@swarm-agent/cli 0.1.47

package/LICENSE

@@ -0,0 +1,201 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Swarm contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,130 @@
+# @swarm-agent/cli — unpublished Linux headless candidate
+
+A thin Node 22+ launcher for a **local** Docker or rootless Podman engine. Installs
+are inert: no lifecycle scripts, daemon downloads, image pulls or container starts.
+The executable is `swarm-headless`, not the native `swarm` launcher. Only Linux
+amd64 container images are supported. Docker must use its local Unix socket;
+remote contexts/connections are rejected. Rootless Podman is explicitly local.
+
+Package names are candidate identities, not a claim of npm scope ownership.
+Nothing here authorizes registry publication. GitHub review/merge and separate
+publication approval precede registry delivery.
+
+## Image pin
+
+`runtime-image.json` is the packaged authority. Release packaging supplies `version`
+(semver), `distribution: "ghcr"`, `reference` (exactly
+`ghcr.io/swarm-agent/swarm-headless@sha256:<manifest>`), `manifestDigest`, `imageId`
+(the config digest), `platform: "linux/amd64"` and `sourceCommit` (40 hex characters).
+`swarm-headless install` explicitly pulls that reference for Linux amd64 and verifies
+RepoDigests, config ID and platform. It creates no containers, networks or state
+volumes. Failed pulls/verification stop without tag or local-image fallback; an
+engine may retain downloaded image layers. Retry explicitly after resolving errors.
+
+Start and setup reverify the local immutable image before running anything. Start
+uses the verified config ID with `--pull=never`; neither operation downloads images.
+Help/version never access the engine. No install marker or second pin authority exists.
+
+The checked-in metadata remains explicitly `local-candidate`, **not a published
+registry digest**. In that mode install only verifies an already built/loaded image;
+it never pulls the candidate tag. Release packaging must replace metadata using real
+qualified registry provenance and repeat package/live checks before publication.
+
+To transfer the unpublished image, on the build host (outside source directories):
+
+<copy>
+docker save --output "$IMAGE_ARCHIVE" localhost/swarm-headless:0.1.0-headless.1
+# On the intended isolated runtime host:
+docker load --input "$IMAGE_ARCHIVE"
+</copy>
+
+For Podman use `podman save --format docker-archive` and `podman load`. Verify the
+loaded image ID against `runtime-image.json`; the launcher fails if it is absent.
+
+## Install and explicit lifecycle
+
+Install the local tarball from a clean consumer directory; no Swarm checkout is
+needed by the installed launcher. Set `CLI_TARBALL` to its absolute path.
+
+<copy>
+npm install "$CLI_TARBALL"
+npx --no-install swarm-headless --help
+npx --no-install swarm-headless install
+npx --no-install swarm-headless start --project "$PROJECT_DIR"
+npx --no-install swarm-headless status
+npx --no-install swarm-headless stop
+npx --no-install swarm-headless start --project "$PROJECT_DIR" --recreate
+</copy>
+
+Set `PROJECT_DIR` to one clean, committed, ordinary Git checkout (not a linked
+worktree), readable/writable by image UID/GID 10001. The launcher rejects the home
+directory, its ancestors, root and comma/newline mount injection. Symlinks resolve
+to the selected canonical directory. It never recursively changes ownership.
+Rootless engines remap IDs: prepare the selected project for that mapping first.
+
+Use `--engine podman` on **every** operation for rootless Podman. Use the same
+`--name example` on lifecycle/setup operations for a separate instance (`install`
+is image-only and accepts only `--engine`). `--port` is start-only
+(default 7783, host binding always `127.0.0.1`). The four state volumes are
+`NAME-config`, `NAME-data`, `NAME-cache`, `NAME-logs`; the dedicated network is
+`NAME-network`. No home, engine socket, privileged mode or host network is mounted.
+Keep that network free of untrusted peers. Local engine authority is administrative.
+
+`stop` retains the container and all volumes. `start --recreate` requires a stopped,
+launcher-labelled instance and the same project; it removes only that container,
+without `--force` or `--volumes`, then attaches the original named state. Missing
+state volumes, foreign name collisions and failed inspections fail closed. A failed
+replacement may leave a stopped container removed, but state volumes remain; inspect
+the engine before retrying. Never attach the same data volume to concurrent daemons.
+The launcher does not delete data or perform automatic recovery/polling. To upgrade,
+stop with the old package, install the new version's pinned image, then use
+`start --recreate` with the same name/project. Back up durable state beforehand;
+image verification does not establish database downgrade compatibility.
+
+## Setup (explicit choices only)
+
+`setup` forwards only the existing `swarmctl setup` operations through container
+exec. No host settings or model assignments are changed. No setup step is automatic.
+Set `PROVIDER`, `MODEL`, `THINKING` explicitly and choose a private existing key file
+outside the project. Do not enable shell tracing or put keys in command arguments.
+
+<copy>
+npx --no-install swarm-headless setup -- status
+npx --no-install swarm-headless setup -- identity --username owner --name Headless
+npx --no-install swarm-headless setup -- credential --provider "$PROVIDER" --api-key-stdin < "$PROVIDER_KEY_FILE"
+for role in action plan compact finder coder designer router; do
+  npx --no-install swarm-headless setup -- model --role "$role" --provider "$PROVIDER" --model "$MODEL" --thinking "$THINKING" || break
+done
+npx --no-install swarm-headless setup -- workspace --path /project --name Project
+npx --no-install swarm-headless setup -- complete
+</copy>
+
+Execute steps individually and stop on any failure. The model loop explicitly
+chooses the same model for all roles; use individual calls for different choices.
+A saved credential is not proof of provider validity. Credentials are stdin-only;
+the launcher refuses terminal key input and never allocates a TTY. `setup complete`
+checks canonical prerequisites. `setup status` can be retried explicitly after the
+private socket is ready; there is no TCP setup fallback.
+
+To export a one-hour scoped SDK token, select a **new**, absolute token file in a
+private directory outside the project:
+
+<copy>
+(umask 077; set -C; npx --no-install swarm-headless setup -- sdk-token --expires-in-seconds 3600 > "$SWARM_SDK_TOKEN_FILE")
+# Revoke using the non-secret ID from the export, never the token itself:
+npx --no-install swarm-headless setup -- revoke-sdk-token --id "$TOKEN_ID"
+</copy>
+
+Token export refuses terminal output; protect the plaintext file with mode 0600.
+A failed export may already have minted a token: inspect/revoke before retrying.
+Use the SDK's packaged `examples/headless-session.ts` with the loopback endpoint.
+Scoped session write access is powerful and can approve tools; it is not a sandbox.
+
+## Validation limits
+
+`npm test` exercises command construction, negative paths and state-preserving
+operation ordering against an injected engine. `tests/scripts/headless_npm_test.mjs`
+builds the SDK outside the checkout, inspects packs, installs with normal lifecycle
+behavior into an empty consumer and checks ESM/types/CLI commands. Neither starts
+Swarm. Real setup, networking, permissions and restart persistence require the
+separate isolated live qualification step.

package/bin/swarm-headless.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { HELP, parseArgs, engineRunner, runLauncher } from '../src/launcher.js';
+
+try {
+  const opts = parseArgs(process.argv.slice(2));
+  const pin = JSON.parse(readFileSync(new URL('../runtime-image.json', import.meta.url), 'utf8'));
+  if (opts.command === 'help') console.log(HELP);
+  else if (opts.command === 'version') console.log(pin.version);
+  else {
+    if (process.platform !== 'linux') throw Error('This candidate supports Linux hosts only');
+    runLauncher(opts, pin, engineRunner(opts.engine), { stdinTTY: process.stdin.isTTY, stdoutTTY: process.stdout.isTTY });
+  }
+} catch (error) {
+  // Only our fixed messages are safe; filesystem/JSON errors can contain paths/data.
+  const message = error instanceof Error && !error.code && !(error instanceof SyntaxError)
+    ? error.message : 'Cannot read package metadata or selected project';
+  console.error(`swarm-headless: ${message}`);
+  process.exitCode = 1;
+}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@swarm-agent/cli",
+  "version": "0.1.47",
+  "description": "Explicit headless Swarm container launcher",
+  "type": "module",
+  "bin": {
+    "swarm-headless": "bin/swarm-headless.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "runtime-image.json",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/swarm-agent/swarm.git"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "os": [
+    "linux"
+  ],
+  "scripts": {
+    "test": "node --test --test-concurrency=1 test/*.test.js"
+  },
+  "license": "Apache-2.0"
+}

package/runtime-image.json

@@ -0,0 +1,9 @@
+{
+  "version": "0.1.47",
+  "manifestDigest": "sha256:875ef95fa73f97d8a2f39279989746522bede8147111690ee49afc5441e6930e",
+  "imageId": "sha256:31faa8dda74c53766d9401692451b1f1d66ea3a1d8352e99dd10c684f261f2e8",
+  "platform": "linux/amd64",
+  "sourceCommit": "81c1085e26f84500c478919578a898f15f6fe83d",
+  "distribution": "ghcr",
+  "reference": "ghcr.io/swarm-agent/swarm-headless@sha256:875ef95fa73f97d8a2f39279989746522bede8147111690ee49afc5441e6930e"
+}

package/src/launcher.js

@@ -0,0 +1,201 @@
+import { spawnSync } from 'node:child_process';
+import { lstatSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, parse, relative } from 'node:path';
+import { createHash } from 'node:crypto';
+
+const LABEL = 'dev.swarm.headless';
+const VOLUMES = { config: '/etc/swarmd', data: '/var/lib/swarmd', cache: '/var/cache/swarmd', logs: '/var/log/swarmd' };
+export const HELP = `swarm-headless <install|start|stop|status|setup> [options]
+  --engine docker|podman   Local engine (default docker)
+  --name NAME              Instance name (default swarm-headless)
+  start --project PATH [--port 7783] [--recreate]
+  setup [options] -- <status|identity|credential|model|workspace|complete|sdk-token|revoke-sdk-token> [flags]
+  --version | --help       No engine access
+install explicitly pulls/verifies the packaged GHCR digest (or verifies a loaded candidate).
+No npm install-time actions, automatic pulls, model defaults or volume deletion.
+Stop preserves the container and all named state volumes. Recreate requires a
+stopped, launcher-owned container and the same project. See README for setup.`;
+
+export function parseArgs(argv) {
+  const [command, ...rest] = argv;
+  if (!command || ['--help', 'help'].includes(command)) return { command: 'help' };
+  if (command === '--version') return { command: 'version' };
+  if (!['install', 'start', 'stop', 'status', 'setup'].includes(command)) throw Error('Unknown command; use --help');
+  const opts = { command, engine: 'docker', name: 'swarm-headless', port: 7783, recreate: false, setup: [] };
+  const seen = new Set();
+  for (let i = 0; i < rest.length; i++) {
+    const key = rest[i];
+    if (key === '--' && command === 'setup') { opts.setup = rest.slice(i + 1); break; }
+    if (seen.has(key)) throw Error('Duplicate option');
+    seen.add(key);
+    if (key === '--recreate' && command === 'start') { opts.recreate = true; continue; }
+    if (!['--engine', ...(command === 'install' ? [] : ['--name']), ...(command === 'start' ? ['--project', '--port'] : [])].includes(key)) throw Error('Invalid option; secrets must use stdin, never flags');
+    const value = rest[++i];
+    if (!value || value.startsWith('--')) throw Error('Option needs a value');
+    opts[key.slice(2)] = value;
+  }
+  if (!['docker', 'podman'].includes(opts.engine)) throw Error('Engine must be docker or podman');
+  if (!/^[a-z][a-z0-9-]{0,47}$/.test(opts.name)) throw Error('Invalid instance name');
+  if (!/^\d+$/.test(String(opts.port)) || Number(opts.port) < 1024 || Number(opts.port) > 65535) throw Error('Port must be 1024–65535');
+  opts.port = Number(opts.port);
+  if (command === 'setup') validateSetup(opts.setup);
+  return opts;
+}
+
+function validateSetup(args) {
+  const flags = {
+    status: [], complete: [], identity: ['username', 'name'],
+    credential: ['provider', 'api-key-stdin'],
+    model: ['role', 'provider', 'model', 'thinking', 'service-tier', 'context-mode'],
+    workspace: ['path', 'name'], 'sdk-token': ['expires-in-seconds'], 'revoke-sdk-token': ['id'],
+  };
+  if (!Object.hasOwn(flags, args[0])) throw Error('Select a supported setup operation after --');
+  const seen = new Set();
+  for (let i = 1; i < args.length; i++) {
+    const flag = args[i];
+    if (!flag.startsWith('--') || !flags[args[0]].includes(flag.slice(2)) || seen.has(flag)) throw Error('Invalid setup flags; secrets must use stdin');
+    seen.add(flag);
+    if (flag === '--api-key-stdin') continue;
+    const value = args[++i];
+    if (!value || value.startsWith('--')) throw Error('Setup flag needs a value');
+    if (flag === '--path' && value !== '/project') throw Error('Workspace must be /project');
+  }
+  if (args[0] === 'credential' && !seen.has('--api-key-stdin')) throw Error('Credentials require --api-key-stdin');
+}
+
+export function selectedProject(path) {
+  if (!path || !isAbsolute(path)) throw Error('Select an absolute project path');
+  const result = realpathSync(path);
+  const home = realpathSync(homedir());
+  const toHome = relative(result, home);
+  if (result === parse(result).root || !toHome || (!toHome.startsWith('..') && !isAbsolute(toHome))) throw Error('Cannot mount the home directory or its ancestors');
+  if (/[\r\n,]/.test(result) || !lstatSync(result).isDirectory()) throw Error('Invalid project mount path');
+  // Linked worktrees can refer to metadata outside the only authorized mount.
+  if (!lstatSync(join(result, '.git')).isDirectory() || lstatSync(join(result, '.git')).isSymbolicLink()) throw Error('Select a normal Git checkout, not a linked worktree');
+  return result;
+}
+
+export function engineRunner(engine, env = process.env) {
+  if (env.DOCKER_CONTEXT || env.CONTAINER_CONNECTION || env.CONTAINER_HOST ||
+      (env.DOCKER_HOST && !env.DOCKER_HOST.startsWith('unix://'))) throw Error('Only a local Unix-socket engine is supported; unset remote context variables');
+  const prefix = engine === 'podman' ? ['--remote=false'] : ['--host', env.DOCKER_HOST || 'unix:///var/run/docker.sock'];
+  return (args, options = {}) => {
+    const result = spawnSync(engine, [...prefix, ...args], {
+      shell: false, encoding: 'utf8', maxBuffer: 1024 * 1024, timeout: 150000,
+      stdio: options.stream ? ['inherit', 'inherit', 'pipe'] : ['ignore', 'pipe', 'pipe'],
+    });
+    // Do not print engine stderr/argv: exec failures can contain private values.
+    if (result.error || result.status !== 0) throw Error('Container engine operation failed; inspect the engine and instance before retrying (details withheld)');
+    return result.stdout || '';
+  };
+}
+
+function decode(text) {
+  const value = JSON.parse(text);
+  if (!Array.isArray(value) || value.length !== 1) throw Error('Unexpected engine inspection response');
+  return value[0];
+}
+const imageID = value => `sha256:${String(value).replace(/^sha256:/, '')}`;
+const lines = text => text.trim().split('\n').filter(Boolean);
+
+function validatePin(pin) {
+  const fields = ['version', 'imageId', 'platform', 'sourceCommit', 'distribution'];
+  if (pin.distribution === 'ghcr') fields.push('reference', 'manifestDigest');
+  if (fields.some(key => typeof pin[key] !== 'string' || pin[key] !== pin[key].trim())) throw Error('Invalid packaged image pin');
+  const digest = /^sha256:[a-f0-9]{64}$/;
+  const semver = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/;
+  if (!digest.test(pin.imageId) || pin.platform !== 'linux/amd64' ||
+      !semver.test(pin.version) || !/^[a-f0-9]{40}$/.test(pin.sourceCommit)) throw Error('Invalid packaged image pin');
+  if (pin.distribution === 'local-candidate') return;
+  if (pin.distribution !== 'ghcr' || !digest.test(pin.manifestDigest) ||
+      pin.reference !== `ghcr.io/swarm-agent/swarm-headless@${pin.manifestDigest}`) throw Error('Invalid packaged registry pin');
+}
+
+function verifyImage(pin, run) {
+  // Inspect the manifest reference too: a matching config alone is not registry provenance.
+  const image = decode(run(['image', 'inspect', pin.distribution === 'ghcr' ? pin.reference : pin.imageId]));
+  if (imageID(image.Id) !== pin.imageId || image.Os !== 'linux' || image.Architecture !== 'amd64' ||
+      (pin.distribution === 'ghcr' && (!Array.isArray(image.RepoDigests) || !image.RepoDigests.includes(pin.reference)))) {
+    throw Error('Image does not match the packaged digest, config or platform; run install with the matching package');
+  }
+}
+
+export function runLauncher(opts, pin, run, io = {}) {
+  const show = io.show || console.log;
+  if (opts.command === 'help') { show(HELP); return; }
+  if (opts.command === 'version') { show(pin.version); return; }
+  validatePin(pin);
+  if (opts.command === 'install') {
+    if (pin.distribution === 'ghcr') run(['pull', '--platform', pin.platform, pin.reference]);
+    verifyImage(pin, run);
+    show('Verified packaged image; no container started or state volumes changed.');
+    return;
+  }
+  const names = lines(run(['container', 'ls', '--all', '--format', '{{.Names}}']));
+  const current = names.includes(opts.name) ? decode(run(['container', 'inspect', opts.name])) : null;
+  if (current && current.Config?.Labels?.[LABEL] !== opts.name) throw Error('Instance name belongs to an unmanaged container; refusing access');
+  if (opts.command === 'status') {
+    show(current ? `state=${current.State.Status} image=${imageID(current.Image)} endpoint=http://127.0.0.1:${current.Config.Labels[`${LABEL}.port`]}` : 'state=absent');
+    return;
+  }
+  if (opts.command === 'stop') {
+    if (!current) throw Error('Instance does not exist');
+    if (current.State.Running) run(['container', 'stop', '--time', '30', current.Id]);
+    show('Stopped; named state volumes preserved.'); return;
+  }
+  if (opts.command === 'setup') {
+    if (!current?.State.Running) throw Error('Start the instance before setup');
+    if (imageID(current.Image) !== pin.imageId) throw Error('Instance does not match the packaged image pin');
+    if (opts.setup[0] === 'credential' && io.stdinTTY) throw Error('Redirect a private key file or secret-manager pipe to stdin');
+    if (opts.setup[0] === 'sdk-token' && io.stdoutTTY) throw Error('Redirect token output to a new private file or pipe');
+    verifyImage(pin, run);
+    run(['exec', ...(opts.setup[0] === 'credential' ? ['-i'] : []), current.Id, 'swarmctl', 'setup', ...opts.setup], { stream: true });
+    return;
+  }
+  const project = (io.project || selectedProject)(opts.project);
+  const spec = createHash('sha256').update(JSON.stringify([pin.imageId, project, opts.port])).digest('hex');
+  if (current) {
+    if (current.Config.Labels[`${LABEL}.project`] !== project) throw Error('Recreation must keep the same project');
+    if (current.State.Running) {
+      if (opts.recreate || current.Config.Labels[`${LABEL}.spec`] !== spec || imageID(current.Image) !== pin.imageId) throw Error('Stop the existing instance before changing or recreating it');
+      verifyImage(pin, run);
+      show('Already running.'); return;
+    }
+    if (!opts.recreate) throw Error('Instance is stopped; use start --recreate with the same project to preserve its volumes');
+  }
+  // Verification precedes any container removal or resource creation. Never auto-pull.
+  verifyImage(pin, run);
+  const network = `${opts.name}-network`;
+  const networks = lines(run(['network', 'ls', '--format', '{{.Name}}']));
+  if (networks.includes(network)) {
+    const n = decode(run(['network', 'inspect', network]));
+    if ((n.Labels || n.labels)?.[LABEL] !== opts.name) throw Error('Network name collision; refusing reuse');
+  }
+  const volumes = lines(run(['volume', 'ls', '--format', '{{.Name}}']));
+  // A partial existing set is never a new instance: do not silently reset identity.
+  const present = Object.keys(VOLUMES).filter(key => volumes.includes(`${opts.name}-${key}`)).length;
+  if (present !== 0 && present !== Object.keys(VOLUMES).length) throw Error('Incomplete state volumes; inspect and recover the existing instance before retrying');
+  // Check every collision before creating a volume or removing a stopped container.
+  for (const suffix of Object.keys(VOLUMES)) {
+    const name = `${opts.name}-${suffix}`;
+    if (volumes.includes(name)) {
+      const v = decode(run(['volume', 'inspect', name]));
+      if (v.Labels?.[LABEL] !== opts.name || v.Labels?.[`${LABEL}.project`] !== project) throw Error('Volume ownership/project collision; refusing reuse');
+    } else if (current) throw Error('Existing instance has a missing state volume; refusing silent reset');
+  }
+  if (!networks.includes(network)) run(['network', 'create', '--label', `${LABEL}=${opts.name}`, network]);
+  for (const suffix of Object.keys(VOLUMES)) {
+    const name = `${opts.name}-${suffix}`;
+    if (!volumes.includes(name)) run(['volume', 'create', '--label', `${LABEL}=${opts.name}`, '--label', `${LABEL}.project=${project}`, name]);
+  }
+  if (current) run(['container', 'rm', current.Id]); // Never --force or --volumes.
+  const mounts = Object.entries(VOLUMES).flatMap(([key, dst]) => ['--mount', `type=volume,src=${opts.name}-${key},dst=${dst}`]);
+  run(['run', '--detach', '--pull=never', '--platform', 'linux/amd64', '--name', opts.name,
+    '--label', `${LABEL}=${opts.name}`, '--label', `${LABEL}.project=${project}`,
+    '--label', `${LABEL}.port=${opts.port}`, '--label', `${LABEL}.spec=${spec}`,
+    '--network', network, '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
+    '--publish', `127.0.0.1:${opts.port}:7783`, ...mounts,
+    '--mount', `type=bind,src=${project},dst=/project`, pin.imageId, '--container-sdk-port=7783']);
+  show(`Started; endpoint=http://127.0.0.1:${opts.port}. Run setup status when the private socket is ready.`);
+}