@runneth/cli 0.0.0-sha.14f7fe073a12.production

package/dist/cli.js

@@ -0,0 +1,1533 @@
+#!/usr/bin/env node
+import { resolveBuildDefaultMcpResourceUrl } from "./build-defaults.js";
+import { B as readOAuthCredentialStatus, C as setDefaultRunnethSshTarget, D as runRunnethConversationMachineCommand, I as getOAuthAccessToken, L as loginWithOAuth, M as parseRunnethConversationArgs, N as resolveRunnethConversationOptions, P as runRunnethConversation, R as logoutOAuthCredential, S as saveRunnethSshTarget, T as runRunnethVmCopy, U as resolveSocketPath, _ as resolveRunnethSshTarget, a as normalizeSessionName, b as runOpenSsh, d as installRunnethSshAccess, f as normalizeRunnethSshTargetName, l as installRunnethSkills, m as removeRunnethSshTarget, p as readRunnethSshTargetStore, r as ensureDaemon, s as sendRunnethCliRequest, t as RunnethCliDaemon, w as assertRunnethVmCopyTargetsUseSameResource, x as runRunnethSshProxy } from "./src.js";
+import { readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import process$1 from "node:process";
+import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+//#region src/ssh-stdio.ts
+const ALLOWED_PROCESS_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGKILL",
+	"SIGTERM"
+];
+const DEFAULT_EXEC_TIMEOUT_MS = 6e5;
+const DEFAULT_MASTER_READY_TIMEOUT_MS = 1e4;
+const DEFAULT_MAX_FRAME_BYTES = 1048576;
+const DEFAULT_MAX_PROCESSES = 16;
+const PROCESS_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/u;
+const nowIso = () => {
+	return (/* @__PURE__ */ new Date()).toISOString();
+};
+const isRecord$1 = (value) => {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const errorMessage = (error) => {
+	return error instanceof Error ? error.message : String(error);
+};
+const parseString = (record, key) => {
+	const value = record[key];
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${key} must be a non-empty string`);
+	return value;
+};
+const parseProcessId = (value) => {
+	if (!PROCESS_ID_PATTERN.test(value)) throw new Error(`Invalid process id: ${value}. Use letters, numbers, dot, underscore, dash, and colon only.`);
+	return value;
+};
+const parsePositiveInteger = (record, key) => {
+	const value = record[key];
+	if (value === void 0) return;
+	if (!Number.isInteger(value) || typeof value !== "number" || value <= 0) throw new Error(`${key} must be a positive integer`);
+	return value;
+};
+const parseParams = (record) => {
+	const params = record.params;
+	if (!isRecord$1(params)) throw new Error("params must be a JSON object");
+	return params;
+};
+const parseProcessSignal = (record) => {
+	const value = parseString(record, "signal");
+	if (!ALLOWED_PROCESS_SIGNALS.includes(value)) throw new Error(`Unsupported signal: ${value}`);
+	return value;
+};
+const parseRunnethSshStdioRequest = (value) => {
+	if (!isRecord$1(value)) throw new Error("Request must be a JSON object");
+	const id = parseProcessId(parseString(value, "id"));
+	const method = parseString(value, "method");
+	switch (method) {
+		case "exec": {
+			const params = parseParams(value);
+			const timeoutMs = parsePositiveInteger(params, "timeoutMs");
+			return {
+				id,
+				method,
+				params: {
+					command: parseString(params, "command"),
+					...timeoutMs === void 0 ? {} : { timeoutMs }
+				}
+			};
+		}
+		case "spawn": return {
+			id,
+			method,
+			params: { command: parseString(parseParams(value), "command") }
+		};
+		case "stdin": {
+			const data = parseParams(value).data;
+			if (typeof data !== "string") throw new Error("data must be a string");
+			return {
+				id,
+				method,
+				params: { data }
+			};
+		}
+		case "signal": return {
+			id,
+			method,
+			params: { signal: parseProcessSignal(parseParams(value)) }
+		};
+		case "close":
+		case "list":
+		case "ping": return {
+			id,
+			method
+		};
+		default: throw new Error(`Unknown SSH stdio method: ${method}`);
+	}
+};
+const writeChunk = async (stream, chunk) => {
+	if (stream.write(chunk)) return;
+	await new Promise((resolve) => {
+		stream.once("drain", () => {
+			resolve();
+		});
+	});
+};
+var JsonLineWriter = class {
+	#stream;
+	#queue = Promise.resolve();
+	constructor(stream) {
+		this.#stream = stream;
+	}
+	async flush() {
+		await this.#queue;
+	}
+	write(payload) {
+		const line = `${JSON.stringify(payload)}\n`;
+		const next = this.#queue.then(async () => {
+			await writeChunk(this.#stream, line);
+		});
+		this.#queue = next.then(() => void 0, () => void 0);
+		return next;
+	}
+};
+const waitForChildExit = async (child) => {
+	return await new Promise((resolve, reject) => {
+		child.once("error", reject);
+		child.once("close", (code, signal) => {
+			resolve({
+				code,
+				signal
+			});
+		});
+	});
+};
+const runProcessExitCode = async (input) => {
+	return await new Promise((resolve, reject) => {
+		const child = spawn(input.sshCommand, [...input.args], {
+			env: input.env,
+			stdio: [
+				"ignore",
+				"ignore",
+				"ignore"
+			]
+		});
+		child.once("error", reject);
+		child.once("close", (code, signal) => {
+			if (signal !== null) {
+				resolve(1);
+				return;
+			}
+			resolve(code ?? 1);
+		});
+	});
+};
+var RunnethSshControlMaster = class {
+	#controlPath;
+	#env;
+	#masterReadyTimeoutMs;
+	#setup;
+	#sshCommand;
+	#master = null;
+	#masterClosed = false;
+	#masterExit = null;
+	#masterStderr = "";
+	constructor(options) {
+		this.#controlPath = options.controlPath;
+		this.#env = options.env;
+		this.#masterReadyTimeoutMs = options.masterReadyTimeoutMs;
+		this.#setup = options.setup;
+		this.#sshCommand = options.sshCommand;
+	}
+	async start() {
+		await rm(this.#controlPath, { force: true });
+		const master = spawn(this.#sshCommand, [
+			"-F",
+			this.#setup.configPath,
+			"-S",
+			this.#controlPath,
+			"-o",
+			"ControlMaster=yes",
+			"-o",
+			"ControlPersist=no",
+			"-N",
+			this.#setup.hostAlias
+		], {
+			env: this.#env,
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			]
+		});
+		this.#master = master;
+		master.stderr?.on("data", (chunk) => {
+			this.#masterStderr += String(chunk);
+		});
+		this.#masterExit = waitForChildExit(master).then((exit) => {
+			this.#masterClosed = true;
+			return exit;
+		});
+		const deadline = Date.now() + this.#masterReadyTimeoutMs;
+		while (Date.now() < deadline) {
+			if (this.#masterClosed) throw new Error(this.#formatMasterExitError());
+			if (await this.check() === 0) return;
+			await setTimeout$1(50);
+		}
+		throw new Error(this.#formatMasterExitError("Timed out opening SSH master"));
+	}
+	async check() {
+		return await runProcessExitCode({
+			args: [
+				"-F",
+				this.#setup.configPath,
+				"-S",
+				this.#controlPath,
+				"-O",
+				"check",
+				this.#setup.hostAlias
+			],
+			env: this.#env,
+			sshCommand: this.#sshCommand
+		});
+	}
+	async requireReady() {
+		if (this.#masterClosed || await this.check() !== 0) throw new Error(this.#formatMasterExitError("SSH master is not running"));
+	}
+	spawnRemoteCommand(command) {
+		return spawn(this.#sshCommand, [
+			"-F",
+			this.#setup.configPath,
+			"-S",
+			this.#controlPath,
+			"-o",
+			"ControlMaster=no",
+			this.#setup.hostAlias,
+			command
+		], {
+			env: this.#env,
+			stdio: "pipe"
+		});
+	}
+	async stop() {
+		const master = this.#master;
+		if (master === null || this.#masterExit === null || this.#masterClosed) {
+			await rm(this.#controlPath, { force: true });
+			return;
+		}
+		master.kill("SIGTERM");
+		const timeout = setTimeout$1(5e3).then(() => {
+			if (!this.#masterClosed) master.kill("SIGKILL");
+		});
+		await Promise.race([this.#masterExit, timeout]);
+		await this.#masterExit;
+		await rm(this.#controlPath, { force: true });
+	}
+	#formatMasterExitError(prefix = "SSH master exited before it was ready") {
+		const stderr = this.#masterStderr.trim();
+		if (stderr.length === 0) return prefix;
+		return `${prefix}: ${stderr}`;
+	}
+};
+var RunnethSshStdioController = class {
+	#defaultTimeoutMs;
+	#master;
+	#maxFrameBytes;
+	#maxProcesses;
+	#processes = /* @__PURE__ */ new Map();
+	#setup;
+	#stdin;
+	#stderr;
+	#writer;
+	#stopping = false;
+	constructor(options) {
+		const setup = options.setup;
+		const env = options.env ?? process.env;
+		const controlPath = path.join(path.dirname(setup.configPath), "control.sock");
+		this.#defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS;
+		this.#maxFrameBytes = options.maxFrameBytes ?? DEFAULT_MAX_FRAME_BYTES;
+		this.#maxProcesses = options.maxProcesses ?? DEFAULT_MAX_PROCESSES;
+		this.#setup = setup;
+		this.#stdin = options.streams?.stdin ?? process.stdin;
+		this.#stderr = options.streams?.stderr ?? process.stderr;
+		this.#writer = new JsonLineWriter(options.streams?.stdout ?? process.stdout);
+		this.#master = new RunnethSshControlMaster({
+			controlPath,
+			env,
+			masterReadyTimeoutMs: options.masterReadyTimeoutMs ?? DEFAULT_MASTER_READY_TIMEOUT_MS,
+			setup,
+			sshCommand: options.sshCommand ?? "ssh"
+		});
+	}
+	async start() {
+		await this.#master.start();
+		await writeChunk(this.#stderr, `SSH stdio master ${this.#setup.hostAlias} ready\n`);
+		await this.#writer.write({
+			hostAlias: this.#setup.hostAlias,
+			ok: true,
+			protocol: "runneth-ssh-stdio",
+			type: "ready",
+			version: 1,
+			...this.#setup.targetName === void 0 ? {} : { targetName: this.#setup.targetName }
+		});
+	}
+	async run() {
+		let buffer = "";
+		for await (const chunk of this.#stdin) {
+			buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+			let newlineIndex = buffer.indexOf("\n");
+			while (newlineIndex !== -1) {
+				const rawLine = buffer.slice(0, newlineIndex);
+				buffer = buffer.slice(newlineIndex + 1);
+				if (Buffer.byteLength(rawLine, "utf8") > this.#maxFrameBytes) {
+					await this.#writer.write({
+						message: `SSH stdio frame exceeds ${String(this.#maxFrameBytes)} bytes`,
+						ok: false,
+						type: "error"
+					});
+					return;
+				}
+				if (rawLine.trim().length > 0) await this.#handleLine(rawLine);
+				newlineIndex = buffer.indexOf("\n");
+			}
+			if (Buffer.byteLength(buffer, "utf8") > this.#maxFrameBytes) {
+				await this.#writer.write({
+					message: `SSH stdio frame exceeds ${String(this.#maxFrameBytes)} bytes`,
+					ok: false,
+					type: "error"
+				});
+				return;
+			}
+		}
+	}
+	async stop() {
+		this.#stopping = true;
+		for (const processInfo of this.#processes.values()) processInfo.child.kill("SIGTERM");
+		await this.#master.stop();
+		await this.#writer.flush();
+	}
+	async #handleLine(rawLine) {
+		let request;
+		try {
+			request = parseRunnethSshStdioRequest(JSON.parse(rawLine));
+		} catch (error) {
+			await this.#writer.write({
+				message: errorMessage(error),
+				ok: false,
+				type: "error"
+			});
+			return;
+		}
+		try {
+			switch (request.method) {
+				case "exec":
+					this.#exec(request).catch((error) => {
+						this.#writeRequestError(request.id, error);
+					});
+					return;
+				case "spawn":
+					await this.#spawn(request);
+					return;
+				case "stdin":
+					await this.#writeProcessStdin(request);
+					return;
+				case "signal":
+					await this.#signalProcess(request);
+					return;
+				case "close":
+					await this.#closeProcess(request.id);
+					return;
+				case "list":
+					await this.#writer.write({
+						id: request.id,
+						ok: true,
+						processes: [...this.#processes.values()].map((processInfo) => {
+							return {
+								command: processInfo.command,
+								processId: processInfo.processId,
+								startedAt: processInfo.startedAt
+							};
+						}),
+						type: "list"
+					});
+					return;
+				case "ping":
+					await this.#writer.write({
+						id: request.id,
+						ok: true,
+						type: "pong"
+					});
+					return;
+				default: return request;
+			}
+		} catch (error) {
+			await this.#writeRequestError(request.id, error);
+		}
+	}
+	async #exec(request) {
+		await this.#master.requireReady();
+		const child = this.#master.spawnRemoteCommand(request.params.command);
+		const timeoutMs = request.params.timeoutMs ?? this.#defaultTimeoutMs;
+		let timedOut = false;
+		const timeout = setTimeout(() => {
+			timedOut = true;
+			this.#writer.write({
+				id: request.id,
+				message: `Command timed out after ${String(timeoutMs)}ms`,
+				ok: false,
+				type: "error"
+			});
+			child.kill("SIGTERM");
+		}, timeoutMs);
+		child.stdout.on("data", (chunk) => {
+			this.#writer.write({
+				data: String(chunk),
+				id: request.id,
+				type: "stdout"
+			});
+		});
+		child.stderr.on("data", (chunk) => {
+			this.#writer.write({
+				data: String(chunk),
+				id: request.id,
+				type: "stderr"
+			});
+		});
+		child.once("error", (error) => {
+			clearTimeout(timeout);
+			this.#writeRequestError(request.id, error);
+		});
+		child.once("close", (code, signal) => {
+			clearTimeout(timeout);
+			this.#writer.write({
+				code,
+				id: request.id,
+				ok: !timedOut,
+				signal,
+				type: "exit"
+			});
+		});
+	}
+	async #spawn(request) {
+		if (this.#processes.has(request.id)) throw new Error(`Process is already running: ${request.id}`);
+		if (this.#processes.size >= this.#maxProcesses) throw new Error(`SSH stdio process limit reached: ${String(this.#maxProcesses)}`);
+		await this.#master.requireReady();
+		const child = this.#master.spawnRemoteCommand(request.params.command);
+		const processInfo = {
+			child,
+			command: request.params.command,
+			processId: request.id,
+			startedAt: nowIso()
+		};
+		this.#processes.set(request.id, processInfo);
+		child.once("spawn", () => {
+			this.#writer.write({
+				command: request.params.command,
+				id: request.id,
+				ok: true,
+				processId: request.id,
+				type: "started"
+			});
+		});
+		child.stdout.on("data", (chunk) => {
+			this.#writer.write({
+				data: String(chunk),
+				id: request.id,
+				processId: request.id,
+				type: "stdout"
+			});
+		});
+		child.stderr.on("data", (chunk) => {
+			this.#writer.write({
+				data: String(chunk),
+				id: request.id,
+				processId: request.id,
+				type: "stderr"
+			});
+		});
+		child.once("error", (error) => {
+			this.#processes.delete(request.id);
+			this.#writeRequestError(request.id, error);
+		});
+		child.once("close", (code, signal) => {
+			this.#processes.delete(request.id);
+			if (this.#stopping) return;
+			this.#writer.write({
+				code,
+				id: request.id,
+				ok: true,
+				processId: request.id,
+				signal,
+				type: "exit"
+			});
+		});
+	}
+	async #writeProcessStdin(request) {
+		await writeChunk(this.#requireProcess(request.id).child.stdin, request.params.data);
+		await this.#writer.write({
+			id: request.id,
+			ok: true,
+			type: "ack"
+		});
+	}
+	async #signalProcess(request) {
+		if (!this.#requireProcess(request.id).child.kill(request.params.signal)) throw new Error(`Unable to signal process: ${request.id}`);
+		await this.#writer.write({
+			id: request.id,
+			ok: true,
+			signal: request.params.signal,
+			type: "ack"
+		});
+	}
+	async #closeProcess(processId) {
+		if (!this.#requireProcess(processId).child.kill("SIGTERM")) throw new Error(`Unable to close process: ${processId}`);
+		await this.#writer.write({
+			id: processId,
+			ok: true,
+			type: "ack"
+		});
+	}
+	#requireProcess(processId) {
+		const processInfo = this.#processes.get(processId);
+		if (processInfo === void 0) throw new Error(`Process is not running: ${processId}`);
+		return processInfo;
+	}
+	async #writeRequestError(id, error) {
+		await this.#writer.write({
+			id,
+			message: errorMessage(error),
+			ok: false,
+			type: "error"
+		});
+	}
+};
+const runRunnethSshStdio = async (options) => {
+	const controller = new RunnethSshStdioController(options);
+	await controller.start();
+	try {
+		await controller.run();
+	} finally {
+		await controller.stop();
+	}
+};
+//#endregion
+//#region src/cli.ts
+const DEFAULT_TIMEOUT_MS = 6e5;
+const DEFAULT_OAUTH_CLIENT_NAME = "Runneth MCP";
+const DEFAULT_OAUTH_SCOPE = "openid profile email offline_access";
+const MAX_STDIN_BYTES = 1048576;
+const isRecord = (value) => {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const parseStringField = (record, key) => {
+	const value = record[key];
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${key} must be a non-empty string`);
+	return value;
+};
+const parseOptionalStringField = (record, key) => {
+	const value = record[key];
+	if (value === void 0) return;
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${key} must be a non-empty string`);
+	return value;
+};
+const resolveDefaultResourceUrl = () => {
+	return resolveBuildDefaultMcpResourceUrl();
+};
+const requireResourceUrl = (resourceUrl, commandDescription) => {
+	if (resourceUrl === void 0) throw new Error(`${commandDescription} requires --resource <url> because this CLI build does not include MONDRIAN_API_URL`);
+	return resourceUrl;
+};
+const readStdin = async () => {
+	const chunks = [];
+	let totalBytes = 0;
+	for await (const chunk of process$1.stdin) {
+		const buffer = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+		totalBytes += buffer.length;
+		if (totalBytes > MAX_STDIN_BYTES) throw new Error(`stdin input exceeds ${String(MAX_STDIN_BYTES)} bytes`);
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks, totalBytes).toString("utf8");
+};
+const printHelp = () => {
+	process$1.stdout.write([
+		"Usage: runneth-cli <command> [options]",
+		"",
+		"Commands:",
+		"  open      Open or reuse a persistent shell session",
+		"  send      Send a shell command to a persistent session",
+		"  status    Show one session",
+		"  list      List sessions",
+		"  close     Close one session",
+		"  oauth     Authorize against an OAuth-protected MCP resource",
+		"  chat      Start an interactive Runneth terminal conversation",
+		"  conversation",
+		"            Create, send, inspect, or run a JSONL conversation session",
+		"  ssh       Connect to Runneth runtime SSH through OAuth",
+		"  copy      Copy one VM path to another VM through Builder file-share upload",
+		"  skills    Install or update bundled Claude/Codex skills",
+		"  shutdown  Stop the local runneth-cli daemon",
+		"",
+		"Examples:",
+		"  runneth-cli open",
+		"  runneth-cli send 'cd ~/project && pnpm test'",
+		"  runneth-cli send -- git status --short",
+		"  printf 'cd ~/project\\npwd\\n' | runneth-cli send --stdin",
+		"  runneth-cli oauth login",
+		"  runneth-cli chat --workspace <workspace-id>",
+		"  runneth-cli conversation create --workspace <workspace-id> --json",
+		"  runneth-cli ssh target add primary-vm --host 93c7ca56-debe-4b95-8be2-a873afe72234.app.runneth.com --default",
+		"  runneth-cli ssh -- 'pwd'",
+		"  runneth-cli copy --from source-vm --to destination-vm /agent/project /agent/imports/project",
+		"  runneth-cli skills install --agent all",
+		""
+	].join("\n"));
+};
+const parseNumber = (rawValue, label) => {
+	const value = Number(rawValue);
+	if (!Number.isInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer`);
+	return value;
+};
+const parseArgs = (argv) => {
+	const values = [];
+	let cwd;
+	let name = "default";
+	let shell;
+	let stdin = false;
+	let timeoutMs = DEFAULT_TIMEOUT_MS;
+	let parseOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (parseOptions && token === "--") {
+			parseOptions = false;
+			continue;
+		}
+		if (!parseOptions || !token.startsWith("--")) {
+			values.push(token);
+			continue;
+		}
+		const readValue = (label) => {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error(`Missing value for ${label}`);
+			index += 1;
+			return value;
+		};
+		switch (token) {
+			case "--cwd":
+				cwd = readValue(token);
+				break;
+			case "--name":
+				name = normalizeSessionName(readValue(token));
+				break;
+			case "--shell":
+				shell = readValue(token);
+				break;
+			case "--stdin":
+				stdin = true;
+				break;
+			case "--timeout-ms":
+				timeoutMs = parseNumber(readValue(token), token);
+				break;
+			default: throw new Error(`Unknown option: ${token}`);
+		}
+	}
+	return {
+		cwd,
+		name,
+		shell,
+		stdin,
+		timeoutMs,
+		values
+	};
+};
+const parseSkillAgent = (value) => {
+	if (value === "all") return ["claude", "codex"];
+	if (value === "claude" || value === "codex") return [value];
+	throw new Error(`Invalid skill agent: ${value}. Use claude, codex, or all.`);
+};
+const parseSkillsArgs = (argv) => {
+	let agents = ["claude", "codex"];
+	const values = [];
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (token === "--agent") {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error("Missing value for --agent");
+			agents = parseSkillAgent(value);
+			index += 1;
+			continue;
+		}
+		values.push(token);
+	}
+	if (values.length > 0) throw new Error("runneth-cli skills install only accepts --agent");
+	return { agents };
+};
+const parseOAuthArgs = (argv) => {
+	const values = [];
+	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let openBrowser = true;
+	let resourceUrl;
+	let scope = DEFAULT_OAUTH_SCOPE;
+	let timeoutMs = DEFAULT_TIMEOUT_MS;
+	let parseOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (parseOptions && token === "--") {
+			parseOptions = false;
+			continue;
+		}
+		if (!parseOptions || !token.startsWith("--")) {
+			values.push(token);
+			continue;
+		}
+		const readValue = (label) => {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error(`Missing value for ${label}`);
+			index += 1;
+			return value;
+		};
+		switch (token) {
+			case "--client-name":
+				clientName = readValue(token);
+				break;
+			case "--no-open":
+				openBrowser = false;
+				break;
+			case "--resource":
+				resourceUrl = readValue(token);
+				break;
+			case "--scope":
+				scope = readValue(token);
+				break;
+			case "--timeout-ms":
+				timeoutMs = parseNumber(readValue(token), token);
+				break;
+			default: throw new Error(`Unknown option: ${token}`);
+		}
+	}
+	return {
+		clientName,
+		openBrowser,
+		resourceUrl,
+		scope,
+		timeoutMs,
+		values
+	};
+};
+const parseSshArgs = (argv) => {
+	const values = [];
+	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let identityFilePath;
+	let makeDefault = false;
+	let openBrowser = true;
+	let resourceUrl;
+	let scope = DEFAULT_OAUTH_SCOPE;
+	let sshHost;
+	let sshUrl;
+	let targetName;
+	let timeoutMs = DEFAULT_TIMEOUT_MS;
+	let uniqueKey = false;
+	let argumentSeparatorSeen = false;
+	let parseOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (parseOptions && token === "--") {
+			argumentSeparatorSeen = true;
+			parseOptions = false;
+			continue;
+		}
+		if (!parseOptions || !token.startsWith("--")) {
+			values.push(token);
+			continue;
+		}
+		const readValue = (label) => {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error(`Missing value for ${label}`);
+			index += 1;
+			return value;
+		};
+		switch (token) {
+			case "--client-name":
+				clientName = readValue(token);
+				break;
+			case "--default":
+				makeDefault = true;
+				break;
+			case "--host":
+				sshHost = readValue(token);
+				break;
+			case "--identity-file":
+				identityFilePath = readValue(token);
+				break;
+			case "--no-open":
+				openBrowser = false;
+				break;
+			case "--resource":
+				resourceUrl = readValue(token);
+				break;
+			case "--scope":
+				scope = readValue(token);
+				break;
+			case "--ssh-url":
+				sshUrl = readValue(token);
+				break;
+			case "--target":
+				targetName = readValue(token);
+				break;
+			case "--timeout-ms":
+				timeoutMs = parseNumber(readValue(token), token);
+				break;
+			case "--unique-key":
+				uniqueKey = true;
+				break;
+			default: throw new Error(`Unknown option: ${token}`);
+		}
+	}
+	return {
+		argumentSeparatorSeen,
+		clientName,
+		...identityFilePath === void 0 ? {} : { identityFilePath },
+		makeDefault,
+		openBrowser,
+		resourceUrl,
+		scope,
+		...sshHost === void 0 ? {} : { sshHost },
+		sshUrl,
+		...targetName === void 0 ? {} : { targetName },
+		timeoutMs,
+		uniqueKey,
+		values
+	};
+};
+const parseCopyArgs = (argv) => {
+	const values = [];
+	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let destinationTargetName;
+	const ignoredPaths = [];
+	let openBrowser = true;
+	let scope = DEFAULT_OAUTH_SCOPE;
+	let sourceTargetName;
+	let timeoutMs = DEFAULT_TIMEOUT_MS;
+	let parseOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (parseOptions && token === "--") {
+			parseOptions = false;
+			continue;
+		}
+		if (!parseOptions || !token.startsWith("--")) {
+			values.push(token);
+			continue;
+		}
+		const readValue = (label) => {
+			const value = argv[index + 1];
+			if (value === void 0) throw new Error(`Missing value for ${label}`);
+			index += 1;
+			return value;
+		};
+		switch (token) {
+			case "--client-name":
+				clientName = readValue(token);
+				break;
+			case "--from":
+				sourceTargetName = normalizeRunnethSshTargetName(readValue(token));
+				break;
+			case "--ignore":
+				ignoredPaths.push(readValue(token));
+				break;
+			case "--no-open":
+				openBrowser = false;
+				break;
+			case "--scope":
+				scope = readValue(token);
+				break;
+			case "--timeout-ms":
+				timeoutMs = parseNumber(readValue(token), token);
+				break;
+			case "--to":
+				destinationTargetName = normalizeRunnethSshTargetName(readValue(token));
+				break;
+			default: throw new Error(`Unknown option: ${token}`);
+		}
+	}
+	if (sourceTargetName === void 0) throw new Error("runneth-cli copy requires --from <target>");
+	if (destinationTargetName === void 0) throw new Error("runneth-cli copy requires --to <target>");
+	return {
+		clientName,
+		destinationTargetName,
+		ignoredPaths,
+		openBrowser,
+		scope,
+		sourceTargetName,
+		timeoutMs,
+		values
+	};
+};
+const resolveOAuthResourceUrl = (parsed) => {
+	return requireResourceUrl(parsed.resourceUrl ?? parsed.values[0] ?? resolveDefaultResourceUrl(), "runneth-cli oauth");
+};
+const normalizeSshHost = (value) => {
+	const sshHost = value.trim();
+	if (sshHost.length === 0 || sshHost.includes("/") || sshHost.includes("?") || sshHost.includes("#") || sshHost.includes("@") || /^[A-Za-z][A-Za-z0-9+.-]*:\/\//u.test(sshHost) || /\s/u.test(sshHost)) throw new Error("SSH host must be a full hostname without scheme or path");
+	const url = new URL(`https://${sshHost}/runneth/ssh`);
+	if (url.hostname.length === 0) throw new Error("SSH host must be a full hostname without scheme or path");
+	return url.host;
+};
+const resolveSshUrlFromHost = (host) => {
+	return `https://${normalizeSshHost(host)}/runneth/ssh`;
+};
+const resolveSshUrlOption = (parsed) => {
+	if (parsed.sshUrl !== void 0 && parsed.sshHost !== void 0) throw new Error("Use either --ssh-url or --host, not both");
+	if (parsed.sshHost === void 0) return parsed.sshUrl;
+	return resolveSshUrlFromHost(parsed.sshHost);
+};
+const resolveSshResourceUrlOption = (parsed) => {
+	if (parsed.resourceUrl !== void 0) return parsed.resourceUrl;
+	if (parsed.sshHost !== void 0 || parsed.sshUrl !== void 0) return resolveDefaultResourceUrl();
+};
+const resolveSshTargetForCommand = async (parsed) => {
+	const sshUrl = resolveSshUrlOption(parsed);
+	const resourceUrl = resolveSshResourceUrlOption(parsed);
+	if (sshUrl !== void 0 && resourceUrl === void 0) requireResourceUrl(resourceUrl, "runneth-cli ssh");
+	return await resolveRunnethSshTarget({
+		resourceUrl,
+		sshUrl,
+		targetName: parsed.targetName
+	});
+};
+const assertNoSshTargetDefaultFlag = (parsed) => {
+	if (parsed.makeDefault) throw new Error("--default is only valid for runneth-cli ssh target add");
+};
+const assertSshRemoteCommandSeparator = (parsed) => {
+	if (parsed.values.length > 0 && !parsed.argumentSeparatorSeen) throw new Error("Remote SSH commands must follow --");
+};
+const assertNoSshKeyOptions = (parsed, commandDescription) => {
+	if (parsed.identityFilePath !== void 0 || parsed.uniqueKey) throw new Error(`${commandDescription} does not accept SSH key options`);
+};
+const resolveSshKeyInstallOptions = (parsed) => {
+	if (parsed.identityFilePath !== void 0 && parsed.uniqueKey) throw new Error("Use either --identity-file or --unique-key, not both");
+	if (parsed.identityFilePath !== void 0) return { identityFilePath: parsed.identityFilePath };
+	if (parsed.uniqueKey) return { keyMode: "unique" };
+	return {};
+};
+const parseSshTargetImportEntry = (payload, index) => {
+	if (!isRecord(payload)) throw new Error(`targets[${String(index)}] must be a JSON object`);
+	const name = normalizeRunnethSshTargetName(parseStringField(payload, "name"));
+	const host = parseOptionalStringField(payload, "host");
+	const resourceUrl = parseOptionalStringField(payload, "resourceUrl");
+	const sshUrl = parseOptionalStringField(payload, "sshUrl");
+	if (host === void 0 === (sshUrl === void 0)) throw new Error(`targets[${String(index)}] requires exactly one of host or sshUrl`);
+	return {
+		...host === void 0 ? {} : { host },
+		name,
+		...resourceUrl === void 0 ? {} : { resourceUrl },
+		...sshUrl === void 0 ? {} : { sshUrl }
+	};
+};
+const parseSshTargetImportFile = (payload) => {
+	if (!isRecord(payload)) throw new Error("SSH target import file must be a JSON object");
+	const rawTargets = payload.targets;
+	if (!Array.isArray(rawTargets) || rawTargets.length === 0) throw new Error("SSH target import file requires a non-empty targets array");
+	const defaultTargetValue = parseOptionalStringField(payload, "defaultTarget");
+	const resourceUrl = parseOptionalStringField(payload, "resourceUrl");
+	return {
+		...defaultTargetValue === void 0 ? {} : { defaultTarget: normalizeRunnethSshTargetName(defaultTargetValue) },
+		...resourceUrl === void 0 ? {} : { resourceUrl },
+		targets: rawTargets.map((entry, index) => parseSshTargetImportEntry(entry, index))
+	};
+};
+const readSshTargetImportFile = async (filePath) => {
+	const resolvedPath = path.resolve(filePath);
+	return parseSshTargetImportFile(JSON.parse(await readFile(resolvedPath, "utf8")));
+};
+const resolveImportEntryResourceUrl = (input) => {
+	return requireResourceUrl(input.entry.resourceUrl ?? input.fileResourceUrl ?? input.commandResourceUrl ?? resolveDefaultResourceUrl(), "runneth-cli ssh target import");
+};
+const resolveImportEntrySshUrl = (entry) => {
+	if (entry.sshUrl !== void 0) return entry.sshUrl;
+	if (entry.host === void 0) throw new Error(`Imported SSH target is missing host: ${entry.name}`);
+	return resolveSshUrlFromHost(entry.host);
+};
+const resolveSshTargetImportEntries = (input) => {
+	const names = /* @__PURE__ */ new Set();
+	for (const target of input.file.targets) {
+		if (names.has(target.name)) throw new Error(`Duplicate SSH target in import file: ${target.name}`);
+		names.add(target.name);
+	}
+	if (input.file.defaultTarget !== void 0 && !names.has(input.file.defaultTarget)) throw new Error(`Import defaultTarget does not match an imported target: ${input.file.defaultTarget}`);
+	return input.file.targets.map((entry, index) => {
+		return {
+			makeDefault: entry.name === input.file.defaultTarget || input.file.defaultTarget === void 0 && input.makeFirstDefault && index === 0,
+			name: entry.name,
+			resourceUrl: resolveImportEntryResourceUrl({
+				entry,
+				...input.commandResourceUrl === void 0 ? {} : { commandResourceUrl: input.commandResourceUrl },
+				...input.file.resourceUrl === void 0 ? {} : { fileResourceUrl: input.file.resourceUrl }
+			}),
+			sshUrl: resolveImportEntrySshUrl(entry)
+		};
+	});
+};
+const resolveSshOAuthToken = async (parsed, resourceUrl) => {
+	if ((await readOAuthCredentialStatus({ resourceUrl })).authenticated) return await getOAuthAccessToken({ resourceUrl });
+	return await loginWithOAuth({
+		authorizationUrlHandler: (authorizationUrl) => {
+			process$1.stderr.write(`Authorize runneth-cli here:\n${authorizationUrl}\n`);
+		},
+		clientName: parsed.clientName,
+		openBrowser: parsed.openBrowser,
+		resourceUrl,
+		scope: parsed.scope,
+		timeoutMs: parsed.timeoutMs
+	});
+};
+const writeJson = (response) => {
+	process$1.stdout.write(`${JSON.stringify(response, null, 2)}\n`);
+};
+const runDaemon = async (argv) => {
+	const socketPath = parseArgs(argv).values[0] ?? resolveSocketPath();
+	await new RunnethCliDaemon().start({ socketPath });
+};
+const request = async (payload, timeoutMs = DEFAULT_TIMEOUT_MS) => {
+	const socketPath = resolveSocketPath();
+	await ensureDaemon({
+		cliPath: fileURLToPath(import.meta.url),
+		socketPath
+	});
+	return await sendRunnethCliRequest({
+		request: payload,
+		socketPath,
+		timeoutMs
+	});
+};
+const run = async (argv) => {
+	const command = argv[0];
+	if (command === void 0 || command === "--help" || command === "-h") {
+		printHelp();
+		return;
+	}
+	if (command === "daemon") {
+		await runDaemon(argv.slice(1));
+		return;
+	}
+	if (command === "open") {
+		const parsed = parseArgs(argv.slice(1));
+		writeJson(await request({
+			cwd: parsed.cwd ?? process$1.cwd(),
+			name: parsed.name,
+			op: "open",
+			...parsed.shell === void 0 ? {} : { shell: parsed.shell }
+		}));
+		return;
+	}
+	if (command === "send") {
+		const parsed = parseArgs(argv.slice(1));
+		const shellCommand = parsed.stdin ? await readStdin() : parsed.values.join(" ");
+		if (shellCommand.trim().length === 0) throw new Error("runneth-cli send requires a command or --stdin");
+		const response = await request({
+			command: shellCommand,
+			cwd: parsed.cwd ?? process$1.cwd(),
+			name: parsed.name,
+			op: "send",
+			...parsed.shell === void 0 ? {} : { shell: parsed.shell }
+		}, parsed.timeoutMs);
+		writeJson(response);
+		if (response.ok && response.op === "send" && response.exitCode !== 0) process$1.exitCode = response.exitCode;
+		return;
+	}
+	if (command === "status") {
+		writeJson(await request({
+			name: parseArgs(argv.slice(1)).name,
+			op: "status"
+		}));
+		return;
+	}
+	if (command === "list") {
+		writeJson(await request({ op: "list" }));
+		return;
+	}
+	if (command === "chat") {
+		if (argv[1] === "--help" || argv[1] === "-h") {
+			process$1.stdout.write([
+				"Usage: runneth-cli chat --workspace <workspace-id> [options]",
+				"",
+				"Starts an interactive terminal chat against the canonical Runneth conversation API.",
+				"",
+				"Options:",
+				"  --api <url>              Builder API origin override; official builds include the environment default",
+				"  --resource <url>         OAuth protected resource URL; defaults to Builder /mcp in published builds",
+				"  --workspace <id>         Mondrian/Builder workspace id; may also use RUNNETH_WORKSPACE_ID",
+				"  --token <token>          Bearer token override; omitted uses stored OAuth or starts login",
+				"  --auth <mode>            mondrian or builder. Defaults to mondrian",
+				"  --client-name <name>     OAuth dynamic client name. Defaults to Runneth MCP",
+				"  --conversation <id>      Resume an existing conversation",
+				"  --no-open                Print the OAuth URL instead of opening a browser",
+				"  --scope <scope>          OAuth scope. Defaults to openid profile email offline_access",
+				"  --tenanth <id>           Tenant route id. Defaults to motion",
+				"  --title <title>          Title for newly-created conversations",
+				"  --poll-interval-ms <ms>  State refresh interval. Defaults to 1000",
+				"  --timeout-ms <ms>        OAuth callback timeout. Defaults to 600000",
+				"",
+				"Environment:",
+				"  RUNNETH_API_URL, RUNNETH_RESOURCE_URL, RUNNETH_WORKSPACE_ID",
+				"  RUNNETH_TOKEN, MONDRIAN_TOKEN, BUILDER_AGENT_CHAT_TOKEN",
+				"",
+				"Commands inside chat:",
+				"  /state   Redraw the current conversation state",
+				"  /exit    Quit",
+				""
+			].join("\n"));
+			return;
+		}
+		await runRunnethConversation(await resolveRunnethConversationOptions(parseRunnethConversationArgs(argv.slice(1), parseNumber)));
+		return;
+	}
+	if (command === "conversation") {
+		await runRunnethConversationMachineCommand({
+			argv: argv.slice(1),
+			parseNumber
+		});
+		return;
+	}
+	if (command === "oauth") {
+		const subcommand = argv[1];
+		if (subcommand === void 0 || subcommand === "--help" || subcommand === "-h") {
+			process$1.stdout.write([
+				"Usage: runneth-cli oauth <login|status|logout> [--resource <url>] [options]",
+				"",
+				"Options:",
+				"  --client-name <name>   Dynamic OAuth client name",
+				"  --no-open              Print the authorization URL without opening a browser",
+				"  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp",
+				"  --scope <scope>        OAuth scopes",
+				"  --timeout-ms <ms>      Authorization callback timeout",
+				""
+			].join("\n"));
+			return;
+		}
+		const parsed = parseOAuthArgs(argv.slice(2));
+		const resourceUrl = resolveOAuthResourceUrl(parsed);
+		if (subcommand === "login") {
+			const result = await loginWithOAuth({
+				authorizationUrlHandler: (authorizationUrl) => {
+					process$1.stderr.write(`Authorize runneth-cli here:\n${authorizationUrl}\n`);
+				},
+				clientName: parsed.clientName,
+				openBrowser: parsed.openBrowser,
+				resourceUrl,
+				scope: parsed.scope,
+				timeoutMs: parsed.timeoutMs
+			});
+			writeJson({
+				accessToken: result.accessToken,
+				credentialPath: result.credentialPath,
+				expiresAt: result.expiresAt,
+				ok: true,
+				op: "oauth-login",
+				resource: result.credential.resource,
+				scope: result.credential.token.scope ?? result.credential.scope,
+				tokenType: result.tokenType
+			});
+			return;
+		}
+		if (subcommand === "status") {
+			writeJson({
+				ok: true,
+				op: "oauth-status",
+				...await readOAuthCredentialStatus({ resourceUrl })
+			});
+			return;
+		}
+		if (subcommand === "logout") {
+			writeJson({
+				ok: true,
+				op: "oauth-logout",
+				...await logoutOAuthCredential({ resourceUrl })
+			});
+			return;
+		}
+		throw new Error(`Unknown oauth command: ${subcommand}`);
+	}
+	if (command === "copy") {
+		if (argv[1] === "--help" || argv[1] === "-h") {
+			process$1.stdout.write([
+				"Usage: runneth-cli copy --from <source-target> --to <destination-target> <source-path> <destination-path> [options]",
+				"",
+				"Copies one absolute VM path to another VM through Builder file-share upload.",
+				"",
+				"Options:",
+				"  --from <target>        Source SSH target name",
+				"  --to <target>          Destination SSH target name",
+				"  --ignore <path>        Additional relative folder/path to skip; node_modules is skipped by default",
+				"  --client-name <name>   Dynamic OAuth client name",
+				"  --no-open              Print the authorization URL without opening a browser",
+				"  --scope <scope>        OAuth scopes",
+				"  --timeout-ms <ms>      Copy command timeout",
+				"",
+				"Examples:",
+				"  runneth-cli copy --from source-vm --to destination-vm /agent/output.tgz /agent/imports/output.tgz",
+				""
+			].join("\n"));
+			return;
+		}
+		const parsed = parseCopyArgs(argv.slice(1));
+		const sourcePath = parsed.values[0];
+		const destinationPath = parsed.values[1];
+		if (sourcePath === void 0 || destinationPath === void 0 || parsed.values.length !== 2) throw new Error("runneth-cli copy requires exactly <source-path> and <destination-path>");
+		const sourceTarget = await resolveRunnethSshTarget({ targetName: parsed.sourceTargetName });
+		const destinationTarget = await resolveRunnethSshTarget({ targetName: parsed.destinationTargetName });
+		assertRunnethVmCopyTargetsUseSameResource({
+			destination: destinationTarget,
+			source: sourceTarget
+		});
+		const oauthToken = await resolveSshOAuthToken(parsed, sourceTarget.resourceUrl);
+		writeJson({
+			ok: true,
+			op: "copy",
+			...await runRunnethVmCopy({
+				destination: destinationTarget,
+				destinationPath,
+				ignoredPaths: parsed.ignoredPaths,
+				oauthToken,
+				source: sourceTarget,
+				sourcePath,
+				timeoutMs: parsed.timeoutMs
+			})
+		});
+		return;
+	}
+	if (command === "skills") {
+		const subcommand = argv[1];
+		if (subcommand === void 0 || subcommand === "--help" || subcommand === "-h") {
+			process$1.stdout.write([
+				"Usage: runneth-cli skills <install> [--agent claude|codex|all]",
+				"",
+				"Commands:",
+				"  install   Install or update the bundled Runneth skill",
+				"",
+				"Options:",
+				"  --agent <agent>   claude, codex, or all. Defaults to all",
+				"",
+				"Examples:",
+				"  runneth-cli skills install",
+				"  runneth-cli skills install --agent claude",
+				"  runneth-cli skills install --agent codex",
+				""
+			].join("\n"));
+			return;
+		}
+		if (subcommand === "install") {
+			writeJson({
+				ok: true,
+				op: "skills-install",
+				...await installRunnethSkills({ agents: parseSkillsArgs(argv.slice(2)).agents })
+			});
+			return;
+		}
+		throw new Error(`Unknown skills command: ${subcommand}`);
+	}
+	if (command === "ssh") {
+		const subcommand = argv[1];
+		if (subcommand === "--help" || subcommand === "-h") {
+			process$1.stdout.write([
+				"Usage: runneth-cli ssh [stdio|target] [--target <name>] [--resource <url>] [--ssh-url <url>] [-- remote-command]",
+				"",
+				"Commands:",
+				"  ssh       Log in if needed, install the public key, then run OpenSSH",
+				"  stdio     Keep one SSH master open and accept JSONL exec/process requests on stdin",
+				"  target    Manage named Runneth SSH VM targets",
+				"",
+				"Options:",
+				"  --client-name <name>   Dynamic OAuth client name",
+				"  --no-open              Print the authorization URL without opening a browser",
+				"  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp when using --host or --ssh-url",
+				"  --scope <scope>        OAuth scopes",
+				"  --ssh-url <url>        SSH app URL, defaults to <resource-origin>/runneth/ssh",
+				"  --target <name>        Stored SSH target name",
+				"  --timeout-ms <ms>      Authorization callback timeout",
+				"  --host <host>          Build SSH URL as https://<host>/runneth/ssh",
+				"  --identity-file <path> Use an existing private key and matching .pub file",
+				"  --unique-key           Generate/use a per-target key instead of the shared key",
+				"",
+				"Target commands:",
+				"  runneth-cli ssh target add <name> [--resource <url>] (--ssh-url <url> | --host <host>) [--default]",
+				"  runneth-cli ssh target import <file> [--resource <url>] [--default]",
+				"  runneth-cli ssh target list",
+				"  runneth-cli ssh target use <name>",
+				"  runneth-cli ssh target remove <name>",
+				"",
+				"Examples:",
+				"  runneth-cli ssh target add primary-vm --host 93c7ca56-debe-4b95-8be2-a873afe72234.app.runneth.com --default",
+				"  runneth-cli ssh -- 'pwd'",
+				"  runneth-cli ssh --target primary-vm -- 'pwd'",
+				"  runneth-cli ssh stdio --target primary-vm",
+				""
+			].join("\n"));
+			return;
+		}
+		if (subcommand === "target") {
+			const targetCommand = argv[2];
+			if (targetCommand === void 0 || targetCommand === "--help" || targetCommand === "-h") {
+				process$1.stdout.write([
+					"Usage: runneth-cli ssh target <add|import|list|use|remove> [options]",
+					"",
+					"Commands:",
+					"  add <name>     Add or update a named SSH target",
+					"  import <file>  Add or update SSH targets from a JSON file",
+					"  list           List SSH targets",
+					"  use <name>     Set the default SSH target",
+					"  remove <name>  Remove an SSH target",
+					"",
+					"Add options:",
+					"  --default              Set this target as default",
+					"  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp",
+					"  --ssh-url <url>        SSH app URL",
+					"  --host <host>          Build SSH URL as https://<host>/runneth/ssh",
+					"",
+					"Import file:",
+					"  { \"defaultTarget\": \"vm-one\", \"targets\": [{ \"name\": \"vm-one\", \"host\": \"vm-one.example.com\" }] }",
+					""
+				].join("\n"));
+				return;
+			}
+			if (targetCommand === "add") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshKeyOptions(parsed, "runneth-cli ssh target add");
+				const name = parsed.values[0];
+				if (name === void 0 || parsed.values.length !== 1) throw new Error("runneth-cli ssh target add requires one target name");
+				if (parsed.sshHost === void 0 && parsed.sshUrl === void 0) throw new Error("runneth-cli ssh target add requires --host <host> or --ssh-url <url>");
+				if (parsed.targetName !== void 0) throw new Error("--target is not valid for ssh target add");
+				const saved = await saveRunnethSshTarget({
+					makeDefault: parsed.makeDefault,
+					name,
+					resourceUrl: requireResourceUrl(parsed.resourceUrl ?? resolveDefaultResourceUrl(), "runneth-cli ssh target add"),
+					sshUrl: resolveSshUrlOption(parsed)
+				});
+				writeJson({
+					defaultTarget: saved.store.defaultTarget,
+					ok: true,
+					op: "ssh-target-add",
+					target: saved.target
+				});
+				return;
+			}
+			if (targetCommand === "import") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshKeyOptions(parsed, "runneth-cli ssh target import");
+				const filePath = parsed.values[0];
+				if (filePath === void 0 || parsed.values.length !== 1) throw new Error("runneth-cli ssh target import requires one JSON file path");
+				if (parsed.targetName !== void 0) throw new Error("--target is not valid for ssh target import");
+				if (parsed.sshHost !== void 0 || parsed.sshUrl !== void 0) throw new Error("runneth-cli ssh target import reads host and sshUrl from the file");
+				const importFile = await readSshTargetImportFile(filePath);
+				if (parsed.makeDefault && importFile.defaultTarget !== void 0) throw new Error("Use either import file defaultTarget or --default, not both");
+				const entries = resolveSshTargetImportEntries({
+					...parsed.resourceUrl === void 0 ? {} : { commandResourceUrl: parsed.resourceUrl },
+					file: importFile,
+					makeFirstDefault: parsed.makeDefault
+				});
+				const targets = [];
+				let defaultTarget;
+				for (const entry of entries) {
+					const saved = await saveRunnethSshTarget({
+						makeDefault: entry.makeDefault,
+						name: entry.name,
+						resourceUrl: entry.resourceUrl,
+						sshUrl: entry.sshUrl
+					});
+					targets.push(saved.target);
+					defaultTarget = saved.store.defaultTarget;
+				}
+				writeJson({
+					defaultTarget,
+					ok: true,
+					op: "ssh-target-import",
+					targets
+				});
+				return;
+			}
+			if (targetCommand === "list") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshKeyOptions(parsed, "runneth-cli ssh target list");
+				if (parsed.values.length > 0) throw new Error("runneth-cli ssh target list does not accept names");
+				const store = await readRunnethSshTargetStore({});
+				writeJson({
+					defaultTarget: store.defaultTarget,
+					ok: true,
+					op: "ssh-target-list",
+					targets: store.targets
+				});
+				return;
+			}
+			if (targetCommand === "use") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshKeyOptions(parsed, "runneth-cli ssh target use");
+				const name = parsed.values[0];
+				if (name === void 0 || parsed.values.length !== 1) throw new Error("runneth-cli ssh target use requires one target name");
+				const store = await setDefaultRunnethSshTarget({ name });
+				const target = store.targets.find((item) => item.name === name);
+				writeJson({
+					defaultTarget: store.defaultTarget,
+					ok: true,
+					op: "ssh-target-use",
+					target
+				});
+				return;
+			}
+			if (targetCommand === "remove") {
+				const parsed = parseSshArgs(argv.slice(3));
+				assertNoSshKeyOptions(parsed, "runneth-cli ssh target remove");
+				const name = parsed.values[0];
+				if (name === void 0 || parsed.values.length !== 1) throw new Error("runneth-cli ssh target remove requires one target name");
+				const store = await removeRunnethSshTarget({ name });
+				writeJson({
+					defaultTarget: store.defaultTarget,
+					ok: true,
+					op: "ssh-target-remove",
+					targetName: name,
+					targets: store.targets
+				});
+				return;
+			}
+			throw new Error(`Unknown ssh target command: ${targetCommand}`);
+		}
+		if (subcommand === "proxy") {
+			const parsed = parseSshArgs(argv.slice(2));
+			if (parsed.values.length > 0) throw new Error("runneth-cli ssh proxy does not accept extra arguments");
+			assertNoSshTargetDefaultFlag(parsed);
+			assertNoSshKeyOptions(parsed, "runneth-cli ssh proxy");
+			const target = await resolveSshTargetForCommand(parsed);
+			await runRunnethSshProxy({
+				resourceUrl: target.resourceUrl,
+				sshUrl: target.sshUrl
+			});
+			return;
+		}
+		if (subcommand === "stdio") {
+			const parsed = parseSshArgs(argv.slice(2));
+			if (parsed.values.length > 0) throw new Error("runneth-cli ssh stdio does not accept extra arguments");
+			assertNoSshTargetDefaultFlag(parsed);
+			const target = await resolveSshTargetForCommand(parsed);
+			const oauthToken = await resolveSshOAuthToken(parsed, target.resourceUrl);
+			const setup = await installRunnethSshAccess({
+				cliPath: fileURLToPath(import.meta.url),
+				oauthToken,
+				resourceUrl: target.resourceUrl,
+				sshUrl: target.sshUrl,
+				...resolveSshKeyInstallOptions(parsed),
+				...target.targetName === void 0 ? {} : { targetName: target.targetName }
+			});
+			process$1.stderr.write(`SSH target ${setup.hostAlias} configured with ${setup.configPath}\n`);
+			await runRunnethSshStdio({
+				defaultTimeoutMs: parsed.timeoutMs,
+				setup
+			});
+			return;
+		}
+		const parsed = parseSshArgs(argv.slice(1));
+		assertNoSshTargetDefaultFlag(parsed);
+		assertSshRemoteCommandSeparator(parsed);
+		const target = await resolveSshTargetForCommand(parsed);
+		const oauthToken = await resolveSshOAuthToken(parsed, target.resourceUrl);
+		const setup = await installRunnethSshAccess({
+			cliPath: fileURLToPath(import.meta.url),
+			oauthToken,
+			resourceUrl: target.resourceUrl,
+			sshUrl: target.sshUrl,
+			...resolveSshKeyInstallOptions(parsed),
+			...target.targetName === void 0 ? {} : { targetName: target.targetName }
+		});
+		process$1.stderr.write(`SSH target ${setup.hostAlias} configured with ${setup.configPath}\n`);
+		process$1.exitCode = await runOpenSsh({
+			extraArgs: parsed.values,
+			setup
+		});
+		return;
+	}
+	if (command === "close") {
+		writeJson(await request({
+			name: parseArgs(argv.slice(1)).name,
+			op: "close"
+		}));
+		return;
+	}
+	if (command === "shutdown") {
+		writeJson(await request({ op: "shutdown" }));
+		return;
+	}
+	throw new Error(`Unknown command: ${command}`);
+};
+const isSshProxyInvocation = (argv) => {
+	return argv[0] === "ssh" && argv[1] === "proxy";
+};
+const isSshStdioInvocation = (argv) => {
+	return argv[0] === "ssh" && argv[1] === "stdio";
+};
+const isConversationSessionInvocation = (argv) => {
+	return argv[0] === "conversation" && argv[1] === "session";
+};
+const argv = process$1.argv.slice(2);
+run(argv).catch((error) => {
+	const message = error instanceof Error ? error.message : String(error);
+	if (isSshProxyInvocation(argv)) {
+		process$1.stderr.write(`${message}\n`);
+		process$1.exitCode = 1;
+		return;
+	}
+	if (isSshStdioInvocation(argv)) {
+		process$1.stdout.write(`${JSON.stringify({
+			message,
+			ok: false,
+			type: "error"
+		})}\n`);
+		process$1.exitCode = 1;
+		return;
+	}
+	if (isConversationSessionInvocation(argv)) {
+		process$1.stdout.write(`${JSON.stringify({
+			message,
+			ok: false,
+			type: "error"
+		})}\n`);
+		process$1.exitCode = 1;
+		return;
+	}
+	process$1.stdout.write(`${JSON.stringify({
+		error: message,
+		ok: false
+	}, null, 2)}\n`);
+	process$1.exitCode = 1;
+});
+//#endregion
+export {};