@repo-os/repoos 0.5.45

package/LICENSE.md

@@ -0,0 +1,110 @@
+# Functional Source License, Version 1.1, MIT Future License
+
+## Abbreviation
+
+FSL-1.1-MIT
+
+## Notice
+
+Copyright 2026 Nick Jachowski
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the MIT license that is effective on the second anniversary of the date we make
+the Software available. On or after that date, you may use the Software under
+the MIT license, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,272 @@
+# RepoOS
+
+**The repo is the operating system.**
+
+RepoOS is a lightweight, repo-native way to track work that lives as markdown
+files inside your monorepo. Tasks, specs, bugs, and feature requests are plain
+`.md` files with YAML frontmatter — versioned in git, readable by humans, and
+designed to be consumed directly by AI coding agents.
+
+It is **not** a Jira/Linear replacement bolted onto your repo. It is the
+connective tissue for an AI-native workflow: humans define and review work,
+agents read the same files as full context and execute against the repo.
+RepoOS directly spawns and manages coding agents in isolated worktrees,
+streams their output, and keeps humans as the sign-off gate.
+
+```
+the repo  ──▶  source of truth (markdown + git)
+   │
+   ├─ work/*.md      tasks, specs, bugs  (status lives in frontmatter)
+   ├─ docs/          architecture, ADRs, AGENTS.md
+   └─ .repoos/       derived index cache (gitignored, disposable)
+```
+
+## Why
+
+Traditional trackers fragment context away from where agents actually work. The
+friction that historically made "markdown as a task system" lose to Jira was
+*humans* editing YAML — and that's exactly the friction an LLM removes. RepoOS
+leans into that: the task file is the spec the agent reads, the status it
+updates, and the artifact git versions.
+
+RepoOS doesn't just host tasks that agents read — it spawns and manages the
+agents themselves. You configure a coding agent on the Agents page, click Start
+on a task, and RepoOS launches the agent in a dedicated git worktree, streams
+its output live, and lets you resume the conversation at any point. When the
+agent finishes, the task moves to review for human sign-off. Agents are
+first-class participants, but humans always hold the gate.
+
+## Install
+
+Install a standalone `repoos` command straight from GitHub Releases:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/repo-os/repoos/main/install.sh | bash
+```
+
+Runs on Bun when it's installed (recommended); otherwise requires Node.js >= 20.6.0. Installs to `~/.repoos` and links `repoos` into `~/.local/bin`.
+
+Then in any repo:
+
+```bash
+repoos init        # scaffold work/, docs/, repoos.toml, AGENTS.md (idempotent)
+```
+
+Zero config required. `repoos init` walks up to find your repo root, creates the
+folders if missing, adds a sample task, and gitignores the derived cache.
+
+## Core principles
+
+1. **Files are truth.** Every task is a markdown file. Delete the cache, lose
+   nothing.
+2. **Status is a field, not a folder.** `repoos mv 0012 active` edits the
+   `status:` frontmatter — the file never moves. No git churn, no merge
+   conflicts from two agents touching a queue.
+3. **The index is derived.** `.repoos/index.json` is a disposable cache,
+   rebuilt from files on demand. It exists for fast reads (and the upcoming
+   local server), never as a source of truth.
+4. **Zero runtime dependencies.** Installs instantly; nothing to break.
+5. **Degrades gracefully.** No git? Still works. No config? Sensible defaults.
+
+## Commands
+
+```bash
+repoos init                    Scaffold this repo for RepoOS
+repoos list [status]           Show the board, or one column
+repoos show <id>               Show a task's full spec
+repoos mv <id> <status>        Move a task (inbox|ready|active|review|done)
+repoos new "<title>" [flags]   Create a task
+repoos index [--json]          Rebuild the derived index (--json for agents/tools)
+repoos serve [--port N]        Start the local server: live API + SSE event stream
+repoos check                   Definition-of-done gate (build, typecheck, tests, UI smoke)
+repoos tunnel [subcommand]     Cloudflare Tunnel + Zero Trust publishing
+```
+
+**`repoos new` flags:** `--ai` (assign to AI), `--type`, `--area`, `--priority`, `--body` (`-` reads from stdin). Unknown flags are rejected.
+
+```bash
+repoos new "Add company dashboard" --ai --type feature --area web --priority p1
+repoos mv 0012 active
+repoos list ready
+repoos index --json        # machine-readable, pipe to agents
+```
+
+## Task file format
+
+```markdown
+---
+id: "0012"
+title: Add company dashboard
+type: feature
+status: ready
+priority: p1
+area: web
+assigned_to: ai
+created_by: human
+branch: feat/0012-company-dashboard
+---
+
+## Problem
+Agency owners have no single view of placements, fill rate, and revenue.
+
+## Desired UX
+A glanceable dashboard: KPI cards, a revenue chart, upcoming shifts.
+
+## Acceptance criteria
+- [ ] KPI summary cards
+- [ ] Revenue chart with range selector
+
+## Notes for AI
+Use the StatCard component from @ui. Mock data until backend #0020 lands.
+```
+
+Unknown frontmatter keys are **preserved** on write — RepoOS never clobbers
+fields it doesn't recognize.
+
+## Use as a library
+
+The CLI is a thin shell over a programmatic API. The same API powers the
+local server and can be called from your own scripts or agents.
+
+```ts
+import { createRepoOS } from "@repo-os/repoos";
+
+const repoos = createRepoOS();              // resolves repo root + config
+
+repoos.getTasks("active");                  // Task[]
+repoos.getTask("0012");                     // Task | null
+repoos.counts();                            // { inbox, ready, active, review, done }
+repoos.updateStatus("0012", "review");      // edits frontmatter, returns Task
+repoos.createTask({ title: "New thing", assignedTo: "ai", priority: "p1" });
+repoos.reindex();                           // rebuild + cache the index
+```
+
+## Configuration
+
+Optional `repoos.toml` at the repo root. These are the defaults:
+
+```toml
+workDir = "work"
+docsDir = "docs"
+defaultStatus = "inbox"
+defaultAssignee = "unassigned"
+cacheDir = ".repoos"
+```
+
+## The local server
+
+`repoos serve` starts a long-lived process that holds the index in memory, watches
+your task files, and serves a JSON API plus a live event stream. It adds no new
+business logic — it's a transport layer over the same core the CLI uses.
+
+```bash
+repoos serve                 # http://127.0.0.1:7171 (or your Tailscale IP, if detected)
+repoos serve --port 8080     # custom port
+repoos serve --host 0.0.0.0  # listen on all interfaces
+repoos serve --quiet         # no terminal activity log
+```
+
+If Tailscale is running on the machine, `repoos serve` binds to `0.0.0.0` (all
+interfaces) by default instead of localhost-only, so it's reachable both from
+your other Tailscale devices and from localhost-only tools on the same machine
+(e.g. a Cloudflare Tunnel's local origin). Pass `--host 127.0.0.1` explicitly
+to restrict it to localhost only.
+
+### Endpoints
+
+```
+GET    /api/health             { ok, root, taskCount, workDir }
+GET    /api/tasks              Task[]   (?status=active to filter)
+GET    /api/tasks/:id          Task | 404
+GET    /api/counts             { inbox, ready, active, review, done }
+GET    /api/index              full RepoIndex snapshot
+GET    /api/docs               [{ path, title }]  context docs listing
+GET    /api/skills             [{ name, path }]  installed skills
+GET    /api/config             current repoos.toml config
+GET    /api/agents/detect      installed coding agents found on PATH
+GET    /api/agents/running     currently running agent sessions
+GET    /api/tasks/:id/output   agent session transcript for a task
+POST   /api/tasks              create  { title, type?, area?, priority?, assignedTo? }
+POST   /api/tasks/freeform     create  { prompt }  AI-drafted task from a description
+PATCH  /api/tasks/:id          patch   { status?, title?, priority?, ... }
+PATCH  /api/config             edit repoos.toml fields
+DELETE /api/tasks/:id          delete a task
+POST   /api/tasks/:id/start    launch an agent on this task
+POST   /api/tasks/:id/pause    stop a running agent (graceful)
+POST   /api/tasks/:id/message  send a follow-up to an agent session
+POST   /api/tasks/:id/done     review-to-done: merge branch, close worktree
+GET    /api/events             SSE stream of repo events
+```
+
+### The event stream
+
+`GET /api/events` is a Server-Sent Events stream. It emits an event whenever the
+repo changes — whether the change came through the API or from a file edited
+directly on disk (e.g. by an AI agent). This is the heartbeat the UI subscribes
+to; no polling.
+
+```
+event: task.updated
+data: {"type":"task.updated","task":{...},"prev":{"status":"ready"},"at":"..."}
+```
+
+Event types: `hello`, `index.rebuilt`, `task.created`, `task.updated`,
+`task.deleted`, `agent.running`, `agent.exited`, `agent.output`,
+`task.corrected`. Because an agent editing a markdown file produces the same
+event as an API call, agents are first-class participants without needing to
+know RepoOS exists — they just edit files.
+
+### Concurrent writes
+
+Status lives in per-task files, so two writers touching *different* tasks never
+conflict. For the same task, the server re-reads the file immediately before
+writing and merges the change onto current on-disk state, so a status update
+won't clobber a body edit an agent made a moment earlier.
+
+## The web UI
+
+`repoos serve` also serves a web UI at the root URL — open `http://127.0.0.1:7171`
+in a browser. It's a live control plane: a dashboard, the work board, an Agents
+page for configuring and running coding agents, a context-docs viewer with
+skills, and settings. All reading from the API and updating in real time via the
+SSE stream. Edit a task file in your editor (or let an agent edit it) and the
+board updates instantly — no reload.
+
+The UI ships prebuilt and vendored (Vue is bundled, not loaded from a CDN), so
+it works fully offline — important for a tool running on a local box.
+
+## Agent orchestration
+
+RepoOS can spawn and manage coding agents (opencode, Claude Code, Qwen, Codex)
+to execute tasks. Agents run in isolated git worktrees per task so parallel work
+never collides. Output streams over SSE in real time, and the per-task chat tab
+lets you resume a session mid-flight. When the agent finishes, the task moves to
+review — human sign-off is always the gate.
+
+Configure agents on the Agents page: choose the CLI, pick a model (sourced live
+from `opencode models`), add custom instructions, and set up PM and reviewer
+roles alongside the engineer agent. Freeform task creation sends a description
+through the PM agent for structured drafting. All agent capability is local —
+no API tokens leave your machine unless you configure them.
+
+## Roadmap
+
+- **Stage 1 — parser + index + CLI** ✅
+- **Stage 2 — local server** ✅ — live index, file watcher, JSON API, SSE.
+- **Stage 3 — web UI** ✅ — Vite + Vue 3 SFC, served from the local server,
+  responsive (desktop + mobile), live-updating via SSE.
+- **Stage 4** — read-only deploy/infra panel (Railway, Cloudflare Pages).
+- **Stage 5 — agent orchestration** ✅ — spawn coding agents (opencode, Claude
+  Code, Qwen, Codex) in git worktrees per task, stream their output over SSE,
+  resume sessions via chat, and move completed work into review. Actively
+  being hardened and extended (agent-visible worktree previews, context packs,
+  and sandbox handoff).
+
+For live status and what's in progress, run `repoos list`. The task files in
+`work/` are the authoritative record of current work.
+
+## License
+
+[FSL-1.1-MIT](LICENSE.md) — free to use, self-host, and modify. The only
+restriction is offering it as a competing commercial product/service. Each
+version converts to plain MIT two years after release.

package/dist/.build-info.json

@@ -0,0 +1,4 @@
+{
+  "hash": "e49c2d85116e21cce445444e46ba4c7961583ce35dcf49707db0d41c623126d2",
+  "version": "0.5.44"
+}

package/dist/.build-stamp.json

@@ -0,0 +1,3 @@
+{
+  "generatedAt": "2026-09-17T08:36:35.890Z"
+}

package/dist/cli/colors.d.ts

@@ -0,0 +1,13 @@
+export declare const c: {
+    bold: (s: string) => string;
+    dim: (s: string) => string;
+    cyan: (s: string) => string;
+    magenta: (s: string) => string;
+    green: (s: string) => string;
+    yellow: (s: string) => string;
+    red: (s: string) => string;
+    gray: (s: string) => string;
+};
+/** Color a status string consistently with the GUI palette. */
+export declare function statusColor(status: string): (s: string) => string;
+export declare function priorityColor(p: string): (s: string) => string;

package/dist/cli/colors.js

@@ -0,0 +1,37 @@
+/** Minimal ANSI styling. Honors NO_COLOR and non-TTY output. */
+const enabled = process.env.NO_COLOR === undefined && process.stdout.isTTY === true;
+const wrap = (open, close) => (s) => enabled ? `\x1b[${open}m${s}\x1b[${close}m` : s;
+export const c = {
+    bold: wrap(1, 22),
+    dim: wrap(2, 22),
+    cyan: wrap(36, 39),
+    magenta: wrap(35, 39),
+    green: wrap(32, 39),
+    yellow: wrap(33, 39),
+    red: wrap(31, 39),
+    gray: wrap(90, 39),
+};
+/** Color a status string consistently with the GUI palette. */
+export function statusColor(status) {
+    switch (status) {
+        case "draft":
+            return c.dim;
+        case "ready":
+            return c.cyan;
+        case "active":
+            return c.magenta;
+        case "review":
+            return c.yellow;
+        case "done":
+            return c.green;
+        default:
+            return c.gray;
+    }
+}
+export function priorityColor(p) {
+    if (p === "p0" || p === "p1")
+        return c.red;
+    if (p === "p2")
+        return c.yellow;
+    return c.green;
+}

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli/index.js

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+/**
+ * RepoOS CLI entrypoint. Bin name: `repoos`.
+ * Dependency-free arg routing — no commander/yargs needed for Stage 1.
+ */
+import { cmdInit } from "../commands/init.js";
+import { cmdList, cmdShow, cmdMv, cmdUpdate, cmdNew, cmdIndex, cmdNote, } from "../commands/tasks.js";
+import { cmdNewDoc } from "../commands/docs.js";
+import { cmdGc } from "../commands/gc.js";
+import { cmdCheck } from "../commands/check.js";
+import { cmdServe, serveProcessTitle, setServeProcessTitle } from "../commands/serve.js";
+import { cmdStop } from "../commands/stop.js";
+import { cmdTunnel } from "../commands/tunnel.js";
+import { cmdUpgrade } from "../commands/upgrade.js";
+import { cmdStatus } from "../commands/status.js";
+import { checkBuild } from "../core/build.js";
+import { loadConfig } from "../core/config.js";
+import { reexecUnderBunIfRequested } from "../core/runtime.js";
+import { c } from "./colors.js";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+// node:sqlite (used by db.ts/auth-store.ts) is still marked experimental on
+// supported Node versions and prints a warning the first time it's loaded.
+// That's expected/stable usage here, not something a user needs to see —
+// suppress just that one warning, leaving everything else intact. Matched on
+// message content alone, not warning.name: which exact warning class/name
+// Node uses for this varies by version (confirmed — no warning fires on
+// instantiation at all on Node 24.19.0, but one does on Node 25.2.1), so a
+// name-based filter risks silently failing to match on some future/older
+// Node version and falling through to print it anyway.
+process.on("warning", (warning) => {
+    if (/\bsqlite\b/i.test(warning.message))
+        return;
+    console.warn(warning);
+});
+/** Reads the version stamped into .build-info.json at build time; falls back for dev/source runs. */
+function readVersion() {
+    try {
+        const root = dirname(dirname(fileURLToPath(import.meta.url)));
+        const info = JSON.parse(readFileSync(join(root, ".build-info.json"), "utf8"));
+        if (info.version)
+            return info.version;
+    }
+    catch {
+        /* fall through */
+    }
+    return "0.0.0-dev";
+}
+const VERSION = readVersion();
+function help() {
+    console.log(`
+  ${c.bold(c.cyan("RepoOS"))} ${c.dim("v" + VERSION)} — the repo is the operating system
+
+  ${c.bold("USAGE")}
+    repoos <command> [args]
+
+  ${c.bold("COMMANDS")}
+    ${c.cyan("check")}               Full definition-of-done: build, typecheck, tests, UI smoke check
+    ${c.cyan("init")} [name]           Scaffold work/, repoos.toml, AGENTS.md; outside a git repo runs a guided flow that can launch the web console
+    ${c.cyan("list")} [status]        Show the board (or one column: ${c.dim("inbox|ready|active|review|done")})
+    ${c.cyan("status")} [--json]      One-screen health snapshot: server, build freshness, board, worktrees, tunnel, git
+    ${c.cyan("show")} <id>            Show a task's full spec
+    ${c.cyan("mv")} <id> <status>     Move a task to a new status   ${c.dim('flags: --note "..."')}
+    ${c.cyan("note")} <id> "<text>"   Append a free-form note to a task's activity log
+    ${c.cyan("update")} <id>           Edit a task's metadata/body   ${c.dim("flags: --title --area --priority --type --body --branch --assigned-to")}
+    ${c.cyan("new")} "<title>"        Create a task   ${c.dim("flags: --ai --type --area --priority --body")}
+    ${c.cyan("new-doc")} "<desc>"     Create a document from a description via PM agent
+    ${c.cyan("index")} [--json]       Rebuild the derived index cache
+    ${c.cyan("gc")} [--yes|--dry-run] Collect leaked task worktrees/branches (done/absent tasks, integrate candidates)
+    ${c.cyan("serve")} [--port N]     Start the local server (live API + SSE stream)
+    ${c.cyan("stop")} [--port N]      Stop this repo's serve process (by its own lockfile)
+    ${c.cyan("tunnel")} <sub>         Publish local apps via Cloudflare Tunnel + Zero Trust ${c.dim("(setup|create|allow|deny|rename|destroy|start|install|stop|list|status)")}
+    ${c.cyan("upgrade")} [--channel beta|canary|rc]
+                          Self-update a standalone (curl-installed) repoos to the latest release
+                          (stable by default; --channel tracks a prerelease line instead)
+
+  ${c.bold("EXAMPLES")}
+    ${c.dim("$")} repoos init
+    ${c.dim("$")} repoos init myproject   # guided new-project flow outside a git repo
+    ${c.dim("$")} repoos new "Add company dashboard" --ai --type feature --area web --priority p1
+    ${c.dim("$")} repoos new-doc "API design doc for the payment system"
+    ${c.dim("$")} repoos mv 0012 active
+    ${c.dim("$")} repoos mv 0012 active --note "Fix the regression in checkout; see review"
+    ${c.dim("$")} repoos note 0012 "Handle the reviewer's suggestions before the next review"
+    ${c.dim("$")} repoos update 0012 --title "New title" --area web
+    ${c.dim("$")} repoos list ready
+    ${c.dim("$")} repoos status             ${c.dim("# one-screen health snapshot")}
+    ${c.dim("$")} repoos status --json      ${c.dim("# machine-readable, for agents/tools")}
+    ${c.dim("$")} repoos index --json   ${c.dim("# machine-readable, for agents/tools")}
+    ${c.dim("$")} repoos serve          ${c.dim("# live API + SSE at http://127.0.0.1:7171")}
+`);
+}
+function main() {
+    const [cmd, ...rest] = process.argv.slice(2);
+    // Run every command under Bun when it's available (opt out with
+    // REPOOS_RUNTIME=node). With `execve` this call replaces the process image;
+    // with the spawn fallback the Node parent stays only to relay signals. Done
+    // first, so nothing (prompts, the staleness warning) runs twice.
+    if (reexecUnderBunIfRequested()) {
+        return;
+    }
+    // Name the managed project in `ps`/Activity Monitor for the long-lived serve
+    // process (#0347). Done here — before the staleness check — so the one-time
+    // Bun re-exec inside setServeProcessTitle can't re-print that warning, and
+    // only for the real `serve` command (cmdServe is also called mid-`init`,
+    // where a re-exec would restart the whole guided flow). Display-only.
+    if (cmd === "serve" || cmd === "server")
+        setServeProcessTitle(serveProcessTitle());
+    // Staleness check — skip for version/help since those read no source, and
+    // for `status`/`check` which report staleness themselves as first-class
+    // output (a second, louder warning above their own would be noise).
+    const skipCheck = new Set([
+        "version",
+        "--version",
+        "-v",
+        undefined,
+        "check",
+        "status",
+        "help",
+        "--help",
+        "-h",
+        "upgrade",
+    ]);
+    if (!skipCheck.has(cmd)) {
+        const result = checkBuild();
+        // Only warn when the RepoOS build contract actually applies (marker
+        // present). No dist/ or no marker means this checkout isn't using our build
+        // pipeline — see checkBuildForRoot's `applicable` (#0349).
+        if (result.stale && result.applicable) {
+            const config = loadConfig();
+            const strict = config.strictBuild ||
+                process.env.REPOOS_STRICT_BUILD === "1" ||
+                process.argv.includes("--strict-build");
+            if (strict) {
+                console.error(c.red("  ✗ ") + result.message);
+                process.exit(1);
+            }
+            console.error(c.yellow("  ⚠ ") + result.message);
+        }
+    }
+    switch (cmd) {
+        case "init":
+            void cmdInit(rest);
+            break;
+        case "list":
+        case "ls":
+            cmdList(rest[0]);
+            break;
+        case "status":
+            void cmdStatus(rest);
+            break;
+        case "show":
+        case "cat":
+            cmdShow(rest[0]);
+            break;
+        case "mv":
+        case "move": {
+            let note;
+            const args = rest.slice();
+            for (let i = 0; i < args.length; i++) {
+                if (args[i] === "--note")
+                    note = args[++i];
+            }
+            cmdMv(args[0], args[1], note);
+            break;
+        }
+        case "note":
+            cmdNote(rest);
+            break;
+        case "update":
+            cmdUpdate(rest);
+            break;
+        case "new":
+        case "add":
+            cmdNew(rest);
+            break;
+        case "new-doc":
+            void cmdNewDoc(rest);
+            break;
+        case "index":
+        case "reindex":
+            cmdIndex(rest);
+            break;
+        case "gc":
+            cmdGc(rest);
+            break;
+        case "serve":
+        case "server":
+            void cmdServe(rest);
+            break;
+        case "stop":
+            cmdStop(rest);
+            break;
+        case "check":
+            void cmdCheck();
+            break;
+        case "tunnel":
+            void cmdTunnel(rest);
+            break;
+        case "upgrade":
+            void cmdUpgrade(rest);
+            break;
+        case "version":
+        case "--version":
+        case "-v":
+            console.log("repoos v" + VERSION);
+            break;
+        case undefined:
+        case "help":
+        case "--help":
+        case "-h":
+            help();
+            break;
+        default:
+            console.error(c.red(`  Unknown command: ${cmd}`));
+            help();
+            process.exitCode = 1;
+    }
+}
+main();