blun-king-cli 9.1.601 → 9.1.603

package/bin/agentspine-king-worker-host.mjs

@@ -1,160 +1,160 @@
-#!/usr/bin/env node
-import { appendFile, mkdir, readFile, realpath } from 'node:fs/promises';
-import path from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { setTimeout as delay } from 'node:timers/promises';
-import { createGoalHostFactory } from './agentspine-king-host-runner.mjs';
-import { ingestGoalInbox } from './agentspine-king-goal-inbox.mjs';
-import { createGoalStatusReporter, goalResultRejectionCode } from './agentspine-king-status-policy.mjs';
-import snapshotPolicy from './agentspine-king-snapshot-policy.cjs';
-
-const packageRoot = path.resolve(import.meta.dirname, '..');
-const required = ['blunHome', 'profile', 'projectRoot', 'projectId', 'standFile', 'expectedStandSha256',
-  'expectedSnapshotSha256', 'exchangeDirectory', 'telegramQueueFile', 'instructionSenderId', 'instructionChatId',
-  'logicalPersonaId', 'runtimePersonaId', 'groupId', 'ownerSubjectId', 'permission', 'gatewayStateDirectory'];
-
-export async function loadWorkerConfig(file) {
-  const config = JSON.parse(await readFile(path.resolve(file), 'utf8'));
-  if (config?.schema !== 'blun.king-goal-worker-config/v1'
-    || required.some(key => typeof config[key] !== 'string' || !config[key])
-    || (config.instructionThreadId !== null && config.instructionThreadId !== undefined && (typeof config.instructionThreadId !== 'string'
-      || !/^[1-9][0-9]*$/.test(config.instructionThreadId) || !Number.isSafeInteger(Number(config.instructionThreadId))))
-    || !['manual', 'auto', 'yolo'].includes(config.permission)) throw new Error('KING_WORKER_CONFIG_INVALID');
-  for (const key of ['blunHome', 'projectRoot', 'exchangeDirectory', 'telegramQueueFile', 'gatewayStateDirectory']) {
-    if (!path.isAbsolute(config[key])) throw new Error('KING_WORKER_ABSOLUTE_PATH_REQUIRED');
-  }
-  const blunHome = await realpath(config.blunHome);
-  const relative = path.relative(blunHome, path.resolve(config.gatewayStateDirectory));
-  if (path.isAbsolute(relative) || relative === '..' || relative.startsWith('..' + path.sep)) throw new Error('KING_WORKER_STATE_OUTSIDE_APP_HOME');
-  const state = await realpath(config.gatewayStateDirectory);
-  const canonicalRelative = path.relative(blunHome, state);
-  if (path.isAbsolute(canonicalRelative) || canonicalRelative === '..' || canonicalRelative.startsWith('..' + path.sep)) {
-    throw new Error('KING_WORKER_STATE_OUTSIDE_APP_HOME');
-  }
-  return Object.freeze({ ...config, blunHome, gatewayStateDirectory: state, projectRoot: await realpath(config.projectRoot) });
-}
-
-export async function runGuardedWorkerTick(context) {
-  const { config, gateway, hostFactory, env, adapter } = context;
-  const snapshot = snapshotPolicy.verifyWorkspaceSnapshot({ root: config.projectRoot, projectId: config.projectId,
-    standFile: config.standFile, expectedStandSha256: config.expectedStandSha256,
-    expectedSnapshotSha256: config.expectedSnapshotSha256 });
-  const personas = await gateway.loadPersonaRuntime(snapshot.root);
-  const persona = personas.runtime.personas.find(item => item.personaId === config.runtimePersonaId && item.status === 'active');
-  const binding = personas.policy.bindings.find(item => item.id === persona?.bindingId && item.active);
-  if (!binding || binding.profileId !== config.profile || binding.groupId !== config.groupId) {
-    throw new Error('KING_WORKER_IDENTITY_MISMATCH');
-  }
-  const { withOwnedFileLock } = await import(pathToFileURL(path.join(packageRoot,
-    'agent-spine-plugin/src/lib/owned-file-lock.js')).href);
-  const statusReporter = createGoalStatusReporter({
-    stateFile: path.join(config.blunHome, 'worker', 'goal-status-v2.json'),
-    scope: { logicalPersonaId: config.logicalPersonaId, runtimePersonaId: config.runtimePersonaId,
-      projectId: config.projectId, groupId: config.groupId, ownerSubjectId: config.ownerSubjectId,
-      chatId: config.instructionChatId, senderId: config.instructionSenderId,
-      threadId: config.instructionThreadId ?? null },
-    withOwnedFileLock, loadPolicy: () => gateway.loadChannelPolicy(snapshot.root), adapter,
-  });
-  const statusReports = [];
-  const reportCommittedStatus = async () => {
-    const context = await gateway.gatewayContext({ root: snapshot.root, agentId: config.runtimePersonaId });
-    if (!context.enabled || context.killSwitch) return;
-    await statusReporter.reconcile(context);
-    statusReports.push(...await statusReporter.flush());
-  };
-  // Reconcile the saved goal state first: a prior process may have stopped after committing its tick.
-  await reportCommittedStatus();
-  const intake = await ingestGoalInbox({ exchangeDirectory: config.exchangeDirectory,
-    queueFile: config.telegramQueueFile, checkpointFile: path.join(config.blunHome, 'worker', 'goal-queue-checkpoint.json'),
-    instructionSenderId: config.instructionSenderId, instructionChatId: config.instructionChatId,
-    instructionThreadId: config.instructionThreadId,
-    logicalPersonaId: config.logicalPersonaId, runtimePersonaId: config.runtimePersonaId,
-    projectId: config.projectId, groupId: config.groupId, ownerSubjectId: config.ownerSubjectId,
-    snapshot, assignGoal: gateway.assignGoal,
-    recordResult: result => result.status === 'rejected'
-      ? statusReporter.record({ kind: 'intake-rejected', eventId: result.eventId,
-        messageId: result.messageId, error: result.error }) : undefined });
-  const result = await gateway.runWorkerTick({ root: snapshot.root, workerId: 'gateway-worker:blun:' + process.pid,
-    agentId: config.runtimePersonaId, projectId: config.projectId, groupId: config.groupId,
-    goalOnly: true, env,
-    hostFactory: async item => {
-      const host = await hostFactory(item);
-      return { ...host, async run() {
-        try { return await host.run(); }
-        catch (error) {
-          const rejection = goalResultRejectionCode(error);
-          if (rejection) {
-            // Record the concrete parser failure before the gateway replaces it with an execution hold.
-            await statusReporter.record({ kind: 'result-rejected', eventId: `${item.queueId}:${item.attempts}`,
-              goalId: item.goal.goalId, goalStepId: item.goalStep?.stepId ?? null,
-              attempt: item.attempts, error: rejection });
-          }
-          throw error;
-        }
-      } };
-    },
-    adapter: { send: item => adapter.send(item) } });
-  await reportCommittedStatus();
-  return { ...result, intake, statusReports };
-}
-
-export async function runWorkerHost(config, { once = false, signal, onResult = () => {} } = {}) {
-  const gateway = await import(pathToFileURL(path.join(packageRoot, 'agent-spine-plugin/src/index.js')).href);
-  const { createKingWorkerHarness, LocalKaos } = await import(pathToFileURL(path.join(packageRoot, 'worker-host.mjs')).href);
-  const env = { ...process.env, BLUN_HOME: config.blunHome, BLUN_PROFILE: config.profile };
-  const harness = createKingWorkerHarness({ homeDir: config.blunHome, configPath: config.settingsPath });
-  const hostFactory = createGoalHostFactory({ harness, workDir: config.projectRoot, model: config.model,
-    permission: config.permission, tickTimeoutMs: config.tickTimeoutMs, cleanupTimeoutMs: config.cleanupTimeoutMs,
-    sessionOptions: { kaos: (await LocalKaos.create()).withCwd(config.projectRoot).withEnv({
-      BLUN_HOME: config.blunHome, BLUN_PROFILE: config.profile, AGENTSPINE_STATE_DIR: config.gatewayStateDirectory,
-    }) },
-    signal });
-  const adapter = gateway.createTelegramAdapter({ root: config.projectRoot, env });
-  try {
-    do {
-      if (signal?.aborted) return { status: 'stopped', processed: false };
-      const result = await runGuardedWorkerTick({ config, gateway, hostFactory, env, adapter });
-      await mkdir(path.join(config.blunHome, 'worker'), { recursive: true });
-      await appendFile(path.join(config.blunHome, 'worker', 'worker.log'), JSON.stringify({
-        schema: 'blun.king-goal-worker-log/v1', at: new Date().toISOString(), status: result.status,
-        queueId: result.queueId ?? null, hostSettlement: result.hostSettlement ?? null,
-        statusReports: result.statusReports,
-        intake: result.intake.map(item => ({ status: item.status, messageId: item.messageId, error: item.error }))
-      }) + '\n', { mode: 0o600 });
-      await onResult(result);
-      if (once || result.status === 'stopped' || result.status === 'blocked') return result;
-      await delay(result.processed ? 1000 : 15000, undefined, { signal }).catch(error => {
-        if (error.name !== 'AbortError') throw error;
-      });
-    } while (!signal?.aborted);
-    return { status: 'stopped', processed: false };
-  } finally {
-    let quiet = true;
-    for (const session of harness.sessions.values()) {
-      const proof = await session.quiesce({ deadlineAt: Date.now() + (config.cleanupTimeoutMs ?? 10000) }).catch(() => null);
-      if (!proof || proof.status !== 'quiescent' || proof.remaining.length) quiet = false;
-    }
-    // Never turn a cleanup deadline into a successful host termination acknowledgement.
-    if (quiet) await harness.close();
-  }
-}
-
-async function main() {
-  const args = process.argv.slice(2);
-  const index = args.indexOf('--config');
-  if (index < 0 || !args[index + 1] || args[index + 1].startsWith('--')) throw new Error('--config requires a path');
-  const config = await loadWorkerConfig(args[index + 1]);
-  process.env.BLUN_HOME = config.blunHome;
-  process.env.BLUN_PROFILE = config.profile;
-  process.env.AGENTSPINE_STATE_DIR = config.gatewayStateDirectory;
-  const controller = new AbortController();
-  const stop = () => controller.abort();
-  process.once('SIGINT', stop); process.once('SIGTERM', stop);
-  try { await runWorkerHost(config, { once: args.includes('--once'), signal: controller.signal,
-    onResult: result => process.stdout.write(JSON.stringify(result) + '\n') }); }
-  finally { process.removeListener('SIGINT', stop); process.removeListener('SIGTERM', stop); }
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main().catch(error => { process.stderr.write(String(error.message).slice(0, 500) + '\n'); process.exitCode = 1; });
-}
+#!/usr/bin/env node
+import { appendFile, mkdir, readFile, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { setTimeout as delay } from 'node:timers/promises';
+import { createGoalHostFactory } from './agentspine-king-host-runner.mjs';
+import { ingestGoalInbox } from './agentspine-king-goal-inbox.mjs';
+import { createGoalStatusReporter, goalResultRejectionCode } from './agentspine-king-status-policy.mjs';
+import snapshotPolicy from './agentspine-king-snapshot-policy.cjs';
+
+const packageRoot = path.resolve(import.meta.dirname, '..');
+const required = ['blunHome', 'profile', 'projectRoot', 'projectId', 'standFile', 'expectedStandSha256',
+  'expectedSnapshotSha256', 'exchangeDirectory', 'telegramQueueFile', 'instructionSenderId', 'instructionChatId',
+  'logicalPersonaId', 'runtimePersonaId', 'groupId', 'ownerSubjectId', 'permission', 'gatewayStateDirectory'];
+
+export async function loadWorkerConfig(file) {
+  const config = JSON.parse(await readFile(path.resolve(file), 'utf8'));
+  if (config?.schema !== 'blun.king-goal-worker-config/v1'
+    || required.some(key => typeof config[key] !== 'string' || !config[key])
+    || (config.instructionThreadId !== null && config.instructionThreadId !== undefined && (typeof config.instructionThreadId !== 'string'
+      || !/^[1-9][0-9]*$/.test(config.instructionThreadId) || !Number.isSafeInteger(Number(config.instructionThreadId))))
+    || !['manual', 'auto', 'yolo'].includes(config.permission)) throw new Error('KING_WORKER_CONFIG_INVALID');
+  for (const key of ['blunHome', 'projectRoot', 'exchangeDirectory', 'telegramQueueFile', 'gatewayStateDirectory']) {
+    if (!path.isAbsolute(config[key])) throw new Error('KING_WORKER_ABSOLUTE_PATH_REQUIRED');
+  }
+  const blunHome = await realpath(config.blunHome);
+  const relative = path.relative(blunHome, path.resolve(config.gatewayStateDirectory));
+  if (path.isAbsolute(relative) || relative === '..' || relative.startsWith('..' + path.sep)) throw new Error('KING_WORKER_STATE_OUTSIDE_APP_HOME');
+  const state = await realpath(config.gatewayStateDirectory);
+  const canonicalRelative = path.relative(blunHome, state);
+  if (path.isAbsolute(canonicalRelative) || canonicalRelative === '..' || canonicalRelative.startsWith('..' + path.sep)) {
+    throw new Error('KING_WORKER_STATE_OUTSIDE_APP_HOME');
+  }
+  return Object.freeze({ ...config, blunHome, gatewayStateDirectory: state, projectRoot: await realpath(config.projectRoot) });
+}
+
+export async function runGuardedWorkerTick(context) {
+  const { config, gateway, hostFactory, env, adapter } = context;
+  const snapshot = snapshotPolicy.verifyWorkspaceSnapshot({ root: config.projectRoot, projectId: config.projectId,
+    standFile: config.standFile, expectedStandSha256: config.expectedStandSha256,
+    expectedSnapshotSha256: config.expectedSnapshotSha256 });
+  const personas = await gateway.loadPersonaRuntime(snapshot.root);
+  const persona = personas.runtime.personas.find(item => item.personaId === config.runtimePersonaId && item.status === 'active');
+  const binding = personas.policy.bindings.find(item => item.id === persona?.bindingId && item.active);
+  if (!binding || binding.profileId !== config.profile || binding.groupId !== config.groupId) {
+    throw new Error('KING_WORKER_IDENTITY_MISMATCH');
+  }
+  const { withOwnedFileLock } = await import(pathToFileURL(path.join(packageRoot,
+    'agent-spine-plugin/src/lib/owned-file-lock.js')).href);
+  const statusReporter = createGoalStatusReporter({
+    stateFile: path.join(config.blunHome, 'worker', 'goal-status-v2.json'),
+    scope: { logicalPersonaId: config.logicalPersonaId, runtimePersonaId: config.runtimePersonaId,
+      projectId: config.projectId, groupId: config.groupId, ownerSubjectId: config.ownerSubjectId,
+      chatId: config.instructionChatId, senderId: config.instructionSenderId,
+      threadId: config.instructionThreadId ?? null },
+    withOwnedFileLock, loadPolicy: () => gateway.loadChannelPolicy(snapshot.root), adapter,
+  });
+  const statusReports = [];
+  const reportCommittedStatus = async () => {
+    const context = await gateway.gatewayContext({ root: snapshot.root, agentId: config.runtimePersonaId });
+    if (!context.enabled || context.killSwitch) return;
+    await statusReporter.reconcile(context);
+    statusReports.push(...await statusReporter.flush());
+  };
+  // Reconcile the saved goal state first: a prior process may have stopped after committing its tick.
+  await reportCommittedStatus();
+  const intake = await ingestGoalInbox({ exchangeDirectory: config.exchangeDirectory,
+    queueFile: config.telegramQueueFile, checkpointFile: path.join(config.blunHome, 'worker', 'goal-queue-checkpoint.json'),
+    instructionSenderId: config.instructionSenderId, instructionChatId: config.instructionChatId,
+    instructionThreadId: config.instructionThreadId,
+    logicalPersonaId: config.logicalPersonaId, runtimePersonaId: config.runtimePersonaId,
+    projectId: config.projectId, groupId: config.groupId, ownerSubjectId: config.ownerSubjectId,
+    snapshot, assignGoal: gateway.assignGoal,
+    recordResult: result => result.status === 'rejected'
+      ? statusReporter.record({ kind: 'intake-rejected', eventId: result.eventId,
+        messageId: result.messageId, error: result.error }) : undefined });
+  const result = await gateway.runWorkerTick({ root: snapshot.root, workerId: 'gateway-worker:blun:' + process.pid,
+    agentId: config.runtimePersonaId, projectId: config.projectId, groupId: config.groupId,
+    goalOnly: true, env,
+    hostFactory: async item => {
+      const host = await hostFactory(item);
+      return { ...host, async run() {
+        try { return await host.run(); }
+        catch (error) {
+          const rejection = goalResultRejectionCode(error);
+          if (rejection) {
+            // Record the concrete parser failure before the gateway replaces it with an execution hold.
+            await statusReporter.record({ kind: 'result-rejected', eventId: `${item.queueId}:${item.attempts}`,
+              goalId: item.goal.goalId, goalStepId: item.goalStep?.stepId ?? null,
+              attempt: item.attempts, error: rejection });
+          }
+          throw error;
+        }
+      } };
+    },
+    adapter: { send: item => adapter.send(item) } });
+  await reportCommittedStatus();
+  return { ...result, intake, statusReports };
+}
+
+export async function runWorkerHost(config, { once = false, signal, onResult = () => {} } = {}) {
+  const gateway = await import(pathToFileURL(path.join(packageRoot, 'agent-spine-plugin/src/index.js')).href);
+  const { createKingWorkerHarness, LocalKaos } = await import(pathToFileURL(path.join(packageRoot, 'worker-host.mjs')).href);
+  const env = { ...process.env, BLUN_HOME: config.blunHome, BLUN_PROFILE: config.profile };
+  const harness = createKingWorkerHarness({ homeDir: config.blunHome, configPath: config.settingsPath });
+  const hostFactory = createGoalHostFactory({ harness, workDir: config.projectRoot, model: config.model,
+    permission: config.permission, tickTimeoutMs: config.tickTimeoutMs, cleanupTimeoutMs: config.cleanupTimeoutMs,
+    sessionOptions: { kaos: (await LocalKaos.create()).withCwd(config.projectRoot).withEnv({
+      BLUN_HOME: config.blunHome, BLUN_PROFILE: config.profile, AGENTSPINE_STATE_DIR: config.gatewayStateDirectory,
+    }) },
+    signal });
+  const adapter = gateway.createTelegramAdapter({ root: config.projectRoot, env });
+  try {
+    do {
+      if (signal?.aborted) return { status: 'stopped', processed: false };
+      const result = await runGuardedWorkerTick({ config, gateway, hostFactory, env, adapter });
+      await mkdir(path.join(config.blunHome, 'worker'), { recursive: true });
+      await appendFile(path.join(config.blunHome, 'worker', 'worker.log'), JSON.stringify({
+        schema: 'blun.king-goal-worker-log/v1', at: new Date().toISOString(), status: result.status,
+        queueId: result.queueId ?? null, hostSettlement: result.hostSettlement ?? null,
+        statusReports: result.statusReports,
+        intake: result.intake.map(item => ({ status: item.status, messageId: item.messageId, error: item.error }))
+      }) + '\n', { mode: 0o600 });
+      await onResult(result);
+      if (once || result.status === 'stopped' || result.status === 'blocked') return result;
+      await delay(result.processed ? 1000 : 15000, undefined, { signal }).catch(error => {
+        if (error.name !== 'AbortError') throw error;
+      });
+    } while (!signal?.aborted);
+    return { status: 'stopped', processed: false };
+  } finally {
+    let quiet = true;
+    for (const session of harness.sessions.values()) {
+      const proof = await session.quiesce({ deadlineAt: Date.now() + (config.cleanupTimeoutMs ?? 10000) }).catch(() => null);
+      if (!proof || proof.status !== 'quiescent' || proof.remaining.length) quiet = false;
+    }
+    // Never turn a cleanup deadline into a successful host termination acknowledgement.
+    if (quiet) await harness.close();
+  }
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const index = args.indexOf('--config');
+  if (index < 0 || !args[index + 1] || args[index + 1].startsWith('--')) throw new Error('--config requires a path');
+  const config = await loadWorkerConfig(args[index + 1]);
+  process.env.BLUN_HOME = config.blunHome;
+  process.env.BLUN_PROFILE = config.profile;
+  process.env.AGENTSPINE_STATE_DIR = config.gatewayStateDirectory;
+  const controller = new AbortController();
+  const stop = () => controller.abort();
+  process.once('SIGINT', stop); process.once('SIGTERM', stop);
+  try { await runWorkerHost(config, { once: args.includes('--once'), signal: controller.signal,
+    onResult: result => process.stdout.write(JSON.stringify(result) + '\n') }); }
+  finally { process.removeListener('SIGINT', stop); process.removeListener('SIGTERM', stop); }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch(error => { process.stderr.write(String(error.message).slice(0, 500) + '\n'); process.exitCode = 1; });
+}

package/bin/core-bootstrap.js

@@ -1,77 +1,77 @@
-'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { pathToFileURL } = require('node:url');
-
-const { acquireSharedRuntimeLease } = require('./update-lease');
-const { installWindowsNodeCrashDump } = require('./windows-node-crash-dump.cjs');
-const { recordRuntimeExit } = require('./runtime-exit-ledger.cjs');
-const { isStandaloneHelpRequest } = require('./launcher-mode');
-
-const CORE_LOADED_MESSAGE = 'blun-core-bootstrap-loaded';
-
-async function runCoreBootstrap() {
-  const informational = isStandaloneHelpRequest(process.argv.slice(2));
-  let diagnostics;
-  if (!informational) {
-    try { diagnostics = installWindowsNodeCrashDump({ homeDir: process.env.BLUN_HOME }); } catch {}
-  }
-  const packageRoot = path.resolve(__dirname, '..');
-  const mainPath = path.join(packageRoot, 'blun.mjs');
-  let leaseResult;
-
-  try {
-    leaseResult = await acquireSharedRuntimeLease({ packageRoot });
-    if (!leaseResult.acquired) throw new Error('RUNTIME_PROTECTION_UNAVAILABLE');
-    leaseResult.lease.assertOwned();
-    process.argv = [process.execPath, mainPath, ...process.argv.slice(2)];
-    await import(pathToFileURL(mainPath).href);
-    leaseResult.lease.assertOwned();
-  } catch (error) {
-    if (!informational) {
-      try {
-        if (diagnostics?.enabled) diagnostics.write(error, 'bootstrap-failure');
-        else recordRuntimeExit({ homeDir: process.env.BLUN_HOME, source: 'bootstrap',
-          kind: 'bootstrap-failure', phase: 'startup', error });
-      } catch {}
-    }
-    try { diagnostics?.dispose(); } catch {}
-    try { await leaseResult?.lease?.release(); }
-    catch (leaseError) {
-      if (!informational) {
-        try {
-          recordRuntimeExit({ homeDir: process.env.BLUN_HOME, source: 'bootstrap',
-            kind: 'lease-release-failure', phase: 'cleanup', error: leaseError });
-        } catch {}
-      }
-    }
-    throw error;
-  }
-
-  // The bundled CLI loads package assets lazily after module evaluation. Keep
-  // the install lease for this process's lifetime, without keeping print/help
-  // commands alive solely because of the owner server.
-  leaseResult.lease.unref();
-
-  if (process.connected) {
-    try {
-      process.send({ type: CORE_LOADED_MESSAGE }, () => {
-        try {
-          process.disconnect();
-        } catch {}
-      });
-    } catch {}
-  }
-}
-
-if (require.main === module) {
-  // oxlint-disable-next-line unicorn/prefer-top-level-await -- Worker entry is CommonJS.
-  void runCoreBootstrap().catch((error) => {
-    const message = error && error.message ? error.message : String(error);
-    fs.writeSync(process.stderr.fd, `BLUN Start fehlgeschlagen: ${message}\n`);
-    process.exit(1);
-  });
-}
-
-module.exports = { CORE_LOADED_MESSAGE, runCoreBootstrap };
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+
+const { acquireSharedRuntimeLease } = require('./update-lease');
+const { installWindowsNodeCrashDump } = require('./windows-node-crash-dump.cjs');
+const { recordRuntimeExit } = require('./runtime-exit-ledger.cjs');
+const { isStandaloneHelpRequest } = require('./launcher-mode');
+
+const CORE_LOADED_MESSAGE = 'blun-core-bootstrap-loaded';
+
+async function runCoreBootstrap() {
+  const informational = isStandaloneHelpRequest(process.argv.slice(2));
+  let diagnostics;
+  if (!informational) {
+    try { diagnostics = installWindowsNodeCrashDump({ homeDir: process.env.BLUN_HOME }); } catch {}
+  }
+  const packageRoot = path.resolve(__dirname, '..');
+  const mainPath = path.join(packageRoot, 'blun.mjs');
+  let leaseResult;
+
+  try {
+    leaseResult = await acquireSharedRuntimeLease({ packageRoot });
+    if (!leaseResult.acquired) throw new Error('RUNTIME_PROTECTION_UNAVAILABLE');
+    leaseResult.lease.assertOwned();
+    process.argv = [process.execPath, mainPath, ...process.argv.slice(2)];
+    await import(pathToFileURL(mainPath).href);
+    leaseResult.lease.assertOwned();
+  } catch (error) {
+    if (!informational) {
+      try {
+        if (diagnostics?.enabled) diagnostics.write(error, 'bootstrap-failure');
+        else recordRuntimeExit({ homeDir: process.env.BLUN_HOME, source: 'bootstrap',
+          kind: 'bootstrap-failure', phase: 'startup', error });
+      } catch {}
+    }
+    try { diagnostics?.dispose(); } catch {}
+    try { await leaseResult?.lease?.release(); }
+    catch (leaseError) {
+      if (!informational) {
+        try {
+          recordRuntimeExit({ homeDir: process.env.BLUN_HOME, source: 'bootstrap',
+            kind: 'lease-release-failure', phase: 'cleanup', error: leaseError });
+        } catch {}
+      }
+    }
+    throw error;
+  }
+
+  // The bundled CLI loads package assets lazily after module evaluation. Keep
+  // the install lease for this process's lifetime, without keeping print/help
+  // commands alive solely because of the owner server.
+  leaseResult.lease.unref();
+
+  if (process.connected) {
+    try {
+      process.send({ type: CORE_LOADED_MESSAGE }, () => {
+        try {
+          process.disconnect();
+        } catch {}
+      });
+    } catch {}
+  }
+}
+
+if (require.main === module) {
+  // oxlint-disable-next-line unicorn/prefer-top-level-await -- Worker entry is CommonJS.
+  void runCoreBootstrap().catch((error) => {
+    const message = error && error.message ? error.message : String(error);
+    fs.writeSync(process.stderr.fd, `BLUN Start fehlgeschlagen: ${message}\n`);
+    process.exit(1);
+  });
+}
+
+module.exports = { CORE_LOADED_MESSAGE, runCoreBootstrap };