, with its marks.",
+     "delegate": "tezgah-status",
+     "run": tool_status,
+     "refuse": refuse_status,
+     "properties": {
+         "path": ("string", "Directory to report on; defaults to the server's "
+                            "own working directory.")}},
+    {"name": "tezgah_gate_check",
+     "description": "Ask the gate what it would decide about one shell "
+                    "command, without running it: the refusal reason, or "
+                    "nothing when the call passes. Answers from "
+                    "`tezgah-gate check`.",
+     "delegate": "tezgah-gate check",
+     "run": tool_gate_check,
+     "properties": {
+         "command": ("string", "The shell command a host is about to run."),
+         "path": ("string", "The directory the command would run in; its "
+                            "scope is what the gate judges.")},
+     "required": ("command",)},
+    {"name": "tezgah_features",
+     "description": "Every tezgah feature id with its default, its selection "
+                    "and whether its dependency is installed. Answers from "
+                    "`tezgah-setup --features`.",
+     "delegate": "tezgah-setup --features",
+     "run": tool_features,
+     "properties": {}},
+    {"name": "tezgah_consult",
+     "description": "A second opinion on one question: independent answers "
+                    "from external models, then one referee. Answers from "
+                    "`consult`; needs an agent CLI or a provider key. Exit 4/5 "
+                    "lists the members to offer the user; pass the choice as "
+                    "`use`.",
+     "delegate": "consult",
+     "run": tool_consult,
+     "timeout": CONSULT_TIMEOUT,
+     "properties": {
+         "question": ("string", "The question, stated so a model can answer "
+                                "it without the session's context."),
+         "use": ("string", "Members the user chose, comma-separated (e.g. "
+                           "`cli:codex,openrouter`): recorded as consult's "
+                           "choice before the question is asked.")},
+     "required": ("question",)},
+    {"name": "tezgah_research_check",
+     "description": "Check a repository's research lines - their predictions, "
+                    "citations and receipts - from their own manifest. Answers "
+                    "from `tezgah-research check`.",
+     "delegate": "tezgah-research check",
+     "run": tool_research_check,
+     "refuse": refuse_research_check,
+     "properties": {
+         "path": ("string", "The repository to check; defaults to the "
+                            "server's own working directory."),
+         "slug": ("string", "One research line to check in full; when "
+                            "omitted, the open lines in full and each line "
+                            "under done/ by its order seal only.")}},
+)
+
+
+def schema(spec):
+    """The tool's `inputSchema`, built only from the properties it declares."""
+    return {
+        "type": "object",
+        "properties": {name: {"type": ptype, "description": desc}
+                       for name, (ptype, desc) in spec["properties"].items()},
+        "required": list(spec.get("required", ())),
+        "additionalProperties": False,
+    }
+
+
+def declared(spec):
+    """The tool's JSON-RPC descriptor."""
+    return {"name": spec["name"], "description": spec["description"],
+            "inputSchema": schema(spec)}
+
+
+def spec_for(name):
+    return next((s for s in SPECS if s["name"] == name), None)
+
+
+def arguments_for(spec, raw):
+    """(validated arguments, refusal) for one call.
+
+    Every declared property is a string here, and the set of keys is closed in
+    both directions: a required property must arrive non-empty, a property the
+    schema does not declare is refused rather than ignored, because a host
+    sending one is a host whose call would otherwise be answered about
+    something other than what it asked."""
+    args = {}
+    for name in spec["properties"]:
+        value = raw.get(name)
+        needed = name in spec.get("required", ())
+        if value is None or (needed and not str(value).strip()):
+            if needed:
+                return None, "missing required property %r" % name
+            continue
+        if not isinstance(value, str):
+            return None, "property %r must be a string" % name
+        args[name] = value
+    unknown = sorted(set(raw) - set(spec["properties"]))
+    if unknown:
+        return None, "unknown property %s" % ", ".join(repr(u) for u in unknown)
+    return args, None
+
+
+def run(argv, stdin_text, cwd, timeout):
+    """One delegate run: (exit status, the log's lines).
+
+    stdout then stderr: a command that fails explains itself on stderr, and the
+    card is the only place a host shows it. stdin is /dev/null unless the tool
+    feeds the command something - an inherited pipe would let a delegate read
+    the host's own JSON-RPC stream, which is the session, not its input."""
+    kwargs = {"capture_output": True, "text": True, "timeout": timeout,
+              "cwd": cwd}
+    if stdin_text is None:
+        kwargs["stdin"] = subprocess.DEVNULL
+    else:
+        kwargs["input"] = stdin_text
+    try:
+        proc = subprocess.run(argv, **kwargs)
+    except OSError as exc:
+        return None, ["%s did not start: %s" % (argv[0], exc)]
+    except subprocess.TimeoutExpired:
+        return None, ["%s did not finish within %ss" % (argv[0], timeout)]
+    return proc.returncode, proc.stdout.splitlines() + proc.stderr.splitlines()
+
+
+def summary(spec, status, lines):
+    """The one line a host collapses to, before the log."""
+    return "%s: %s %s, %d line(s)" % (
+        spec["name"], spec["delegate"],
+        "exited %d" % status if status is not None else "did not run",
+        len(lines))
+
+
+def call(spec, args):
+    """The `tools/call` result: the summary line, then the log line by line."""
+    argv, stdin_text, cwd = spec["run"](args)
+    status, lines = run(argv, stdin_text, cwd,
+                        spec.get("timeout", TIMEOUT))
+    text = "\n".join([summary(spec, status, lines)] + lines)
+    result = {"content": [{"type": "text", "text": text}]}
+    if status != 0:
+        result["isError"] = True
+    return result
+
+
+def ok(msg_id, result):
+    return {"jsonrpc": "2.0", "id": msg_id, "result": result}
+
+
+def error(msg_id, code, message):
+    return {"jsonrpc": "2.0", "id": msg_id,
+            "error": {"code": code, "message": message}}
+
+
+def dispatch(msg):
+    """The reply for one message, or None when it wants none.
+
+    A notification (no id) is not answered; neither is a client's reply to a
+    request of ours. Every failure is a JSON-RPC error rather than an exception,
+    because the loop has to survive the frame that caused it."""
+    method = msg.get("method")
+    if not isinstance(method, str) or msg.get("id") is None:
+        return None
+    msg_id = msg["id"]
+    params = msg.get("params")
+    params = params if isinstance(params, dict) else {}
+    if method == "initialize":
+        return ok(msg_id, {
+            "protocolVersion": params.get("protocolVersion") or PROTOCOL_VERSION,
+            "capabilities": {"tools": {}},
+            "serverInfo": {"name": "tezgah", "version": SERVER_VERSION}})
+    if method == "tools/list":
+        return ok(msg_id, {"tools": [declared(s) for s in SPECS]})
+    if method == "tools/call":
+        spec = spec_for(params.get("name"))
+        if spec is None:
+            return error(msg_id, -32602, "unknown tool %r (have: %s)"
+                         % (params.get("name"),
+                            ", ".join(s["name"] for s in SPECS)))
+        raw = params.get("arguments")
+        raw = raw if isinstance(raw, dict) else {}
+        args, refusal = arguments_for(spec, raw)
+        if not refusal and spec.get("refuse"):
+            refusal = spec["refuse"](args)
+        if refusal:
+            return error(msg_id, -32602, refusal)
+        return ok(msg_id, call(spec, args))
+    if method == "ping":
+        return ok(msg_id, {})
+    return error(msg_id, -32601, "method not found: %s" % method)
+
+
+def serve(stdin, stdout):
+    """Read one JSON object per line, answer each, exit 0 at EOF."""
+    for line in stdin:
+        if not line.strip():
+            continue
+        try:
+            msg = json.loads(line)
+            if not isinstance(msg, dict):
+                raise ValueError("not a JSON object")
+        except ValueError as exc:
+            reply = error(None, -32700, "parse error: %s" % exc)
+        else:
+            reply = dispatch(msg)
+        if reply is None:
+            continue
+        stdout.write(json.dumps(reply) + "\n")
+        stdout.flush()
+    return 0
+
+
+def main():
+    try:
+        return serve(sys.stdin, sys.stdout)
+    except BrokenPipeError:
+        return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/bin/tezgah-migrate

@@ -0,0 +1,324 @@
+#!/usr/bin/env python3
+"""tezgah-migrate [--apply] [--repo PATH ...] - move legacy tezgah state into <repo>/.tezgah.
+
+Without --repo it looks at every git repository directly under each configured
+root (a directory with its own `.git` directory; the tezgah checkout itself is
+skipped). Without --apply it only prints what it would do. With --apply it first
+writes a backup tarball of every path it touches to
+~/.config/tezgah/backups/<repo>-<UTC stamp>.tar.gz, then:
+
+  1. untracks a `.tezgah/` the project repo tracks (`git rm -r --cached`; the
+     files stay on disk);
+  2. moves a root `plans/` in tezgah plan format into `.tezgah/plans/`;
+  3. moves a root `analysis/` into `.tezgah/analysis/`;
+  4. moves a root `research/` into `.tezgah/analysis/imported-research/`;
+  5. writes `.tezgah/analysis/project-knowledge.md`, an index of the
+     project-owned knowledge that stays where it is (CLAUDE.md, AGENTS.md,
+     docs/research/, .claude/agents ...);
+  6. ensures the workspace (`/.tezgah/` and `/.codegraph/` in .gitignore, a
+     private git repository at `.tezgah/.git`) and commits the imported content
+     there.
+
+A file whose name already exists at the destination with other content is
+reported and left where it is. Nothing is committed in the project repository and
+nothing is pushed: the result is an uncommitted change for the user to review.
+A re-run after a clean apply finds nothing to do.
+
+Exit codes: 0 ok, 1 an apply step failed, 2 misuse.
+"""
+import datetime
+import os
+import subprocess
+import sys
+import tarfile
+
+HERE = os.path.dirname(os.path.dirname(os.path.realpath(__file__)))
+sys.path.insert(0, os.path.join(HERE, "hooks"))
+import tezgah_paths as tp  # noqa: E402
+from tezgah_paths import ensure_workspace, ws_git  # noqa: E402
+
+IGNORES = tp.WORKSPACE_IGNORES
+KNOWLEDGE = ("CLAUDE.md", "AGENTS.md", "GEMINI.md", "docs/research", ".claude/agents",
+             ".claude/skills", ".claude/commands", ".agents", "skills")
+RULE_FILES = ("CLAUDE.md", "AGENTS.md", "GEMINI.md")
+INDEX = os.path.join(".tezgah", "analysis", "project-knowledge.md")
+
+
+def read(path):
+    try:
+        with open(path, encoding="utf-8") as fh:
+            return fh.read()
+    except (OSError, UnicodeDecodeError):
+        return ""
+
+
+def git(repo, *args):
+    return subprocess.run(["git", "-C", repo] + list(args), capture_output=True, text=True)
+
+
+def in_work_tree(repo):
+    return git(repo, "rev-parse", "--is-inside-work-tree").stdout.strip() == "true"
+
+
+def missing_ignores(repo):
+    lines = {line.strip() for line in read(os.path.join(repo, ".gitignore")).splitlines()}
+    return [want for want in IGNORES
+            if not lines & {want, want.strip("/"), want.rstrip("/"), want.lstrip("/")}]
+
+
+def tracked(repo, path):
+    out = git(repo, "ls-files", "-z", "--", path).stdout
+    return [p for p in out.split("\0") if p]
+
+
+def files_under(root):
+    """Every file (and symlink) below `root`, relative to it, sorted."""
+    found = []
+    for base, dirs, files in os.walk(root):
+        dirs[:] = [d for d in dirs if d != ".git" or base != root]
+        for name in files + [d for d in dirs if os.path.islink(os.path.join(base, d))]:
+            found.append(os.path.relpath(os.path.join(base, name), root))
+    return sorted(found)
+
+
+def same(a, b):
+    try:
+        with open(a, "rb") as fa, open(b, "rb") as fb:
+            return fa.read() == fb.read()
+    except OSError:
+        return False
+
+
+def is_plan_tree(path):
+    return (os.path.isdir(os.path.join(path, "open")) or os.path.isdir(os.path.join(path, "done"))
+            or "<!-- status:start -->" in read(os.path.join(path, "README.md")))
+
+
+def first_heading(path):
+    """The first markdown heading of a file, or of a directory's README.md (else
+    its first .md file); '-' when there is none."""
+    if os.path.isdir(path):
+        mds = [f for f in files_under(path) if f.endswith(".md")]
+        if not mds:
+            return "-"
+        path = os.path.join(path, "README.md" if "README.md" in mds else mds[0])
+    lines = read(path).splitlines()
+    if lines and lines[0].strip() == "---":
+        end = next((i for i, line in enumerate(lines[1:], 1) if line.strip() == "---"), 0)
+        lines = lines[end + 1:]
+    for line in lines:
+        if line.startswith("#"):
+            return line.lstrip("#").strip() or "-"
+    return "-"
+
+
+def knowledge_index(repo):
+    """The index text, or '' when the repo has no project-owned knowledge."""
+    paths = [p for p in KNOWLEDGE if os.path.lexists(os.path.join(repo, p))]
+    paths += sorted(p for p in tracked(repo, ".")
+                    if "/" in p and os.path.basename(p) in RULE_FILES and p not in paths)
+    if not paths:
+        return ""
+    rows = ["# Project knowledge", "",
+            "Project-owned knowledge that stays where it is. tezgah-migrate wrote this",
+            "index so a session finds it; the project's git owns the files.", "",
+            "| path | files | first heading |", "|---|---|---|"]
+    for p in paths:
+        full = os.path.join(repo, p)
+        count = len(files_under(full)) if os.path.isdir(full) else 1
+        rows.append("| `%s` | %d | %s |" % (p, count, first_heading(full).replace("|", "\\|")))
+    return "\n".join(rows) + "\n"
+
+
+class Plan:
+    """What one repo needs: printable steps, the paths a backup must hold, and
+    the callables that perform the steps."""
+
+    def __init__(self, repo):
+        self.repo = repo
+        self.steps = []      # (text, callable)
+        self.skipped = []    # text
+        self.backup = set()  # repo-relative paths
+        self.imported = False
+
+    def add(self, text, fn, *backup):
+        self.steps.append((text, fn))
+        self.backup.update(backup)
+
+
+def plan_move(plan, src, dest):
+    """Move every file of root `src` under `dest`; a differing name collision is
+    skipped and stays in place, an identical one only drops the source."""
+    repo = plan.repo
+    root = os.path.join(repo, src)
+    if not os.path.isdir(root) or os.path.islink(root):
+        return
+    known = set(tracked(repo, src))
+    moves = []
+    for rel in files_under(root):
+        target = os.path.join(repo, dest, rel)
+        if os.path.lexists(target) and not same(os.path.join(root, rel), target):
+            plan.skipped.append("%s/%s: %s/%s exists with other content" % (src, rel, dest, rel))
+            continue
+        moves.append(rel)
+    if not moves:
+        return
+    untrack = [p for p in (os.path.join(src, rel) for rel in moves) if p in known]
+
+    def run():
+        for rel in moves:
+            source, target = os.path.join(root, rel), os.path.join(repo, dest, rel)
+            if os.path.lexists(target):
+                os.remove(source)  # identical copy already there; the backup holds it
+            else:
+                os.makedirs(os.path.dirname(target), exist_ok=True)
+                os.rename(source, target)
+        if untrack:
+            out = git(repo, "rm", "-q", "--cached", "--", *untrack)
+            if out.returncode:
+                raise RuntimeError(out.stderr.strip())
+        for base, _dirs, _files in sorted(os.walk(root), reverse=True):
+            if not os.listdir(base):
+                os.rmdir(base)
+
+    plan.add("move %s/ -> %s/ (%d files, %d tracked)" % (src, dest, len(moves), len(untrack)),
+             run, src)
+    plan.imported = True
+
+
+def make_plan(repo):
+    plan = Plan(repo)
+    ws = os.path.join(repo, ".tezgah")
+    ours = tracked(repo, ".tezgah")
+    if ours:
+        def untrack():
+            out = git(repo, "rm", "-r", "-q", "--cached", ".tezgah")
+            if out.returncode:
+                raise RuntimeError(out.stderr.strip())
+        plan.add("untrack .tezgah/ (%d tracked files; they stay on disk)" % len(ours),
+                 untrack, ".tezgah")
+    if os.path.isdir(os.path.join(repo, "plans")):
+        if is_plan_tree(os.path.join(repo, "plans")):
+            plan_move(plan, "plans", ".tezgah/plans")
+        else:
+            plan.skipped.append("plans/: not in tezgah plan format, left alone")
+    plan_move(plan, "analysis", ".tezgah/analysis")
+    plan_move(plan, "research", ".tezgah/analysis/imported-research")
+
+    text = knowledge_index(repo)
+    if text and read(os.path.join(repo, INDEX)) != text:
+        def index():
+            os.makedirs(os.path.dirname(os.path.join(repo, INDEX)), exist_ok=True)
+            with open(os.path.join(repo, INDEX), "w", encoding="utf-8") as fh:
+                fh.write(text)
+        plan.add("index project knowledge (%d paths) -> %s" % (text.count("\n| `"), INDEX),
+                 index, INDEX)
+        plan.imported = True
+
+    missing = missing_ignores(repo) if in_work_tree(repo) else []
+    fresh = not os.path.isdir(os.path.join(ws, ".git"))
+    if missing or fresh:
+        def ensure():
+            if ensure_workspace(repo) is None:
+                raise RuntimeError("ensure_workspace failed")
+        parts = (["add %s to .gitignore" % " ".join(missing)] if missing else []) + \
+            (["git init .tezgah"] if fresh else [])
+        plan.add("ensure workspace: %s" % "; ".join(parts), ensure, ".gitignore", ".tezgah")
+    if fresh or plan.imported or ws_git(repo, "rev-parse", "-q", "--verify", "HEAD").returncode:
+        head = git(repo, "rev-parse", "--short", "HEAD").stdout.strip() or "none"
+        message = "import from project history %s" % head
+
+        def commit():
+            # without its own .git, `git -C .tezgah` would reach the project repo
+            if not os.path.isdir(os.path.join(ws, ".git")):
+                raise RuntimeError("%s/.git is missing" % ws)
+            ws_git(repo, "add", "-A")
+            out = ws_git(repo, "commit", "-q", "--allow-empty", "-m", message)
+            if out.returncode:
+                raise RuntimeError((out.stderr or out.stdout or "").strip())
+        plan.add("commit .tezgah content in its private repo: %r" % message, commit)
+    return plan
+
+
+def write_backup(plan):
+    repo = plan.repo
+    stamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y%m%dT%H%M%S")
+    folder = os.path.join(tp.CONFIG_DIR, "backups")
+    os.makedirs(folder, exist_ok=True)
+    path = os.path.join(folder, "%s-%s.tar.gz" % (os.path.basename(repo), stamp))
+    with tarfile.open(path, "w:gz") as tar:
+        for rel in sorted(plan.backup):
+            if os.path.lexists(os.path.join(repo, rel)):
+                tar.add(os.path.join(repo, rel), arcname=rel)
+    return path
+
+
+def migrate(repo, apply):
+    plan = make_plan(repo)
+    print("%s (%s)" % (os.path.basename(repo), repo))
+    for text, _fn in plan.steps:
+        print("  %s %s" % ("do" if apply else "would", text))
+    for text in plan.skipped:
+        print("  skip %s" % text)
+    backup, failed = "none", False
+    if plan.steps and apply:
+        backup = write_backup(plan)
+        for text, fn in plan.steps:
+            try:
+                fn()
+            except (OSError, RuntimeError) as exc:
+                print("  FAIL %s: %s" % (text, exc))
+                failed = True
+                break
+    elif plan.steps:
+        backup = "would write %s" % os.path.join(tp.CONFIG_DIR, "backups",
+                                                  os.path.basename(repo) + "-<stamp>.tar.gz")
+    print("= %s: %d %s, %d skipped, backup %s" % (
+        os.path.basename(repo), len(plan.steps), "done" if apply and not failed else
+        "failed" if failed else "planned", len(plan.skipped), backup))
+    return not failed
+
+
+def discover():
+    repos = []
+    for root in tp.roots():
+        try:
+            names = sorted(os.listdir(root))
+        except OSError:
+            continue
+        for name in names:
+            path = os.path.realpath(os.path.join(root, name))
+            if not os.path.isdir(os.path.join(path, ".git")):
+                continue
+            if path == tp.PLUGIN_ROOT or os.path.isfile(os.path.join(path, "hooks", "tezgah_policy.py")):
+                continue
+            repos.append(path)
+    return repos
+
+
+def main(argv):
+    apply, repos, i = False, [], 0
+    while i < len(argv):
+        if argv[i] == "--apply":
+            apply = True
+        elif argv[i] == "--repo" and i + 1 < len(argv):
+            repos.append(os.path.realpath(argv[i + 1]))
+            i += 1
+        else:
+            print(__doc__, file=sys.stderr)
+            return 2
+        i += 1
+    for repo in repos:
+        if not os.path.isdir(os.path.join(repo, ".git")):
+            print("tezgah-migrate: %s is not a git repository root" % repo, file=sys.stderr)
+            return 2
+    ok = True
+    for repo in repos or discover():
+        ok = migrate(repo, apply) and ok
+    if not apply:
+        print("dry run: nothing changed; re-run with --apply to perform it")
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))