@runneth/cli 0.0.0-sha.19a36f654ef6.production

package/dist/cli.js

@@ -0,0 +1,1112 @@
+#!/usr/bin/env node
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { resolveBuildDefaultMcpResourceUrl } from "./build-defaults.js";
+import { assertRunnethVmCopyTargetsUseSameResource, ensureDaemon, getOAuthAccessToken, installRunnethSshAccess, installRunnethSkills, loginWithOAuth, logoutOAuthCredential, normalizeRunnethSshTargetName, normalizeSessionName, readOAuthCredentialStatus, readRunnethSshTargetStore, removeRunnethSshTarget, resolveRunnethSshTarget, resolveSocketPath, RunnethCliDaemon, runOpenSsh, runRunnethSshProxy, runRunnethVmCopy, saveRunnethSshTarget, sendRunnethCliRequest, setDefaultRunnethSshTarget, } from "./index.js";
+import { runRunnethSshStdio } from "./ssh-stdio.js";
+const DEFAULT_TIMEOUT_MS = 600_000;
+const DEFAULT_OAUTH_CLIENT_NAME = "Runneth MCP";
+const DEFAULT_OAUTH_SCOPE = "openid profile email offline_access";
+const MAX_STDIN_BYTES = 1_048_576;
+const isRecord = (value) => {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const parseStringField = (record, key) => {
+    const value = record[key];
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new Error(`${key} must be a non-empty string`);
+    }
+    return value;
+};
+const parseOptionalStringField = (record, key) => {
+    const value = record[key];
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new Error(`${key} must be a non-empty string`);
+    }
+    return value;
+};
+const resolveDefaultResourceUrl = () => {
+    return resolveBuildDefaultMcpResourceUrl();
+};
+const requireResourceUrl = (resourceUrl, commandDescription) => {
+    if (resourceUrl === undefined) {
+        throw new Error(`${commandDescription} requires --resource <url> because this CLI build does not include MONDRIAN_API_URL`);
+    }
+    return resourceUrl;
+};
+const readStdin = async () => {
+    const chunks = [];
+    let totalBytes = 0;
+    for await (const chunk of process.stdin) {
+        const buffer = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+        totalBytes += buffer.length;
+        if (totalBytes > MAX_STDIN_BYTES) {
+            throw new Error(`stdin input exceeds ${String(MAX_STDIN_BYTES)} bytes`);
+        }
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks, totalBytes).toString("utf8");
+};
+const printHelp = () => {
+    process.stdout.write([
+        "Usage: runneth-cli <command> [options]",
+        "",
+        "Commands:",
+        "  open      Open or reuse a persistent shell session",
+        "  send      Send a shell command to a persistent session",
+        "  status    Show one session",
+        "  list      List sessions",
+        "  close     Close one session",
+        "  oauth     Authorize against an OAuth-protected MCP resource",
+        "  ssh       Connect to Runneth runtime SSH through OAuth",
+        "  copy      Copy one VM path to another VM through Builder file-share upload",
+        "  skills    Install or update bundled Claude/Codex skills",
+        "  shutdown  Stop the local runneth-cli daemon",
+        "",
+        "Examples:",
+        "  runneth-cli open",
+        "  runneth-cli send 'cd ~/project && pnpm test'",
+        "  runneth-cli send -- git status --short",
+        "  printf 'cd ~/project\\npwd\\n' | runneth-cli send --stdin",
+        "  runneth-cli oauth login",
+        "  runneth-cli ssh target add primary-vm --host 93c7ca56-debe-4b95-8be2-a873afe72234.app.runneth.com --default",
+        "  runneth-cli ssh -- 'pwd'",
+        "  runneth-cli copy --from source-vm --to destination-vm /agent/project /agent/imports/project",
+        "  runneth-cli skills install --agent all",
+        "",
+    ].join("\n"));
+};
+const parseNumber = (rawValue, label) => {
+    const value = Number(rawValue);
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new Error(`${label} must be a positive integer`);
+    }
+    return value;
+};
+const parseArgs = (argv) => {
+    const values = [];
+    let cwd;
+    let name = "default";
+    let shell;
+    let stdin = false;
+    let timeoutMs = DEFAULT_TIMEOUT_MS;
+    let parseOptions = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (parseOptions && token === "--") {
+            parseOptions = false;
+            continue;
+        }
+        if (!parseOptions || !token.startsWith("--")) {
+            values.push(token);
+            continue;
+        }
+        const readValue = (label) => {
+            const value = argv[index + 1];
+            if (value === undefined) {
+                throw new Error(`Missing value for ${label}`);
+            }
+            index += 1;
+            return value;
+        };
+        switch (token) {
+            case "--cwd": {
+                cwd = readValue(token);
+                break;
+            }
+            case "--name": {
+                name = normalizeSessionName(readValue(token));
+                break;
+            }
+            case "--shell": {
+                shell = readValue(token);
+                break;
+            }
+            case "--stdin": {
+                stdin = true;
+                break;
+            }
+            case "--timeout-ms": {
+                timeoutMs = parseNumber(readValue(token), token);
+                break;
+            }
+            default: {
+                throw new Error(`Unknown option: ${token}`);
+            }
+        }
+    }
+    return {
+        cwd,
+        name,
+        shell,
+        stdin,
+        timeoutMs,
+        values,
+    };
+};
+const parseSkillAgent = (value) => {
+    if (value === "all") {
+        return ["claude", "codex"];
+    }
+    if (value === "claude" || value === "codex") {
+        return [value];
+    }
+    throw new Error(`Invalid skill agent: ${value}. Use claude, codex, or all.`);
+};
+const parseSkillsArgs = (argv) => {
+    let agents = ["claude", "codex"];
+    const values = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (token === "--agent") {
+            const value = argv[index + 1];
+            if (value === undefined) {
+                throw new Error("Missing value for --agent");
+            }
+            agents = parseSkillAgent(value);
+            index += 1;
+            continue;
+        }
+        values.push(token);
+    }
+    if (values.length > 0) {
+        throw new Error("runneth-cli skills install only accepts --agent");
+    }
+    return {
+        agents,
+    };
+};
+const parseOAuthArgs = (argv) => {
+    const values = [];
+    let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+    let openBrowser = true;
+    let resourceUrl;
+    let scope = DEFAULT_OAUTH_SCOPE;
+    let timeoutMs = DEFAULT_TIMEOUT_MS;
+    let parseOptions = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (parseOptions && token === "--") {
+            parseOptions = false;
+            continue;
+        }
+        if (!parseOptions || !token.startsWith("--")) {
+            values.push(token);
+            continue;
+        }
+        const readValue = (label) => {
+            const value = argv[index + 1];
+            if (value === undefined) {
+                throw new Error(`Missing value for ${label}`);
+            }
+            index += 1;
+            return value;
+        };
+        switch (token) {
+            case "--client-name": {
+                clientName = readValue(token);
+                break;
+            }
+            case "--no-open": {
+                openBrowser = false;
+                break;
+            }
+            case "--resource": {
+                resourceUrl = readValue(token);
+                break;
+            }
+            case "--scope": {
+                scope = readValue(token);
+                break;
+            }
+            case "--timeout-ms": {
+                timeoutMs = parseNumber(readValue(token), token);
+                break;
+            }
+            default: {
+                throw new Error(`Unknown option: ${token}`);
+            }
+        }
+    }
+    return {
+        clientName,
+        openBrowser,
+        resourceUrl,
+        scope,
+        timeoutMs,
+        values,
+    };
+};
+const parseSshArgs = (argv) => {
+    const values = [];
+    let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+    let identityFilePath;
+    let makeDefault = false;
+    let openBrowser = true;
+    let resourceUrl;
+    let scope = DEFAULT_OAUTH_SCOPE;
+    let sshHost;
+    let sshUrl;
+    let targetName;
+    let timeoutMs = DEFAULT_TIMEOUT_MS;
+    let uniqueKey = false;
+    let argumentSeparatorSeen = false;
+    let parseOptions = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (parseOptions && token === "--") {
+            argumentSeparatorSeen = true;
+            parseOptions = false;
+            continue;
+        }
+        if (!parseOptions || !token.startsWith("--")) {
+            values.push(token);
+            continue;
+        }
+        const readValue = (label) => {
+            const value = argv[index + 1];
+            if (value === undefined) {
+                throw new Error(`Missing value for ${label}`);
+            }
+            index += 1;
+            return value;
+        };
+        switch (token) {
+            case "--client-name": {
+                clientName = readValue(token);
+                break;
+            }
+            case "--default": {
+                makeDefault = true;
+                break;
+            }
+            case "--host": {
+                sshHost = readValue(token);
+                break;
+            }
+            case "--identity-file": {
+                identityFilePath = readValue(token);
+                break;
+            }
+            case "--no-open": {
+                openBrowser = false;
+                break;
+            }
+            case "--resource": {
+                resourceUrl = readValue(token);
+                break;
+            }
+            case "--scope": {
+                scope = readValue(token);
+                break;
+            }
+            case "--ssh-url": {
+                sshUrl = readValue(token);
+                break;
+            }
+            case "--target": {
+                targetName = readValue(token);
+                break;
+            }
+            case "--timeout-ms": {
+                timeoutMs = parseNumber(readValue(token), token);
+                break;
+            }
+            case "--unique-key": {
+                uniqueKey = true;
+                break;
+            }
+            default: {
+                throw new Error(`Unknown option: ${token}`);
+            }
+        }
+    }
+    return {
+        argumentSeparatorSeen,
+        clientName,
+        ...(identityFilePath === undefined ? {} : { identityFilePath }),
+        makeDefault,
+        openBrowser,
+        resourceUrl,
+        scope,
+        ...(sshHost === undefined ? {} : { sshHost }),
+        sshUrl,
+        ...(targetName === undefined ? {} : { targetName }),
+        timeoutMs,
+        uniqueKey,
+        values,
+    };
+};
+const parseCopyArgs = (argv) => {
+    const values = [];
+    let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+    let destinationTargetName;
+    const ignoredPaths = [];
+    let openBrowser = true;
+    let scope = DEFAULT_OAUTH_SCOPE;
+    let sourceTargetName;
+    let timeoutMs = DEFAULT_TIMEOUT_MS;
+    let parseOptions = true;
+    for (let index = 0; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (parseOptions && token === "--") {
+            parseOptions = false;
+            continue;
+        }
+        if (!parseOptions || !token.startsWith("--")) {
+            values.push(token);
+            continue;
+        }
+        const readValue = (label) => {
+            const value = argv[index + 1];
+            if (value === undefined) {
+                throw new Error(`Missing value for ${label}`);
+            }
+            index += 1;
+            return value;
+        };
+        switch (token) {
+            case "--client-name": {
+                clientName = readValue(token);
+                break;
+            }
+            case "--from": {
+                sourceTargetName = normalizeRunnethSshTargetName(readValue(token));
+                break;
+            }
+            case "--ignore": {
+                ignoredPaths.push(readValue(token));
+                break;
+            }
+            case "--no-open": {
+                openBrowser = false;
+                break;
+            }
+            case "--scope": {
+                scope = readValue(token);
+                break;
+            }
+            case "--timeout-ms": {
+                timeoutMs = parseNumber(readValue(token), token);
+                break;
+            }
+            case "--to": {
+                destinationTargetName = normalizeRunnethSshTargetName(readValue(token));
+                break;
+            }
+            default: {
+                throw new Error(`Unknown option: ${token}`);
+            }
+        }
+    }
+    if (sourceTargetName === undefined) {
+        throw new Error("runneth-cli copy requires --from <target>");
+    }
+    if (destinationTargetName === undefined) {
+        throw new Error("runneth-cli copy requires --to <target>");
+    }
+    return {
+        clientName,
+        destinationTargetName,
+        ignoredPaths,
+        openBrowser,
+        scope,
+        sourceTargetName,
+        timeoutMs,
+        values,
+    };
+};
+const resolveOAuthResourceUrl = (parsed) => {
+    return requireResourceUrl(parsed.resourceUrl ?? parsed.values[0] ?? resolveDefaultResourceUrl(), "runneth-cli oauth");
+};
+const normalizeSshHost = (value) => {
+    const sshHost = value.trim();
+    if (sshHost.length === 0 ||
+        sshHost.includes("/") ||
+        sshHost.includes("?") ||
+        sshHost.includes("#") ||
+        sshHost.includes("@") ||
+        /^[A-Za-z][A-Za-z0-9+.-]*:\/\//u.test(sshHost) ||
+        /\s/u.test(sshHost)) {
+        throw new Error("SSH host must be a full hostname without scheme or path");
+    }
+    const url = new URL(`https://${sshHost}/runneth/ssh`);
+    if (url.hostname.length === 0) {
+        throw new Error("SSH host must be a full hostname without scheme or path");
+    }
+    return url.host;
+};
+const resolveSshUrlFromHost = (host) => {
+    return `https://${normalizeSshHost(host)}/runneth/ssh`;
+};
+const resolveSshUrlOption = (parsed) => {
+    if (parsed.sshUrl !== undefined && parsed.sshHost !== undefined) {
+        throw new Error("Use either --ssh-url or --host, not both");
+    }
+    if (parsed.sshHost === undefined) {
+        return parsed.sshUrl;
+    }
+    return resolveSshUrlFromHost(parsed.sshHost);
+};
+const resolveSshResourceUrlOption = (parsed) => {
+    if (parsed.resourceUrl !== undefined) {
+        return parsed.resourceUrl;
+    }
+    if (parsed.sshHost !== undefined || parsed.sshUrl !== undefined) {
+        return resolveDefaultResourceUrl();
+    }
+    return undefined;
+};
+const resolveSshTargetForCommand = async (parsed) => {
+    const sshUrl = resolveSshUrlOption(parsed);
+    const resourceUrl = resolveSshResourceUrlOption(parsed);
+    if (sshUrl !== undefined && resourceUrl === undefined) {
+        requireResourceUrl(resourceUrl, "runneth-cli ssh");
+    }
+    return await resolveRunnethSshTarget({
+        resourceUrl,
+        sshUrl,
+        targetName: parsed.targetName,
+    });
+};
+const assertNoSshTargetDefaultFlag = (parsed) => {
+    if (parsed.makeDefault) {
+        throw new Error("--default is only valid for runneth-cli ssh target add");
+    }
+};
+const assertSshRemoteCommandSeparator = (parsed) => {
+    if (parsed.values.length > 0 && !parsed.argumentSeparatorSeen) {
+        throw new Error("Remote SSH commands must follow --");
+    }
+};
+const assertNoSshKeyOptions = (parsed, commandDescription) => {
+    if (parsed.identityFilePath !== undefined || parsed.uniqueKey) {
+        throw new Error(`${commandDescription} does not accept SSH key options`);
+    }
+};
+const resolveSshKeyInstallOptions = (parsed) => {
+    if (parsed.identityFilePath !== undefined && parsed.uniqueKey) {
+        throw new Error("Use either --identity-file or --unique-key, not both");
+    }
+    if (parsed.identityFilePath !== undefined) {
+        return { identityFilePath: parsed.identityFilePath };
+    }
+    if (parsed.uniqueKey) {
+        return { keyMode: "unique" };
+    }
+    return {};
+};
+const parseSshTargetImportEntry = (payload, index) => {
+    if (!isRecord(payload)) {
+        throw new Error(`targets[${String(index)}] must be a JSON object`);
+    }
+    const name = normalizeRunnethSshTargetName(parseStringField(payload, "name"));
+    const host = parseOptionalStringField(payload, "host");
+    const resourceUrl = parseOptionalStringField(payload, "resourceUrl");
+    const sshUrl = parseOptionalStringField(payload, "sshUrl");
+    if ((host === undefined) === (sshUrl === undefined)) {
+        throw new Error(`targets[${String(index)}] requires exactly one of host or sshUrl`);
+    }
+    return {
+        ...(host === undefined ? {} : { host }),
+        name,
+        ...(resourceUrl === undefined ? {} : { resourceUrl }),
+        ...(sshUrl === undefined ? {} : { sshUrl }),
+    };
+};
+const parseSshTargetImportFile = (payload) => {
+    if (!isRecord(payload)) {
+        throw new Error("SSH target import file must be a JSON object");
+    }
+    const rawTargets = payload.targets;
+    if (!Array.isArray(rawTargets) || rawTargets.length === 0) {
+        throw new Error("SSH target import file requires a non-empty targets array");
+    }
+    const defaultTargetValue = parseOptionalStringField(payload, "defaultTarget");
+    const resourceUrl = parseOptionalStringField(payload, "resourceUrl");
+    return {
+        ...(defaultTargetValue === undefined
+            ? {}
+            : { defaultTarget: normalizeRunnethSshTargetName(defaultTargetValue) }),
+        ...(resourceUrl === undefined ? {} : { resourceUrl }),
+        targets: rawTargets.map((entry, index) => parseSshTargetImportEntry(entry, index)),
+    };
+};
+const readSshTargetImportFile = async (filePath) => {
+    const resolvedPath = path.resolve(filePath);
+    return parseSshTargetImportFile(JSON.parse(await readFile(resolvedPath, "utf8")));
+};
+const resolveImportEntryResourceUrl = (input) => {
+    return requireResourceUrl(input.entry.resourceUrl ??
+        input.fileResourceUrl ??
+        input.commandResourceUrl ??
+        resolveDefaultResourceUrl(), "runneth-cli ssh target import");
+};
+const resolveImportEntrySshUrl = (entry) => {
+    if (entry.sshUrl !== undefined) {
+        return entry.sshUrl;
+    }
+    if (entry.host === undefined) {
+        throw new Error(`Imported SSH target is missing host: ${entry.name}`);
+    }
+    return resolveSshUrlFromHost(entry.host);
+};
+const resolveSshTargetImportEntries = (input) => {
+    const names = new Set();
+    for (const target of input.file.targets) {
+        if (names.has(target.name)) {
+            throw new Error(`Duplicate SSH target in import file: ${target.name}`);
+        }
+        names.add(target.name);
+    }
+    if (input.file.defaultTarget !== undefined &&
+        !names.has(input.file.defaultTarget)) {
+        throw new Error(`Import defaultTarget does not match an imported target: ${input.file.defaultTarget}`);
+    }
+    return input.file.targets.map((entry, index) => {
+        return {
+            makeDefault: entry.name === input.file.defaultTarget ||
+                (input.file.defaultTarget === undefined &&
+                    input.makeFirstDefault &&
+                    index === 0),
+            name: entry.name,
+            resourceUrl: resolveImportEntryResourceUrl({
+                entry,
+                ...(input.commandResourceUrl === undefined
+                    ? {}
+                    : { commandResourceUrl: input.commandResourceUrl }),
+                ...(input.file.resourceUrl === undefined
+                    ? {}
+                    : { fileResourceUrl: input.file.resourceUrl }),
+            }),
+            sshUrl: resolveImportEntrySshUrl(entry),
+        };
+    });
+};
+const resolveSshOAuthToken = async (parsed, resourceUrl) => {
+    const status = await readOAuthCredentialStatus({ resourceUrl });
+    if (status.authenticated) {
+        return await getOAuthAccessToken({ resourceUrl });
+    }
+    return await loginWithOAuth({
+        authorizationUrlHandler: (authorizationUrl) => {
+            process.stderr.write(`Authorize runneth-cli here:\n${authorizationUrl}\n`);
+        },
+        clientName: parsed.clientName,
+        openBrowser: parsed.openBrowser,
+        resourceUrl,
+        scope: parsed.scope,
+        timeoutMs: parsed.timeoutMs,
+    });
+};
+const writeJson = (response) => {
+    process.stdout.write(`${JSON.stringify(response, null, 2)}\n`);
+};
+const runDaemon = async (argv) => {
+    const parsed = parseArgs(argv);
+    const socketPath = parsed.values[0] ?? resolveSocketPath();
+    const daemon = new RunnethCliDaemon();
+    await daemon.start({ socketPath });
+};
+const request = async (payload, timeoutMs = DEFAULT_TIMEOUT_MS) => {
+    const socketPath = resolveSocketPath();
+    await ensureDaemon({
+        cliPath: fileURLToPath(import.meta.url),
+        socketPath,
+    });
+    return await sendRunnethCliRequest({
+        request: payload,
+        socketPath,
+        timeoutMs,
+    });
+};
+const run = async (argv) => {
+    const command = argv[0];
+    if (command === undefined || command === "--help" || command === "-h") {
+        printHelp();
+        return;
+    }
+    if (command === "daemon") {
+        await runDaemon(argv.slice(1));
+        return;
+    }
+    if (command === "open") {
+        const parsed = parseArgs(argv.slice(1));
+        writeJson(await request({
+            cwd: parsed.cwd ?? process.cwd(),
+            name: parsed.name,
+            op: "open",
+            ...(parsed.shell === undefined ? {} : { shell: parsed.shell }),
+        }));
+        return;
+    }
+    if (command === "send") {
+        const parsed = parseArgs(argv.slice(1));
+        const shellCommand = parsed.stdin
+            ? await readStdin()
+            : parsed.values.join(" ");
+        if (shellCommand.trim().length === 0) {
+            throw new Error("runneth-cli send requires a command or --stdin");
+        }
+        const response = await request({
+            command: shellCommand,
+            cwd: parsed.cwd ?? process.cwd(),
+            name: parsed.name,
+            op: "send",
+            ...(parsed.shell === undefined ? {} : { shell: parsed.shell }),
+        }, parsed.timeoutMs);
+        writeJson(response);
+        if (response.ok && response.op === "send" && response.exitCode !== 0) {
+            process.exitCode = response.exitCode;
+        }
+        return;
+    }
+    if (command === "status") {
+        const parsed = parseArgs(argv.slice(1));
+        writeJson(await request({ name: parsed.name, op: "status" }));
+        return;
+    }
+    if (command === "list") {
+        writeJson(await request({ op: "list" }));
+        return;
+    }
+    if (command === "oauth") {
+        const subcommand = argv[1];
+        if (subcommand === undefined ||
+            subcommand === "--help" ||
+            subcommand === "-h") {
+            process.stdout.write([
+                "Usage: runneth-cli oauth <login|status|logout> [--resource <url>] [options]",
+                "",
+                "Options:",
+                "  --client-name <name>   Dynamic OAuth client name",
+                "  --no-open              Print the authorization URL without opening a browser",
+                "  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp",
+                "  --scope <scope>        OAuth scopes",
+                "  --timeout-ms <ms>      Authorization callback timeout",
+                "",
+            ].join("\n"));
+            return;
+        }
+        const parsed = parseOAuthArgs(argv.slice(2));
+        const resourceUrl = resolveOAuthResourceUrl(parsed);
+        if (subcommand === "login") {
+            const result = await loginWithOAuth({
+                authorizationUrlHandler: (authorizationUrl) => {
+                    process.stderr.write(`Authorize runneth-cli here:\n${authorizationUrl}\n`);
+                },
+                clientName: parsed.clientName,
+                openBrowser: parsed.openBrowser,
+                resourceUrl,
+                scope: parsed.scope,
+                timeoutMs: parsed.timeoutMs,
+            });
+            writeJson({
+                accessToken: result.accessToken,
+                credentialPath: result.credentialPath,
+                expiresAt: result.expiresAt,
+                ok: true,
+                op: "oauth-login",
+                resource: result.credential.resource,
+                scope: result.credential.token.scope ?? result.credential.scope,
+                tokenType: result.tokenType,
+            });
+            return;
+        }
+        if (subcommand === "status") {
+            writeJson({
+                ok: true,
+                op: "oauth-status",
+                ...(await readOAuthCredentialStatus({ resourceUrl })),
+            });
+            return;
+        }
+        if (subcommand === "logout") {
+            writeJson({
+                ok: true,
+                op: "oauth-logout",
+                ...(await logoutOAuthCredential({ resourceUrl })),
+            });
+            return;
+        }
+        throw new Error(`Unknown oauth command: ${subcommand}`);
+    }
+    if (command === "copy") {
+        if (argv[1] === "--help" || argv[1] === "-h") {
+            process.stdout.write([
+                "Usage: runneth-cli copy --from <source-target> --to <destination-target> <source-path> <destination-path> [options]",
+                "",
+                "Copies one absolute VM path to another VM through Builder file-share upload.",
+                "",
+                "Options:",
+                "  --from <target>        Source SSH target name",
+                "  --to <target>          Destination SSH target name",
+                "  --ignore <path>        Additional relative folder/path to skip; node_modules is skipped by default",
+                "  --client-name <name>   Dynamic OAuth client name",
+                "  --no-open              Print the authorization URL without opening a browser",
+                "  --scope <scope>        OAuth scopes",
+                "  --timeout-ms <ms>      Copy command timeout",
+                "",
+                "Examples:",
+                "  runneth-cli copy --from source-vm --to destination-vm /agent/output.tgz /agent/imports/output.tgz",
+                "",
+            ].join("\n"));
+            return;
+        }
+        const parsed = parseCopyArgs(argv.slice(1));
+        const sourcePath = parsed.values[0];
+        const destinationPath = parsed.values[1];
+        if (sourcePath === undefined ||
+            destinationPath === undefined ||
+            parsed.values.length !== 2) {
+            throw new Error("runneth-cli copy requires exactly <source-path> and <destination-path>");
+        }
+        const sourceTarget = await resolveRunnethSshTarget({
+            targetName: parsed.sourceTargetName,
+        });
+        const destinationTarget = await resolveRunnethSshTarget({
+            targetName: parsed.destinationTargetName,
+        });
+        assertRunnethVmCopyTargetsUseSameResource({
+            destination: destinationTarget,
+            source: sourceTarget,
+        });
+        const oauthToken = await resolveSshOAuthToken(parsed, sourceTarget.resourceUrl);
+        writeJson({
+            ok: true,
+            op: "copy",
+            ...(await runRunnethVmCopy({
+                destination: destinationTarget,
+                destinationPath,
+                ignoredPaths: parsed.ignoredPaths,
+                oauthToken,
+                source: sourceTarget,
+                sourcePath,
+                timeoutMs: parsed.timeoutMs,
+            })),
+        });
+        return;
+    }
+    if (command === "skills") {
+        const subcommand = argv[1];
+        if (subcommand === undefined ||
+            subcommand === "--help" ||
+            subcommand === "-h") {
+            process.stdout.write([
+                "Usage: runneth-cli skills <install> [--agent claude|codex|all]",
+                "",
+                "Commands:",
+                "  install   Install or update the bundled Runneth skill",
+                "",
+                "Options:",
+                "  --agent <agent>   claude, codex, or all. Defaults to all",
+                "",
+                "Examples:",
+                "  runneth-cli skills install",
+                "  runneth-cli skills install --agent claude",
+                "  runneth-cli skills install --agent codex",
+                "",
+            ].join("\n"));
+            return;
+        }
+        if (subcommand === "install") {
+            const parsed = parseSkillsArgs(argv.slice(2));
+            const result = await installRunnethSkills({
+                agents: parsed.agents,
+            });
+            writeJson({
+                ok: true,
+                op: "skills-install",
+                ...result,
+            });
+            return;
+        }
+        throw new Error(`Unknown skills command: ${subcommand}`);
+    }
+    if (command === "ssh") {
+        const subcommand = argv[1];
+        if (subcommand === "--help" || subcommand === "-h") {
+            process.stdout.write([
+                "Usage: runneth-cli ssh [stdio|target] [--target <name>] [--resource <url>] [--ssh-url <url>] [-- remote-command]",
+                "",
+                "Commands:",
+                "  ssh       Log in if needed, install the public key, then run OpenSSH",
+                "  stdio     Keep one SSH master open and accept JSONL exec/process requests on stdin",
+                "  target    Manage named Runneth SSH VM targets",
+                "",
+                "Options:",
+                "  --client-name <name>   Dynamic OAuth client name",
+                "  --no-open              Print the authorization URL without opening a browser",
+                "  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp when using --host or --ssh-url",
+                "  --scope <scope>        OAuth scopes",
+                "  --ssh-url <url>        SSH app URL, defaults to <resource-origin>/runneth/ssh",
+                "  --target <name>        Stored SSH target name",
+                "  --timeout-ms <ms>      Authorization callback timeout",
+                "  --host <host>          Build SSH URL as https://<host>/runneth/ssh",
+                "  --identity-file <path> Use an existing private key and matching .pub file",
+                "  --unique-key           Generate/use a per-target key instead of the shared key",
+                "",
+                "Target commands:",
+                "  runneth-cli ssh target add <name> [--resource <url>] (--ssh-url <url> | --host <host>) [--default]",
+                "  runneth-cli ssh target import <file> [--resource <url>] [--default]",
+                "  runneth-cli ssh target list",
+                "  runneth-cli ssh target use <name>",
+                "  runneth-cli ssh target remove <name>",
+                "",
+                "Examples:",
+                "  runneth-cli ssh target add primary-vm --host 93c7ca56-debe-4b95-8be2-a873afe72234.app.runneth.com --default",
+                "  runneth-cli ssh -- 'pwd'",
+                "  runneth-cli ssh --target primary-vm -- 'pwd'",
+                "  runneth-cli ssh stdio --target primary-vm",
+                "",
+            ].join("\n"));
+            return;
+        }
+        if (subcommand === "target") {
+            const targetCommand = argv[2];
+            if (targetCommand === undefined ||
+                targetCommand === "--help" ||
+                targetCommand === "-h") {
+                process.stdout.write([
+                    "Usage: runneth-cli ssh target <add|import|list|use|remove> [options]",
+                    "",
+                    "Commands:",
+                    "  add <name>     Add or update a named SSH target",
+                    "  import <file>  Add or update SSH targets from a JSON file",
+                    "  list           List SSH targets",
+                    "  use <name>     Set the default SSH target",
+                    "  remove <name>  Remove an SSH target",
+                    "",
+                    "Add options:",
+                    "  --default              Set this target as default",
+                    "  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp",
+                    "  --ssh-url <url>        SSH app URL",
+                    "  --host <host>          Build SSH URL as https://<host>/runneth/ssh",
+                    "",
+                    "Import file:",
+                    '  { "defaultTarget": "vm-one", "targets": [{ "name": "vm-one", "host": "vm-one.example.com" }] }',
+                    "",
+                ].join("\n"));
+                return;
+            }
+            if (targetCommand === "add") {
+                const parsed = parseSshArgs(argv.slice(3));
+                assertNoSshKeyOptions(parsed, "runneth-cli ssh target add");
+                const name = parsed.values[0];
+                if (name === undefined || parsed.values.length !== 1) {
+                    throw new Error("runneth-cli ssh target add requires one target name");
+                }
+                if (parsed.sshHost === undefined && parsed.sshUrl === undefined) {
+                    throw new Error("runneth-cli ssh target add requires --host <host> or --ssh-url <url>");
+                }
+                if (parsed.targetName !== undefined) {
+                    throw new Error("--target is not valid for ssh target add");
+                }
+                const saved = await saveRunnethSshTarget({
+                    makeDefault: parsed.makeDefault,
+                    name,
+                    resourceUrl: requireResourceUrl(parsed.resourceUrl ?? resolveDefaultResourceUrl(), "runneth-cli ssh target add"),
+                    sshUrl: resolveSshUrlOption(parsed),
+                });
+                writeJson({
+                    defaultTarget: saved.store.defaultTarget,
+                    ok: true,
+                    op: "ssh-target-add",
+                    target: saved.target,
+                });
+                return;
+            }
+            if (targetCommand === "import") {
+                const parsed = parseSshArgs(argv.slice(3));
+                assertNoSshKeyOptions(parsed, "runneth-cli ssh target import");
+                const filePath = parsed.values[0];
+                if (filePath === undefined || parsed.values.length !== 1) {
+                    throw new Error("runneth-cli ssh target import requires one JSON file path");
+                }
+                if (parsed.targetName !== undefined) {
+                    throw new Error("--target is not valid for ssh target import");
+                }
+                if (parsed.sshHost !== undefined || parsed.sshUrl !== undefined) {
+                    throw new Error("runneth-cli ssh target import reads host and sshUrl from the file");
+                }
+                const importFile = await readSshTargetImportFile(filePath);
+                if (parsed.makeDefault && importFile.defaultTarget !== undefined) {
+                    throw new Error("Use either import file defaultTarget or --default, not both");
+                }
+                const entries = resolveSshTargetImportEntries({
+                    ...(parsed.resourceUrl === undefined
+                        ? {}
+                        : { commandResourceUrl: parsed.resourceUrl }),
+                    file: importFile,
+                    makeFirstDefault: parsed.makeDefault,
+                });
+                const targets = [];
+                let defaultTarget;
+                for (const entry of entries) {
+                    const saved = await saveRunnethSshTarget({
+                        makeDefault: entry.makeDefault,
+                        name: entry.name,
+                        resourceUrl: entry.resourceUrl,
+                        sshUrl: entry.sshUrl,
+                    });
+                    targets.push(saved.target);
+                    defaultTarget = saved.store.defaultTarget;
+                }
+                writeJson({
+                    defaultTarget,
+                    ok: true,
+                    op: "ssh-target-import",
+                    targets,
+                });
+                return;
+            }
+            if (targetCommand === "list") {
+                const parsed = parseSshArgs(argv.slice(3));
+                assertNoSshKeyOptions(parsed, "runneth-cli ssh target list");
+                if (parsed.values.length > 0) {
+                    throw new Error("runneth-cli ssh target list does not accept names");
+                }
+                const store = await readRunnethSshTargetStore({});
+                writeJson({
+                    defaultTarget: store.defaultTarget,
+                    ok: true,
+                    op: "ssh-target-list",
+                    targets: store.targets,
+                });
+                return;
+            }
+            if (targetCommand === "use") {
+                const parsed = parseSshArgs(argv.slice(3));
+                assertNoSshKeyOptions(parsed, "runneth-cli ssh target use");
+                const name = parsed.values[0];
+                if (name === undefined || parsed.values.length !== 1) {
+                    throw new Error("runneth-cli ssh target use requires one target name");
+                }
+                const store = await setDefaultRunnethSshTarget({ name });
+                const target = store.targets.find((item) => item.name === name);
+                writeJson({
+                    defaultTarget: store.defaultTarget,
+                    ok: true,
+                    op: "ssh-target-use",
+                    target,
+                });
+                return;
+            }
+            if (targetCommand === "remove") {
+                const parsed = parseSshArgs(argv.slice(3));
+                assertNoSshKeyOptions(parsed, "runneth-cli ssh target remove");
+                const name = parsed.values[0];
+                if (name === undefined || parsed.values.length !== 1) {
+                    throw new Error("runneth-cli ssh target remove requires one target name");
+                }
+                const store = await removeRunnethSshTarget({ name });
+                writeJson({
+                    defaultTarget: store.defaultTarget,
+                    ok: true,
+                    op: "ssh-target-remove",
+                    targetName: name,
+                    targets: store.targets,
+                });
+                return;
+            }
+            throw new Error(`Unknown ssh target command: ${targetCommand}`);
+        }
+        if (subcommand === "proxy") {
+            const parsed = parseSshArgs(argv.slice(2));
+            if (parsed.values.length > 0) {
+                throw new Error("runneth-cli ssh proxy does not accept extra arguments");
+            }
+            assertNoSshTargetDefaultFlag(parsed);
+            assertNoSshKeyOptions(parsed, "runneth-cli ssh proxy");
+            const target = await resolveSshTargetForCommand(parsed);
+            await runRunnethSshProxy({
+                resourceUrl: target.resourceUrl,
+                sshUrl: target.sshUrl,
+            });
+            return;
+        }
+        if (subcommand === "stdio") {
+            const parsed = parseSshArgs(argv.slice(2));
+            if (parsed.values.length > 0) {
+                throw new Error("runneth-cli ssh stdio does not accept extra arguments");
+            }
+            assertNoSshTargetDefaultFlag(parsed);
+            const target = await resolveSshTargetForCommand(parsed);
+            const oauthToken = await resolveSshOAuthToken(parsed, target.resourceUrl);
+            const setup = await installRunnethSshAccess({
+                cliPath: fileURLToPath(import.meta.url),
+                oauthToken,
+                resourceUrl: target.resourceUrl,
+                sshUrl: target.sshUrl,
+                ...resolveSshKeyInstallOptions(parsed),
+                ...(target.targetName === undefined
+                    ? {}
+                    : { targetName: target.targetName }),
+            });
+            process.stderr.write(`SSH target ${setup.hostAlias} configured with ${setup.configPath}\n`);
+            await runRunnethSshStdio({
+                defaultTimeoutMs: parsed.timeoutMs,
+                setup,
+            });
+            return;
+        }
+        const parsed = parseSshArgs(argv.slice(1));
+        assertNoSshTargetDefaultFlag(parsed);
+        assertSshRemoteCommandSeparator(parsed);
+        const target = await resolveSshTargetForCommand(parsed);
+        const oauthToken = await resolveSshOAuthToken(parsed, target.resourceUrl);
+        const setup = await installRunnethSshAccess({
+            cliPath: fileURLToPath(import.meta.url),
+            oauthToken,
+            resourceUrl: target.resourceUrl,
+            sshUrl: target.sshUrl,
+            ...resolveSshKeyInstallOptions(parsed),
+            ...(target.targetName === undefined
+                ? {}
+                : { targetName: target.targetName }),
+        });
+        process.stderr.write(`SSH target ${setup.hostAlias} configured with ${setup.configPath}\n`);
+        process.exitCode = await runOpenSsh({
+            extraArgs: parsed.values,
+            setup,
+        });
+        return;
+    }
+    if (command === "close") {
+        const parsed = parseArgs(argv.slice(1));
+        writeJson(await request({ name: parsed.name, op: "close" }));
+        return;
+    }
+    if (command === "shutdown") {
+        writeJson(await request({ op: "shutdown" }));
+        return;
+    }
+    throw new Error(`Unknown command: ${command}`);
+};
+const isSshProxyInvocation = (argv) => {
+    return argv[0] === "ssh" && argv[1] === "proxy";
+};
+const isSshStdioInvocation = (argv) => {
+    return argv[0] === "ssh" && argv[1] === "stdio";
+};
+const argv = process.argv.slice(2);
+void run(argv).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    if (isSshProxyInvocation(argv)) {
+        process.stderr.write(`${message}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (isSshStdioInvocation(argv)) {
+        process.stdout.write(`${JSON.stringify({ message, ok: false, type: "error" })}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    process.stdout.write(`${JSON.stringify({ error: message, ok: false }, null, 2)}\n`);
+    process.exitCode = 1;
+});