@runneth/cli 0.0.0-sha.08ddca3b68de.production

package/dist/cli.js

@@ -0,0 +1,3732 @@
+#!/usr/bin/env node
+import { $ as resolveOAuthClientCredentialOptions, A as RunnethCliReplacementInterruptedError, D as sendRunnethCliShutdownRequest, E as sendRunnethCliRequest, G as resolveRunnethConversationOptions, I as runRunnethConversationMachineCommand, K as runRunnethConversation, L as resolveCliDisplayRequest, M as runWithRunnethCliReplacement, N as writeRunnethCliFileAtomically, O as resolveRunnethCliDaemonInstallationPath, P as require_proper_lockfile, Q as readOAuthCredentialStatus, R as writeCliDisplay, S as ensureDaemon, V as fetchConversationSshTarget, W as parseRunnethConversationArgs, X as logoutOAuthCredential, Y as loginWithOAuth, _ as assertRunnethVmCopyTargetsUseSameResource, a as normalizeRunnethSshTargetName, at as __require, b as RunnethCliRequestTimeoutError, g as setDefaultRunnethSshTarget, h as saveRunnethSshTarget, i as installRunnethSshAccess, it as __commonJSMin, j as assertRunnethCliReplacementStopped, k as runWithRunnethCliDaemonGate, m as runRunnethSshProxy, n as installRunnethSkills, nt as resolveRunnethCliHome, o as readRunnethSshTargetStore, ot as __toESM, p as runOpenSsh, rt as resolveSocketPath, s as removeRunnethSshTarget, tt as resolveOAuthToken, u as resolveRunnethSshTarget, v as runRunnethVmCopy, w as normalizeSessionName, y as RunnethCliDaemonRuntime, z as RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS } from "./src.js";
+import { resolveBuildDefaultMcpResourceUrl } from "./build-defaults.js";
+import { mkdir, readFile, realpath, rm } from "node:fs/promises";
+import path from "node:path";
+import process$1 from "node:process";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+import os from "node:os";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { emitKeypressEvents } from "node:readline";
+//#region src/copy-progress.ts
+const COPY_PROGRESS_RENDER_INTERVAL_MS = 200;
+const COPY_PROGRESS_RENDER_INTERVAL_NON_TTY_MS = 1e4;
+const formatErrorMessage$1 = (error) => {
+	return error instanceof Error ? error.message : String(error);
+};
+const writeOutput = async (output, chunk) => {
+	await new Promise((resolve, reject) => {
+		let settled = false;
+		const rejectWrite = (error) => {
+			if (settled) return;
+			settled = true;
+			reject(error);
+		};
+		const onError = (error) => {
+			rejectWrite(error);
+		};
+		output.once("error", onError);
+		try {
+			output.write(chunk, (error) => {
+				if (error !== null && error !== void 0) {
+					rejectWrite(error);
+					return;
+				}
+				if (settled) return;
+				settled = true;
+				output.off("error", onError);
+				resolve();
+			});
+		} catch (error) {
+			output.off("error", onError);
+			rejectWrite(error);
+		}
+	});
+};
+const formatCopyByteCount = (bytes) => {
+	const units = [
+		"B",
+		"KiB",
+		"MiB",
+		"GiB",
+		"TiB"
+	];
+	let unitIndex = 0;
+	let value = bytes;
+	while (value >= 1024 && unitIndex < units.length - 1) {
+		value /= 1024;
+		unitIndex += 1;
+	}
+	const unit = units[unitIndex];
+	if (unit === void 0) throw new Error(`Copy byte count unit index out of range: ${String(unitIndex)}`);
+	return `${unitIndex === 0 ? String(value) : value.toFixed(value >= 100 ? 0 : 1)} ${unit}`;
+};
+const formatCopyDuration = (seconds) => {
+	if (!Number.isFinite(seconds) || seconds < 0) throw new Error(`Invalid copy duration: ${String(seconds)}`);
+	const totalSeconds = Math.ceil(seconds);
+	if (totalSeconds < 60) return `${String(totalSeconds)}s`;
+	const minutes = Math.floor(totalSeconds / 60);
+	const remainingSeconds = totalSeconds % 60;
+	return `${String(minutes)}m${String(remainingSeconds).padStart(2, "0")}s`;
+};
+const createCopyProgressReporter = (input) => {
+	let lastRenderAtMs = 0;
+	let lastRenderedLine = "";
+	let uploadStartedAtMs = null;
+	const clearLiveLine = async () => {
+		if (input.interactive && lastRenderedLine.length > 0) {
+			await writeOutput(input.output, `\r${" ".repeat(lastRenderedLine.length)}\r`);
+			lastRenderedLine = "";
+		}
+	};
+	const render = async (line, force, completeLine = false) => {
+		const now = Date.now();
+		const interval = input.interactive ? COPY_PROGRESS_RENDER_INTERVAL_MS : COPY_PROGRESS_RENDER_INTERVAL_NON_TTY_MS;
+		if (!force && now - lastRenderAtMs < interval) return;
+		lastRenderAtMs = now;
+		if (input.interactive) {
+			const padding = Math.max(0, lastRenderedLine.length - line.length);
+			await writeOutput(input.output, `\r${line}${" ".repeat(padding)}${completeLine ? "\n" : ""}`);
+			lastRenderedLine = completeLine ? "" : line;
+			return;
+		}
+		await writeOutput(input.output, `${line}\n`);
+	};
+	const requireUploadStartedAtMs = (label) => {
+		if (uploadStartedAtMs === null) throw new Error(`Copy progress ${label} arrived before upload-started`);
+		return uploadStartedAtMs;
+	};
+	const report = async (event) => {
+		if (event.type === "archive-preparing") {
+			await render("Runneth VM copy: preparing source archive", true);
+			return;
+		}
+		if (event.type === "archive-ready") {
+			await render(`Runneth VM copy: archived ${formatCopyByteCount(event.bytesArchived)} in ${String(event.entriesArchived)} entries (${formatCopyByteCount(event.archiveByteLength)} archive); preparing destination upload`, true);
+			return;
+		}
+		if (event.type === "upload-started") {
+			uploadStartedAtMs = Date.now();
+			await render(`Runneth VM copy: uploading 0 B / ${formatCopyByteCount(event.totalBytes)} (0%)`, true);
+			return;
+		}
+		if (event.type === "range-uploaded") {
+			const startedAtMs = requireUploadStartedAtMs(`event ${event.type}`);
+			const elapsedSeconds = Math.max(.001, (Date.now() - startedAtMs) / 1e3);
+			const bytesPerSecond = event.uploadedBytes / elapsedSeconds;
+			const percent = Math.min(100, Math.floor(event.uploadedBytes / event.totalBytes * 100));
+			const etaSeconds = (event.totalBytes - event.uploadedBytes) / bytesPerSecond;
+			await render(`Runneth VM copy: uploading ${formatCopyByteCount(event.uploadedBytes)} / ${formatCopyByteCount(event.totalBytes)} (${String(percent)}%) at ${formatCopyByteCount(bytesPerSecond)}/s, eta ${formatCopyDuration(etaSeconds)}`, event.uploadedBytes >= event.totalBytes);
+			return;
+		}
+		if (event.type === "archive-applying") {
+			await render(`Runneth VM copy: uploaded ${formatCopyByteCount(event.archiveByteLength)}; applying archive`, true, true);
+			return;
+		}
+		throw new Error(`Unknown copy progress event: ${JSON.stringify(event)}`);
+	};
+	return {
+		finishFailure: async (error) => {
+			try {
+				await clearLiveLine();
+			} catch (cleanupError) {
+				throw new AggregateError([error, cleanupError], `Runneth VM copy failed: ${formatErrorMessage$1(error)}; progress output cleanup failed: ${formatErrorMessage$1(cleanupError)}`);
+			}
+			throw error;
+		},
+		report
+	};
+};
+//#endregion
+//#region src/ssh-stdio.ts
+const ALLOWED_PROCESS_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGKILL",
+	"SIGTERM"
+];
+const DEFAULT_EXEC_TIMEOUT_MS = 6e5;
+const DEFAULT_MASTER_READY_TIMEOUT_MS = 1e4;
+const DEFAULT_MAX_FRAME_BYTES = 1048576;
+const DEFAULT_MAX_PROCESSES = 16;
+const PROCESS_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/u;
+const nowIso = () => {
+	return (/* @__PURE__ */ new Date()).toISOString();
+};
+const isRecord$4 = (value) => {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const errorMessage = (error) => {
+	return error instanceof Error ? error.message : String(error);
+};
+const parseString = (record, key) => {
+	const value = record[key];
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${key} must be a non-empty string`);
+	return value;
+};
+const parseProcessId = (value) => {
+	if (!PROCESS_ID_PATTERN.test(value)) throw new Error(`Invalid process id: ${value}. Use letters, numbers, dot, underscore, dash, and colon only.`);
+	return value;
+};
+const parsePositiveInteger = (record, key) => {
+	const value = record[key];
+	if (value === void 0) return;
+	if (!Number.isInteger(value) || typeof value !== "number" || value <= 0) throw new Error(`${key} must be a positive integer`);
+	return value;
+};
+const parseParams = (record) => {
+	const params = record.params;
+	if (!isRecord$4(params)) throw new Error("params must be a JSON object");
+	return params;
+};
+const parseProcessSignal = (record) => {
+	const value = parseString(record, "signal");
+	if (!ALLOWED_PROCESS_SIGNALS.includes(value)) throw new Error(`Unsupported signal: ${value}`);
+	return value;
+};
+const parseRunnethSshStdioRequest = (value) => {
+	if (!isRecord$4(value)) throw new Error("Request must be a JSON object");
+	const id = parseProcessId(parseString(value, "id"));
+	const method = parseString(value, "method");
+	switch (method) {
+		case "exec": {
+			const params = parseParams(value);
+			const timeoutMs = parsePositiveInteger(params, "timeoutMs");
+			return {
+				id,
+				method,
+				params: {
+					command: parseString(params, "command"),
+					...timeoutMs === void 0 ? {} : { timeoutMs }
+				}
+			};
+		}
+		case "spawn": return {
+			id,
+			method,
+			params: { command: parseString(parseParams(value), "command") }
+		};
+		case "stdin": {
+			const data = parseParams(value).data;
+			if (typeof data !== "string") throw new Error("data must be a string");
+			return {
+				id,
+				method,
+				params: { data }
+			};
+		}
+		case "signal": return {
+			id,
+			method,
+			params: { signal: parseProcessSignal(parseParams(value)) }
+		};
+		case "close":
+		case "list":
+		case "ping": return {
+			id,
+			method
+		};
+		default: throw new Error(`Unknown SSH stdio method: ${method}`);
+	}
+};
+const writeChunk = async (stream, chunk) => {
+	if (stream.write(chunk)) return;
+	await new Promise((resolve) => {
+		stream.once("drain", () => {
+			resolve();
+		});
+	});
+};
+var JsonLineWriter = class {
+	#stream;
+	#queue = Promise.resolve();
+	constructor(stream) {
+		this.#stream = stream;
+	}
+	async flush() {
+		await this.#queue;
+	}
+	write(payload) {
+		const line = `${JSON.stringify(payload)}\n`;
+		const next = this.#queue.then(async () => {
+			await writeChunk(this.#stream, line);
+		});
+		this.#queue = next.then(() => void 0, () => void 0);
+		return next;
+	}
+};
+const waitForChildExit = async (child) => {
+	return await new Promise((resolve, reject) => {
+		child.once("error", reject);
+		child.once("close", (code, signal) => {
+			resolve({
+				code,
+				signal
+			});
+		});
+	});
+};
+const runProcessExitCode = async (input) => {
+	return await new Promise((resolve, reject) => {
+		const child = spawn(input.sshCommand, [...input.args], {
+			env: input.env,
+			stdio: [
+				"ignore",
+				"ignore",
+				"ignore"
+			]
+		});
+		child.once("error", reject);
+		child.once("close", (code, signal) => {
+			if (signal !== null) {
+				resolve(1);
+				return;
+			}
+			resolve(code ?? 1);
+		});
+	});
+};
+var RunnethSshControlMaster = class {
+	#controlPath;
+	#env;
+	#masterReadyTimeoutMs;
+	#setup;
+	#sshCommand;
+	#master = null;
+	#masterClosed = false;
+	#masterExit = null;
+	#masterStderr = "";
+	constructor(options) {
+		this.#controlPath = options.controlPath;
+		this.#env = options.env;
+		this.#masterReadyTimeoutMs = options.masterReadyTimeoutMs;
+		this.#setup = options.setup;
+		this.#sshCommand = options.sshCommand;
+	}
+	async start() {
+		await rm(this.#controlPath, { force: true });
+		const master = spawn(this.#sshCommand, [
+			"-F",
+			this.#setup.configPath,
+			"-S",
+			this.#controlPath,
+			"-o",
+			"ControlMaster=yes",
+			"-o",
+			"ControlPersist=no",
+			"-N",
+			this.#setup.hostAlias
+		], {
+			env: this.#env,
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			]
+		});
+		this.#master = master;
+		master.stderr?.on("data", (chunk) => {
+			this.#masterStderr += String(chunk);
+		});
+		this.#masterExit = waitForChildExit(master).then((exit) => {
+			this.#masterClosed = true;
+			return exit;
+		});
+		const deadline = Date.now() + this.#masterReadyTimeoutMs;
+		while (Date.now() < deadline) {
+			if (this.#masterClosed) throw new Error(this.#formatMasterExitError());
+			if (await this.check() === 0) return;
+			await setTimeout$1(50);
+		}
+		throw new Error(this.#formatMasterExitError("Timed out opening SSH master"));
+	}
+	async check() {
+		return await runProcessExitCode({
+			args: [
+				"-F",
+				this.#setup.configPath,
+				"-S",
+				this.#controlPath,
+				"-O",
+				"check",
+				this.#setup.hostAlias
+			],
+			env: this.#env,
+			sshCommand: this.#sshCommand
+		});
+	}
+	async requireReady() {
+		if (this.#masterClosed || await this.check() !== 0) throw new Error(this.#formatMasterExitError("SSH master is not running"));
+	}
+	spawnRemoteCommand(command) {
+		return spawn(this.#sshCommand, [
+			"-F",
+			this.#setup.configPath,
+			"-S",
+			this.#controlPath,
+			"-o",
+			"ControlMaster=no",
+			this.#setup.hostAlias,
+			command
+		], {
+			env: this.#env,
+			stdio: "pipe"
+		});
+	}
+	async stop() {
+		const master = this.#master;
+		if (master === null || this.#masterExit === null || this.#masterClosed) {
+			await rm(this.#controlPath, { force: true });
+			return;
+		}
+		master.kill("SIGTERM");
+		const timeout = setTimeout$1(5e3).then(() => {
+			if (!this.#masterClosed) master.kill("SIGKILL");
+		});
+		await Promise.race([this.#masterExit, timeout]);
+		await this.#masterExit;
+		await rm(this.#controlPath, { force: true });
+	}
+	#formatMasterExitError(prefix = "SSH master exited before it was ready") {
+		const stderr = this.#masterStderr.trim();
+		if (stderr.length === 0) return prefix;
+		return `${prefix}: ${stderr}`;
+	}
+};
+var RunnethSshStdioController = class {
+	#defaultTimeoutMs;
+	#master;
+	#maxFrameBytes;
+	#maxProcesses;
+	#processes = /* @__PURE__ */ new Map();
+	#setup;
+	#stdin;
+	#stderr;
+	#writer;
+	#stopping = false;
+	constructor(options) {
+		const setup = options.setup;
+		const env = options.env ?? process.env;
+		const controlPath = path.join(path.dirname(setup.configPath), "control.sock");
+		this.#defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS;
+		this.#maxFrameBytes = options.maxFrameBytes ?? DEFAULT_MAX_FRAME_BYTES;
+		this.#maxProcesses = options.maxProcesses ?? DEFAULT_MAX_PROCESSES;
+		this.#setup = setup;
+		this.#stdin = options.streams?.stdin ?? process.stdin;
+		this.#stderr = options.streams?.stderr ?? process.stderr;
+		this.#writer = new JsonLineWriter(options.streams?.stdout ?? process.stdout);
+		this.#master = new RunnethSshControlMaster({
+			controlPath,
+			env,
+			masterReadyTimeoutMs: options.masterReadyTimeoutMs ?? DEFAULT_MASTER_READY_TIMEOUT_MS,
+			setup,
+			sshCommand: options.sshCommand ?? "ssh"
+		});
+	}
+	async start() {
+		await this.#master.start();
+		await writeChunk(this.#stderr, `SSH stdio master ${this.#setup.hostAlias} ready\n`);
+		await this.#writer.write({
+			hostAlias: this.#setup.hostAlias,
+			ok: true,
+			protocol: "runneth-ssh-stdio",
+			type: "ready",
+			version: 1,
+			...this.#setup.targetName === void 0 ? {} : { targetName: this.#setup.targetName }
+		});
+	}
+	async run() {
+		let buffer = "";
+		for await (const chunk of this.#stdin) {
+			buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+			let newlineIndex = buffer.indexOf("\n");
+			while (newlineIndex !== -1) {
+				const rawLine = buffer.slice(0, newlineIndex);
+				buffer = buffer.slice(newlineIndex + 1);
+				if (Buffer.byteLength(rawLine, "utf8") > this.#maxFrameBytes) {
+					await this.#writer.write({
+						message: `SSH stdio frame exceeds ${String(this.#maxFrameBytes)} bytes`,
+						ok: false,
+						type: "error"
+					});
+					return;
+				}
+				if (rawLine.trim().length > 0) await this.#handleLine(rawLine);
+				newlineIndex = buffer.indexOf("\n");
+			}
+			if (Buffer.byteLength(buffer, "utf8") > this.#maxFrameBytes) {
+				await this.#writer.write({
+					message: `SSH stdio frame exceeds ${String(this.#maxFrameBytes)} bytes`,
+					ok: false,
+					type: "error"
+				});
+				return;
+			}
+		}
+	}
+	async stop() {
+		this.#stopping = true;
+		for (const processInfo of this.#processes.values()) processInfo.child.kill("SIGTERM");
+		await this.#master.stop();
+		await this.#writer.flush();
+	}
+	async #handleLine(rawLine) {
+		let request;
+		try {
+			request = parseRunnethSshStdioRequest(JSON.parse(rawLine));
+		} catch (error) {
+			await this.#writer.write({
+				message: errorMessage(error),
+				ok: false,
+				type: "error"
+			});
+			return;
+		}
+		try {
+			switch (request.method) {
+				case "exec":
+					this.#exec(request).catch((error) => {
+						this.#writeRequestError(request.id, error);
+					});
+					return;
+				case "spawn":
+					await this.#spawn(request);
+					return;
+				case "stdin":
+					await this.#writeProcessStdin(request);
+					return;
+				case "signal":
+					await this.#signalProcess(request);
+					return;
+				case "close":
+					await this.#closeProcess(request.id);
+					return;
+				case "list":
+					await this.#writer.write({
+						id: request.id,
+						ok: true,
+						processes: [...this.#processes.values()].map((processInfo) => {
+							return {
+								command: processInfo.command,
+								processId: processInfo.processId,
+								startedAt: processInfo.startedAt
+							};
+						}),
+						type: "list"
+					});
+					return;
+				case "ping":
+					await this.#writer.write({
+						id: request.id,
+						ok: true,
+						type: "pong"
+					});
+					return;
+				default: return request;
+			}
+		} catch (error) {
+			await this.#writeRequestError(request.id, error);
+		}
+	}
+	async #exec(request) {
+		await this.#master.requireReady();
+		const child = this.#master.spawnRemoteCommand(request.params.command);
+		const timeoutMs = request.params.timeoutMs ?? this.#defaultTimeoutMs;
+		let timedOut = false;
+		const timeout = setTimeout(() => {
+			timedOut = true;
+			this.#writer.write({
+				id: request.id,
+				message: `Command timed out after ${String(timeoutMs)}ms`,
+				ok: false,
+				type: "error"
+			});
+			child.kill("SIGTERM");
+		}, timeoutMs);
+		child.stdout.on("data", (chunk) => {
+			this.#writer.write({
+				data: String(chunk),
+				id: request.id,
+				type: "stdout"
+			});
+		});
+		child.stderr.on("data", (chunk) => {
+			this.#writer.write({
+				data: String(chunk),
+				id: request.id,
+				type: "stderr"
+			});
+		});
+		child.once("error", (error) => {
+			clearTimeout(timeout);
+			this.#writeRequestError(request.id, error);
+		});
+		child.once("close", (code, signal) => {
+			clearTimeout(timeout);
+			this.#writer.write({
+				code,
+				id: request.id,
+				ok: !timedOut,
+				signal,
+				type: "exit"
+			});
+		});
+	}
+	async #spawn(request) {
+		if (this.#processes.has(request.id)) throw new Error(`Process is already running: ${request.id}`);
+		if (this.#processes.size >= this.#maxProcesses) throw new Error(`SSH stdio process limit reached: ${String(this.#maxProcesses)}`);
+		await this.#master.requireReady();
+		const child = this.#master.spawnRemoteCommand(request.params.command);
+		const processInfo = {
+			child,
+			command: request.params.command,
+			processId: request.id,
+			startedAt: nowIso()
+		};
+		this.#processes.set(request.id, processInfo);
+		child.once("spawn", () => {
+			this.#writer.write({
+				command: request.params.command,
+				id: request.id,
+				ok: true,
+				processId: request.id,
+				type: "started"
+			});
+		});
+		child.stdout.on("data", (chunk) => {
+			this.#writer.write({
+				data: String(chunk),
+				id: request.id,
+				processId: request.id,
+				type: "stdout"
+			});
+		});
+		child.stderr.on("data", (chunk) => {
+			this.#writer.write({
+				data: String(chunk),
+				id: request.id,
+				processId: request.id,
+				type: "stderr"
+			});
+		});
+		child.once("error", (error) => {
+			this.#processes.delete(request.id);
+			this.#writeRequestError(request.id, error);
+		});
+		child.once("close", (code, signal) => {
+			this.#processes.delete(request.id);
+			if (this.#stopping) return;
+			this.#writer.write({
+				code,
+				id: request.id,
+				ok: true,
+				processId: request.id,
+				signal,
+				type: "exit"
+			});
+		});
+	}
+	async #writeProcessStdin(request) {
+		await writeChunk(this.#requireProcess(request.id).child.stdin, request.params.data);
+		await this.#writer.write({
+			id: request.id,
+			ok: true,
+			type: "ack"
+		});
+	}
+	async #signalProcess(request) {
+		if (!this.#requireProcess(request.id).child.kill(request.params.signal)) throw new Error(`Unable to signal process: ${request.id}`);
+		await this.#writer.write({
+			id: request.id,
+			ok: true,
+			signal: request.params.signal,
+			type: "ack"
+		});
+	}
+	async #closeProcess(processId) {
+		if (!this.#requireProcess(processId).child.kill("SIGTERM")) throw new Error(`Unable to close process: ${processId}`);
+		await this.#writer.write({
+			id: processId,
+			ok: true,
+			type: "ack"
+		});
+	}
+	#requireProcess(processId) {
+		const processInfo = this.#processes.get(processId);
+		if (processInfo === void 0) throw new Error(`Process is not running: ${processId}`);
+		return processInfo;
+	}
+	async #writeRequestError(id, error) {
+		await this.#writer.write({
+			id,
+			message: errorMessage(error),
+			ok: false,
+			type: "error"
+		});
+	}
+};
+const runRunnethSshStdio = async (options) => {
+	const controller = new RunnethSshStdioController(options);
+	await controller.start();
+	try {
+		await controller.run();
+	} finally {
+		await controller.stop();
+	}
+};
+//#endregion
+//#region src/update-invocation.ts
+const isRunnethCliUpdatePromptInvocation = (argv) => {
+	const separatorIndex = argv.indexOf("--");
+	const optionArguments = separatorIndex === -1 ? argv : argv.slice(0, separatorIndex);
+	if (optionArguments.includes("--help") || optionArguments.includes("-h")) return false;
+	if (argv[0] === "chat") return true;
+	if (argv[0] !== "ssh" || argv[1] === "proxy" || argv[1] === "stdio" || argv[1] === "target") return false;
+	return separatorIndex === -1 || separatorIndex === argv.length - 1;
+};
+//#endregion
+//#region ../../node_modules/.pnpm/signal-exit@4.1.0/node_modules/signal-exit/dist/mjs/signals.js
+/**
+* This is not the set of all possible signals.
+*
+* It IS, however, the set of all signals that trigger
+* an exit on either Linux or BSD systems.  Linux is a
+* superset of the signal names supported on BSD, and
+* the unknown signals just fail to register, so we can
+* catch that easily enough.
+*
+* Windows signals are a different set, since there are
+* signals that terminate Windows processes, but don't
+* terminate (or don't even exist) on Posix systems.
+*
+* Don't bother with SIGKILL.  It's uncatchable, which
+* means that we can't fire any callbacks anyway.
+*
+* If a user does happen to register a handler on a non-
+* fatal signal like SIGWINCH or something, and then
+* exit, it'll end up firing `process.emit('exit')`, so
+* the handler will be fired anyway.
+*
+* SIGBUS, SIGFPE, SIGSEGV and SIGILL, when not raised
+* artificially, inherently leave the process in a
+* state from which it is not safe to try and enter JS
+* listeners.
+*/
+const signals = [];
+signals.push("SIGHUP", "SIGINT", "SIGTERM");
+if (process.platform !== "win32") signals.push("SIGALRM", "SIGABRT", "SIGVTALRM", "SIGXCPU", "SIGXFSZ", "SIGUSR2", "SIGTRAP", "SIGSYS", "SIGQUIT", "SIGIOT");
+if (process.platform === "linux") signals.push("SIGIO", "SIGPOLL", "SIGPWR", "SIGSTKFLT");
+//#endregion
+//#region ../../node_modules/.pnpm/signal-exit@4.1.0/node_modules/signal-exit/dist/mjs/index.js
+const processOk = (process) => !!process && typeof process === "object" && typeof process.removeListener === "function" && typeof process.emit === "function" && typeof process.reallyExit === "function" && typeof process.listeners === "function" && typeof process.kill === "function" && typeof process.pid === "number" && typeof process.on === "function";
+const kExitEmitter = Symbol.for("signal-exit emitter");
+const global$1 = globalThis;
+const ObjectDefineProperty = Object.defineProperty.bind(Object);
+var Emitter = class {
+	emitted = {
+		afterExit: false,
+		exit: false
+	};
+	listeners = {
+		afterExit: [],
+		exit: []
+	};
+	count = 0;
+	id = Math.random();
+	constructor() {
+		if (global$1[kExitEmitter]) return global$1[kExitEmitter];
+		ObjectDefineProperty(global$1, kExitEmitter, {
+			value: this,
+			writable: false,
+			enumerable: false,
+			configurable: false
+		});
+	}
+	on(ev, fn) {
+		this.listeners[ev].push(fn);
+	}
+	removeListener(ev, fn) {
+		const list = this.listeners[ev];
+		const i = list.indexOf(fn);
+		/* c8 ignore start */
+		if (i === -1) return;
+		/* c8 ignore stop */
+		if (i === 0 && list.length === 1) list.length = 0;
+		else list.splice(i, 1);
+	}
+	emit(ev, code, signal) {
+		if (this.emitted[ev]) return false;
+		this.emitted[ev] = true;
+		let ret = false;
+		for (const fn of this.listeners[ev]) ret = fn(code, signal) === true || ret;
+		if (ev === "exit") ret = this.emit("afterExit", code, signal) || ret;
+		return ret;
+	}
+};
+var SignalExitBase = class {};
+const signalExitWrap = (handler) => {
+	return {
+		onExit(cb, opts) {
+			return handler.onExit(cb, opts);
+		},
+		load() {
+			return handler.load();
+		},
+		unload() {
+			return handler.unload();
+		}
+	};
+};
+var SignalExitFallback = class extends SignalExitBase {
+	onExit() {
+		return () => {};
+	}
+	load() {}
+	unload() {}
+};
+var SignalExit = class extends SignalExitBase {
+	/* c8 ignore start */
+	#hupSig = process$2.platform === "win32" ? "SIGINT" : "SIGHUP";
+	/* c8 ignore stop */
+	#emitter = new Emitter();
+	#process;
+	#originalProcessEmit;
+	#originalProcessReallyExit;
+	#sigListeners = {};
+	#loaded = false;
+	constructor(process) {
+		super();
+		this.#process = process;
+		this.#sigListeners = {};
+		for (const sig of signals) this.#sigListeners[sig] = () => {
+			const listeners = this.#process.listeners(sig);
+			let { count } = this.#emitter;
+			/* c8 ignore start */
+			const p = process;
+			if (typeof p.__signal_exit_emitter__ === "object" && typeof p.__signal_exit_emitter__.count === "number") count += p.__signal_exit_emitter__.count;
+			/* c8 ignore stop */
+			if (listeners.length === count) {
+				this.unload();
+				const ret = this.#emitter.emit("exit", null, sig);
+				/* c8 ignore start */
+				const s = sig === "SIGHUP" ? this.#hupSig : sig;
+				if (!ret) process.kill(process.pid, s);
+			}
+		};
+		this.#originalProcessReallyExit = process.reallyExit;
+		this.#originalProcessEmit = process.emit;
+	}
+	onExit(cb, opts) {
+		/* c8 ignore start */
+		if (!processOk(this.#process)) return () => {};
+		/* c8 ignore stop */
+		if (this.#loaded === false) this.load();
+		const ev = opts?.alwaysLast ? "afterExit" : "exit";
+		this.#emitter.on(ev, cb);
+		return () => {
+			this.#emitter.removeListener(ev, cb);
+			if (this.#emitter.listeners["exit"].length === 0 && this.#emitter.listeners["afterExit"].length === 0) this.unload();
+		};
+	}
+	load() {
+		if (this.#loaded) return;
+		this.#loaded = true;
+		this.#emitter.count += 1;
+		for (const sig of signals) try {
+			const fn = this.#sigListeners[sig];
+			if (fn) this.#process.on(sig, fn);
+		} catch (_) {}
+		this.#process.emit = (ev, ...a) => {
+			return this.#processEmit(ev, ...a);
+		};
+		this.#process.reallyExit = (code) => {
+			return this.#processReallyExit(code);
+		};
+	}
+	unload() {
+		if (!this.#loaded) return;
+		this.#loaded = false;
+		signals.forEach((sig) => {
+			const listener = this.#sigListeners[sig];
+			/* c8 ignore start */
+			if (!listener) throw new Error("Listener not defined for signal: " + sig);
+			/* c8 ignore stop */
+			try {
+				this.#process.removeListener(sig, listener);
+			} catch (_) {}
+			/* c8 ignore stop */
+		});
+		this.#process.emit = this.#originalProcessEmit;
+		this.#process.reallyExit = this.#originalProcessReallyExit;
+		this.#emitter.count -= 1;
+	}
+	#processReallyExit(code) {
+		/* c8 ignore start */
+		if (!processOk(this.#process)) return 0;
+		this.#process.exitCode = code || 0;
+		/* c8 ignore stop */
+		this.#emitter.emit("exit", this.#process.exitCode, null);
+		return this.#originalProcessReallyExit.call(this.#process, this.#process.exitCode);
+	}
+	#processEmit(ev, ...args) {
+		const og = this.#originalProcessEmit;
+		if (ev === "exit" && processOk(this.#process)) {
+			if (typeof args[0] === "number") this.#process.exitCode = args[0];
+			/* c8 ignore start */
+			const ret = og.call(this.#process, ev, ...args);
+			/* c8 ignore start */
+			this.#emitter.emit("exit", this.#process.exitCode, null);
+			/* c8 ignore stop */
+			return ret;
+		} else return og.call(this.#process, ev, ...args);
+	}
+};
+const process$2 = globalThis.process;
+const { onExit, load, unload } = signalExitWrap(processOk(process$2) ? new SignalExit(process$2) : new SignalExitFallback());
+//#endregion
+//#region src/update-prompt.ts
+const DEFAULT_TERMINAL_COLUMNS = 80;
+const OPTIONS = [
+	{
+		label: "Update now",
+		selection: "update"
+	},
+	{
+		label: "Not now",
+		selection: "not-now"
+	},
+	{
+		label: "Do not remind me for this version",
+		selection: "dismiss"
+	}
+];
+const actionFromKeypress = (character, key) => {
+	if (key.name === "up" || character === "k") return "up";
+	if (key.name === "down" || character === "j") return "down";
+	if (key.name === "return" || key.name === "enter") return "select";
+	if (key.name === "escape" || key.ctrl === true && (key.name === "c" || key.name === "d")) return "escape";
+	return null;
+};
+const moveRunnethCliUpdatePromptHighlight = (highlighted, direction) => {
+	switch (highlighted) {
+		case 0: return direction === "down" ? 1 : 2;
+		case 1: return direction === "down" ? 2 : 0;
+		case 2: return direction === "down" ? 0 : 1;
+		default: return highlighted;
+	}
+};
+const renderOptions = (output, highlighted, previousRows) => {
+	if (previousRows > 0) output.write(`\u001b[${String(previousRows)}A\r\u001b[0J`);
+	const columns = typeof output.columns === "number" && Number.isInteger(output.columns) && output.columns > 0 ? output.columns : DEFAULT_TERMINAL_COLUMNS;
+	let renderedRows = 0;
+	OPTIONS.forEach((option, index) => {
+		const line = `${index === highlighted ? "›" : " "} ${String(index + 1)}. ${option.label}`;
+		renderedRows += Math.ceil(line.length / columns);
+		output.write(`\r${line}\n`);
+	});
+	return renderedRows;
+};
+const runRunnethCliUpdatePrompt = async (input) => {
+	if (input.input.isTTY !== true || input.output.isTTY !== true) throw new Error("Runneth CLI update prompt requires an interactive TTY");
+	input.output.write(`\n✨ Update available! ${input.currentVersion} -> ${input.targetVersion}\n\nUpdate now runs \`${input.updateCommand}\`\n\n`);
+	let highlighted = 0;
+	let renderedRows = renderOptions(input.output, highlighted, 0);
+	const wasFlowing = input.input.readableFlowing === true;
+	const wasRaw = input.input.isRaw;
+	const restoreInput = () => {
+		input.input.setRawMode(wasRaw);
+		if (!wasFlowing) input.input.pause();
+	};
+	const removeExitCleanup = onExit(restoreInput);
+	input.input.setRawMode(true);
+	input.input.resume();
+	emitKeypressEvents(input.input);
+	return await new Promise((resolve) => {
+		const finish = (selection) => {
+			input.input.off("keypress", onKeypress);
+			restoreInput();
+			removeExitCleanup();
+			input.output.write("\n");
+			resolve(selection);
+		};
+		const onKeypress = (character, key) => {
+			const action = actionFromKeypress(character, key);
+			switch (action) {
+				case "up":
+				case "down":
+					highlighted = moveRunnethCliUpdatePromptHighlight(highlighted, action);
+					renderedRows = renderOptions(input.output, highlighted, renderedRows);
+					return;
+				case "select":
+					finish(OPTIONS[highlighted].selection);
+					return;
+				case "escape":
+					finish("not-now");
+					return;
+				case null: return;
+				default: return action;
+			}
+		};
+		input.input.on("keypress", onKeypress);
+	});
+};
+//#endregion
+//#region ../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js
+var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = isexe;
+	isexe.sync = sync;
+	var fs$2 = __require("fs");
+	function checkPathExt(path, options) {
+		var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
+		if (!pathext) return true;
+		pathext = pathext.split(";");
+		if (pathext.indexOf("") !== -1) return true;
+		for (var i = 0; i < pathext.length; i++) {
+			var p = pathext[i].toLowerCase();
+			if (p && path.substr(-p.length).toLowerCase() === p) return true;
+		}
+		return false;
+	}
+	function checkStat(stat, path, options) {
+		if (!stat.isSymbolicLink() && !stat.isFile()) return false;
+		return checkPathExt(path, options);
+	}
+	function isexe(path, options, cb) {
+		fs$2.stat(path, function(er, stat) {
+			cb(er, er ? false : checkStat(stat, path, options));
+		});
+	}
+	function sync(path, options) {
+		return checkStat(fs$2.statSync(path), path, options);
+	}
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js
+var require_mode = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = isexe;
+	isexe.sync = sync;
+	var fs$1 = __require("fs");
+	function isexe(path, options, cb) {
+		fs$1.stat(path, function(er, stat) {
+			cb(er, er ? false : checkStat(stat, options));
+		});
+	}
+	function sync(path, options) {
+		return checkStat(fs$1.statSync(path), options);
+	}
+	function checkStat(stat, options) {
+		return stat.isFile() && checkMode(stat, options);
+	}
+	function checkMode(stat, options) {
+		var mod = stat.mode;
+		var uid = stat.uid;
+		var gid = stat.gid;
+		var myUid = options.uid !== void 0 ? options.uid : process.getuid && process.getuid();
+		var myGid = options.gid !== void 0 ? options.gid : process.getgid && process.getgid();
+		var u = parseInt("100", 8);
+		var g = parseInt("010", 8);
+		var o = parseInt("001", 8);
+		var ug = u | g;
+		return mod & o || mod & g && gid === myGid || mod & u && uid === myUid || mod & ug && myUid === 0;
+	}
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
+var require_isexe = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	__require("fs");
+	var core;
+	if (process.platform === "win32" || global.TESTING_WINDOWS) core = require_windows();
+	else core = require_mode();
+	module.exports = isexe;
+	isexe.sync = sync;
+	function isexe(path, options, cb) {
+		if (typeof options === "function") {
+			cb = options;
+			options = {};
+		}
+		if (!cb) {
+			if (typeof Promise !== "function") throw new TypeError("callback not provided");
+			return new Promise(function(resolve, reject) {
+				isexe(path, options || {}, function(er, is) {
+					if (er) reject(er);
+					else resolve(is);
+				});
+			});
+		}
+		core(path, options || {}, function(er, is) {
+			if (er) {
+				if (er.code === "EACCES" || options && options.ignoreErrors) {
+					er = null;
+					is = false;
+				}
+			}
+			cb(er, is);
+		});
+	}
+	function sync(path, options) {
+		try {
+			return core.sync(path, options || {});
+		} catch (er) {
+			if (options && options.ignoreErrors || er.code === "EACCES") return false;
+			else throw er;
+		}
+	}
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/which@2.0.2/node_modules/which/which.js
+var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
+	const path$3 = __require("path");
+	const COLON = isWindows ? ";" : ":";
+	const isexe = require_isexe();
+	const getNotFoundError = (cmd) => Object.assign(/* @__PURE__ */ new Error(`not found: ${cmd}`), { code: "ENOENT" });
+	const getPathInfo = (cmd, opt) => {
+		const colon = opt.colon || COLON;
+		const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? [""] : [...isWindows ? [process.cwd()] : [], ...(opt.path || process.env.PATH || "").split(colon)];
+		const pathExtExe = isWindows ? opt.pathExt || process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM" : "";
+		const pathExt = isWindows ? pathExtExe.split(colon) : [""];
+		if (isWindows) {
+			if (cmd.indexOf(".") !== -1 && pathExt[0] !== "") pathExt.unshift("");
+		}
+		return {
+			pathEnv,
+			pathExt,
+			pathExtExe
+		};
+	};
+	const which = (cmd, opt, cb) => {
+		if (typeof opt === "function") {
+			cb = opt;
+			opt = {};
+		}
+		if (!opt) opt = {};
+		const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+		const found = [];
+		const step = (i) => new Promise((resolve, reject) => {
+			if (i === pathEnv.length) return opt.all && found.length ? resolve(found) : reject(getNotFoundError(cmd));
+			const ppRaw = pathEnv[i];
+			const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+			const pCmd = path$3.join(pathPart, cmd);
+			resolve(subStep(!pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd, i, 0));
+		});
+		const subStep = (p, i, ii) => new Promise((resolve, reject) => {
+			if (ii === pathExt.length) return resolve(step(i + 1));
+			const ext = pathExt[ii];
+			isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
+				if (!er && is) if (opt.all) found.push(p + ext);
+				else return resolve(p + ext);
+				return resolve(subStep(p, i, ii + 1));
+			});
+		});
+		return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
+	};
+	const whichSync = (cmd, opt) => {
+		opt = opt || {};
+		const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+		const found = [];
+		for (let i = 0; i < pathEnv.length; i++) {
+			const ppRaw = pathEnv[i];
+			const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+			const pCmd = path$3.join(pathPart, cmd);
+			const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+			for (let j = 0; j < pathExt.length; j++) {
+				const cur = p + pathExt[j];
+				try {
+					if (isexe.sync(cur, { pathExt: pathExtExe })) if (opt.all) found.push(cur);
+					else return cur;
+				} catch (ex) {}
+			}
+		}
+		if (opt.all && found.length) return found;
+		if (opt.nothrow) return null;
+		throw getNotFoundError(cmd);
+	};
+	module.exports = which;
+	which.sync = whichSync;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/path-key@3.1.1/node_modules/path-key/index.js
+var require_path_key = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const pathKey = (options = {}) => {
+		const environment = options.env || process.env;
+		if ((options.platform || process.platform) !== "win32") return "PATH";
+		return Object.keys(environment).reverse().find((key) => key.toUpperCase() === "PATH") || "Path";
+	};
+	module.exports = pathKey;
+	module.exports.default = pathKey;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js
+var require_resolveCommand = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const path$2 = __require("path");
+	const which = require_which();
+	const getPathKey = require_path_key();
+	function resolveCommandAttempt(parsed, withoutPathExt) {
+		const env = parsed.options.env || process.env;
+		const cwd = process.cwd();
+		const hasCustomCwd = parsed.options.cwd != null;
+		const shouldSwitchCwd = hasCustomCwd && process.chdir !== void 0 && !process.chdir.disabled;
+		if (shouldSwitchCwd) try {
+			process.chdir(parsed.options.cwd);
+		} catch (err) {}
+		let resolved;
+		try {
+			resolved = which.sync(parsed.command, {
+				path: env[getPathKey({ env })],
+				pathExt: withoutPathExt ? path$2.delimiter : void 0
+			});
+		} catch (e) {} finally {
+			if (shouldSwitchCwd) process.chdir(cwd);
+		}
+		if (resolved) resolved = path$2.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+		return resolved;
+	}
+	function resolveCommand(parsed) {
+		return resolveCommandAttempt(parsed) || resolveCommandAttempt(parsed, true);
+	}
+	module.exports = resolveCommand;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/escape.js
+var require_escape = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const metaCharsRegExp = /([()\][%!^"`<>&|;, *?])/g;
+	function escapeCommand(arg) {
+		arg = arg.replace(metaCharsRegExp, "^$1");
+		return arg;
+	}
+	function escapeArgument(arg, doubleEscapeMetaChars) {
+		arg = `${arg}`;
+		arg = arg.replace(/(?=(\\+?)?)\1"/g, "$1$1\\\"");
+		arg = arg.replace(/(?=(\\+?)?)\1$/, "$1$1");
+		arg = `"${arg}"`;
+		arg = arg.replace(metaCharsRegExp, "^$1");
+		if (doubleEscapeMetaChars) arg = arg.replace(metaCharsRegExp, "^$1");
+		return arg;
+	}
+	module.exports.command = escapeCommand;
+	module.exports.argument = escapeArgument;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/shebang-regex@3.0.0/node_modules/shebang-regex/index.js
+var require_shebang_regex = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = /^#!(.*)/;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/shebang-command@2.0.0/node_modules/shebang-command/index.js
+var require_shebang_command = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const shebangRegex = require_shebang_regex();
+	module.exports = (string = "") => {
+		const match = string.match(shebangRegex);
+		if (!match) return null;
+		const [path, argument] = match[0].replace(/#! ?/, "").split(" ");
+		const binary = path.split("/").pop();
+		if (binary === "env") return argument;
+		return argument ? `${binary} ${argument}` : binary;
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js
+var require_readShebang = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const fs = __require("fs");
+	const shebangCommand = require_shebang_command();
+	function readShebang(command) {
+		const size = 150;
+		const buffer = Buffer.alloc(size);
+		let fd;
+		try {
+			fd = fs.openSync(command, "r");
+			fs.readSync(fd, buffer, 0, size, 0);
+			fs.closeSync(fd);
+		} catch (e) {}
+		return shebangCommand(buffer.toString());
+	}
+	module.exports = readShebang;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js
+var require_parse$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const path$1 = __require("path");
+	const resolveCommand = require_resolveCommand();
+	const escape = require_escape();
+	const readShebang = require_readShebang();
+	const isWin = process.platform === "win32";
+	const isExecutableRegExp = /\.(?:com|exe)$/i;
+	const isCmdShimRegExp = /node_modules[\\/].bin[\\/][^\\/]+\.cmd$/i;
+	function detectShebang(parsed) {
+		parsed.file = resolveCommand(parsed);
+		const shebang = parsed.file && readShebang(parsed.file);
+		if (shebang) {
+			parsed.args.unshift(parsed.file);
+			parsed.command = shebang;
+			return resolveCommand(parsed);
+		}
+		return parsed.file;
+	}
+	function parseNonShell(parsed) {
+		if (!isWin) return parsed;
+		const commandFile = detectShebang(parsed);
+		const needsShell = !isExecutableRegExp.test(commandFile);
+		if (parsed.options.forceShell || needsShell) {
+			const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
+			parsed.command = path$1.normalize(parsed.command);
+			parsed.command = escape.command(parsed.command);
+			parsed.args = parsed.args.map((arg) => escape.argument(arg, needsDoubleEscapeMetaChars));
+			parsed.args = [
+				"/d",
+				"/s",
+				"/c",
+				`"${[parsed.command].concat(parsed.args).join(" ")}"`
+			];
+			parsed.command = process.env.comspec || "cmd.exe";
+			parsed.options.windowsVerbatimArguments = true;
+		}
+		return parsed;
+	}
+	function parse(command, args, options) {
+		if (args && !Array.isArray(args)) {
+			options = args;
+			args = null;
+		}
+		args = args ? args.slice(0) : [];
+		options = Object.assign({}, options);
+		const parsed = {
+			command,
+			args,
+			options,
+			file: void 0,
+			original: {
+				command,
+				args
+			}
+		};
+		return options.shell ? parsed : parseNonShell(parsed);
+	}
+	module.exports = parse;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/enoent.js
+var require_enoent = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const isWin = process.platform === "win32";
+	function notFoundError(original, syscall) {
+		return Object.assign(/* @__PURE__ */ new Error(`${syscall} ${original.command} ENOENT`), {
+			code: "ENOENT",
+			errno: "ENOENT",
+			syscall: `${syscall} ${original.command}`,
+			path: original.command,
+			spawnargs: original.args
+		});
+	}
+	function hookChildProcess(cp, parsed) {
+		if (!isWin) return;
+		const originalEmit = cp.emit;
+		cp.emit = function(name, arg1) {
+			if (name === "exit") {
+				const err = verifyENOENT(arg1, parsed);
+				if (err) return originalEmit.call(cp, "error", err);
+			}
+			return originalEmit.apply(cp, arguments);
+		};
+	}
+	function verifyENOENT(status, parsed) {
+		if (isWin && status === 1 && !parsed.file) return notFoundError(parsed.original, "spawn");
+		return null;
+	}
+	function verifyENOENTSync(status, parsed) {
+		if (isWin && status === 1 && !parsed.file) return notFoundError(parsed.original, "spawnSync");
+		return null;
+	}
+	module.exports = {
+		hookChildProcess,
+		verifyENOENT,
+		verifyENOENTSync,
+		notFoundError
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/index.js
+var require_cross_spawn = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const cp$1 = __require("child_process");
+	const parse = require_parse$1();
+	const enoent = require_enoent();
+	function spawn(command, args, options) {
+		const parsed = parse(command, args, options);
+		const spawned = cp$1.spawn(parsed.command, parsed.args, parsed.options);
+		enoent.hookChildProcess(spawned, parsed);
+		return spawned;
+	}
+	function spawnSync(command, args, options) {
+		const parsed = parse(command, args, options);
+		const result = cp$1.spawnSync(parsed.command, parsed.args, parsed.options);
+		result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
+		return result;
+	}
+	module.exports = spawn;
+	module.exports.spawn = spawn;
+	module.exports.sync = spawnSync;
+	module.exports._parse = parse;
+	module.exports._enoent = enoent;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/semver@7.8.0/node_modules/semver/internal/debug.js
+var require_debug = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () => {};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/semver@7.8.0/node_modules/semver/internal/constants.js
+var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const SEMVER_SPEC_VERSION = "2.0.0";
+	const MAX_LENGTH = 256;
+	const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER || 9007199254740991;
+	module.exports = {
+		MAX_LENGTH,
+		MAX_SAFE_COMPONENT_LENGTH: 16,
+		MAX_SAFE_BUILD_LENGTH: MAX_LENGTH - 6,
+		MAX_SAFE_INTEGER,
+		RELEASE_TYPES: [
+			"major",
+			"premajor",
+			"minor",
+			"preminor",
+			"patch",
+			"prepatch",
+			"prerelease"
+		],
+		SEMVER_SPEC_VERSION,
+		FLAG_INCLUDE_PRERELEASE: 1,
+		FLAG_LOOSE: 2
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/semver@7.8.0/node_modules/semver/internal/re.js
+var require_re = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const { MAX_SAFE_COMPONENT_LENGTH, MAX_SAFE_BUILD_LENGTH, MAX_LENGTH } = require_constants();
+	const debug = require_debug();
+	exports = module.exports = {};
+	const re = exports.re = [];
+	const safeRe = exports.safeRe = [];
+	const src = exports.src = [];
+	const safeSrc = exports.safeSrc = [];
+	const t = exports.t = {};
+	let R = 0;
+	const LETTERDASHNUMBER = "[a-zA-Z0-9-]";
+	const safeRegexReplacements = [
+		["\\s", 1],
+		["\\d", MAX_LENGTH],
+		[LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH]
+	];
+	const makeSafeRegex = (value) => {
+		for (const [token, max] of safeRegexReplacements) value = value.split(`${token}*`).join(`${token}{0,${max}}`).split(`${token}+`).join(`${token}{1,${max}}`);
+		return value;
+	};
+	const createToken = (name, value, isGlobal) => {
+		const safe = makeSafeRegex(value);
+		const index = R++;
+		debug(name, index, value);
+		t[name] = index;
+		src[index] = value;
+		safeSrc[index] = safe;
+		re[index] = new RegExp(value, isGlobal ? "g" : void 0);
+		safeRe[index] = new RegExp(safe, isGlobal ? "g" : void 0);
+	};
+	createToken("NUMERICIDENTIFIER", "0|[1-9]\\d*");
+	createToken("NUMERICIDENTIFIERLOOSE", "\\d+");
+	createToken("NONNUMERICIDENTIFIER", `\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`);
+	createToken("MAINVERSION", `(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})`);
+	createToken("MAINVERSIONLOOSE", `(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})`);
+	createToken("PRERELEASEIDENTIFIER", `(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIER]})`);
+	createToken("PRERELEASEIDENTIFIERLOOSE", `(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIERLOOSE]})`);
+	createToken("PRERELEASE", `(?:-(${src[t.PRERELEASEIDENTIFIER]}(?:\\.${src[t.PRERELEASEIDENTIFIER]})*))`);
+	createToken("PRERELEASELOOSE", `(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${src[t.PRERELEASEIDENTIFIERLOOSE]})*))`);
+	createToken("BUILDIDENTIFIER", `${LETTERDASHNUMBER}+`);
+	createToken("BUILD", `(?:\\+(${src[t.BUILDIDENTIFIER]}(?:\\.${src[t.BUILDIDENTIFIER]})*))`);
+	createToken("FULLPLAIN", `v?${src[t.MAINVERSION]}${src[t.PRERELEASE]}?${src[t.BUILD]}?`);
+	createToken("FULL", `^${src[t.FULLPLAIN]}$`);
+	createToken("LOOSEPLAIN", `[v=\\s]*${src[t.MAINVERSIONLOOSE]}${src[t.PRERELEASELOOSE]}?${src[t.BUILD]}?`);
+	createToken("LOOSE", `^${src[t.LOOSEPLAIN]}$`);
+	createToken("GTLT", "((?:<|>)?=?)");
+	createToken("XRANGEIDENTIFIERLOOSE", `${src[t.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);
+	createToken("XRANGEIDENTIFIER", `${src[t.NUMERICIDENTIFIER]}|x|X|\\*`);
+	createToken("XRANGEPLAIN", `[v=\\s]*(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:${src[t.PRERELEASE]})?${src[t.BUILD]}?)?)?`);
+	createToken("XRANGEPLAINLOOSE", `[v=\\s]*(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:${src[t.PRERELEASELOOSE]})?${src[t.BUILD]}?)?)?`);
+	createToken("XRANGE", `^${src[t.GTLT]}\\s*${src[t.XRANGEPLAIN]}$`);
+	createToken("XRANGELOOSE", `^${src[t.GTLT]}\\s*${src[t.XRANGEPLAINLOOSE]}$`);
+	createToken("COERCEPLAIN", `(^|[^\\d])(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}})(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?`);
+	createToken("COERCE", `${src[t.COERCEPLAIN]}(?:$|[^\\d])`);
+	createToken("COERCEFULL", src[t.COERCEPLAIN] + `(?:${src[t.PRERELEASE]})?(?:${src[t.BUILD]})?(?:$|[^\\d])`);
+	createToken("COERCERTL", src[t.COERCE], true);
+	createToken("COERCERTLFULL", src[t.COERCEFULL], true);
+	createToken("LONETILDE", "(?:~>?)");
+	createToken("TILDETRIM", `(\\s*)${src[t.LONETILDE]}\\s+`, true);
+	exports.tildeTrimReplace = "$1~";
+	createToken("TILDE", `^${src[t.LONETILDE]}${src[t.XRANGEPLAIN]}$`);
+	createToken("TILDELOOSE", `^${src[t.LONETILDE]}${src[t.XRANGEPLAINLOOSE]}$`);
+	createToken("LONECARET", "(?:\\^)");
+	createToken("CARETTRIM", `(\\s*)${src[t.LONECARET]}\\s+`, true);
+	exports.caretTrimReplace = "$1^";
+	createToken("CARET", `^${src[t.LONECARET]}${src[t.XRANGEPLAIN]}$`);
+	createToken("CARETLOOSE", `^${src[t.LONECARET]}${src[t.XRANGEPLAINLOOSE]}$`);
+	createToken("COMPARATORLOOSE", `^${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]})$|^$`);
+	createToken("COMPARATOR", `^${src[t.GTLT]}\\s*(${src[t.FULLPLAIN]})$|^$`);
+	createToken("COMPARATORTRIM", `(\\s*)${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]}|${src[t.XRANGEPLAIN]})`, true);
+	exports.comparatorTrimReplace = "$1$2$3";
+	createToken("HYPHENRANGE", `^\\s*(${src[t.XRANGEPLAIN]})\\s+-\\s+(${src[t.XRANGEPLAIN]})\\s*$`);
+	createToken("HYPHENRANGELOOSE", `^\\s*(${src[t.XRANGEPLAINLOOSE]})\\s+-\\s+(${src[t.XRANGEPLAINLOOSE]})\\s*$`);
+	createToken("STAR", "(<|>)?=?\\s*\\*");
+	createToken("GTE0", "^\\s*>=\\s*0\\.0\\.0\\s*$");
+	createToken("GTE0PRE", "^\\s*>=\\s*0\\.0\\.0-0\\s*$");
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/semver@7.8.0/node_modules/semver/internal/parse-options.js
+var require_parse_options = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const looseOption = Object.freeze({ loose: true });
+	const emptyOpts = Object.freeze({});
+	const parseOptions = (options) => {
+		if (!options) return emptyOpts;
+		if (typeof options !== "object") return looseOption;
+		return options;
+	};
+	module.exports = parseOptions;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/semver@7.8.0/node_modules/semver/internal/identifiers.js
+var require_identifiers = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const numeric = /^[0-9]+$/;
+	const compareIdentifiers = (a, b) => {
+		if (typeof a === "number" && typeof b === "number") return a === b ? 0 : a < b ? -1 : 1;
+		const anum = numeric.test(a);
+		const bnum = numeric.test(b);
+		if (anum && bnum) {
+			a = +a;
+			b = +b;
+		}
+		return a === b ? 0 : anum && !bnum ? -1 : bnum && !anum ? 1 : a < b ? -1 : 1;
+	};
+	const rcompareIdentifiers = (a, b) => compareIdentifiers(b, a);
+	module.exports = {
+		compareIdentifiers,
+		rcompareIdentifiers
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/semver@7.8.0/node_modules/semver/classes/semver.js
+var require_semver = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const debug = require_debug();
+	const { MAX_LENGTH, MAX_SAFE_INTEGER } = require_constants();
+	const { safeRe: re, t } = require_re();
+	const parseOptions = require_parse_options();
+	const { compareIdentifiers } = require_identifiers();
+	module.exports = class SemVer {
+		constructor(version, options) {
+			options = parseOptions(options);
+			if (version instanceof SemVer) if (version.loose === !!options.loose && version.includePrerelease === !!options.includePrerelease) return version;
+			else version = version.version;
+			else if (typeof version !== "string") throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);
+			if (version.length > MAX_LENGTH) throw new TypeError(`version is longer than ${MAX_LENGTH} characters`);
+			debug("SemVer", version, options);
+			this.options = options;
+			this.loose = !!options.loose;
+			this.includePrerelease = !!options.includePrerelease;
+			const m = version.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL]);
+			if (!m) throw new TypeError(`Invalid Version: ${version}`);
+			this.raw = version;
+			this.major = +m[1];
+			this.minor = +m[2];
+			this.patch = +m[3];
+			if (this.major > MAX_SAFE_INTEGER || this.major < 0) throw new TypeError("Invalid major version");
+			if (this.minor > MAX_SAFE_INTEGER || this.minor < 0) throw new TypeError("Invalid minor version");
+			if (this.patch > MAX_SAFE_INTEGER || this.patch < 0) throw new TypeError("Invalid patch version");
+			if (!m[4]) this.prerelease = [];
+			else this.prerelease = m[4].split(".").map((id) => {
+				if (/^[0-9]+$/.test(id)) {
+					const num = +id;
+					if (num >= 0 && num < MAX_SAFE_INTEGER) return num;
+				}
+				return id;
+			});
+			this.build = m[5] ? m[5].split(".") : [];
+			this.format();
+		}
+		format() {
+			this.version = `${this.major}.${this.minor}.${this.patch}`;
+			if (this.prerelease.length) this.version += `-${this.prerelease.join(".")}`;
+			return this.version;
+		}
+		toString() {
+			return this.version;
+		}
+		compare(other) {
+			debug("SemVer.compare", this.version, this.options, other);
+			if (!(other instanceof SemVer)) {
+				if (typeof other === "string" && other === this.version) return 0;
+				other = new SemVer(other, this.options);
+			}
+			if (other.version === this.version) return 0;
+			return this.compareMain(other) || this.comparePre(other);
+		}
+		compareMain(other) {
+			if (!(other instanceof SemVer)) other = new SemVer(other, this.options);
+			if (this.major < other.major) return -1;
+			if (this.major > other.major) return 1;
+			if (this.minor < other.minor) return -1;
+			if (this.minor > other.minor) return 1;
+			if (this.patch < other.patch) return -1;
+			if (this.patch > other.patch) return 1;
+			return 0;
+		}
+		comparePre(other) {
+			if (!(other instanceof SemVer)) other = new SemVer(other, this.options);
+			if (this.prerelease.length && !other.prerelease.length) return -1;
+			else if (!this.prerelease.length && other.prerelease.length) return 1;
+			else if (!this.prerelease.length && !other.prerelease.length) return 0;
+			let i = 0;
+			do {
+				const a = this.prerelease[i];
+				const b = other.prerelease[i];
+				debug("prerelease compare", i, a, b);
+				if (a === void 0 && b === void 0) return 0;
+				else if (b === void 0) return 1;
+				else if (a === void 0) return -1;
+				else if (a === b) continue;
+				else return compareIdentifiers(a, b);
+			} while (++i);
+		}
+		compareBuild(other) {
+			if (!(other instanceof SemVer)) other = new SemVer(other, this.options);
+			let i = 0;
+			do {
+				const a = this.build[i];
+				const b = other.build[i];
+				debug("build compare", i, a, b);
+				if (a === void 0 && b === void 0) return 0;
+				else if (b === void 0) return 1;
+				else if (a === void 0) return -1;
+				else if (a === b) continue;
+				else return compareIdentifiers(a, b);
+			} while (++i);
+		}
+		inc(release, identifier, identifierBase) {
+			if (release.startsWith("pre")) {
+				if (!identifier && identifierBase === false) throw new Error("invalid increment argument: identifier is empty");
+				if (identifier) {
+					const match = `-${identifier}`.match(this.options.loose ? re[t.PRERELEASELOOSE] : re[t.PRERELEASE]);
+					if (!match || match[1] !== identifier) throw new Error(`invalid identifier: ${identifier}`);
+				}
+			}
+			switch (release) {
+				case "premajor":
+					this.prerelease.length = 0;
+					this.patch = 0;
+					this.minor = 0;
+					this.major++;
+					this.inc("pre", identifier, identifierBase);
+					break;
+				case "preminor":
+					this.prerelease.length = 0;
+					this.patch = 0;
+					this.minor++;
+					this.inc("pre", identifier, identifierBase);
+					break;
+				case "prepatch":
+					this.prerelease.length = 0;
+					this.inc("patch", identifier, identifierBase);
+					this.inc("pre", identifier, identifierBase);
+					break;
+				case "prerelease":
+					if (this.prerelease.length === 0) this.inc("patch", identifier, identifierBase);
+					this.inc("pre", identifier, identifierBase);
+					break;
+				case "release":
+					if (this.prerelease.length === 0) throw new Error(`version ${this.raw} is not a prerelease`);
+					this.prerelease.length = 0;
+					break;
+				case "major":
+					if (this.minor !== 0 || this.patch !== 0 || this.prerelease.length === 0) this.major++;
+					this.minor = 0;
+					this.patch = 0;
+					this.prerelease = [];
+					break;
+				case "minor":
+					if (this.patch !== 0 || this.prerelease.length === 0) this.minor++;
+					this.patch = 0;
+					this.prerelease = [];
+					break;
+				case "patch":
+					if (this.prerelease.length === 0) this.patch++;
+					this.prerelease = [];
+					break;
+				case "pre": {
+					const base = Number(identifierBase) ? 1 : 0;
+					if (this.prerelease.length === 0) this.prerelease = [base];
+					else {
+						let i = this.prerelease.length;
+						while (--i >= 0) if (typeof this.prerelease[i] === "number") {
+							this.prerelease[i]++;
+							i = -2;
+						}
+						if (i === -1) {
+							if (identifier === this.prerelease.join(".") && identifierBase === false) throw new Error("invalid increment argument: identifier already exists");
+							this.prerelease.push(base);
+						}
+					}
+					if (identifier) {
+						let prerelease = [identifier, base];
+						if (identifierBase === false) prerelease = [identifier];
+						if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
+							if (isNaN(this.prerelease[1])) this.prerelease = prerelease;
+						} else this.prerelease = prerelease;
+					}
+					break;
+				}
+				default: throw new Error(`invalid increment argument: ${release}`);
+			}
+			this.raw = this.format();
+			if (this.build.length) this.raw += `+${this.build.join(".")}`;
+			return this;
+		}
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/semver@7.8.0/node_modules/semver/functions/parse.js
+var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const SemVer = require_semver();
+	const parse = (version, options, throwErrors = false) => {
+		if (version instanceof SemVer) return version;
+		try {
+			return new SemVer(version, options);
+		} catch (er) {
+			if (!throwErrors) return null;
+			throw er;
+		}
+	};
+	module.exports = parse;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/semver@7.8.0/node_modules/semver/functions/valid.js
+var require_valid = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const parse = require_parse();
+	const valid = (version, options) => {
+		const v = parse(version, options);
+		return v ? v.version : null;
+	};
+	module.exports = valid;
+}));
+//#endregion
+//#region src/update-version.ts
+var import_cross_spawn = /* @__PURE__ */ __toESM(require_cross_spawn(), 1);
+var import_valid = /* @__PURE__ */ __toESM(require_valid(), 1);
+const parseRunnethCliVersion = (value, label) => {
+	if (typeof value !== "string") throw new Error(`${label} must be a semantic version`);
+	const parsed = (0, import_valid.default)(value);
+	if (parsed === null || parsed !== value) throw new Error(`${label} must be a semantic version`);
+	return parsed;
+};
+const parseRunnethCliPublicationTime = (value, label) => {
+	if (typeof value !== "string") throw new Error(`${label} must be an ISO date string`);
+	const timestamp = Date.parse(value);
+	if (!Number.isFinite(timestamp)) throw new Error(`${label} must be an ISO date string`);
+	return new Date(timestamp).toISOString();
+};
+const isRunnethCliReleaseNewer = (input) => {
+	return input.candidateVersion !== input.installedVersion && Date.parse(input.candidatePublishedAt) > Date.parse(input.installedPublishedAt);
+};
+//#endregion
+//#region src/package-info.ts
+const isRecord$3 = (value) => {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const parseNonEmptyString$1 = (record, key) => {
+	const value = record[key];
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`Runneth CLI package.json ${key} must be a non-empty string`);
+	return value;
+};
+const parseUpdateTarget = (manifest, packageName) => {
+	const value = manifest.runnethCliUpdate;
+	if (!isRecord$3(value) || typeof value.mode !== "string") throw new Error("Runneth CLI package.json runnethCliUpdate must be an object with a mode");
+	if (value.mode === "source") return null;
+	if (value.mode !== "registry") throw new Error(`Unsupported Runneth CLI update mode: ${value.mode}`);
+	const updatePackageName = parseNonEmptyString$1(value, "packageName");
+	if (updatePackageName !== packageName) throw new Error(`Runneth CLI update package ${updatePackageName} does not match manifest package ${packageName}`);
+	if (typeof value.tag !== "string" || !/^[a-z][a-z0-9-]*$/u.test(value.tag)) throw new Error(`Unsupported Runneth CLI update tag: ${String(value.tag)}`);
+	return {
+		packageName: updatePackageName,
+		tag: value.tag
+	};
+};
+const readRunnethCliPackageInfo = async (moduleUrl) => {
+	const cliPath = await realpath(fileURLToPath(moduleUrl));
+	const packageRoot = path.resolve(path.dirname(cliPath), "..");
+	const manifestPath = path.join(packageRoot, "package.json");
+	const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+	if (!isRecord$3(manifest)) throw new Error(`Runneth CLI package.json must contain an object: ${manifestPath}`);
+	const name = parseNonEmptyString$1(manifest, "name");
+	return {
+		cliPath,
+		name,
+		packageRoot,
+		updateTarget: parseUpdateTarget(manifest, name),
+		version: parseRunnethCliVersion(manifest.version, "Runneth CLI package.json version")
+	};
+};
+const resolveRunnethCliUpdateTarget = (packageInfo) => {
+	return packageInfo.updateTarget;
+};
+//#endregion
+//#region src/update-state.ts
+var import_proper_lockfile = require_proper_lockfile();
+const RUNNETH_CLI_UPDATE_CHECK_ATTEMPT_SCHEMA_VERSION = 1;
+const RUNNETH_CLI_UPDATE_DISMISSAL_SCHEMA_VERSION = 1;
+const RUNNETH_CLI_UPDATE_CHECK_INTERVAL_MS = 1200 * 60 * 1e3;
+const RUNNETH_CLI_UPDATE_LOCK_STALE_MS = 3e4;
+const RUNNETH_CLI_UPDATE_LOCK_REFRESH_MS = 1e4;
+const RUNNETH_CLI_UPDATE_MUTATION_LOCK_RETRIES = 2400;
+const RUNNETH_CLI_UPDATE_MUTATION_LOCK_RETRY_MS = 250;
+const isRecord$2 = (value) => {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const isErrnoCode = (error, code) => {
+	return typeof error === "object" && error !== null && "code" in error && error.code === code;
+};
+const parseNonEmptyString = (value, label) => {
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${label} must be a non-empty string`);
+	return value;
+};
+const parseAbsolutePath = (value, label) => {
+	const parsed = parseNonEmptyString(value, label);
+	if (!path.isAbsolute(parsed)) throw new Error(`${label} must be an absolute path`);
+	return path.resolve(parsed);
+};
+const parseIsoDate = (value, label) => {
+	const parsed = parseNonEmptyString(value, label);
+	if (!Number.isFinite(Date.parse(parsed))) throw new Error(`${label} must be an ISO date string`);
+	return parsed;
+};
+const parseInstallationIdentity = (value, label) => {
+	const manager = value.manager;
+	if (manager !== "npm" && manager !== "pnpm") throw new Error(`${label} manager must be npm or pnpm`);
+	return {
+		installationRoot: parseAbsolutePath(value.installationRoot, `${label} installationRoot`),
+		manager,
+		packageName: parseNonEmptyString(value.packageName, `${label} packageName`),
+		tag: parseNonEmptyString(value.tag, `${label} tag`)
+	};
+};
+const parseIdentity = (value, label) => {
+	return {
+		installedVersion: parseRunnethCliVersion(value.installedVersion, `${label} installedVersion`),
+		packageName: parseNonEmptyString(value.packageName, `${label} packageName`),
+		packageRoot: parseAbsolutePath(value.packageRoot, `${label} packageRoot`),
+		tag: parseNonEmptyString(value.tag, `${label} tag`)
+	};
+};
+const assertInstallationIdentity = (actual, expected, label) => {
+	if (actual.installationRoot !== path.resolve(expected.installationRoot) || actual.manager !== expected.manager || actual.packageName !== expected.packageName || actual.tag !== expected.tag) throw new Error(`${label} identity does not match ${expected.manager} installation ${expected.packageName}@${expected.tag} at ${path.resolve(expected.installationRoot)}`);
+};
+const assertCacheIdentity = (actual, expected, label) => {
+	if (actual.packageName !== expected.packageName || actual.packageRoot !== path.resolve(expected.packageRoot) || actual.tag !== expected.tag || actual.installedVersion !== expected.installedVersion) throw new Error(`${label} identity does not match ${expected.packageName}@${expected.tag} version ${expected.installedVersion} at ${path.resolve(expected.packageRoot)}`);
+};
+const parseRunnethCliUpdateCache = (value, identity) => {
+	if (!isRecord$2(value)) throw new Error("Runneth CLI update cache must be an object");
+	if (value.schemaVersion !== 2) throw new Error(`Unsupported Runneth CLI update cache schema version: ${String(value.schemaVersion)}`);
+	const parsedIdentity = parseIdentity(value, "Runneth CLI update cache");
+	assertCacheIdentity(parsedIdentity, identity, "Runneth CLI update cache");
+	if (value.manager === "npm" && value.pnpmGlobalBinDirectory !== null) throw new Error("An npm update cache must not specify a pnpm executable directory");
+	return {
+		...parsedIdentity,
+		...parseInstallationIdentity(value, "Runneth CLI update cache"),
+		pnpmGlobalBinDirectory: value.manager === "pnpm" ? parseAbsolutePath(value.pnpmGlobalBinDirectory, "Runneth CLI update cache pnpmGlobalBinDirectory") : null,
+		installedVersionPublishedAt: parseRunnethCliPublicationTime(value.installedVersionPublishedAt, "Runneth CLI update cache installedVersionPublishedAt"),
+		lastCheckedAt: parseIsoDate(value.lastCheckedAt, "Runneth CLI update cache lastCheckedAt"),
+		latestVersion: parseRunnethCliVersion(value.latestVersion, "Runneth CLI update cache latestVersion"),
+		latestVersionPublishedAt: parseRunnethCliPublicationTime(value.latestVersionPublishedAt, "Runneth CLI update cache latestVersionPublishedAt"),
+		schemaVersion: 2
+	};
+};
+const parseRunnethCliUpdateCheckAttempt = (value, identity) => {
+	if (!isRecord$2(value)) throw new Error("Runneth CLI update check attempt state must be an object");
+	if (value.schemaVersion !== RUNNETH_CLI_UPDATE_CHECK_ATTEMPT_SCHEMA_VERSION) throw new Error(`Unsupported Runneth CLI update check attempt schema version: ${String(value.schemaVersion)}`);
+	const parsedIdentity = parseInstallationIdentity(value, "Runneth CLI update check attempt");
+	assertInstallationIdentity(parsedIdentity, identity, "Runneth CLI update check attempt");
+	return {
+		...parsedIdentity,
+		attemptedAt: parseIsoDate(value.attemptedAt, "Runneth CLI update check attempt attemptedAt"),
+		schemaVersion: RUNNETH_CLI_UPDATE_CHECK_ATTEMPT_SCHEMA_VERSION
+	};
+};
+const parseRunnethCliUpdateDismissal = (value, identity, targetVersion) => {
+	if (!isRecord$2(value)) throw new Error("Runneth CLI update dismissal must be an object");
+	if (value.schemaVersion !== RUNNETH_CLI_UPDATE_DISMISSAL_SCHEMA_VERSION) throw new Error(`Unsupported Runneth CLI update dismissal schema version: ${String(value.schemaVersion)}`);
+	const parsedIdentity = parseInstallationIdentity(value, "Runneth CLI update dismissal");
+	assertInstallationIdentity(parsedIdentity, identity, "Runneth CLI update dismissal");
+	const parsedTargetVersion = parseRunnethCliVersion(value.targetVersion, "Runneth CLI update dismissal targetVersion");
+	if (parsedTargetVersion !== targetVersion) throw new Error(`Runneth CLI update dismissal target does not match ${targetVersion}`);
+	return {
+		...parsedIdentity,
+		schemaVersion: RUNNETH_CLI_UPDATE_DISMISSAL_SCHEMA_VERSION,
+		targetVersion: parsedTargetVersion
+	};
+};
+const updateIdentityKey = (identity) => {
+	return createHash("sha256").update(JSON.stringify([
+		identity.packageName,
+		identity.tag,
+		path.resolve(identity.packageRoot),
+		identity.installedVersion
+	])).digest("hex");
+};
+const updateInstallationKey = (identity) => {
+	return createHash("sha256").update(JSON.stringify([
+		identity.manager,
+		identity.packageName,
+		identity.tag,
+		path.resolve(identity.installationRoot)
+	])).digest("hex");
+};
+const updateMutationKey = (identity) => {
+	return createHash("sha256").update(JSON.stringify([
+		identity.manager,
+		identity.packageName,
+		path.resolve(identity.installationRoot)
+	])).digest("hex");
+};
+const updateDiscoveryKey = (identity) => {
+	return createHash("sha256").update(JSON.stringify([
+		identity.packageName,
+		identity.tag,
+		path.resolve(identity.packageRoot)
+	])).digest("hex");
+};
+const dismissalIdentityKey = (identity, targetVersion) => {
+	return createHash("sha256").update(JSON.stringify([updateInstallationKey(identity), targetVersion])).digest("hex");
+};
+const resolveRunnethCliUpdateCachePath = (identity, homePath = resolveRunnethCliHome()) => {
+	return path.join(homePath, "update-cache", `${updateIdentityKey(identity)}.json`);
+};
+const resolveRunnethCliUpdateCheckAttemptPath = (identity, homePath = resolveRunnethCliHome()) => {
+	return path.join(homePath, "update-check-attempts", `${updateInstallationKey(identity)}.json`);
+};
+const resolveRunnethCliUpdateDismissalPath = (identity, targetVersion, homePath) => {
+	return path.join(homePath, "update-dismissals", `${dismissalIdentityKey(identity, targetVersion)}.json`);
+};
+const resolveRunnethCliUpdateCheckErrorPath = (homePath = resolveRunnethCliHome()) => {
+	return path.join(homePath, "update-check-error.log");
+};
+const resolveRunnethCliUpdateMutationLockPath = (identity, lockRootPath = path.join(os.userInfo().homedir, ".runneth-cli-update-locks")) => {
+	return path.join(path.resolve(lockRootPath), updateMutationKey(identity));
+};
+const withRunnethCliUpdateMutationLock = async (input, operation) => {
+	const lockPath = resolveRunnethCliUpdateMutationLockPath(input.identity, input.lockRootPath);
+	await mkdir(path.dirname(lockPath), { recursive: true });
+	const release = await (0, import_proper_lockfile.lock)(lockPath, {
+		realpath: false,
+		retries: {
+			factor: 1,
+			maxTimeout: RUNNETH_CLI_UPDATE_MUTATION_LOCK_RETRY_MS,
+			minTimeout: RUNNETH_CLI_UPDATE_MUTATION_LOCK_RETRY_MS,
+			retries: RUNNETH_CLI_UPDATE_MUTATION_LOCK_RETRIES
+		},
+		stale: RUNNETH_CLI_UPDATE_LOCK_STALE_MS,
+		update: RUNNETH_CLI_UPDATE_LOCK_REFRESH_MS
+	});
+	try {
+		await assertRunnethCliReplacementStopped(input.replacementRootPath);
+		return await operation();
+	} finally {
+		await release();
+	}
+};
+const runWithRunnethCliUpdateDiscoveryLock = async (input, operation) => {
+	const homePath = input.homePath ?? resolveRunnethCliHome();
+	const lockPath = path.join(homePath, "update-discovery", updateDiscoveryKey(input.identity));
+	await mkdir(path.dirname(lockPath), { recursive: true });
+	let release;
+	try {
+		release = await (0, import_proper_lockfile.lock)(lockPath, {
+			realpath: false,
+			retries: 0,
+			stale: RUNNETH_CLI_UPDATE_LOCK_STALE_MS,
+			update: RUNNETH_CLI_UPDATE_LOCK_REFRESH_MS
+		});
+	} catch (error) {
+		if (isErrnoCode(error, "ELOCKED")) return false;
+		throw error;
+	}
+	try {
+		await operation();
+		return true;
+	} finally {
+		await release();
+	}
+};
+const readJson = async (filePath) => {
+	try {
+		return JSON.parse(await readFile(filePath, "utf8"));
+	} catch (error) {
+		if (isErrnoCode(error, "ENOENT")) return null;
+		throw error;
+	}
+};
+const writeJsonAtomically = async (filePath, value) => {
+	await writeRunnethCliFileAtomically(filePath, `${JSON.stringify(value, null, 2)}\n`);
+};
+const claimRunnethCliUpdateCheckAttempt = async (input) => {
+	const homePath = input.homePath ?? resolveRunnethCliHome();
+	const attemptPath = resolveRunnethCliUpdateCheckAttemptPath(input.identity, homePath);
+	await mkdir(path.dirname(attemptPath), { recursive: true });
+	let release;
+	try {
+		release = await (0, import_proper_lockfile.lock)(attemptPath, {
+			realpath: false,
+			retries: 0,
+			stale: RUNNETH_CLI_UPDATE_LOCK_STALE_MS,
+			update: RUNNETH_CLI_UPDATE_LOCK_REFRESH_MS
+		});
+	} catch (error) {
+		if (isErrnoCode(error, "ELOCKED")) return false;
+		throw error;
+	}
+	try {
+		const value = await readJson(attemptPath);
+		const previous = value === null ? null : parseRunnethCliUpdateCheckAttempt(value, input.identity);
+		const now = input.now ?? /* @__PURE__ */ new Date();
+		if (previous !== null && now.getTime() - Date.parse(previous.attemptedAt) < RUNNETH_CLI_UPDATE_CHECK_INTERVAL_MS) return false;
+		await writeJsonAtomically(attemptPath, {
+			...input.identity,
+			attemptedAt: now.toISOString(),
+			installationRoot: path.resolve(input.identity.installationRoot),
+			schemaVersion: RUNNETH_CLI_UPDATE_CHECK_ATTEMPT_SCHEMA_VERSION
+		});
+		return true;
+	} finally {
+		await release();
+	}
+};
+const readRunnethCliUpdateCache = async (identity, homePath = resolveRunnethCliHome()) => {
+	const value = await readJson(resolveRunnethCliUpdateCachePath(identity, homePath));
+	return value === null ? null : parseRunnethCliUpdateCache(value, identity);
+};
+const writeRunnethCliUpdateCache = async (cache, homePath = resolveRunnethCliHome()) => {
+	const identity = {
+		installedVersion: cache.installedVersion,
+		packageName: cache.packageName,
+		packageRoot: cache.packageRoot,
+		tag: cache.tag
+	};
+	await writeJsonAtomically(resolveRunnethCliUpdateCachePath(identity, homePath), parseRunnethCliUpdateCache(cache, identity));
+};
+const isRunnethCliUpdateDismissed = async (input) => {
+	const homePath = input.homePath ?? resolveRunnethCliHome();
+	const value = await readJson(resolveRunnethCliUpdateDismissalPath(input.identity, input.targetVersion, homePath));
+	if (value === null) return false;
+	parseRunnethCliUpdateDismissal(value, input.identity, input.targetVersion);
+	return true;
+};
+const dismissRunnethCliUpdateVersion = async (input) => {
+	const homePath = input.homePath ?? resolveRunnethCliHome();
+	const dismissal = {
+		...input.identity,
+		installationRoot: path.resolve(input.identity.installationRoot),
+		schemaVersion: RUNNETH_CLI_UPDATE_DISMISSAL_SCHEMA_VERSION,
+		targetVersion: input.targetVersion
+	};
+	await writeJsonAtomically(resolveRunnethCliUpdateDismissalPath(input.identity, input.targetVersion, homePath), parseRunnethCliUpdateDismissal(dismissal, input.identity, input.targetVersion));
+};
+const clearRunnethCliUpdateCheckError = async (homePath = resolveRunnethCliHome()) => {
+	await rm(resolveRunnethCliUpdateCheckErrorPath(homePath), { force: true });
+};
+const writeRunnethCliUpdateCheckError = async (message, homePath = resolveRunnethCliHome()) => {
+	if (message.trim().length === 0) throw new Error("Runneth CLI update check error must be non-empty");
+	await writeRunnethCliFileAtomically(resolveRunnethCliUpdateCheckErrorPath(homePath), `${message.trim()}\n`);
+};
+//#endregion
+//#region src/update.ts
+var RunnethCliUpdateCommandError = class extends Error {
+	exitCode;
+	constructor(exitCode, operation = "Runneth CLI update") {
+		super(`${operation} failed with exit code ${String(exitCode)}`);
+		this.name = "RunnethCliUpdateCommandError";
+		this.exitCode = exitCode;
+	}
+};
+const runRunnethCliCommand = async (input) => {
+	return await new Promise((resolve, reject) => {
+		const stdio = input.stdio ?? "pipe";
+		const child = (0, import_cross_spawn.default)(input.command, [...input.args], {
+			env: input.env ?? process$1.env,
+			stdio: stdio === "inherit" ? "inherit" : [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let commandError = null;
+		let interruptedSignal = null;
+		let stderr = "";
+		let stdout = "";
+		const signalListeners = [
+			"SIGINT",
+			"SIGTERM",
+			"SIGHUP"
+		].map((signal) => ({
+			signal,
+			listener: () => {
+				interruptedSignal ??= signal;
+				child.kill(signal);
+			}
+		}));
+		child.once("error", (error) => {
+			commandError = error;
+		});
+		if (stdio === "inherit") for (const { signal, listener } of signalListeners) process$1.on(signal, listener);
+		if (stdio === "pipe") if (child.stdout === null || child.stderr === null) commandError = /* @__PURE__ */ new Error(`${input.command} did not expose piped output streams`);
+		else {
+			child.stdout.setEncoding("utf8");
+			child.stderr.setEncoding("utf8");
+			child.stdout.on("data", (chunk) => {
+				stdout += chunk;
+			});
+			child.stderr.on("data", (chunk) => {
+				stderr += chunk;
+			});
+		}
+		child.once("close", (code, signal) => {
+			for (const { signal, listener } of signalListeners) process$1.off(signal, listener);
+			if (interruptedSignal !== null) {
+				reject(new RunnethCliUpdateCommandError(128 + os.constants.signals[interruptedSignal], input.command));
+				return;
+			}
+			if (commandError !== null) {
+				reject(commandError);
+				return;
+			}
+			if (signal !== null) {
+				reject(/* @__PURE__ */ new Error(`${input.command} exited from signal ${signal}`));
+				return;
+			}
+			if (code === null) {
+				reject(/* @__PURE__ */ new Error(`${input.command} exited without a status code`));
+				return;
+			}
+			resolve({
+				exitCode: code,
+				stderr,
+				stdout
+			});
+		});
+	});
+};
+const isPathWithin = (candidatePath, parentPath) => {
+	const relative = path.relative(parentPath, candidatePath);
+	return relative.length === 0 || !relative.startsWith("..") && !path.isAbsolute(relative);
+};
+const isCommandUnavailable = (error) => {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+};
+const parseCommandOutputPath = (result, command) => {
+	if (result.exitCode !== 0) throw new RunnethCliUpdateCommandError(result.exitCode, command);
+	const outputPath = result.stdout.trim();
+	if (outputPath.length === 0 || outputPath.includes("\n") || outputPath.includes("\r") || !path.isAbsolute(outputPath)) throw new Error(`${command} returned an invalid global package root`);
+	return path.resolve(outputPath);
+};
+const resolveNpmGlobalPrefix = (globalRoot, platform = process$1.platform) => {
+	if (path.basename(globalRoot) !== "node_modules") throw new Error(`npm root --global returned an unsupported package root: ${globalRoot}`);
+	const parentPath = path.dirname(globalRoot);
+	if (platform === "win32") return parentPath;
+	if (path.basename(parentPath) !== "lib") throw new Error(`npm root --global returned an unsupported package root: ${globalRoot}`);
+	return path.dirname(parentPath);
+};
+const resolvePnpmGlobalDir = (globalPackageRoot) => {
+	const globalDir = path.dirname(globalPackageRoot);
+	if (globalDir === globalPackageRoot) throw new Error(`pnpm list --global returned an unsupported global package root: ${globalPackageRoot}`);
+	return globalDir;
+};
+const resolveNpmGlobalRoot = async (input) => {
+	return await realpath(parseCommandOutputPath(await input.runner({
+		args: ["root", "--global"],
+		command: "npm",
+		env: input.env
+	}), "npm root --global"));
+};
+const isNpmExecInvocation = (entryPath, env) => {
+	if (env.npm_command === "exec") return true;
+	const configuredCache = env.npm_config_cache?.trim();
+	if (configuredCache === void 0 || configuredCache.length === 0) return false;
+	return isPathWithin(path.resolve(path.dirname(entryPath), ".."), path.join(path.resolve(configuredCache), "_npx"));
+};
+const parsePnpmGlobalPackage = (result, packageName) => {
+	if (result.exitCode !== 0) throw new Error(`pnpm list --global failed with exit code ${String(result.exitCode)}`);
+	const value = JSON.parse(result.stdout);
+	if (!Array.isArray(value) || value.length !== 1) throw new Error("pnpm list --global returned an invalid package list");
+	const globalProject = value[0];
+	if (typeof globalProject !== "object" || globalProject === null || Array.isArray(globalProject) || !("path" in globalProject) || typeof globalProject.path !== "string" || !path.isAbsolute(globalProject.path)) throw new Error("pnpm list --global returned an invalid global project");
+	if (!("dependencies" in globalProject)) return null;
+	const dependencies = globalProject.dependencies;
+	if (typeof dependencies !== "object" || dependencies === null || Array.isArray(dependencies)) throw new Error("pnpm list --global returned invalid dependencies");
+	const dependency = dependencies[packageName];
+	if (dependency === void 0) return null;
+	if (typeof dependency !== "object" || dependency === null || Array.isArray(dependency) || !("path" in dependency) || typeof dependency.path !== "string" || !path.isAbsolute(dependency.path) || !("version" in dependency) || typeof dependency.version !== "string" || dependency.version.trim().length === 0) throw new Error(`pnpm list --global returned invalid package data for ${packageName}`);
+	return {
+		installationRoot: globalProject.path,
+		packagePath: dependency.path,
+		version: dependency.version
+	};
+};
+const resolvePnpmGlobalInstallation = async (input) => {
+	let result;
+	try {
+		result = await input.runner({
+			args: [
+				"list",
+				"--global",
+				input.target.packageName,
+				"--depth=0",
+				"--json"
+			],
+			command: "pnpm",
+			env: input.env
+		});
+	} catch (error) {
+		if (isCommandUnavailable(error)) return { kind: "no-match" };
+		throw error;
+	}
+	if (result.exitCode !== 0) throw new RunnethCliUpdateCommandError(result.exitCode, "pnpm list --global");
+	const packageRoot = await realpath(input.packageInfo.packageRoot);
+	const installedPackage = parsePnpmGlobalPackage(result, input.target.packageName);
+	if (installedPackage === null) return { kind: "no-match" };
+	const installedPackageRoot = await realpath(installedPackage.packagePath);
+	const installationRoot = await realpath(installedPackage.installationRoot);
+	if (installedPackageRoot !== packageRoot) return { kind: "no-match" };
+	if (installedPackage.version !== input.packageInfo.version) throw new Error(`The active Runneth CLI version ${input.packageInfo.version} does not match the pnpm global version ${installedPackage.version}`);
+	return {
+		context: {
+			installationRoot,
+			kind: "global",
+			manager: "pnpm",
+			pnpmGlobalBinDirectory: parseCommandOutputPath(await input.runner({
+				command: "pnpm",
+				args: ["bin", "--global"],
+				env: input.env
+			}), "pnpm bin --global"),
+			packageInfo: input.packageInfo,
+			target: input.target
+		},
+		kind: "match"
+	};
+};
+const resolveNpmGlobalInstallation = async (input) => {
+	const npmGlobalRoot = await resolveNpmGlobalRoot(input);
+	const packageRoot = await realpath(input.packageInfo.packageRoot);
+	if (!isPathWithin(packageRoot, npmGlobalRoot)) return { kind: "no-match" };
+	if (await realpath(path.join(npmGlobalRoot, ...input.target.packageName.split("/"))) !== packageRoot) throw new Error("The active Runneth CLI does not match the npm global installation");
+	return {
+		kind: "match",
+		context: {
+			installationRoot: npmGlobalRoot,
+			kind: "global",
+			manager: "npm",
+			pnpmGlobalBinDirectory: null,
+			packageInfo: input.packageInfo,
+			target: input.target
+		}
+	};
+};
+const detectRunnethCliInstallContext = async (input) => {
+	const env = input.env ?? process$1.env;
+	const runner = input.runner ?? runRunnethCliCommand;
+	const target = resolveRunnethCliUpdateTarget(input.packageInfo);
+	if (target === null) return {
+		kind: "source",
+		packageInfo: input.packageInfo
+	};
+	if (isNpmExecInvocation(input.entryPath, env)) return {
+		kind: "npm-exec",
+		packageInfo: input.packageInfo,
+		target
+	};
+	const probe = {
+		env,
+		packageInfo: input.packageInfo,
+		runner,
+		target
+	};
+	const resolutions = await Promise.allSettled([resolvePnpmGlobalInstallation(probe), resolveNpmGlobalInstallation(probe)]);
+	for (const resolution of resolutions) if (resolution.status === "fulfilled" && resolution.value.kind === "match") return resolution.value.context;
+	for (const resolution of resolutions) if (resolution.status === "rejected") throw resolution.reason;
+	return {
+		kind: "local",
+		packageInfo: input.packageInfo,
+		target
+	};
+};
+const resolveApplicableContext = (context) => {
+	switch (context.kind) {
+		case "global": return context;
+		case "source": throw new Error("Source checkouts do not self-update");
+		case "local": throw new Error("Project-local Runneth CLI installations must be updated through the project package manager");
+		case "npm-exec": throw new Error(`npm-exec installations are ephemeral. Rerun with \`npx ${context.target.packageName}@${context.target.tag}\`.`);
+		default: return context;
+	}
+};
+const isRecord$1 = (value) => {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const requirePnpmGlobalBinDirectory = (directory) => {
+	if (directory === null || !path.isAbsolute(directory)) throw new Error("The pnpm global executable directory is unavailable");
+	return directory;
+};
+const actionFromContext = (context, packageSpecifier) => {
+	const packageReference = `${context.target.packageName}@${packageSpecifier}`;
+	const args = context.manager === "npm" ? [
+		"install",
+		"--global",
+		packageReference,
+		"--prefix",
+		resolveNpmGlobalPrefix(context.installationRoot)
+	] : [
+		"add",
+		"--global",
+		packageReference,
+		"--global-dir",
+		resolvePnpmGlobalDir(context.installationRoot),
+		"--global-bin-dir",
+		requirePnpmGlobalBinDirectory(context.pnpmGlobalBinDirectory)
+	];
+	return {
+		args,
+		command: context.manager,
+		displayCommand: [context.manager, ...args].join(" "),
+		expectedInstalledVersion: context.packageInfo.version,
+		installation: {
+			installationRoot: context.installationRoot,
+			manager: context.manager,
+			packageName: context.target.packageName,
+			tag: context.target.tag
+		}
+	};
+};
+const resolveRunnethCliUpdateAction = async (input) => {
+	const env = input.env ?? process$1.env;
+	const runner = input.runner ?? runRunnethCliCommand;
+	const packageInfo = await readRunnethCliPackageInfo(input.moduleUrl);
+	const context = resolveApplicableContext(await detectRunnethCliInstallContext({
+		entryPath: input.entryPath,
+		env,
+		packageInfo,
+		runner
+	}));
+	return actionFromContext(context, context.target.tag);
+};
+const readInstalledVersionForUpdate = async (input) => {
+	const installation = input.action.installation;
+	if (installation.manager === "pnpm") {
+		const result = await input.runner({
+			args: [
+				"list",
+				"--global",
+				installation.packageName,
+				"--depth=0",
+				"--json",
+				"--global-dir",
+				resolvePnpmGlobalDir(installation.installationRoot)
+			],
+			command: "pnpm",
+			env: input.env
+		});
+		if (result.exitCode !== 0) throw new RunnethCliUpdateCommandError(result.exitCode, "pnpm list --global");
+		const installedPackage = parsePnpmGlobalPackage(result, installation.packageName);
+		if (installedPackage === null) throw new Error(`The pnpm global installation does not contain ${installation.packageName}`);
+		const activeInstallationRoot = await realpath(installedPackage.installationRoot);
+		if (activeInstallationRoot !== installation.installationRoot) throw new Error(`The active pnpm global installation moved from ${installation.installationRoot} to ${activeInstallationRoot}`);
+		return parseRunnethCliVersion(installedPackage.version, "Installed Runneth CLI version");
+	}
+	const packageRoot = path.join(installation.installationRoot, ...installation.packageName.split("/"));
+	const manifestPath = path.join(packageRoot, "package.json");
+	const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+	if (!isRecord$1(manifest)) throw new Error(`Installed Runneth CLI package manifest must be an object: ${manifestPath}`);
+	if (manifest.name !== installation.packageName) throw new Error(`Installed Runneth CLI package name does not match ${installation.packageName}`);
+	return parseRunnethCliVersion(manifest.version, "Installed Runneth CLI version");
+};
+const runRunnethCliUpdateAction = async (input) => {
+	const env = input.env ?? process$1.env;
+	const runner = input.runner ?? runRunnethCliCommand;
+	await withRunnethCliUpdateMutationLock({
+		identity: input.action.installation,
+		lockRootPath: input.mutationLockRootPath,
+		replacementRootPath: input.replacementRootPath
+	}, async () => {
+		const installedVersion = await readInstalledVersionForUpdate({
+			action: input.action,
+			env,
+			runner
+		});
+		if (installedVersion !== input.action.expectedInstalledVersion) throw new Error(`Runneth CLI changed from ${input.action.expectedInstalledVersion} to ${installedVersion} before the update could start. Rerun the command to use the current installation.`);
+		const result = await runWithRunnethCliReplacement({
+			args: input.action.args,
+			command: input.action.command,
+			installationRoot: input.action.installation.installationRoot,
+			packageName: input.action.installation.packageName,
+			rootPath: input.replacementRootPath
+		}, async () => await runner({
+			args: input.action.args,
+			command: input.action.command,
+			env,
+			stdio: "inherit"
+		}));
+		if (result.exitCode !== 0) throw new RunnethCliUpdateCommandError(result.exitCode);
+	});
+};
+const parseRegistryVersion = (result, packageReference) => {
+	if (result.exitCode !== 0) throw new Error(`Failed to resolve ${packageReference}: npm exited with code ${String(result.exitCode)}`);
+	return parseRunnethCliVersion(JSON.parse(result.stdout), `Failed to resolve ${packageReference}: registry version`);
+};
+const parseRegistryPublicationTimes = (result, packageName, installedVersion, latestVersion) => {
+	if (result.exitCode !== 0) throw new Error(`Failed to resolve ${packageName} publication times: npm exited with code ${String(result.exitCode)}`);
+	const value = JSON.parse(result.stdout);
+	if (!isRecord$1(value)) throw new Error(`Failed to resolve ${packageName} publication times: registry time metadata must be an object`);
+	return {
+		installedVersionPublishedAt: parseRunnethCliPublicationTime(value[installedVersion], `Failed to resolve ${packageName}@${installedVersion} publication time`),
+		latestVersionPublishedAt: parseRunnethCliPublicationTime(value[latestVersion], `Failed to resolve ${packageName}@${latestVersion} publication time`)
+	};
+};
+const installationIdentity = (context) => {
+	return {
+		installationRoot: context.installationRoot,
+		manager: context.manager,
+		packageName: context.target.packageName,
+		tag: context.target.tag
+	};
+};
+const cacheIdentity = (context) => {
+	return {
+		installedVersion: context.packageInfo.version,
+		packageName: context.target.packageName,
+		packageRoot: context.packageInfo.packageRoot,
+		tag: context.target.tag
+	};
+};
+const discoverAndCacheRunnethCliUpdate = async (input) => {
+	const identity = cacheIdentity(input.context);
+	const packageReference = `${input.context.target.packageName}@${input.context.target.tag}`;
+	const latestVersion = parseRegistryVersion(await input.runner({
+		args: [
+			"view",
+			packageReference,
+			"version",
+			"--json"
+		],
+		command: "npm",
+		env: input.env
+	}), packageReference);
+	const publicationTimes = parseRegistryPublicationTimes(await input.runner({
+		args: [
+			"view",
+			input.context.target.packageName,
+			"time",
+			"--json"
+		],
+		command: "npm",
+		env: input.env
+	}), input.context.target.packageName, input.context.packageInfo.version, latestVersion);
+	const cache = {
+		...identity,
+		...installationIdentity(input.context),
+		...publicationTimes,
+		pnpmGlobalBinDirectory: input.context.pnpmGlobalBinDirectory,
+		lastCheckedAt: input.now.toISOString(),
+		latestVersion,
+		schemaVersion: 2
+	};
+	await writeRunnethCliUpdateCache(cache, input.homePath);
+	return cache;
+};
+const runRunnethCliBackgroundUpdateCheckAttempt = async (input) => {
+	if (isNpmExecInvocation(input.entryPath, input.env)) return;
+	const packageInfo = await readRunnethCliPackageInfo(input.moduleUrl);
+	const target = resolveRunnethCliUpdateTarget(packageInfo);
+	if (target === null) return;
+	await runWithRunnethCliUpdateDiscoveryLock({
+		homePath: input.homePath,
+		identity: {
+			packageName: target.packageName,
+			packageRoot: packageInfo.packageRoot,
+			tag: target.tag
+		}
+	}, async () => {
+		const context = await detectRunnethCliInstallContext({
+			entryPath: input.entryPath,
+			env: input.env,
+			packageInfo,
+			runner: input.runner
+		});
+		if (context.kind !== "global") return;
+		if (!await claimRunnethCliUpdateCheckAttempt({
+			homePath: input.homePath,
+			identity: installationIdentity(context),
+			now: input.now
+		})) return;
+		await clearRunnethCliUpdateCheckError(input.homePath);
+		await discoverAndCacheRunnethCliUpdate({
+			context,
+			env: input.env,
+			homePath: input.homePath,
+			now: input.now,
+			runner: input.runner
+		});
+	});
+};
+const runRunnethCliBackgroundUpdateCheck = async (input) => {
+	const homePath = input.homePath ?? resolveRunnethCliHome();
+	try {
+		await runRunnethCliBackgroundUpdateCheckAttempt({
+			entryPath: input.entryPath,
+			env: input.env ?? process$1.env,
+			homePath,
+			moduleUrl: input.moduleUrl,
+			now: input.now ?? /* @__PURE__ */ new Date(),
+			runner: input.runner ?? runRunnethCliCommand
+		});
+	} catch (error) {
+		await writeRunnethCliUpdateCheckError(`Runneth CLI update check failed: ${error instanceof Error ? error.message : String(error)}`, homePath);
+		throw error;
+	}
+};
+const startRunnethCliBackgroundUpdateCheck = (input) => {
+	const child = spawn(process$1.execPath, [
+		input.entryPath,
+		"__update-check",
+		input.entryPath
+	], {
+		detached: true,
+		env: input.env,
+		stdio: "ignore",
+		windowsHide: true
+	});
+	child.once("error", (error) => {
+		process$1.stderr.write(`Unable to start the Runneth CLI background update check: ${error.message}\n`);
+	});
+	child.unref();
+};
+const scheduleRunnethCliUpdateCheck = (input) => {
+	const env = input.env ?? process$1.env;
+	if (isNpmExecInvocation(input.entryPath, env)) return false;
+	startRunnethCliBackgroundUpdateCheck({
+		entryPath: input.entryPath,
+		env
+	});
+	return true;
+};
+const readRunnethCliCachedUpdate = async (input) => {
+	if (isNpmExecInvocation(input.entryPath, input.env ?? process$1.env)) return null;
+	const packageInfo = await readRunnethCliPackageInfo(input.moduleUrl);
+	const target = resolveRunnethCliUpdateTarget(packageInfo);
+	if (target === null) return null;
+	const cache = await readRunnethCliUpdateCache({
+		installedVersion: packageInfo.version,
+		packageName: target.packageName,
+		packageRoot: packageInfo.packageRoot,
+		tag: target.tag
+	}, input.homePath ?? resolveRunnethCliHome());
+	if (cache === null || !isRunnethCliReleaseNewer({
+		candidatePublishedAt: cache.latestVersionPublishedAt,
+		candidateVersion: cache.latestVersion,
+		installedPublishedAt: cache.installedVersionPublishedAt,
+		installedVersion: packageInfo.version
+	}) || await isRunnethCliUpdateDismissed({
+		homePath: input.homePath,
+		identity: cache,
+		targetVersion: cache.latestVersion
+	})) return null;
+	return {
+		action: {
+			args: cache.manager === "npm" ? [
+				"install",
+				"--global",
+				`${cache.packageName}@${cache.latestVersion}`,
+				"--prefix",
+				resolveNpmGlobalPrefix(cache.installationRoot)
+			] : [
+				"add",
+				"--global",
+				`${cache.packageName}@${cache.latestVersion}`,
+				"--global-dir",
+				resolvePnpmGlobalDir(cache.installationRoot),
+				"--global-bin-dir",
+				requirePnpmGlobalBinDirectory(cache.pnpmGlobalBinDirectory)
+			],
+			command: cache.manager,
+			displayCommand: cache.manager === "npm" ? `npm install --global ${cache.packageName}@${cache.latestVersion} --prefix ${resolveNpmGlobalPrefix(cache.installationRoot)}` : `pnpm add --global ${cache.packageName}@${cache.latestVersion} --global-dir ${resolvePnpmGlobalDir(cache.installationRoot)} --global-bin-dir ${requirePnpmGlobalBinDirectory(cache.pnpmGlobalBinDirectory)}`,
+			expectedInstalledVersion: packageInfo.version,
+			installation: cache
+		},
+		currentVersion: packageInfo.version,
+		dismissal: {
+			identity: cache,
+			targetVersion: cache.latestVersion
+		},
+		latestVersion: cache.latestVersion
+	};
+};
+const dismissRunnethCliUpdate = async (input) => {
+	await dismissRunnethCliUpdateVersion({
+		homePath: input.homePath,
+		identity: input.dismissal.identity,
+		targetVersion: input.dismissal.targetVersion
+	});
+};
+//#endregion
+//#region src/cli.ts
+const DEFAULT_TIMEOUT_MS = 6e5;
+const DEFAULT_OAUTH_CLIENT_NAME = "Runneth MCP";
+const MAX_STDIN_BYTES = 1048576;
+const RUNNETH_OAUTH_CLIENT_ID_ENV = "RUNNETH_OAUTH_CLIENT_ID";
+const RUNNETH_OAUTH_CLIENT_SECRET_ENV = "RUNNETH_OAUTH_CLIENT_SECRET";
+const resolveCliEntryPath = () => {
+	const entryPath = process$1.argv[1];
+	if (entryPath === void 0) throw new Error("Runneth CLI entry path is unavailable");
+	return path.resolve(entryPath);
+};
+const isRecord = (value) => {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const parseStringField = (record, key) => {
+	const value = record[key];
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${key} must be a non-empty string`);
+	return value;
+};
+const parseOptionalStringField = (record, key) => {
+	const value = record[key];
+	if (value === void 0) return;
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${key} must be a non-empty string`);
+	return value;
+};
+const resolveDefaultResourceUrl = () => {
+	return resolveBuildDefaultMcpResourceUrl();
+};
+const requireResourceUrl = (resourceUrl, commandDescription) => {
+	if (resourceUrl === void 0) throw new Error(`${commandDescription} requires --resource <url> because this CLI build does not include MONDRIAN_API_URL`);
+	return resourceUrl;
+};
+const readStdin = async () => {
+	const chunks = [];
+	let totalBytes = 0;
+	for await (const chunk of process$1.stdin) {
+		const buffer = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+		totalBytes += buffer.length;
+		if (totalBytes > MAX_STDIN_BYTES) throw new Error(`stdin input exceeds ${String(MAX_STDIN_BYTES)} bytes`);
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks, totalBytes).toString("utf8");
+};
+const parseNumber = (rawValue, label) => {
+	const value = Number(rawValue);
+	if (!Number.isInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer`);
+	return value;
+};
+const resolveCliOAuthClientCredentialOptions = (parsed) => {
+	return resolveOAuthClientCredentialOptions({
+		clientId: parsed.clientId ?? process$1.env[RUNNETH_OAUTH_CLIENT_ID_ENV],
+		clientSecret: parsed.clientSecret ?? process$1.env[RUNNETH_OAUTH_CLIENT_SECRET_ENV]
+	});
+};
+const parseArgs = (argv) => {
+	const values = [];
+	let cwd;
+	let name = "default";
+	let shell;
+	let stdin = false;
+	let timeoutMs = DEFAULT_TIMEOUT_MS;
+	let parseOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (parseOptions && token === "--") {
+			parseOptions = false;
+			continue;
+		}
+		if (!parseOptions || !token.startsWith("--")) {
+			values.push(token);
+			continue;
+		}
+		const readValue = (label) => {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error(`Missing value for ${label}`);
+			index += 1;
+			return value;
+		};
+		switch (token) {
+			case "--cwd":
+				cwd = readValue(token);
+				break;
+			case "--name":
+				name = normalizeSessionName(readValue(token));
+				break;
+			case "--shell":
+				shell = readValue(token);
+				break;
+			case "--stdin":
+				stdin = true;
+				break;
+			case "--timeout-ms":
+				timeoutMs = parseNumber(readValue(token), token);
+				break;
+			default: throw new Error(`Unknown option: ${token}`);
+		}
+	}
+	return {
+		cwd,
+		name,
+		shell,
+		stdin,
+		timeoutMs,
+		values
+	};
+};
+const parseSkillAgent = (value) => {
+	if (value === "all") return ["claude", "codex"];
+	if (value === "claude" || value === "codex") return [value];
+	throw new Error(`Invalid skill agent: ${value}. Use claude, codex, or all.`);
+};
+const parseSkillsArgs = (argv) => {
+	let agents = ["claude", "codex"];
+	const values = [];
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (token === "--agent") {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error("Missing value for --agent");
+			agents = parseSkillAgent(value);
+			index += 1;
+			continue;
+		}
+		values.push(token);
+	}
+	if (values.length > 0) throw new Error("runneth skills install only accepts --agent");
+	return { agents };
+};
+const parseOAuthArgs = (argv) => {
+	const values = [];
+	let clientId;
+	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
+	let openBrowser = true;
+	let resourceUrl;
+	let scope;
+	let timeoutMs = DEFAULT_TIMEOUT_MS;
+	let parseOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (parseOptions && token === "--") {
+			parseOptions = false;
+			continue;
+		}
+		if (!parseOptions || !token.startsWith("--")) {
+			values.push(token);
+			continue;
+		}
+		const readValue = (label) => {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error(`Missing value for ${label}`);
+			index += 1;
+			return value;
+		};
+		switch (token) {
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(token);
+				break;
+			case "--client-name":
+				clientName = readValue(token);
+				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(token);
+				break;
+			case "--no-open":
+				openBrowser = false;
+				break;
+			case "--resource":
+				resourceUrl = readValue(token);
+				break;
+			case "--scope":
+				scope = readValue(token);
+				break;
+			case "--timeout-ms":
+				timeoutMs = parseNumber(readValue(token), token);
+				break;
+			default: throw new Error(`Unknown option: ${token}`);
+		}
+	}
+	return {
+		...clientId === void 0 ? {} : { clientId },
+		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
+		openBrowser,
+		resourceUrl,
+		scope,
+		timeoutMs,
+		values
+	};
+};
+const parseSshArgs = (argv) => {
+	const values = [];
+	let apiBaseUrl;
+	let authMode = "mondrian";
+	let clientId;
+	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
+	let conversationId;
+	let identityFilePath;
+	let makeDefault = false;
+	let openBrowser = true;
+	let resourceUrl;
+	let scope;
+	let sshHost;
+	let sshUrl;
+	let targetName;
+	let tenanthId = "motion";
+	let timeoutMs = DEFAULT_TIMEOUT_MS;
+	let tokenValue;
+	let uniqueKey = false;
+	let workspaceId;
+	let argumentSeparatorSeen = false;
+	let parseOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (parseOptions && token === "--") {
+			argumentSeparatorSeen = true;
+			parseOptions = false;
+			continue;
+		}
+		if (!parseOptions || !token.startsWith("--")) {
+			values.push(token);
+			continue;
+		}
+		const readValue = (label) => {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error(`Missing value for ${label}`);
+			index += 1;
+			return value;
+		};
+		switch (token) {
+			case "--api":
+				apiBaseUrl = readValue(token);
+				break;
+			case "--auth": {
+				const value = readValue(token);
+				if (value !== "builder" && value !== "mondrian") throw new Error("--auth must be builder or mondrian");
+				authMode = value;
+				break;
+			}
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(token);
+				break;
+			case "--client-name":
+				clientName = readValue(token);
+				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(token);
+				break;
+			case "--conversation":
+				conversationId = readValue(token);
+				break;
+			case "--default":
+				makeDefault = true;
+				break;
+			case "--host":
+				sshHost = readValue(token);
+				break;
+			case "--identity-file":
+				identityFilePath = readValue(token);
+				break;
+			case "--no-open":
+				openBrowser = false;
+				break;
+			case "--resource":
+				resourceUrl = readValue(token);
+				break;
+			case "--scope":
+				scope = readValue(token);
+				break;
+			case "--ssh-url":
+				sshUrl = readValue(token);
+				break;
+			case "--target":
+				targetName = readValue(token);
+				break;
+			case "--tenanth":
+				tenanthId = readValue(token);
+				break;
+			case "--timeout-ms":
+				timeoutMs = parseNumber(readValue(token), token);
+				break;
+			case "--token":
+				tokenValue = readValue(token);
+				break;
+			case "--unique-key":
+				uniqueKey = true;
+				break;
+			case "--workspace":
+				workspaceId = readValue(token);
+				break;
+			default: throw new Error(`Unknown option: ${token}`);
+		}
+	}
+	return {
+		...apiBaseUrl === void 0 ? {} : { apiBaseUrl },
+		argumentSeparatorSeen,
+		authMode,
+		...clientId === void 0 ? {} : { clientId },
+		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
+		...conversationId === void 0 ? {} : { conversationId },
+		...identityFilePath === void 0 ? {} : { identityFilePath },
+		makeDefault,
+		openBrowser,
+		resourceUrl,
+		scope,
+		...sshHost === void 0 ? {} : { sshHost },
+		sshUrl,
+		...targetName === void 0 ? {} : { targetName },
+		tenanthId,
+		timeoutMs,
+		...tokenValue === void 0 ? {} : { token: tokenValue },
+		uniqueKey,
+		values,
+		...workspaceId === void 0 ? {} : { workspaceId }
+	};
+};
+const parseCopyArgs = (argv) => {
+	const values = [];
+	let clientId;
+	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
+	let destinationTargetName;
+	const ignoredPaths = [];
+	let openBrowser = true;
+	let scope;
+	let sourceTargetName;
+	let timeoutMs = DEFAULT_TIMEOUT_MS;
+	let parseOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (parseOptions && token === "--") {
+			parseOptions = false;
+			continue;
+		}
+		if (!parseOptions || !token.startsWith("--")) {
+			values.push(token);
+			continue;
+		}
+		const readValue = (label) => {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error(`Missing value for ${label}`);
+			index += 1;
+			return value;
+		};
+		switch (token) {
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(token);
+				break;
+			case "--client-name":
+				clientName = readValue(token);
+				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(token);
+				break;
+			case "--from":
+				sourceTargetName = normalizeRunnethSshTargetName(readValue(token));
+				break;
+			case "--ignore":
+				ignoredPaths.push(readValue(token));
+				break;
+			case "--no-open":
+				openBrowser = false;
+				break;
+			case "--scope":
+				scope = readValue(token);
+				break;
+			case "--timeout-ms":
+				timeoutMs = parseNumber(readValue(token), token);
+				break;
+			case "--to":
+				destinationTargetName = normalizeRunnethSshTargetName(readValue(token));
+				break;
+			default: throw new Error(`Unknown option: ${token}`);
+		}
+	}
+	if (sourceTargetName === void 0) throw new Error("runneth copy requires --from <target>");
+	if (destinationTargetName === void 0) throw new Error("runneth copy requires --to <target>");
+	return {
+		...clientId === void 0 ? {} : { clientId },
+		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
+		destinationTargetName,
+		ignoredPaths,
+		openBrowser,
+		scope,
+		sourceTargetName,
+		timeoutMs,
+		values
+	};
+};
+const resolveOAuthResourceUrl = (parsed) => {
+	return requireResourceUrl(parsed.resourceUrl ?? parsed.values[0] ?? resolveDefaultResourceUrl(), "runneth oauth");
+};
+const normalizeSshHost = (value) => {
+	const sshHost = value.trim();
+	if (sshHost.length === 0 || sshHost.includes("/") || sshHost.includes("?") || sshHost.includes("#") || sshHost.includes("@") || /^[A-Za-z][A-Za-z0-9+.-]*:\/\//u.test(sshHost) || /\s/u.test(sshHost)) throw new Error("SSH host must be a full hostname without scheme or path");
+	const url = new URL(`https://${sshHost}/runneth/ssh`);
+	if (url.hostname.length === 0) throw new Error("SSH host must be a full hostname without scheme or path");
+	return url.host;
+};
+const resolveSshUrlFromHost = (host) => {
+	return `https://${normalizeSshHost(host)}/runneth/ssh`;
+};
+const resolveSshUrlOption = (parsed) => {
+	if (parsed.sshUrl !== void 0 && parsed.sshHost !== void 0) throw new Error("Use either --ssh-url or --host, not both");
+	if (parsed.sshHost === void 0) return parsed.sshUrl;
+	return resolveSshUrlFromHost(parsed.sshHost);
+};
+const resolveSshResourceUrlOption = (parsed) => {
+	if (parsed.resourceUrl !== void 0) return parsed.resourceUrl;
+	if (parsed.conversationId !== void 0 || parsed.sshHost !== void 0 || parsed.sshUrl !== void 0) return resolveDefaultResourceUrl();
+};
+const hasSshConversationOptions = (parsed) => {
+	return parsed.apiBaseUrl !== void 0 || parsed.authMode !== "mondrian" || parsed.conversationId !== void 0 || parsed.tenanthId !== "motion" || parsed.token !== void 0 || parsed.workspaceId !== void 0;
+};
+const assertNoSshConversationOptions = (parsed, commandDescription) => {
+	if (hasSshConversationOptions(parsed)) throw new Error(`${commandDescription} does not accept conversation target options`);
+};
+const resolveSshTargetForCommand = async (parsed) => {
+	assertNoSshConversationOptions(parsed, "This SSH command");
+	const sshUrl = resolveSshUrlOption(parsed);
+	const resourceUrl = resolveSshResourceUrlOption(parsed);
+	if (sshUrl !== void 0 && resourceUrl === void 0) requireResourceUrl(resourceUrl, "runneth ssh");
+	return await resolveRunnethSshTarget({
+		resourceUrl,
+		sshUrl,
+		targetName: parsed.targetName
+	});
+};
+const resolveSshCommandContext = async (parsed) => {
+	if (parsed.conversationId === void 0) {
+		assertNoSshConversationOptions(parsed, "runneth ssh");
+		const target = await resolveSshTargetForCommand(parsed);
+		return {
+			oauthToken: await resolveSshOAuthToken(parsed, target.resourceUrl),
+			target
+		};
+	}
+	if (parsed.sshHost !== void 0 || parsed.sshUrl !== void 0 || parsed.targetName !== void 0) throw new Error("Use either --conversation or --target/--host/--ssh-url, not both");
+	const resourceUrl = requireResourceUrl(resolveSshResourceUrlOption(parsed), "runneth ssh --conversation");
+	const oauthToken = await resolveSshOAuthToken(parsed, resourceUrl);
+	return {
+		oauthToken,
+		target: {
+			resourceUrl,
+			sshUrl: (await fetchConversationSshTarget(await resolveRunnethConversationOptions({
+				...parsed.apiBaseUrl === void 0 ? {} : { apiBaseUrl: parsed.apiBaseUrl },
+				authMode: parsed.authMode,
+				clientId: parsed.clientId,
+				clientName: parsed.clientName,
+				clientSecret: parsed.clientSecret,
+				conversationId: parsed.conversationId,
+				openBrowser: parsed.openBrowser,
+				pollIntervalMs: RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS,
+				resourceUrl,
+				scope: parsed.scope,
+				tenanthId: parsed.tenanthId,
+				timeoutMs: parsed.timeoutMs,
+				token: parsed.token,
+				values: [],
+				workspaceId: parsed.workspaceId
+			}, { oauthAccessToken: oauthToken.accessToken }), parsed.conversationId)).url
+		}
+	};
+};
+const assertNoSshTargetDefaultFlag = (parsed) => {
+	if (parsed.makeDefault) throw new Error("--default is only valid for runneth ssh target add");
+};
+const assertSshRemoteCommandSeparator = (parsed) => {
+	if (parsed.values.length > 0 && !parsed.argumentSeparatorSeen) throw new Error("Remote SSH commands must follow --");
+};
+const assertNoSshKeyOptions = (parsed, commandDescription) => {
+	if (parsed.identityFilePath !== void 0 || parsed.uniqueKey) throw new Error(`${commandDescription} does not accept SSH key options`);
+};
+const resolveSshKeyInstallOptions = (parsed) => {
+	if (parsed.identityFilePath !== void 0 && parsed.uniqueKey) throw new Error("Use either --identity-file or --unique-key, not both");
+	if (parsed.identityFilePath !== void 0) return { identityFilePath: parsed.identityFilePath };
+	if (parsed.uniqueKey) return { keyMode: "unique" };
+	return {};
+};
+const parseSshTargetImportEntry = (payload, index) => {
+	if (!isRecord(payload)) throw new Error(`targets[${String(index)}] must be a JSON object`);
+	const name = normalizeRunnethSshTargetName(parseStringField(payload, "name"));
+	const host = parseOptionalStringField(payload, "host");
+	const resourceUrl = parseOptionalStringField(payload, "resourceUrl");
+	const sshUrl = parseOptionalStringField(payload, "sshUrl");
+	if (host === void 0 === (sshUrl === void 0)) throw new Error(`targets[${String(index)}] requires exactly one of host or sshUrl`);
+	return {
+		...host === void 0 ? {} : { host },
+		name,
+		...resourceUrl === void 0 ? {} : { resourceUrl },
+		...sshUrl === void 0 ? {} : { sshUrl }
+	};
+};
+const parseSshTargetImportFile = (payload) => {
+	if (!isRecord(payload)) throw new Error("SSH target import file must be a JSON object");
+	const rawTargets = payload.targets;
+	if (!Array.isArray(rawTargets) || rawTargets.length === 0) throw new Error("SSH target import file requires a non-empty targets array");
+	const defaultTargetValue = parseOptionalStringField(payload, "defaultTarget");
+	const resourceUrl = parseOptionalStringField(payload, "resourceUrl");
+	return {
+		...defaultTargetValue === void 0 ? {} : { defaultTarget: normalizeRunnethSshTargetName(defaultTargetValue) },
+		...resourceUrl === void 0 ? {} : { resourceUrl },
+		targets: rawTargets.map((entry, index) => parseSshTargetImportEntry(entry, index))
+	};
+};
+const readSshTargetImportFile = async (filePath) => {
+	const resolvedPath = path.resolve(filePath);
+	return parseSshTargetImportFile(JSON.parse(await readFile(resolvedPath, "utf8")));
+};
+const resolveImportEntryResourceUrl = (input) => {
+	return requireResourceUrl(input.entry.resourceUrl ?? input.fileResourceUrl ?? input.commandResourceUrl ?? resolveDefaultResourceUrl(), "runneth ssh target import");
+};
+const resolveImportEntrySshUrl = (entry) => {
+	if (entry.sshUrl !== void 0) return entry.sshUrl;
+	if (entry.host === void 0) throw new Error(`Imported SSH target is missing host: ${entry.name}`);
+	return resolveSshUrlFromHost(entry.host);
+};
+const resolveSshTargetImportEntries = (input) => {
+	const names = /* @__PURE__ */ new Set();
+	for (const target of input.file.targets) {
+		if (names.has(target.name)) throw new Error(`Duplicate SSH target in import file: ${target.name}`);
+		names.add(target.name);
+	}
+	if (input.file.defaultTarget !== void 0 && !names.has(input.file.defaultTarget)) throw new Error(`Import defaultTarget does not match an imported target: ${input.file.defaultTarget}`);
+	return input.file.targets.map((entry, index) => {
+		return {
+			makeDefault: entry.name === input.file.defaultTarget || input.file.defaultTarget === void 0 && input.makeFirstDefault && index === 0,
+			name: entry.name,
+			resourceUrl: resolveImportEntryResourceUrl({
+				entry,
+				...input.commandResourceUrl === void 0 ? {} : { commandResourceUrl: input.commandResourceUrl },
+				...input.file.resourceUrl === void 0 ? {} : { fileResourceUrl: input.file.resourceUrl }
+			}),
+			sshUrl: resolveImportEntrySshUrl(entry)
+		};
+	});
+};
+const resolveSshOAuthToken = async (parsed, resourceUrl) => {
+	return await resolveOAuthToken({
+		authorizationUrlHandler: (authorizationUrl) => {
+			process$1.stderr.write(`Authorize runneth here:\n${authorizationUrl}\n`);
+		},
+		clientName: parsed.clientName,
+		...resolveCliOAuthClientCredentialOptions(parsed),
+		openBrowser: parsed.openBrowser,
+		resourceUrl,
+		scope: parsed.scope,
+		timeoutMs: parsed.timeoutMs
+	});
+};
+const writeJson = (response) => {
+	process$1.stdout.write(`${JSON.stringify(response, null, 2)}\n`);
+};
+const isDaemonSocketUnavailable = (error) => {
+	return typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ECONNREFUSED" || error.code === "ECONNRESET" || error.code === "EPIPE");
+};
+const assertRunnethCliDaemonStopped = async (gate) => {
+	const registeredSockets = new Set((await gate.readRegistrations()).map((registration) => registration.socketPath));
+	const socketPaths = new Set([...registeredSockets, resolveSocketPath()]);
+	for (const socketPath of socketPaths) {
+		try {
+			await sendRunnethCliRequest({
+				request: { op: "ping" },
+				socketPath,
+				timeoutMs: 500
+			});
+		} catch (error) {
+			if (isDaemonSocketUnavailable(error)) {
+				if (registeredSockets.has(socketPath)) await gate.removeRegistration(socketPath);
+				continue;
+			}
+			if (!(error instanceof RunnethCliRequestTimeoutError)) throw error;
+		}
+		throw new Error("Stop every local Runneth CLI daemon for this installation before updating. Close persistent sessions, run `runneth shutdown` in each CLI home, then retry `runneth update`.");
+	}
+};
+const waitForRunnethCliDaemonStop = async (socketPath) => {
+	const deadline = Date.now() + 5e3;
+	while (Date.now() < deadline) {
+		try {
+			await sendRunnethCliRequest({
+				request: { op: "ping" },
+				socketPath,
+				timeoutMs: Math.max(1, Math.min(500, deadline - Date.now()))
+			});
+		} catch (error) {
+			if (isDaemonSocketUnavailable(error)) return;
+			if (!(error instanceof RunnethCliRequestTimeoutError)) throw error;
+		}
+		await new Promise((resolve) => {
+			setTimeout(resolve, 25);
+		});
+	}
+	throw new Error("Timed out waiting for the local Runneth CLI daemon to stop");
+};
+const applyRunnethCliUpdate = async (action) => {
+	process$1.stdout.write(`Updating Runneth CLI via \`${action.displayCommand}\`...\n`);
+	await runWithRunnethCliDaemonGate(await resolveRunnethCliDaemonInstallationPath(resolveCliEntryPath()), async (gate) => {
+		await assertRunnethCliDaemonStopped(gate);
+		await runRunnethCliUpdateAction({ action });
+	});
+	process$1.stdout.write("Update ran successfully. Please rerun your Runneth command.\nThe next daemon-backed command starts from the updated installation.\n");
+};
+const formatNullableIdentityValue = (value) => {
+	return value === null ? "(none)" : value;
+};
+const formatSshSetupAccount = (setup) => {
+	return `${setup.provider}:${setup.providerAccountId}`;
+};
+const writeSshSetupSummary = (setup) => {
+	const identityLines = [
+		`  account: ${formatSshSetupAccount(setup)}`,
+		`  vmUser: ${setup.userId}`,
+		`  organization: ${setup.organizationId}`,
+		`  sandbox: ${setup.sandboxId}`,
+		`  workspace: ${formatNullableIdentityValue(setup.workspaceId)}`,
+		`  defaultConversation: ${formatNullableIdentityValue(setup.defaultConversationId)}`
+	];
+	process$1.stderr.write([
+		`SSH target ${setup.targetName ?? setup.hostAlias} configured`,
+		`  config: ${setup.configPath}`,
+		`  hostAlias: ${setup.hostAlias}`,
+		`  sshUser: ${setup.sshUser}`,
+		...identityLines,
+		""
+	].join("\n"));
+};
+const writeSshProxySummary = (result) => {
+	process$1.stderr.write([
+		"SSH tunnel closed",
+		`  transport: ${result.transport}`,
+		`  heartbeat pongs: ${String(result.heartbeatPongCount)}`,
+		""
+	].join("\n"));
+};
+const writeCopyTargetSummary = (input) => {
+	process$1.stderr.write([
+		"Runneth VM copy target binding",
+		`  source: ${input.source.targetName ?? input.source.sshUrl}`,
+		`  sourceResource: ${input.source.resourceUrl}`,
+		`  sourceSsh: ${input.source.sshUrl}`,
+		`  sourcePath: ${input.sourcePath}`,
+		`  destination: ${input.destination.targetName ?? input.destination.sshUrl}`,
+		`  destinationResource: ${input.destination.resourceUrl}`,
+		`  destinationSsh: ${input.destination.sshUrl}`,
+		`  destinationPath: ${input.destinationPath}`,
+		""
+	].join("\n"));
+};
+const runDaemon = async (argv) => {
+	if (argv.length !== 2) throw new Error("Internal Runneth CLI daemon start requires its socket and installation paths");
+	const socketPath = argv[0];
+	const installationPath = argv[1];
+	if (socketPath === void 0 || installationPath === void 0) throw new Error("Internal Runneth CLI daemon start requires its socket and installation paths");
+	await new RunnethCliDaemonRuntime().startWithGateHeld({
+		installationPath,
+		socketPath
+	});
+};
+const request = async (payload, timeoutMs = DEFAULT_TIMEOUT_MS) => {
+	const socketPath = resolveSocketPath();
+	if (payload.op === "shutdown") return await sendRunnethCliShutdownRequest({
+		socketPath,
+		timeoutMs
+	});
+	if (payload.op !== "close") {
+		const cliPath = resolveCliEntryPath();
+		await ensureDaemon({
+			cliPath,
+			installationPath: await resolveRunnethCliDaemonInstallationPath(cliPath),
+			socketPath
+		});
+	}
+	return await sendRunnethCliRequest({
+		request: payload,
+		socketPath,
+		timeoutMs
+	});
+};
+const run = async (argv) => {
+	const command = argv[0];
+	if (command === "__update-check") {
+		const updateEntryPath = argv[1];
+		if (argv.length !== 2 || updateEntryPath === void 0 || !path.isAbsolute(updateEntryPath)) throw new Error("Internal Runneth CLI update check requires its absolute entry path");
+		await runRunnethCliBackgroundUpdateCheck({
+			entryPath: updateEntryPath,
+			moduleUrl: import.meta.url
+		});
+		return;
+	}
+	if (command === "daemon") {
+		await runDaemon(argv.slice(1));
+		return;
+	}
+	if (command === "update") {
+		if (argv.slice(1).length > 0) throw new Error("runneth-cli update accepts no arguments");
+		await applyRunnethCliUpdate(await resolveRunnethCliUpdateAction({
+			entryPath: resolveCliEntryPath(),
+			moduleUrl: import.meta.url
+		}));
+		return;
+	}
+	if (command === "open") {
+		const parsed = parseArgs(argv.slice(1));
+		writeJson(await request({
+			cwd: parsed.cwd ?? process$1.cwd(),
+			name: parsed.name,
+			op: "open",
+			...parsed.shell === void 0 ? {} : { shell: parsed.shell }
+		}));
+		return;
+	}
+	if (command === "send") {
+		const parsed = parseArgs(argv.slice(1));
+		const shellCommand = parsed.stdin ? await readStdin() : parsed.values.join(" ");
+		if (shellCommand.trim().length === 0) throw new Error("runneth send requires a command or --stdin");
+		const response = await request({
+			command: shellCommand,
+			cwd: parsed.cwd ?? process$1.cwd(),
+			name: parsed.name,
+			op: "send",
+			...parsed.shell === void 0 ? {} : { shell: parsed.shell }
+		}, parsed.timeoutMs);
+		writeJson(response);
+		if (response.ok && response.op === "send" && response.exitCode !== 0) process$1.exitCode = response.exitCode;
+		return;
+	}
+	if (command === "status") {
+		writeJson(await request({
+			name: parseArgs(argv.slice(1)).name,
+			op: "status"
+		}));
+		return;
+	}
+	if (command === "list") {
+		if (argv.length !== 1) throw new Error("runneth list does not accept arguments. Use runneth list --help.");
+		writeJson(await request({ op: "list" }));
+		return;
+	}
+	if (command === "chat") {
+		await runRunnethConversation(await resolveRunnethConversationOptions(parseRunnethConversationArgs(argv.slice(1), parseNumber)));
+		return;
+	}
+	if (command === "conversation") {
+		await runRunnethConversationMachineCommand({
+			argv: argv.slice(1),
+			parseNumber
+		});
+		return;
+	}
+	if (command === "oauth") {
+		const subcommand = argv[1];
+		const parsed = parseOAuthArgs(argv.slice(2));
+		const resourceUrl = resolveOAuthResourceUrl(parsed);
+		if (subcommand === "login") {
+			const result = await loginWithOAuth({
+				authorizationUrlHandler: (authorizationUrl) => {
+					process$1.stderr.write(`Authorize runneth here:\n${authorizationUrl}\n`);
+				},
+				clientName: parsed.clientName,
+				...resolveCliOAuthClientCredentialOptions(parsed),
+				openBrowser: parsed.openBrowser,
+				resourceUrl,
+				scope: parsed.scope,
+				timeoutMs: parsed.timeoutMs
+			});
+			writeJson({
+				accessToken: result.accessToken,
+				credentialPath: result.credentialPath,
+				expiresAt: result.expiresAt,
+				ok: true,
+				op: "oauth-login",
+				resource: result.credential.resource,
+				scope: result.credential.token.scope ?? result.credential.scope,
+				tokenType: result.tokenType
+			});
+			return;
+		}
+		if (subcommand === "status") {
+			writeJson({
+				ok: true,
+				op: "oauth-status",
+				...await readOAuthCredentialStatus({ resourceUrl })
+			});
+			return;
+		}
+		if (subcommand === "logout") {
+			writeJson({
+				ok: true,
+				op: "oauth-logout",
+				...await logoutOAuthCredential({ resourceUrl })
+			});
+			return;
+		}
+		throw new Error(`Unknown oauth command: ${subcommand}`);
+	}
+	if (command === "copy") {
+		const parsed = parseCopyArgs(argv.slice(1));
+		const sourcePath = parsed.values[0];
+		const destinationPath = parsed.values[1];
+		if (sourcePath === void 0 || destinationPath === void 0 || parsed.values.length !== 2) throw new Error("runneth copy requires exactly <source-path> and <destination-path>");
+		const sourceTarget = await resolveRunnethSshTarget({ targetName: parsed.sourceTargetName });
+		const destinationTarget = await resolveRunnethSshTarget({ targetName: parsed.destinationTargetName });
+		assertRunnethVmCopyTargetsUseSameResource({
+			destination: destinationTarget,
+			source: sourceTarget
+		});
+		writeCopyTargetSummary({
+			destination: destinationTarget,
+			destinationPath,
+			source: sourceTarget,
+			sourcePath
+		});
+		const oauthToken = await resolveSshOAuthToken(parsed, sourceTarget.resourceUrl);
+		const copyProgressReporter = createCopyProgressReporter({
+			interactive: process$1.stderr.isTTY === true,
+			output: process$1.stderr
+		});
+		try {
+			writeJson({
+				ok: true,
+				op: "copy",
+				...await runRunnethVmCopy({
+					destination: destinationTarget,
+					destinationPath,
+					ignoredPaths: parsed.ignoredPaths,
+					oauthToken,
+					onProgress: copyProgressReporter.report,
+					source: sourceTarget,
+					sourcePath,
+					timeoutMs: parsed.timeoutMs
+				})
+			});
+		} catch (error) {
+			await copyProgressReporter.finishFailure(error);
+		}
+		return;
+	}
+	if (command === "skills") {
+		const subcommand = argv[1];
+		if (subcommand === "install") {
+			writeJson({
+				ok: true,
+				op: "skills-install",
+				...await installRunnethSkills({ agents: parseSkillsArgs(argv.slice(2)).agents })
+			});
+			return;
+		}
+		throw new Error(`Unknown skills command: ${subcommand}`);
+	}
+	if (command === "ssh") {
+		const subcommand = argv[1];
+		if (subcommand === "target") {
+			const targetCommand = argv[2];
+			if (targetCommand === "add") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshConversationOptions(parsed, "runneth ssh target add");
+				assertNoSshKeyOptions(parsed, "runneth ssh target add");
+				const name = parsed.values[0];
+				if (name === void 0 || parsed.values.length !== 1) throw new Error("runneth ssh target add requires one target name");
+				if (parsed.sshHost === void 0 && parsed.sshUrl === void 0) throw new Error("runneth ssh target add requires --host <host> or --ssh-url <url>");
+				if (parsed.targetName !== void 0) throw new Error("--target is not valid for ssh target add");
+				const saved = await saveRunnethSshTarget({
+					makeDefault: parsed.makeDefault,
+					name,
+					resourceUrl: requireResourceUrl(parsed.resourceUrl ?? resolveDefaultResourceUrl(), "runneth ssh target add"),
+					sshUrl: resolveSshUrlOption(parsed)
+				});
+				writeJson({
+					defaultTarget: saved.store.defaultTarget,
+					ok: true,
+					op: "ssh-target-add",
+					target: saved.target
+				});
+				return;
+			}
+			if (targetCommand === "import") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshConversationOptions(parsed, "runneth ssh target import");
+				assertNoSshKeyOptions(parsed, "runneth ssh target import");
+				const filePath = parsed.values[0];
+				if (filePath === void 0 || parsed.values.length !== 1) throw new Error("runneth ssh target import requires one JSON file path");
+				if (parsed.targetName !== void 0) throw new Error("--target is not valid for ssh target import");
+				if (parsed.sshHost !== void 0 || parsed.sshUrl !== void 0) throw new Error("runneth ssh target import reads host and sshUrl from the file");
+				const importFile = await readSshTargetImportFile(filePath);
+				if (parsed.makeDefault && importFile.defaultTarget !== void 0) throw new Error("Use either import file defaultTarget or --default, not both");
+				const entries = resolveSshTargetImportEntries({
+					...parsed.resourceUrl === void 0 ? {} : { commandResourceUrl: parsed.resourceUrl },
+					file: importFile,
+					makeFirstDefault: parsed.makeDefault
+				});
+				const targets = [];
+				let defaultTarget;
+				for (const entry of entries) {
+					const saved = await saveRunnethSshTarget({
+						makeDefault: entry.makeDefault,
+						name: entry.name,
+						resourceUrl: entry.resourceUrl,
+						sshUrl: entry.sshUrl
+					});
+					targets.push(saved.target);
+					defaultTarget = saved.store.defaultTarget;
+				}
+				writeJson({
+					defaultTarget,
+					ok: true,
+					op: "ssh-target-import",
+					targets
+				});
+				return;
+			}
+			if (targetCommand === "list") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshConversationOptions(parsed, "runneth ssh target list");
+				assertNoSshKeyOptions(parsed, "runneth ssh target list");
+				if (parsed.values.length > 0) throw new Error("runneth ssh target list does not accept names");
+				const store = await readRunnethSshTargetStore({});
+				writeJson({
+					defaultTarget: store.defaultTarget,
+					ok: true,
+					op: "ssh-target-list",
+					targets: store.targets
+				});
+				return;
+			}
+			if (targetCommand === "use") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshConversationOptions(parsed, "runneth ssh target use");
+				assertNoSshKeyOptions(parsed, "runneth ssh target use");
+				const name = parsed.values[0];
+				if (name === void 0 || parsed.values.length !== 1) throw new Error("runneth ssh target use requires one target name");
+				const store = await setDefaultRunnethSshTarget({ name });
+				const target = store.targets.find((item) => item.name === name);
+				writeJson({
+					defaultTarget: store.defaultTarget,
+					ok: true,
+					op: "ssh-target-use",
+					target
+				});
+				return;
+			}
+			if (targetCommand === "remove") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshConversationOptions(parsed, "runneth ssh target remove");
+				assertNoSshKeyOptions(parsed, "runneth ssh target remove");
+				const name = parsed.values[0];
+				if (name === void 0 || parsed.values.length !== 1) throw new Error("runneth ssh target remove requires one target name");
+				const store = await removeRunnethSshTarget({ name });
+				writeJson({
+					defaultTarget: store.defaultTarget,
+					ok: true,
+					op: "ssh-target-remove",
+					targetName: name,
+					targets: store.targets
+				});
+				return;
+			}
+			throw new Error(`Unknown ssh target command: ${targetCommand}`);
+		}
+		if (subcommand === "proxy") {
+			const parsed = parseSshArgs(argv.slice(2));
+			if (parsed.values.length > 0) throw new Error("runneth ssh proxy does not accept extra arguments");
+			assertNoSshTargetDefaultFlag(parsed);
+			assertNoSshKeyOptions(parsed, "runneth ssh proxy");
+			const target = await resolveSshTargetForCommand(parsed);
+			writeSshProxySummary(await runRunnethSshProxy({
+				resourceUrl: target.resourceUrl,
+				sshUrl: target.sshUrl
+			}));
+			return;
+		}
+		if (subcommand === "stdio") {
+			const parsed = parseSshArgs(argv.slice(2));
+			if (parsed.values.length > 0) throw new Error("runneth ssh stdio does not accept extra arguments");
+			assertNoSshTargetDefaultFlag(parsed);
+			const { oauthToken, target } = await resolveSshCommandContext(parsed);
+			const setup = await installRunnethSshAccess({
+				cliPath: fileURLToPath(import.meta.url),
+				oauthToken,
+				resourceUrl: target.resourceUrl,
+				sshUrl: target.sshUrl,
+				...resolveSshKeyInstallOptions(parsed),
+				...target.targetName === void 0 ? {} : { targetName: target.targetName }
+			});
+			writeSshSetupSummary(setup);
+			await runRunnethSshStdio({
+				defaultTimeoutMs: parsed.timeoutMs,
+				setup
+			});
+			return;
+		}
+		const parsed = parseSshArgs(argv.slice(1));
+		assertNoSshTargetDefaultFlag(parsed);
+		assertSshRemoteCommandSeparator(parsed);
+		const { oauthToken, target } = await resolveSshCommandContext(parsed);
+		const setup = await installRunnethSshAccess({
+			cliPath: fileURLToPath(import.meta.url),
+			oauthToken,
+			resourceUrl: target.resourceUrl,
+			sshUrl: target.sshUrl,
+			...resolveSshKeyInstallOptions(parsed),
+			...target.targetName === void 0 ? {} : { targetName: target.targetName }
+		});
+		writeSshSetupSummary(setup);
+		process$1.exitCode = await runOpenSsh({
+			extraArgs: parsed.values,
+			setup
+		});
+		return;
+	}
+	if (command === "close") {
+		writeJson(await request({
+			name: parseArgs(argv.slice(1)).name,
+			op: "close"
+		}));
+		return;
+	}
+	if (command === "shutdown") {
+		if (argv.length !== 1) throw new Error("runneth shutdown does not accept arguments. Use runneth shutdown --help.");
+		const socketPath = resolveSocketPath();
+		writeJson(await request({ op: "shutdown" }));
+		await waitForRunnethCliDaemonStop(socketPath);
+		return;
+	}
+	throw new Error(`Unknown command: ${command}. Run runneth --help to see available commands.`);
+};
+const isSshProxyInvocation = (argv) => {
+	return argv[0] === "ssh" && argv[1] === "proxy";
+};
+const isSshStdioInvocation = (argv) => {
+	return argv[0] === "ssh" && argv[1] === "stdio";
+};
+const isConversationSessionInvocation = (argv) => {
+	return argv[0] === "conversation" && argv[1] === "session";
+};
+const formatErrorMessage = (error) => {
+	return error instanceof Error ? error.message : String(error);
+};
+const formatSshProxyErrorMessages = (error) => {
+	if (!(error instanceof AggregateError)) return [formatErrorMessage(error)];
+	return error.errors.flatMap((nestedError) => formatSshProxyErrorMessages(nestedError));
+};
+const shouldSkipStartupUpdateCheck = (argv) => {
+	return argv[0] === "__update-check" || argv[0] === "daemon" || argv[0] === "update" || isConversationSessionInvocation(argv) || (argv[0] === "chat" || argv[0] === "ssh") && !isRunnethCliUpdatePromptInvocation(argv);
+};
+const handleUpdatePromptSelection = async (selection, candidate) => {
+	switch (selection) {
+		case "not-now": return "continue";
+		case "dismiss":
+			await dismissRunnethCliUpdate({ dismissal: candidate.dismissal });
+			return "continue";
+		case "update":
+			await applyRunnethCliUpdate(candidate.action);
+			return "updated";
+		default: return selection;
+	}
+};
+const argv = process$1.argv.slice(2);
+const runWithUpdateCheck = async () => {
+	const display = resolveCliDisplayRequest(argv);
+	if (display !== null) {
+		await writeCliDisplay(display, process$1.stdout);
+		return;
+	}
+	if (shouldSkipStartupUpdateCheck(argv)) {
+		await run(argv);
+		return;
+	}
+	const entryPath = resolveCliEntryPath();
+	const isPromptEligible = isRunnethCliUpdatePromptInvocation(argv) && process$1.stdin.isTTY === true && process$1.stderr.isTTY === true;
+	let cachedUpdate = null;
+	if (isPromptEligible) try {
+		cachedUpdate = await readRunnethCliCachedUpdate({
+			entryPath,
+			moduleUrl: import.meta.url
+		});
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		process$1.stderr.write(`Runneth CLI update notification unavailable: ${message}\n`);
+	}
+	if (cachedUpdate !== null) {
+		if (await handleUpdatePromptSelection(await runRunnethCliUpdatePrompt({
+			currentVersion: cachedUpdate.currentVersion,
+			input: process$1.stdin,
+			output: process$1.stderr,
+			targetVersion: cachedUpdate.latestVersion,
+			updateCommand: cachedUpdate.action.displayCommand
+		}), cachedUpdate) === "updated") {
+			process$1.stdin.pause();
+			return;
+		}
+	}
+	scheduleRunnethCliUpdateCheck({ entryPath });
+	await run(argv);
+};
+runWithUpdateCheck().catch((error) => {
+	process$1.stdin.pause();
+	const message = formatErrorMessage(error);
+	const commandError = error instanceof RunnethCliReplacementInterruptedError ? error.cause : error;
+	if (commandError instanceof RunnethCliUpdateCommandError) {
+		process$1.stderr.write(`${message}\n`);
+		process$1.exitCode = commandError.exitCode;
+		return;
+	}
+	if (argv[0] === "__update-check") {
+		process$1.stderr.write(`Runneth CLI update check failed: ${message}\n`);
+		process$1.exitCode = 1;
+		return;
+	}
+	if (isSshProxyInvocation(argv)) {
+		process$1.stderr.write(`${formatSshProxyErrorMessages(error).join("\n")}\n`);
+		process$1.exitCode = 1;
+		return;
+	}
+	if (isSshStdioInvocation(argv)) {
+		process$1.stdout.write(`${JSON.stringify({
+			message,
+			ok: false,
+			type: "error"
+		})}\n`);
+		process$1.exitCode = 1;
+		return;
+	}
+	if (isConversationSessionInvocation(argv)) {
+		process$1.stdout.write(`${JSON.stringify({
+			message,
+			ok: false,
+			type: "error"
+		})}\n`);
+		process$1.exitCode = 1;
+		return;
+	}
+	if (argv[0] === "update") {
+		process$1.stderr.write(`${message}\n`);
+		process$1.exitCode = 1;
+		return;
+	}
+	process$1.stdout.write(`${JSON.stringify({
+		error: message,
+		ok: false
+	}, null, 2)}\n`);
+	process$1.exitCode = 1;
+});
+//#endregion
+export {};