blun-king-cli 9.1.602 → 9.1.603

package/bin/launcher-runtime.js

@@ -1,491 +1,491 @@
-'use strict';
-/*
- * BLUN CLI Launcher (npm) — Erststart richtet alles ein:
- *   1. King richtet das Telegram-Plugin im BLUN_HOME ein
- * Danach: TUI starten. Anmeldung und Modellkatalog kommen ueber BLUN OAuth.
- */
-const fs = require('node:fs');
-const path = require('node:path');
-const os = require('node:os');
-const { spawn } = require('node:child_process');
-const {
-  LAUNCHER_MODES,
-  createLauncherEnvironment,
-  isNpmPackageUpdateRequest,
-  isStandaloneHelpRequest,
-  launcherHelpText,
-  launcherModeFromArgv,
-} = require('./launcher-mode');
-const { installManagedTelegramPlugin, installManagedAgentSpinePlugin } = require('./plugin-bootstrap');
-const {
-  availableStandardToolNames,
-  seedStandardDesignSkill,
-  seedStandardTools,
-} = require('./standard-tools-bootstrap');
-const { CORE_LOADED_MESSAGE } = require('./core-bootstrap');
-const {
-  appendLauncherStatus, claimLauncherRestart, consumeIntentionalStopMarker,
-  isAbnormalCoreExit, restartDelayMs,
-} = require('./launcher-restart-policy.cjs');
-const { recordRuntimeExit } = require('./runtime-exit-ledger.cjs');
-const { prepareManagedNodeRuntime } = require('./node-runtime');
-const { unsupportedNodeMessage } = require('./node-version');
-const { repairConfiguredNativeModules } = require('./native-module-repair');
-const { acquireSharedRuntimeLease, tryAcquireUpdateLease } = require('./update-lease');
-const { runExplicitUpdate, runUpdateNotice } = require('./update-notice');
-const {
-  ensurePrivateDirectory,
-  securePrivateFile,
-  writePrivateFile,
-} = require('./private-paths');
-
-const PKG = path.resolve(__dirname, '..');
-const ARGS = process.argv.slice(2);
-const CORE_LOAD_TIMEOUT_MS = 30_000;
-
-function normalizeWindowsPath(value) {
-  return path.win32.normalize(value).replace(/\\+$/u, '').toLowerCase();
-}
-
-function resolveLauncherPrivatePaths(options = {}) {
-  const env = options.env || process.env;
-  const platform = options.platform || process.platform;
-  const configuredHome = String(env.BLUN_HOME || '').trim();
-  if (platform !== 'win32') {
-    const userHome = (options.homedir || os.homedir)();
-    return {
-      blunHome: configuredHome ? path.resolve(configuredHome) : path.join(userHome, '.blun'),
-      userHome,
-    };
-  }
-
-  const fsImpl = options.fsImpl || fs;
-  const userInfo = (options.userInfo || os.userInfo)();
-  const reportedHome = String(userInfo?.homedir || '').trim();
-  if (!path.win32.isAbsolute(reportedHome) || reportedHome.startsWith('\\\\')) {
-    throw new Error('Das lokale Windows-Benutzerprofil konnte nicht sicher bestimmt werden.');
-  }
-  const resolvedHome = path.win32.resolve(reportedHome);
-  const stat = fsImpl.lstatSync(resolvedHome);
-  if (!stat.isDirectory() || stat.isSymbolicLink()) {
-    throw new Error('Das lokale Windows-Benutzerprofil ist kein vertrauenswuerdiges Verzeichnis.');
-  }
-  const realpath = fsImpl.realpathSync.native || fsImpl.realpathSync;
-  const userHome = path.win32.normalize(realpath(resolvedHome));
-  const volumeRoot = path.win32.parse(userHome).root;
-  if (!/^[A-Za-z]:\\$/u.test(volumeRoot)
-    || normalizeWindowsPath(userHome) !== normalizeWindowsPath(resolvedHome)) {
-    throw new Error('Das lokale Windows-Benutzerprofil ist kein kanonischer lokaler Pfad.');
-  }
-
-  const blunHome = path.win32.join(userHome, '.blun');
-  if (configuredHome
-    && normalizeWindowsPath(path.win32.resolve(configuredHome)) !== normalizeWindowsPath(blunHome)) {
-    throw new Error(`BLUN_HOME muss unter Windows exakt im Windows-Benutzerprofil liegen: ${blunHome}`);
-  }
-  return { blunHome, userHome };
-}
-
-function readPackageVersion() {
-  const { version } = JSON.parse(fs.readFileSync(path.join(PKG, 'package.json'), 'utf8'));
-  if (typeof version !== 'string' || version.length === 0) {
-    throw new Error('Ungueltige Paketversion in package.json');
-  }
-  return version;
-}
-
-function shouldDetachProtectedCore(options = {}) {
-  const platform = options.platform || process.platform;
-  const stdinIsTTY = Object.hasOwn(options, 'stdinIsTTY')
-    ? options.stdinIsTTY
-    : process.stdin.isTTY;
-  return platform !== 'win32' || stdinIsTTY !== true;
-}
-
-function spawnProtectedCore(args, env, cwd) {
-  const child = spawn(
-    process.execPath,
-    [path.join(PKG, 'bin', 'core-bootstrap.js'), ...args],
-    {
-      cwd,
-      detached: shouldDetachProtectedCore(),
-      env,
-      stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
-      windowsHide: true,
-    },
-  );
-  let loadedSettled = false;
-  let completedSettled = false;
-  let operatorSignal;
-  let resolveLoaded;
-  let resolveCompleted;
-  const loadTimer = setTimeout(() => {
-    try {
-      child.kill();
-    } catch {}
-  }, CORE_LOAD_TIMEOUT_MS);
-  const loaded = new Promise((resolve) => { resolveLoaded = resolve; });
-  const completed = new Promise((resolve) => { resolveCompleted = resolve; });
-  const settleLoaded = (value) => {
-    if (loadedSettled) return;
-    loadedSettled = true;
-    clearTimeout(loadTimer);
-    resolveLoaded(value);
-  };
-  const settleCompleted = (result) => {
-    if (completedSettled) return;
-    completedSettled = true;
-    for (const [signal, handler] of signalHandlers) process.removeListener(signal, handler);
-    settleLoaded(false);
-    resolveCompleted(operatorSignal === undefined ? result : { ...result, signal: operatorSignal });
-  };
-  const signalHandlers = new Map();
-  for (const signal of ['SIGHUP', 'SIGINT', 'SIGTERM']) {
-    const handler = () => {
-      operatorSignal = signal;
-      try {
-        child.kill(signal);
-      } catch {}
-    };
-    signalHandlers.set(signal, handler);
-    process.once(signal, handler);
-  }
-  child.on('message', (message) => {
-    if (message?.type !== CORE_LOADED_MESSAGE) return;
-    settleLoaded(true);
-    try {
-      child.disconnect();
-    } catch {}
-  });
-  child.once('error', (error) => settleCompleted({ error }));
-  child.once('exit', (code, signal) => settleCompleted({ code, signal }));
-  return { child, completed, loaded };
-}
-
-async function runInformationalCore(args, env, cwd, releaseNotice) {
-  const core = spawnProtectedCore(args, env, cwd);
-  await core.loaded;
-  await releaseNotice();
-  const result = await core.completed;
-  if (result.error) throw result.error;
-  return Number.isInteger(result.code) ? result.code : exitCodeForChild(result, false);
-}
-
-async function superviseProtectedCore(args, env, cwd, releaseNotice) {
-  let noticeReleased = false;
-  for (;;) {
-    const core = spawnProtectedCore(args, env, cwd);
-    const loaded = await core.loaded;
-    if (!noticeReleased) {
-      noticeReleased = true;
-      await releaseNotice();
-    }
-    const result = await core.completed;
-    const exitCode = result.error ? 1 : exitCodeForChild(result, loaded);
-    const intentionalStop = consumeIntentionalStopMarker({
-      homeDir: env.BLUN_HOME, childPid: core.child.pid, nowMs: Date.now(),
-    });
-    recordRuntimeExit({
-      homeDir: env.BLUN_HOME, source: 'launcher', kind: result.error ? 'child-error' : 'child-exit',
-      exitCode, signal: result.signal, phase: loaded ? 'runtime' : 'startup',
-      cliVersion: env.BLUN_PUBLIC_PACKAGE_VERSION, profile: env.BLUN_PROFILE,
-      loaded, childPid: core.child.pid, error: result.error,
-    });
-    if (intentionalStop || !isAbnormalCoreExit(result, loaded)) {
-      if (result.error) throw result.error;
-      return exitCode;
-    }
-    const claim = claimLauncherRestart({ homeDir: env.BLUN_HOME, nowMs: Date.now() });
-    try {
-      appendLauncherStatus({
-        homeDir: env.BLUN_HOME,
-        stateDir: env.BLUN_TELEGRAM_STATE_DIR
-          || path.join(env.BLUN_SHARED_HOME || env.BLUN_HOME, 'channels', 'telegram'),
-        nowMs: Date.now(), attempt: claim.attempt, limit: claim.limit, exitCode, signal: result.signal,
-        kind: claim.allowed ? 'launcher-restart' : 'launcher-restart-exhausted',
-      });
-    } catch {}
-    if (!claim.allowed) {
-      if (result.error) throw result.error;
-      return exitCode;
-    }
-    await new Promise((resolve) => setTimeout(resolve, restartDelayMs(claim.attempt)));
-  }
-}
-
-function exitCodeForChild(result, loaded) {
-  if (!loaded && result.code === 75) return 0;
-  if (Number.isInteger(result.code)) return result.code;
-  if (result.signal === 'SIGINT') return 130;
-  if (result.signal === 'SIGTERM') return 143;
-  return 1;
-}
-
-function installTelegramForProfile(packageRoot, blunDir) {
-  installManagedTelegramPlugin({ packageRoot, blunDir });
-  const channelsDir = path.join(blunDir, 'channels');
-  const channelDir = path.join(channelsDir, 'telegram');
-  ensurePrivateDirectory(channelsDir);
-  ensurePrivateDirectory(channelDir);
-  const envFile = path.join(channelDir, '.env');
-  if (!fs.existsSync(envFile)) {
-    writePrivateFile(envFile, 'BLUN_TELEGRAM_BOT_TOKEN=HIER_DEIN_BOT_TOKEN_EINFUEGEN\n');
-  } else {
-    securePrivateFile(envFile);
-  }
-}
-
-function spawnManagedLauncher(binary, cwd) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(binary, process.argv.slice(1), {
-      cwd,
-      env: process.env,
-      stdio: 'inherit',
-      windowsHide: true,
-    });
-    child.once('error', reject);
-    child.once('exit', (code, signal) => {
-      if (Number.isInteger(code)) {
-        resolve(code);
-        return;
-      }
-      if (signal === 'SIGINT') {
-        resolve(130);
-        return;
-      }
-      if (signal === 'SIGTERM') {
-        resolve(143);
-        return;
-      }
-      resolve(1);
-    });
-  });
-}
-
-async function runLauncher(options = {}) {
-  const callerCwd = process.cwd();
-  const mode = options.mode || launcherModeFromArgv(process.argv);
-  const explicitUpdateRequest = isNpmPackageUpdateRequest(ARGS);
-  const explicitToolsRequest = String(ARGS[0] || '').toLowerCase() === 'tools';
-  const noticeResult = options.skipUpdateNotice === true
-    ? { acquired: true, lease: { assertOwned() {}, async release() {} } }
-    : options.noticeLease
-    ? { acquired: true, lease: options.noticeLease }
-    : await tryAcquireUpdateLease({ packageRoot: PKG, role: 'notice' });
-  if (!noticeResult.acquired) {
-    if (explicitUpdateRequest) {
-      process.stderr.write('Das Update konnte nicht verifiziert werden.\n');
-      process.exitCode = 1;
-    }
-    return;
-  }
-  const noticeLease = noticeResult.lease;
-  let runtimeLease = options.runtimeLease;
-  let noticeReleased = false;
-  const releaseNotice = async () => {
-    if (noticeReleased) return;
-    noticeReleased = true;
-    await noticeLease.release();
-    await runtimeLease?.release();
-  };
-
-  try {
-    if (!runtimeLease && !explicitUpdateRequest) {
-      const installProbe = await tryAcquireUpdateLease({ packageRoot: PKG, role: 'install' });
-      if (!installProbe.acquired) {
-        process.stderr.write(explicitUpdateRequest
-          ? 'Das Update konnte nicht verifiziert werden.\n'
-          : 'Der geschuetzte BLUN-Start ist gerade nicht verfuegbar.\n');
-        process.exitCode = 1;
-        return;
-      }
-      await installProbe.lease.release();
-    }
-
-    if (explicitToolsRequest) {
-      const action = String(ARGS[1] || '').toLowerCase();
-      const available = availableStandardToolNames({ packageRoot: PKG });
-      if (action === 'list' && ARGS.length === 2) {
-        process.stdout.write(`${available.join('\n')}\n`);
-        return;
-      }
-      if (action === 'enable' && ARGS.length > 2) {
-        const privatePaths = resolveLauncherPrivatePaths();
-        const selected = [...new Set(ARGS.slice(2))];
-        const unknown = selected.find((name) => !available.includes(name));
-        if (unknown) {
-          process.stderr.write(`Unbekanntes Standard-Tool: ${unknown}\n`);
-          process.exitCode = 1;
-          return;
-        }
-        const mcpNames = selected.filter((name) => name !== 'telegram');
-        if (mcpNames.length > 0) {
-          seedStandardTools({
-            packageRoot: PKG,
-            blunDir: privatePaths.blunHome,
-            names: mcpNames,
-          });
-        }
-        if (selected.includes('telegram')) {
-          installTelegramForProfile(PKG, privatePaths.blunHome);
-        }
-        process.stdout.write(`${selected.join('\n')}\n`);
-        return;
-      }
-      process.stderr.write('Usage: blun tools list | blun tools enable <name...>\n');
-      process.exitCode = 1;
-      return;
-    }
-    if (ARGS.some((arg) => arg === '--version' || arg === '-V')) {
-      process.stdout.write(`${readPackageVersion()}\n`);
-      return;
-    }
-
-    if (explicitUpdateRequest) {
-      const privatePaths = resolveLauncherPrivatePaths();
-      const result = await runExplicitUpdate({
-        currentVersion: readPackageVersion(),
-        env: process.env,
-        stdin: process.stdin,
-        stdout: process.stdout,
-        stderr: process.stderr,
-        blunDir: privatePaths.blunHome,
-        packageRoot: PKG,
-        noticeLease,
-        request: ARGS[0],
-      });
-      if (result.kind === 'failed') process.exitCode = result.exitCode || 1;
-      return;
-    }
-
-    if (isStandaloneHelpRequest(ARGS)) {
-      const compatibilityError = unsupportedNodeMessage(process.versions.node, process.platform);
-      if (compatibilityError !== null) {
-        process.stderr.write(`${compatibilityError}\n`);
-        process.exitCode = 1;
-        return;
-      }
-      process.stdout.write(launcherHelpText());
-      const env = createLauncherEnvironment(process.env, mode, readPackageVersion());
-      const informationalEnv = { ...process.env };
-      delete informationalEnv.BLUN_HOME;
-      env.BLUN_HOME = resolveLauncherPrivatePaths({ env: informationalEnv }).blunHome;
-      process.exitCode = await runInformationalCore(ARGS, env, callerCwd, releaseNotice);
-      return;
-    }
-
-    let privatePaths;
-    const getPrivatePaths = () => {
-      privatePaths ||= resolveLauncherPrivatePaths();
-      return privatePaths;
-    };
-    const nodeRuntime = await prepareManagedNodeRuntime({
-      getBlunDir: () => getPrivatePaths().blunHome,
-    });
-    if (nodeRuntime.kind === 'failed') {
-      process.stderr.write(`${nodeRuntime.message}\n`);
-      process.exitCode = 1;
-      return;
-    }
-    if (nodeRuntime.kind === 'managed') {
-      process.stdout.write('BLUN hat die passende Node.js-Laufzeit eingerichtet.\n');
-      await releaseNotice();
-      process.exitCode = await spawnManagedLauncher(nodeRuntime.binary, callerCwd);
-      return;
-    }
-
-    if (ARGS.some((arg) => arg === '--help' || arg === '-h')) {
-      process.stdout.write(launcherHelpText());
-      const env = createLauncherEnvironment(process.env, mode, readPackageVersion());
-      const informationalEnv = { ...process.env };
-      delete informationalEnv.BLUN_HOME;
-      env.BLUN_HOME = resolveLauncherPrivatePaths({ env: informationalEnv }).blunHome;
-      process.exitCode = await superviseProtectedCore(ARGS, env, callerCwd, releaseNotice);
-      return;
-    }
-
-    const blunDir = getPrivatePaths().blunHome;
-    ensurePrivateDirectory(blunDir);
-
-    // --- 1. Oeffentlicher npm-Update-Dialog. -------------------------------
-    const updateResult = options.skipUpdateNotice === true
-      ? { kind: 'continue', reason: 'notice_busy' }
-      : await runUpdateNotice({
-        currentVersion: readPackageVersion(),
-        argv: ARGS,
-        env: process.env,
-        stdin: process.stdin,
-        stdout: process.stdout,
-        stderr: process.stderr,
-        blunDir,
-        packageRoot: PKG,
-        noticeLease,
-      });
-    if (updateResult.kind === 'installed' || updateResult.kind === 'update_in_progress') return;
-
-    if (!runtimeLease) {
-      const runtimeResult = await acquireSharedRuntimeLease({ packageRoot: PKG });
-      if (!runtimeResult.acquired) {
-        process.stderr.write('Der geschuetzte BLUN-Start ist gerade nicht verfuegbar.\n');
-        process.exitCode = 1;
-        return;
-      }
-      runtimeLease = runtimeResult.lease;
-    }
-
-  // --- 2. Bestehende Konfiguration absichern -------------------------------
-  // Ein frischer Start bleibt absichtlich ohne statischen Anbieter. /login
-  // provisioniert King ueber den BLUN-OAuth-Server.
-    const cfgFile = path.join(blunDir, 'config.toml');
-    if (fs.existsSync(cfgFile)) securePrivateFile(cfgFile);
-    require('./verify-bundled-agent-sources.cjs').verifyBundledAgentSources(PKG);
-
-    // --- 3. BLUN-Standard-MCPs additiv im Benutzerprofil einrichten ---------
-    const standardMcpNames = availableStandardToolNames({ packageRoot: PKG })
-      .filter((name) => name !== 'telegram');
-    seedStandardTools({
-      packageRoot: PKG,
-      blunDir,
-      names: standardMcpNames,
-    });
-
-  // --- 4. Eigenes BLUN-Grunddesign als einzigen Standard-Skill installieren
-    seedStandardDesignSkill({ packageRoot: PKG, blunDir });
-    installManagedAgentSpinePlugin({ packageRoot: PKG, blunDir });
-
-    // --- 5. Telegram-Plugin + Token-Vorlage (nur King) -----------------------
-    if (mode === LAUNCHER_MODES.KING) {
-      installTelegramForProfile(PKG, blunDir);
-    }
-
-    const nativeModules = repairConfiguredNativeModules({
-      blunDir,
-      callerCwd,
-      onRepairStart() {
-        process.stdout.write('BLUN richtet native Node.js-Module fuer die neue Laufzeit ein.\n');
-      },
-    });
-    if (nativeModules.repaired.length > 0) {
-      process.stdout.write('Native Node.js-Module sind wieder einsatzbereit.\n');
-    }
-
-    // --- 6. Start -----------------------------------------------------------
-    const env = createLauncherEnvironment(process.env, mode, readPackageVersion(), blunDir);
-    env.BLUN_HOME = blunDir;
-    process.exitCode = await superviseProtectedCore(
-      ARGS,
-      env,
-      callerCwd,
-      releaseNotice,
-    );
-  } finally {
-    await releaseNotice();
-  }
-}
-
-module.exports = {
-  resolveLauncherPrivatePaths,
-  runLauncher,
-  shouldDetachProtectedCore,
-  spawnManagedLauncher,
-};
+'use strict';
+/*
+ * BLUN CLI Launcher (npm) — Erststart richtet alles ein:
+ *   1. King richtet das Telegram-Plugin im BLUN_HOME ein
+ * Danach: TUI starten. Anmeldung und Modellkatalog kommen ueber BLUN OAuth.
+ */
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const { spawn } = require('node:child_process');
+const {
+  LAUNCHER_MODES,
+  createLauncherEnvironment,
+  isNpmPackageUpdateRequest,
+  isStandaloneHelpRequest,
+  launcherHelpText,
+  launcherModeFromArgv,
+} = require('./launcher-mode');
+const { installManagedTelegramPlugin, installManagedAgentSpinePlugin } = require('./plugin-bootstrap');
+const {
+  availableStandardToolNames,
+  seedStandardDesignSkill,
+  seedStandardTools,
+} = require('./standard-tools-bootstrap');
+const { CORE_LOADED_MESSAGE } = require('./core-bootstrap');
+const {
+  appendLauncherStatus, claimLauncherRestart, consumeIntentionalStopMarker,
+  isAbnormalCoreExit, restartDelayMs,
+} = require('./launcher-restart-policy.cjs');
+const { recordRuntimeExit } = require('./runtime-exit-ledger.cjs');
+const { prepareManagedNodeRuntime } = require('./node-runtime');
+const { unsupportedNodeMessage } = require('./node-version');
+const { repairConfiguredNativeModules } = require('./native-module-repair');
+const { acquireSharedRuntimeLease, tryAcquireUpdateLease } = require('./update-lease');
+const { runExplicitUpdate, runUpdateNotice } = require('./update-notice');
+const {
+  ensurePrivateDirectory,
+  securePrivateFile,
+  writePrivateFile,
+} = require('./private-paths');
+
+const PKG = path.resolve(__dirname, '..');
+const ARGS = process.argv.slice(2);
+const CORE_LOAD_TIMEOUT_MS = 30_000;
+
+function normalizeWindowsPath(value) {
+  return path.win32.normalize(value).replace(/\\+$/u, '').toLowerCase();
+}
+
+function resolveLauncherPrivatePaths(options = {}) {
+  const env = options.env || process.env;
+  const platform = options.platform || process.platform;
+  const configuredHome = String(env.BLUN_HOME || '').trim();
+  if (platform !== 'win32') {
+    const userHome = (options.homedir || os.homedir)();
+    return {
+      blunHome: configuredHome ? path.resolve(configuredHome) : path.join(userHome, '.blun'),
+      userHome,
+    };
+  }
+
+  const fsImpl = options.fsImpl || fs;
+  const userInfo = (options.userInfo || os.userInfo)();
+  const reportedHome = String(userInfo?.homedir || '').trim();
+  if (!path.win32.isAbsolute(reportedHome) || reportedHome.startsWith('\\\\')) {
+    throw new Error('Das lokale Windows-Benutzerprofil konnte nicht sicher bestimmt werden.');
+  }
+  const resolvedHome = path.win32.resolve(reportedHome);
+  const stat = fsImpl.lstatSync(resolvedHome);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error('Das lokale Windows-Benutzerprofil ist kein vertrauenswuerdiges Verzeichnis.');
+  }
+  const realpath = fsImpl.realpathSync.native || fsImpl.realpathSync;
+  const userHome = path.win32.normalize(realpath(resolvedHome));
+  const volumeRoot = path.win32.parse(userHome).root;
+  if (!/^[A-Za-z]:\\$/u.test(volumeRoot)
+    || normalizeWindowsPath(userHome) !== normalizeWindowsPath(resolvedHome)) {
+    throw new Error('Das lokale Windows-Benutzerprofil ist kein kanonischer lokaler Pfad.');
+  }
+
+  const blunHome = path.win32.join(userHome, '.blun');
+  if (configuredHome
+    && normalizeWindowsPath(path.win32.resolve(configuredHome)) !== normalizeWindowsPath(blunHome)) {
+    throw new Error(`BLUN_HOME muss unter Windows exakt im Windows-Benutzerprofil liegen: ${blunHome}`);
+  }
+  return { blunHome, userHome };
+}
+
+function readPackageVersion() {
+  const { version } = JSON.parse(fs.readFileSync(path.join(PKG, 'package.json'), 'utf8'));
+  if (typeof version !== 'string' || version.length === 0) {
+    throw new Error('Ungueltige Paketversion in package.json');
+  }
+  return version;
+}
+
+function shouldDetachProtectedCore(options = {}) {
+  const platform = options.platform || process.platform;
+  const stdinIsTTY = Object.hasOwn(options, 'stdinIsTTY')
+    ? options.stdinIsTTY
+    : process.stdin.isTTY;
+  return platform !== 'win32' || stdinIsTTY !== true;
+}
+
+function spawnProtectedCore(args, env, cwd) {
+  const child = spawn(
+    process.execPath,
+    [path.join(PKG, 'bin', 'core-bootstrap.js'), ...args],
+    {
+      cwd,
+      detached: shouldDetachProtectedCore(),
+      env,
+      stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
+      windowsHide: true,
+    },
+  );
+  let loadedSettled = false;
+  let completedSettled = false;
+  let operatorSignal;
+  let resolveLoaded;
+  let resolveCompleted;
+  const loadTimer = setTimeout(() => {
+    try {
+      child.kill();
+    } catch {}
+  }, CORE_LOAD_TIMEOUT_MS);
+  const loaded = new Promise((resolve) => { resolveLoaded = resolve; });
+  const completed = new Promise((resolve) => { resolveCompleted = resolve; });
+  const settleLoaded = (value) => {
+    if (loadedSettled) return;
+    loadedSettled = true;
+    clearTimeout(loadTimer);
+    resolveLoaded(value);
+  };
+  const settleCompleted = (result) => {
+    if (completedSettled) return;
+    completedSettled = true;
+    for (const [signal, handler] of signalHandlers) process.removeListener(signal, handler);
+    settleLoaded(false);
+    resolveCompleted(operatorSignal === undefined ? result : { ...result, signal: operatorSignal });
+  };
+  const signalHandlers = new Map();
+  for (const signal of ['SIGHUP', 'SIGINT', 'SIGTERM']) {
+    const handler = () => {
+      operatorSignal = signal;
+      try {
+        child.kill(signal);
+      } catch {}
+    };
+    signalHandlers.set(signal, handler);
+    process.once(signal, handler);
+  }
+  child.on('message', (message) => {
+    if (message?.type !== CORE_LOADED_MESSAGE) return;
+    settleLoaded(true);
+    try {
+      child.disconnect();
+    } catch {}
+  });
+  child.once('error', (error) => settleCompleted({ error }));
+  child.once('exit', (code, signal) => settleCompleted({ code, signal }));
+  return { child, completed, loaded };
+}
+
+async function runInformationalCore(args, env, cwd, releaseNotice) {
+  const core = spawnProtectedCore(args, env, cwd);
+  await core.loaded;
+  await releaseNotice();
+  const result = await core.completed;
+  if (result.error) throw result.error;
+  return Number.isInteger(result.code) ? result.code : exitCodeForChild(result, false);
+}
+
+async function superviseProtectedCore(args, env, cwd, releaseNotice) {
+  let noticeReleased = false;
+  for (;;) {
+    const core = spawnProtectedCore(args, env, cwd);
+    const loaded = await core.loaded;
+    if (!noticeReleased) {
+      noticeReleased = true;
+      await releaseNotice();
+    }
+    const result = await core.completed;
+    const exitCode = result.error ? 1 : exitCodeForChild(result, loaded);
+    const intentionalStop = consumeIntentionalStopMarker({
+      homeDir: env.BLUN_HOME, childPid: core.child.pid, nowMs: Date.now(),
+    });
+    recordRuntimeExit({
+      homeDir: env.BLUN_HOME, source: 'launcher', kind: result.error ? 'child-error' : 'child-exit',
+      exitCode, signal: result.signal, phase: loaded ? 'runtime' : 'startup',
+      cliVersion: env.BLUN_PUBLIC_PACKAGE_VERSION, profile: env.BLUN_PROFILE,
+      loaded, childPid: core.child.pid, error: result.error,
+    });
+    if (intentionalStop || !isAbnormalCoreExit(result, loaded)) {
+      if (result.error) throw result.error;
+      return exitCode;
+    }
+    const claim = claimLauncherRestart({ homeDir: env.BLUN_HOME, nowMs: Date.now() });
+    try {
+      appendLauncherStatus({
+        homeDir: env.BLUN_HOME,
+        stateDir: env.BLUN_TELEGRAM_STATE_DIR
+          || path.join(env.BLUN_SHARED_HOME || env.BLUN_HOME, 'channels', 'telegram'),
+        nowMs: Date.now(), attempt: claim.attempt, limit: claim.limit, exitCode, signal: result.signal,
+        kind: claim.allowed ? 'launcher-restart' : 'launcher-restart-exhausted',
+      });
+    } catch {}
+    if (!claim.allowed) {
+      if (result.error) throw result.error;
+      return exitCode;
+    }
+    await new Promise((resolve) => setTimeout(resolve, restartDelayMs(claim.attempt)));
+  }
+}
+
+function exitCodeForChild(result, loaded) {
+  if (!loaded && result.code === 75) return 0;
+  if (Number.isInteger(result.code)) return result.code;
+  if (result.signal === 'SIGINT') return 130;
+  if (result.signal === 'SIGTERM') return 143;
+  return 1;
+}
+
+function installTelegramForProfile(packageRoot, blunDir) {
+  installManagedTelegramPlugin({ packageRoot, blunDir });
+  const channelsDir = path.join(blunDir, 'channels');
+  const channelDir = path.join(channelsDir, 'telegram');
+  ensurePrivateDirectory(channelsDir);
+  ensurePrivateDirectory(channelDir);
+  const envFile = path.join(channelDir, '.env');
+  if (!fs.existsSync(envFile)) {
+    writePrivateFile(envFile, 'BLUN_TELEGRAM_BOT_TOKEN=HIER_DEIN_BOT_TOKEN_EINFUEGEN\n');
+  } else {
+    securePrivateFile(envFile);
+  }
+}
+
+function spawnManagedLauncher(binary, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, process.argv.slice(1), {
+      cwd,
+      env: process.env,
+      stdio: 'inherit',
+      windowsHide: true,
+    });
+    child.once('error', reject);
+    child.once('exit', (code, signal) => {
+      if (Number.isInteger(code)) {
+        resolve(code);
+        return;
+      }
+      if (signal === 'SIGINT') {
+        resolve(130);
+        return;
+      }
+      if (signal === 'SIGTERM') {
+        resolve(143);
+        return;
+      }
+      resolve(1);
+    });
+  });
+}
+
+async function runLauncher(options = {}) {
+  const callerCwd = process.cwd();
+  const mode = options.mode || launcherModeFromArgv(process.argv);
+  const explicitUpdateRequest = isNpmPackageUpdateRequest(ARGS);
+  const explicitToolsRequest = String(ARGS[0] || '').toLowerCase() === 'tools';
+  const noticeResult = options.skipUpdateNotice === true
+    ? { acquired: true, lease: { assertOwned() {}, async release() {} } }
+    : options.noticeLease
+    ? { acquired: true, lease: options.noticeLease }
+    : await tryAcquireUpdateLease({ packageRoot: PKG, role: 'notice' });
+  if (!noticeResult.acquired) {
+    if (explicitUpdateRequest) {
+      process.stderr.write('Das Update konnte nicht verifiziert werden.\n');
+      process.exitCode = 1;
+    }
+    return;
+  }
+  const noticeLease = noticeResult.lease;
+  let runtimeLease = options.runtimeLease;
+  let noticeReleased = false;
+  const releaseNotice = async () => {
+    if (noticeReleased) return;
+    noticeReleased = true;
+    await noticeLease.release();
+    await runtimeLease?.release();
+  };
+
+  try {
+    if (!runtimeLease && !explicitUpdateRequest) {
+      const installProbe = await tryAcquireUpdateLease({ packageRoot: PKG, role: 'install' });
+      if (!installProbe.acquired) {
+        process.stderr.write(explicitUpdateRequest
+          ? 'Das Update konnte nicht verifiziert werden.\n'
+          : 'Der geschuetzte BLUN-Start ist gerade nicht verfuegbar.\n');
+        process.exitCode = 1;
+        return;
+      }
+      await installProbe.lease.release();
+    }
+
+    if (explicitToolsRequest) {
+      const action = String(ARGS[1] || '').toLowerCase();
+      const available = availableStandardToolNames({ packageRoot: PKG });
+      if (action === 'list' && ARGS.length === 2) {
+        process.stdout.write(`${available.join('\n')}\n`);
+        return;
+      }
+      if (action === 'enable' && ARGS.length > 2) {
+        const privatePaths = resolveLauncherPrivatePaths();
+        const selected = [...new Set(ARGS.slice(2))];
+        const unknown = selected.find((name) => !available.includes(name));
+        if (unknown) {
+          process.stderr.write(`Unbekanntes Standard-Tool: ${unknown}\n`);
+          process.exitCode = 1;
+          return;
+        }
+        const mcpNames = selected.filter((name) => name !== 'telegram');
+        if (mcpNames.length > 0) {
+          seedStandardTools({
+            packageRoot: PKG,
+            blunDir: privatePaths.blunHome,
+            names: mcpNames,
+          });
+        }
+        if (selected.includes('telegram')) {
+          installTelegramForProfile(PKG, privatePaths.blunHome);
+        }
+        process.stdout.write(`${selected.join('\n')}\n`);
+        return;
+      }
+      process.stderr.write('Usage: blun tools list | blun tools enable <name...>\n');
+      process.exitCode = 1;
+      return;
+    }
+    if (ARGS.some((arg) => arg === '--version' || arg === '-V')) {
+      process.stdout.write(`${readPackageVersion()}\n`);
+      return;
+    }
+
+    if (explicitUpdateRequest) {
+      const privatePaths = resolveLauncherPrivatePaths();
+      const result = await runExplicitUpdate({
+        currentVersion: readPackageVersion(),
+        env: process.env,
+        stdin: process.stdin,
+        stdout: process.stdout,
+        stderr: process.stderr,
+        blunDir: privatePaths.blunHome,
+        packageRoot: PKG,
+        noticeLease,
+        request: ARGS[0],
+      });
+      if (result.kind === 'failed') process.exitCode = result.exitCode || 1;
+      return;
+    }
+
+    if (isStandaloneHelpRequest(ARGS)) {
+      const compatibilityError = unsupportedNodeMessage(process.versions.node, process.platform);
+      if (compatibilityError !== null) {
+        process.stderr.write(`${compatibilityError}\n`);
+        process.exitCode = 1;
+        return;
+      }
+      process.stdout.write(launcherHelpText());
+      const env = createLauncherEnvironment(process.env, mode, readPackageVersion());
+      const informationalEnv = { ...process.env };
+      delete informationalEnv.BLUN_HOME;
+      env.BLUN_HOME = resolveLauncherPrivatePaths({ env: informationalEnv }).blunHome;
+      process.exitCode = await runInformationalCore(ARGS, env, callerCwd, releaseNotice);
+      return;
+    }
+
+    let privatePaths;
+    const getPrivatePaths = () => {
+      privatePaths ||= resolveLauncherPrivatePaths();
+      return privatePaths;
+    };
+    const nodeRuntime = await prepareManagedNodeRuntime({
+      getBlunDir: () => getPrivatePaths().blunHome,
+    });
+    if (nodeRuntime.kind === 'failed') {
+      process.stderr.write(`${nodeRuntime.message}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    if (nodeRuntime.kind === 'managed') {
+      process.stdout.write('BLUN hat die passende Node.js-Laufzeit eingerichtet.\n');
+      await releaseNotice();
+      process.exitCode = await spawnManagedLauncher(nodeRuntime.binary, callerCwd);
+      return;
+    }
+
+    if (ARGS.some((arg) => arg === '--help' || arg === '-h')) {
+      process.stdout.write(launcherHelpText());
+      const env = createLauncherEnvironment(process.env, mode, readPackageVersion());
+      const informationalEnv = { ...process.env };
+      delete informationalEnv.BLUN_HOME;
+      env.BLUN_HOME = resolveLauncherPrivatePaths({ env: informationalEnv }).blunHome;
+      process.exitCode = await superviseProtectedCore(ARGS, env, callerCwd, releaseNotice);
+      return;
+    }
+
+    const blunDir = getPrivatePaths().blunHome;
+    ensurePrivateDirectory(blunDir);
+
+    // --- 1. Oeffentlicher npm-Update-Dialog. -------------------------------
+    const updateResult = options.skipUpdateNotice === true
+      ? { kind: 'continue', reason: 'notice_busy' }
+      : await runUpdateNotice({
+        currentVersion: readPackageVersion(),
+        argv: ARGS,
+        env: process.env,
+        stdin: process.stdin,
+        stdout: process.stdout,
+        stderr: process.stderr,
+        blunDir,
+        packageRoot: PKG,
+        noticeLease,
+      });
+    if (updateResult.kind === 'installed' || updateResult.kind === 'update_in_progress') return;
+
+    if (!runtimeLease) {
+      const runtimeResult = await acquireSharedRuntimeLease({ packageRoot: PKG });
+      if (!runtimeResult.acquired) {
+        process.stderr.write('Der geschuetzte BLUN-Start ist gerade nicht verfuegbar.\n');
+        process.exitCode = 1;
+        return;
+      }
+      runtimeLease = runtimeResult.lease;
+    }
+
+  // --- 2. Bestehende Konfiguration absichern -------------------------------
+  // Ein frischer Start bleibt absichtlich ohne statischen Anbieter. /login
+  // provisioniert King ueber den BLUN-OAuth-Server.
+    const cfgFile = path.join(blunDir, 'config.toml');
+    if (fs.existsSync(cfgFile)) securePrivateFile(cfgFile);
+    require('./verify-bundled-agent-sources.cjs').verifyBundledAgentSources(PKG);
+
+    // --- 3. BLUN-Standard-MCPs additiv im Benutzerprofil einrichten ---------
+    const standardMcpNames = availableStandardToolNames({ packageRoot: PKG })
+      .filter((name) => name !== 'telegram');
+    seedStandardTools({
+      packageRoot: PKG,
+      blunDir,
+      names: standardMcpNames,
+    });
+
+  // --- 4. Eigenes BLUN-Grunddesign als einzigen Standard-Skill installieren
+    seedStandardDesignSkill({ packageRoot: PKG, blunDir });
+    installManagedAgentSpinePlugin({ packageRoot: PKG, blunDir });
+
+    // --- 5. Telegram-Plugin + Token-Vorlage (nur King) -----------------------
+    if (mode === LAUNCHER_MODES.KING) {
+      installTelegramForProfile(PKG, blunDir);
+    }
+
+    const nativeModules = repairConfiguredNativeModules({
+      blunDir,
+      callerCwd,
+      onRepairStart() {
+        process.stdout.write('BLUN richtet native Node.js-Module fuer die neue Laufzeit ein.\n');
+      },
+    });
+    if (nativeModules.repaired.length > 0) {
+      process.stdout.write('Native Node.js-Module sind wieder einsatzbereit.\n');
+    }
+
+    // --- 6. Start -----------------------------------------------------------
+    const env = createLauncherEnvironment(process.env, mode, readPackageVersion(), blunDir);
+    env.BLUN_HOME = blunDir;
+    process.exitCode = await superviseProtectedCore(
+      ARGS,
+      env,
+      callerCwd,
+      releaseNotice,
+    );
+  } finally {
+    await releaseNotice();
+  }
+}
+
+module.exports = {
+  resolveLauncherPrivatePaths,
+  runLauncher,
+  shouldDetachProtectedCore,
+  spawnManagedLauncher,
+};