@tokenfactory/acc-runner 0.41.7 → 0.42.0

package/README.md

@@ -1,7 +1,7 @@
 # @tokenfactory/acc-runner
 
-CLI runner that polls Agent Control Center for queued tasks and executes
-them via Claude Code.
+The Agent Control Center CLI. Sign in as yourself, read the task board, ask ACC,
+and run agents on this machine.
 
 ## Install
 
@@ -11,14 +11,97 @@ npm i -g @tokenfactory/acc-runner
 pnpm add -g @tokenfactory/acc-runner
 ```
 
-Requires Node.js ≥ 20.6, plus these binaries on `PATH`:
+This installs **two commands**:
+
+| Command      | Status                                                              |
+| ------------ | ------------------------------------------------------------------- |
+| `acc`        | The CLI. Use this.                                                   |
+| `acc-runner` | Deprecated alias. Everything still works; prints a notice on stderr. |
+
+Requires Node.js ≥ 20.6. Running agents on this machine additionally needs these
+binaries on `PATH`:
 
 - `claude` — Claude Code CLI, signed in
 - `gh` — GitHub CLI, signed in (`gh auth login`)
 - `git` — with `user.email` configured
 - A local clone of the target repo (the `repoPath`, see below)
 
-Run `acc-runner doctor` after install to verify everything resolves.
+Run `acc doctor` after install to verify everything resolves.
+
+## The two lanes
+
+There are two different things a terminal can be, and they are separate
+credentials with separate lifecycles. A workstation can hold both at once.
+
+**You, signed in as yourself** — a device-code login that leaves you with your
+own session (the same one your browser holds) and no runner registration:
+
+```sh
+acc login             # device-code sign-in; stores a session in the OS keychain
+acc whoami            # who this terminal is signed in as
+acc logout            # revoke this terminal's session, server-side and locally
+```
+
+The session shows up on **Settings → Sessions** as `acc CLI · <hostname>`, so you
+can revoke it from the browser like any other.
+
+**This machine, enrolled as a runner** — the fleet credential that lets ACC
+assign tasks here:
+
+```sh
+acc runner login      # enrol this host, register a runner
+acc runner logout     # clear the local session, mark this runner offline
+acc watch             # long-running: receive assignments and execute them
+```
+
+## Reading the board
+
+Read-only, under your own token — RLS decides what you can see, exactly as in the
+UI.
+
+```sh
+acc task list                                   # 25 most recently updated
+acc task list --status in_progress --limit 50
+acc task list --repo owner/name --json
+acc task show T-1234
+```
+
+## Asking ACC
+
+Hits the same `/api/chat/stream` endpoint the browser uses, so the same tools,
+delegation ceiling and audit trail apply.
+
+```sh
+acc chat "which tasks are blocked?"             # one shot
+acc chat                                        # interactive session on a TTY
+git log --oneline -20 | acc chat                # piped
+acc chat --conversation <id> "and the risky ones?"
+```
+
+If no provider key resolves for you, the turn is queued for a companion runner
+to drain and `acc chat` says so — read the reply in the ACC conversation.
+
+## Migrating from `acc-runner`
+
+The alias is a true alias: every command keeps the meaning it already had, so no
+script needs changing today.
+
+| You typed                | Keeps working | New name              |
+| ------------------------ | ------------- | --------------------- |
+| `acc-runner login`       | yes           | `acc runner login`    |
+| `acc-runner logout`      | yes           | `acc runner logout`   |
+| `acc-runner auth login`  | yes           | `acc login`           |
+| `acc-runner auth status` | yes           | `acc whoami`          |
+| `acc-runner auth logout` | yes           | `acc logout`          |
+| `acc-runner <anything>`  | yes           | `acc <anything>`      |
+
+Note the one thing a blind rename would get wrong: **`acc login` and
+`acc-runner login` are different lanes.** `acc-runner login` enrols a machine
+(what it always did); `acc login` signs a person in. Use `acc runner login` when
+you mean the machine.
+
+Set `ACC_SUPPRESS_ALIAS_NOTICE=1` to silence the deprecation line — worth doing
+in launchd plists, docker entrypoints and CI where the output was quiet before.
 
 ## Configuration
 

package/dist/acc.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare const program: import("commander").Command;
+//# sourceMappingURL=acc.d.ts.map

package/dist/acc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acc.d.ts","sourceRoot":"","sources":["../src/acc.ts"],"names":[],"mappings":";AAkBA,eAAO,MAAM,OAAO,6BAAqC,CAAC"}

package/dist/acc.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * `acc` — the unified CLI. One command for signing in, reading the board,
+ * asking ACC, and running agents on this machine.
+ *
+ * A separate bin file rather than a name sniff on `process.argv[1]`: npm
+ * installs a symlink on POSIX (whose basename IS the bin name) but a `.cmd`
+ * shim on Windows that invokes node with the built file's own path, so the
+ * typed name is simply not recoverable from argv there. Two entry files make
+ * the invoked name a fact of which file ran, on every platform.
+ *
+ * The command tree lives in program.ts and is shared with the acc-runner alias.
+ */
+import { setInvokedAs } from "./cli-name.js";
+import { buildProgram, isMainModule, runProgram } from "./program.js";
+setInvokedAs("acc");
+export const program = buildProgram({ invokedAs: "acc" });
+if (isMainModule(import.meta.url)) {
+    runProgram(program);
+}
+//# sourceMappingURL=acc.js.map

package/dist/acc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acc.js","sourceRoot":"","sources":["../src/acc.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,CAAC,KAAK,CAAC,CAAC;AAEpB,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAE1D,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClC,UAAU,CAAC,OAAO,CAAC,CAAC;AACtB,CAAC"}

package/dist/cli-name.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Which binary the operator actually typed.
+ *
+ * The package ships two bins over ONE command tree: `acc` (the unified CLI) and
+ * `acc-runner` (the original name, retained as a deprecated alias). Almost
+ * everything behaves identically under both, but two things must not:
+ *
+ *   1. `login` / `logout` mean different lanes under the two names — see
+ *      buildProgram in program.ts for why that is a compatibility requirement
+ *      rather than a wart.
+ *   2. Every "run `… auth login`" hint the CLI prints should name the binary the
+ *      operator is holding. A person who installed `acc` and is told to run
+ *      `acc-runner` has been handed a puzzle instead of an instruction.
+ *
+ * This is process-scoped state set once by the bin entry point, before any
+ * command runs. It defaults to the legacy name so that importing a module in a
+ * test (or from the alias entry) prints exactly what it printed before.
+ */
+export type CliName = "acc" | "acc-runner";
+/** Called by the bin entry points (cli.ts / acc.ts) before parsing argv. */
+export declare function setInvokedAs(name: CliName): void;
+/** The binary name to use in operator-facing copy. */
+export declare function cliName(): CliName;
+/**
+ * `acc login` under the unified bin; `acc-runner auth login` under the alias.
+ * Both start the same person-lane device flow — only the spelling differs.
+ */
+export declare function signInCommand(): string;
+//# sourceMappingURL=cli-name.d.ts.map

package/dist/cli-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-name.d.ts","sourceRoot":"","sources":["../src/cli-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY,CAAC;AAI3C,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAEhD;AAED,sDAAsD;AACtD,wBAAgB,OAAO,IAAI,OAAO,CAEjC;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/cli-name.js

@@ -0,0 +1,17 @@
+let invokedAs = "acc-runner";
+/** Called by the bin entry points (cli.ts / acc.ts) before parsing argv. */
+export function setInvokedAs(name) {
+    invokedAs = name;
+}
+/** The binary name to use in operator-facing copy. */
+export function cliName() {
+    return invokedAs;
+}
+/**
+ * `acc login` under the unified bin; `acc-runner auth login` under the alias.
+ * Both start the same person-lane device flow — only the spelling differs.
+ */
+export function signInCommand() {
+    return invokedAs === "acc" ? "acc login" : "acc-runner auth login";
+}
+//# sourceMappingURL=cli-name.js.map

package/dist/cli-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-name.js","sourceRoot":"","sources":["../src/cli-name.ts"],"names":[],"mappings":"AAoBA,IAAI,SAAS,GAAY,YAAY,CAAC;AAEtC,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,OAAO;IACrB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC;AACrE,CAAC"}

package/dist/cli.d.ts

@@ -1,4 +1,22 @@
 #!/usr/bin/env node
-import { Command } from "commander";
-export declare const program: Command;
+export declare const program: import("commander").Command;
+/**
+ * Set to any non-empty value to silence the alias notice — for launchd plists,
+ * docker entrypoints and CI logs that were quiet before and should stay quiet.
+ */
+export declare const SUPPRESS_ENV = "ACC_SUPPRESS_ALIAS_NOTICE";
+/**
+ * Subcommands that must never gain a line of output. `_precommit-guard` runs
+ * inside `git commit`, where extra stderr is noise attached to every commit an
+ * agent makes.
+ */
+export declare const SILENT_SUBCOMMANDS: Set<string>;
+/**
+ * The alias notice. It deliberately does NOT name a removal date: the
+ * deprecation window is an operator decision that has not been made, and
+ * inventing one here would put a date in front of users that nobody agreed to.
+ * When the window is decided, this string is the single place it lands.
+ */
+export declare function aliasNotice(): string;
+export declare function shouldWarnAlias(argv: string[], env?: NodeJS.ProcessEnv): boolean;
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAOA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyBpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AA0BA,eAAO,MAAM,OAAO,6BAA4C,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,YAAY,8BAA8B,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAAgC,CAAC;AAEhE;;;;;GAKG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAIT"}

package/dist/cli.js

@@ -1,303 +1,59 @@
 #!/usr/bin/env node
 /**
- * acc-runner — CLI entry point. commander wires subcommands into named
- * functions in their own files; this module is intentionally thin.
+ * `acc-runner` — the ORIGINAL bin, retained as a deprecated alias of `acc`.
+ *
+ * Everything this entry point could do before, it still does, with identical
+ * semantics: `acc-runner login` still enrols a machine, `acc-runner auth login`
+ * still signs a person in, `acc-runner watch` / `companion` / `doctor` are
+ * unchanged, and the hidden `_precommit-guard` hook re-invoke still resolves
+ * here. See program.ts for why `login` is the one verb whose meaning depends on
+ * which bin was typed.
+ *
+ * The only new behaviour is one stderr line naming the replacement. It goes to
+ * stderr on purpose — `acc-runner companion status` is consumed by menu-bar
+ * scripts that parse stdout, and a deprecation notice must not become a parse
+ * error in someone's status bar.
  */
-import { realpathSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { Command } from "commander";
 import chalk from "chalk";
-import { loadConfig } from "./config.js";
-import { fetchPricing } from "./cost-pricing.js";
-import { loginCommand } from "./login.js";
-import { logoutCommand } from "./logout.js";
-import { watchCommand } from "./watch.js";
-import { companionCommand, companionInstallCommand, companionStatusCommand, companionUninstallCommand, } from "./companion-run.js";
-import { doctorCommand } from "./doctor.js";
-import { clarifyCommand } from "./clarification.js";
-import { clearQuarantine, getQuarantine } from "./runtime/quarantine.js";
-import { clearChatCircuit, getChatCircuit } from "./runtime/chat-circuit-breaker.js";
-import { runCommitGuardHook } from "./commit-guard.js";
-import { PROTOCOL_VERSION } from "./types.js";
-import { PACKAGE_VERSION } from "./pkg-version.js";
+import { setInvokedAs } from "./cli-name.js";
+import { buildProgram, isMainModule, runProgram } from "./program.js";
+setInvokedAs("acc-runner");
 // Exported so the enrollment-guidance contract test (tests/unit/) can parse the
 // printed `acc-runner companion` command against the ACTUAL command tree without
 // spawning the CLI — the auto-parse below is entry-guarded so importing this
 // module never executes a command. See tests/unit/enroll-guidance-cli-contract.test.ts.
-export const program = new Command();
-program
-    .name("acc-runner")
-    .description("Agent Control Center local runner. Subscribes to ACC, spawns Claude Code on assignment, and opens a PR when done.")
-    .version(`${PACKAGE_VERSION} (protocol v${PROTOCOL_VERSION})`);
-program
-    .command("login")
-    .description("Sign in via device-code OAuth and register this machine.")
-    .action(async () => {
-    try {
-        await loginCommand();
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-program
-    .command("logout")
-    .description("Clear the local session and mark this runner offline.")
-    .action(async () => {
-    try {
-        await logoutCommand();
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-program
-    .command("watch")
-    .description("Long-running. Receive task assignments and execute them.")
-    .action(async () => {
-    try {
-        // Warm the cost-pricing cache before the realtime loop opens.
-        // fetchPricing handles its own logging; embedded fallback governs
-        // if the endpoint is unreachable.
-        await fetchPricing(loadConfig().publicUrl);
-        await watchCommand();
-        // Keep the process alive — stop() runs in the SIGINT handler.
-        await new Promise(() => { });
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-// CC-3C (COMPANION): companion mode — an owner-affinity chat runner. Serves
-// ONLY the logged-in owner's interactive chat turns (no code tasks), mirrors
-// the turn stream to the same-machine browser over a loopback socket, and on
-// exit requeues in-flight turns so an Auto turn fails over to the fleet.
-const companionCmd = program
-    .command("companion")
-    .description("Long-running. Serve the owner's interactive chat turns (companion mode).")
-    .action(async () => {
-    try {
-        const handle = await companionCommand();
-        const shutdown = () => {
-            void handle.stop().finally(() => process.exit(0));
-        };
-        process.on("SIGINT", shutdown);
-        process.on("SIGTERM", shutdown);
-        // Keep the process alive; the loop runs on timers until a signal.
-        await new Promise(() => { });
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-companionCmd
-    .command("status")
-    .description("Print the one-line companion status (menu-bar friendly).")
-    .action(async () => {
-    try {
-        await companionStatusCommand();
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-companionCmd
-    .command("install")
-    .description("Install the companion login agent (autostart at login).")
-    .action(async () => {
-    try {
-        await companionInstallCommand();
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-companionCmd
-    .command("uninstall")
-    .description("Remove the companion login agent.")
-    .action(async () => {
-    try {
-        await companionUninstallCommand();
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-program
-    .command("doctor")
-    .description("Run environment checks. Exit 0 if all green, 1 otherwise.")
-    .option("--strict", "Treat advisory warnings (missing ANTHROPIC_API_KEY, version drift, etc.) as failures.")
-    .action(async (opts) => {
-    const code = await doctorCommand({ strict: opts.strict === true });
-    process.exitCode = code;
-});
-// SH-6 NEEDS-INFO-HALT: a spawned agent that needs clarification / approval /
-// missing information raises a needs_clarification halt for its task and hands
-// the question off to JOJO, instead of guessing or dead-lettering. The operator
-// answers by resolving the halt, which resumes the SAME task blocked -> queued.
-program
-    .command("clarify")
-    .description("Raise a needs_clarification halt for a task and hand the question off to JOJO.")
-    .requiredOption("--task <id>", "Task id the agent is blocked on (e.g. T-1234).")
-    .requiredOption("--question <text>", "The question / missing info the operator must answer.")
-    .option("--context <json>", "Optional JSON object merged into the halt payload.")
-    .action(async (opts) => {
-    try {
-        await clarifyCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-// v0.48: quarantine management. The runner enters quarantine automatically
-// when the failure classifier detects a machine-level failure. An operator
-// resolves the underlying issue then clears the quarantine to resume work.
-const quarantineCmd = program
-    .command("quarantine")
-    .description("Inspect or clear the runner quarantine state.");
-quarantineCmd
-    .command("status")
-    .description("Show quarantine state.")
-    .action(async () => {
-    try {
-        const q = await getQuarantine();
-        if (!q) {
-            console.log("Runner is not quarantined.");
-            return;
-        }
-        console.log(chalk.red.bold(`QUARANTINED (${q.cause})`));
-        console.log(`  Detail:  ${q.detail}`);
-        console.log(`  Task:    ${q.taskId}`);
-        console.log(`  Since:   ${q.classifiedAt}`);
-        // v0.53 T-53-4: consecutive instant-empty count (1 = definitive,
-        // 2 = heuristic confirmed by retry). Omitted for pre-0.53 states.
-        if (q.consecutive !== undefined) {
-            console.log(`  Streak:  ${q.consecutive} consecutive instant-empty exit(s)`);
-        }
-        console.log(chalk.gray(`\nResolve the underlying ${q.cause} issue, then run \`acc-runner quarantine clear\`.`));
-        process.exitCode = 1;
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-quarantineCmd
-    .command("clear")
-    .description("Clear quarantine and allow the runner to resume claiming tasks.")
-    .action(async () => {
-    try {
-        await clearQuarantine();
-        console.log(chalk.green("✓ Quarantine cleared. Runner will resume on next task assignment."));
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-// CC-1B (TURN-LANE): chat-circuit management. The runner opens the chat circuit
-// automatically when a `claude_exit_1`-class fault surfaces while serving a chat
-// turn — benching ONLY the chat lane (code/review keep running). An operator
-// resolves the credential/host issue then clears the circuit to resume chat.
-const chatCircuitCmd = program
-    .command("chat-circuit")
-    .description("Inspect or clear the chat-capability circuit breaker (chat lane only).");
-chatCircuitCmd
-    .command("status")
-    .description("Show chat circuit state.")
-    .action(async () => {
-    try {
-        const c = await getChatCircuit();
-        if (!c) {
-            console.log("Chat circuit is closed (chat lane serving).");
-            return;
-        }
-        console.log(chalk.red.bold(`CHAT CIRCUIT OPEN (${c.cause})`));
-        console.log(`  Detail:        ${c.detail}`);
-        console.log(`  Turn:          ${c.turnId}`);
-        console.log(`  Conversation:  ${c.conversationId}`);
-        console.log(`  Since:         ${c.trippedAt}`);
-        console.log(chalk.gray(`\nResolve the underlying ${c.cause} issue, then run \`acc-runner chat-circuit clear\`. ` +
-            `Code/review lanes are unaffected.`));
-        process.exitCode = 1;
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-chatCircuitCmd
-    .command("clear")
-    .description("Close the chat circuit and allow the runner to resume claiming chat turns.")
-    .action(async () => {
-    try {
-        await clearChatCircuit();
-        console.log(chalk.green("✓ Chat circuit closed. Runner will resume claiming chat turns."));
-    }
-    catch (err) {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exitCode = 1;
-    }
-});
-// RR-4: the git pre-commit hook the runner installs into a
-// task worktree (see commit-guard.ts) re-invokes this hidden subcommand. It
-// scans the STAGED text files and exits non-zero (with an actionable message on
-// stderr) when a NUL byte / invalid UTF-8 / binary-blob-where-text is found, so
-// git aborts the commit and the agent fixes it in-session. Hidden — it is a hook
-// entry point, not an operator command.
-program
-    .command("_precommit-guard", { hidden: true })
-    .description("Internal: commit-time mechanical guard (pre-commit hook entry).")
-    .action(async () => {
-    try {
-        const result = await runCommitGuardHook();
-        if (!result.ok) {
-            console.error(result.message);
-            process.exitCode = 1;
-        }
-    }
-    catch (err) {
-        // Fail OPEN on an internal error: a guard bug must never wedge the agent's
-        // ability to commit. The pre-PR gate (prepr-gate.ts) is the backstop.
-        console.error(chalk.yellow(`acc-runner commit-guard skipped (internal error): ${err.message}`));
-    }
-});
-program
-    .command("version")
-    .description("Print CLI + protocol versions.")
-    .action(() => {
-    console.log(`acc-runner ${PACKAGE_VERSION}`);
-    console.log(`protocol     ${PROTOCOL_VERSION}`);
-});
+export const program = buildProgram({ invokedAs: "acc-runner" });
 /**
- * True when this module is the process entry point (run as the `acc-runner` bin,
- * `node dist/cli.js`, or the commit-guard hook re-invoke) — NOT when imported by
- * a test. realpath resolves the npm bin symlink to dist/cli.js so the compare
- * holds for a globally-installed CLI.
+ * Set to any non-empty value to silence the alias notice — for launchd plists,
+ * docker entrypoints and CI logs that were quiet before and should stay quiet.
  */
-function isMainModule() {
-    const entry = process.argv[1];
-    if (!entry)
-        return false;
-    try {
-        return realpathSync(entry) === realpathSync(fileURLToPath(import.meta.url));
-    }
-    catch {
+export const SUPPRESS_ENV = "ACC_SUPPRESS_ALIAS_NOTICE";
+/**
+ * Subcommands that must never gain a line of output. `_precommit-guard` runs
+ * inside `git commit`, where extra stderr is noise attached to every commit an
+ * agent makes.
+ */
+export const SILENT_SUBCOMMANDS = new Set(["_precommit-guard"]);
+/**
+ * The alias notice. It deliberately does NOT name a removal date: the
+ * deprecation window is an operator decision that has not been made, and
+ * inventing one here would put a date in front of users that nobody agreed to.
+ * When the window is decided, this string is the single place it lands.
+ */
+export function aliasNotice() {
+    return ("acc-runner is now `acc`. Every command works the same under the new name " +
+        "— `acc-runner login` is `acc runner login`, `acc-runner auth login` is `acc login`.\n" +
+        `The acc-runner alias still works; set ${SUPPRESS_ENV}=1 to hide this notice.`);
+}
+export function shouldWarnAlias(argv, env = process.env) {
+    if (env[SUPPRESS_ENV])
         return false;
-    }
+    const first = argv.slice(2).find((arg) => !arg.startsWith("-"));
+    return !(first && SILENT_SUBCOMMANDS.has(first));
 }
-if (isMainModule()) {
-    program.parseAsync(process.argv).catch((err) => {
-        console.error(chalk.red(`✗ ${err.message}`));
-        process.exit(1);
-    });
+if (isMainModule(import.meta.url)) {
+    if (shouldWarnAlias(process.argv))
+        process.stderr.write(`${chalk.yellow(aliasNotice())}\n`);
+    runProgram(program);
 }
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,YAAY,CAAC;KAClB,WAAW,CACV,mHAAmH,CACpH;KACA,OAAO,CAAC,GAAG,eAAe,eAAe,gBAAgB,GAAG,CAAC,CAAC;AAEjE,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,0DAA0D,CAAC;KACvE,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,uDAAuD,CAAC;KACpE,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,0DAA0D,CAAC;KACvE,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,8DAA8D;QAC9D,kEAAkE;QAClE,kCAAkC;QAClC,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,YAAY,EAAE,CAAC;QACrB,8DAA8D;QAC9D,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,YAAY,GAAG,OAAO;KACzB,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,0EAA0E,CAAC;KACvF,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,kEAAkE;QAClE,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0DAA0D,CAAC;KACvE,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,uBAAuB,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,YAAY;KACT,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,yBAAyB,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2DAA2D,CAAC;KACxE,MAAM,CACL,UAAU,EACV,uFAAuF,CACxF;KACA,MAAM,CAAC,KAAK,EAAE,IAA0B,EAAE,EAAE;IAC3C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CACV,gFAAgF,CACjF;KACA,cAAc,CAAC,aAAa,EAAE,gDAAgD,CAAC;KAC/E,cAAc,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KAC5F,MAAM,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;KAChF,MAAM,CAAC,KAAK,EAAE,IAA4D,EAAE,EAAE;IAC7E,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,aAAa,GAAG,OAAO;KAC1B,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,+CAA+C,CAAC,CAAC;AAEhE,aAAa;KACV,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QAC5C,iEAAiE;QACjE,kEAAkE;QAClE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,mDAAmD,CACvF,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,aAAa;KACV,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,iEAAiE,CAAC;KAC9E,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,eAAe,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,cAAc,GAAG,OAAO;KAC3B,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,wEAAwE,CAAC,CAAC;AAEzF,cAAc;KACX,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0BAA0B,CAAC;KACvC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,4BAA4B,CAAC,CAAC,KAAK,sDAAsD;YACvF,mCAAmC,CACtC,CACF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,cAAc;KACX,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,4EAA4E,CAAC;KACzF,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2DAA2D;AAC3D,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,wCAAwC;AACxC,OAAO;KACJ,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAC7C,WAAW,CAAC,iEAAiE,CAAC;KAC9E,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,sEAAsE;QACtE,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CAAC,qDAAsD,GAAa,CAAC,OAAO,EAAE,CAAC,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,gCAAgC,CAAC;KAC7C,MAAM,CAAC,GAAG,EAAE;IACX,OAAO,CAAC,GAAG,CAAC,cAAc,eAAe,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,gBAAgB,gBAAgB,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,CAAC,YAAY,CAAC,CAAC;AAE3B,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,CACL,2EAA2E;QAC3E,uFAAuF;QACvF,yCAAyC,YAAY,yBAAyB,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAc,EACd,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC,KAAK,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClC,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5F,UAAU,CAAC,OAAO,CAAC,CAAC;AACtB,CAAC"}

package/dist/keychain.d.ts

@@ -15,6 +15,23 @@ type KeytarLike = {
 export declare function saveSession(session: StoredSession): Promise<void>;
 export declare function loadSession(): Promise<StoredSession | null>;
 export declare function clearSession(): Promise<boolean>;
+/**
+ * AX-G1: a SECOND entry in the same keychain service, under a different account.
+ *
+ * The runner session lives at (service "acc-runner", account "default") and its
+ * JSON shape is a frozen contract. A person's CLI session is a different
+ * credential with a different shape and a different lifecycle — it is the
+ * human's own Supabase session, not a runner impersonation token — so it gets
+ * its own account slot rather than being squeezed into the frozen one. A machine
+ * that is both a runner and a signed-in workstation holds both, independently,
+ * and `acc-runner logout` still only clears the runner's.
+ *
+ * Same rule as the runner slot: the keychain is the ONLY writable surface for a
+ * credential. Nothing here ever touches the filesystem.
+ */
+export declare function saveSlot(account: string, value: unknown): Promise<void>;
+export declare function loadSlot<T>(account: string): Promise<T | null>;
+export declare function clearSlot(account: string): Promise<boolean>;
 /** Test-only seam used by the keychain test (overrides the lazy import). */
 export declare function __setKeytar(impl: KeytarLike | null): void;
 export {};

package/dist/keychain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAIzE,KAAK,UAAU,GAAG;IAChB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE,CAAC;AAYF,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAUjE;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAGrD;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAEzD"}
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAIzE,KAAK,UAAU,GAAG;IAChB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE,CAAC;AAYF,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAUjE;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAGrD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7E;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWpE;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjE;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAEzD"}