claude-dev-env 2.34.0 → 2.36.0

package/.agents/skills/autoconverge/SKILL.md

@@ -59,8 +59,10 @@ python "$HOME/.claude/skills/_shared/pr-loop/scripts/select_converge_pacer.py" \
   [`../_shared/pr-loop/portable-driver.md`](../_shared/pr-loop/portable-driver.md).
   **Do not abort** because the Workflow tool is missing.
 
-Transport still needs authenticated GitHub access for the PR's owner (`gh` or
-`pr-loop-cloud-transport`).
+Set the GitHub transport directive before any GitHub step. Use `transport: "cloud"` in a
+Cloud session. Use `transport: "local"` in a local session. Cloud uses the
+connected GitHub MCP tools and never starts a local GitHub CLI authentication
+flow.
 
 ## Review-lens boundary
 
@@ -68,18 +70,19 @@ The code-review lens boundary (workflow agent versus the built-in `/code-review`
 command) is defined on the **Code-review lens** bullet in
 [`reference/convergence.md`](reference/convergence.md).
 
-## Transport check (before any GitHub step)
+## Select the GitHub transport directive before any GitHub step
 
-Run `command -v gh`; when it succeeds, run `gh auth status`; once the PR
-scope is resolved, run `gh api repos/<owner>/<repo> --jq .permissions.push`
-and take `true` as the pass. When any check fails, run the
-`pr-loop-cloud-transport` skill first and route every `gh` operation in this
-skill through its substitution matrix. The workflow script
-(`workflow/converge.mjs`) embeds `gh` commands and gh-backed helper scripts in
-its agent prompts, so a cloud run also applies the same substitution to those
-agent prompts when it authors the launch — the transport skill covers the
-orchestrating session's own steps, and the script's agent-prompt text carries
-`gh` calls the spawned agents cannot run in a cloud session.
+In a Cloud session, set `transport: "cloud"` and load the GitHub MCP schemas
+before the first GitHub tool call. Do not run any local GitHub CLI
+authentication, account-switch, or token command. Use the operation in
+[`cloud-pr-loop-compatibility.md`](../../../docs/references/cloud-pr-loop-compatibility.md)
+for each GitHub read or write. Use the Cloud session's credentialed push path
+for local commits. If that path rejects a push, report the exact error instead
+of trying to log in through the local CLI.
+
+In a local session, set `transport: "local"` and use the authenticated local
+GitHub CLI. The workflow defaults to this value when older callers omit the
+field.
 
 ## Pre-flight (main session)
 
@@ -161,7 +164,7 @@ orchestrating session's own steps, and the script's agent-prompt text carries
 ```
 Workflow({
   scriptPath: "<this skill dir>/workflow/converge.mjs",
-  args: { owner: "<O>", repo: "<R>", prNumber: <N>, bugbotDisabled: false, copilotDisabled: false, homeDirectory: "<HOME>" }
+  args: { owner: "<O>", repo: "<R>", prNumber: <N>, bugbotDisabled: false, copilotDisabled: false, homeDirectory: "<HOME>", transport: "<cloud|local>" }
 })
 ```
 
@@ -173,7 +176,8 @@ the absolute path to the directory that holds `.claude` (resolve it once from
 runs in a sandbox with no access to environment variables, so the run reads the
 home directory from this arg to build the path to the codex-review scripts the
 Codex gate calls; leave it out and the Codex gate cannot find those scripts. Set
-`bugbotDisabled: true` only when the user has opted Cursor Bugbot out for the
+`transport: "cloud"` for Cloud and `transport: "local"` for local execution.
+Set `bugbotDisabled: true` only when the user has opted Cursor Bugbot out for the
 run; otherwise the workflow detects an opt-out or an unreachable Bugbot on its
 own. Set `copilotDisabled: true` when the step 5 quota pre-check exits non-zero,
 and `false` when it exits 0; on `true` the workflow skips the Copilot gate with

package/.agents/skills/autoconverge/reference/gotchas.md

@@ -46,9 +46,9 @@ fails in a new way.
   not `~/.claude/...`; a tilde resolves to the wrong home and gives a
   file-not-found error that looks like a script failure.
 
-- **`gh` token drift across accounts.** When a run touches more than one GitHub
-  account, pin the token with `--user <login>`; `gh auth token` alone can return
-  another account's token after a switch.
+- **Local identity drift across accounts.** A local run that touches more than
+  one GitHub account must use the selected local account. Cloud runs use the
+  connected GitHub MCP identity and never use local CLI identity commands.
 
 - **Commit or push fails after a repair.** Read the hook or command output,
   repair the named issue, and record the rerun. Apply the

package/.agents/skills/autoconverge/reference/multi-pr.md

@@ -73,6 +73,7 @@ Workflow({
   args: {
     convergeScriptPath: "<this skill dir>/workflow/converge.mjs",
     homeDirectory: "<HOME>",
+    transport: "<cloud|local>",
     prs: [
       { owner: "<O>", repo: "<R>", prNumber: <N1>, repoPath: "<abs worktree 1>", bugbotDisabled: false, copilotDisabled: false },
       { owner: "<O>", repo: "<R>", prNumber: <N2>, repoPath: "<abs worktree 2>", bugbotDisabled: false, copilotDisabled: false }
@@ -87,8 +88,11 @@ checked out in. `homeDirectory` is the absolute path to the directory that holds
 `.claude` (resolve it once from `$HOME`, or `$env:USERPROFILE` on Windows, with
 forward slashes); the fan-out forwards it to every child run, which needs it to
 build the codex-review scripts path because the workflow sandbox has no access to
-environment variables. The workflow runs in the background and notifies the session on
-completion; watch live progress with `/workflows`, where each PR's child run
+environment variables. Set `transport: "cloud"` in a Cloud session and
+`transport: "local"` in a local session. Cloud uses the connected GitHub MCP
+tools and skips local CLI authentication. The workflow runs in the background
+and notifies the session on completion; watch live progress with `/workflows`,
+where each PR's child run
 appears under its own group.
 
 The workflow returns

package/.agents/skills/autoconverge/workflow/converge.contract.test.mjs

@@ -32,6 +32,17 @@ test('review tasks use code-quality-agent and keep the working tree read-only',
   assert.match(reviewTaskSource, /Make no edit to the tree under verification/)
 })
 
+test('workflow agents receive the selected GitHub transport before role instructions', () => {
+  assert.match(
+    workflowSource,
+    /HEADLESS_EDIT_PREAMBLE\}\$\{githubTransportDirective\(activeGithubTransport\)\}\$\{worktreeDirective/,
+  )
+  assert.match(
+    workflowSource,
+    /HEADLESS_READONLY_PREAMBLE\}\$\{githubTransportDirective\(activeGithubTransport\)\}\$\{worktreeDirective/,
+  )
+})
+
 test('review result parser accepts one standalone terminal disposition only', () => {
   const parseReviewResult = loadReviewResultParser()
 

package/.agents/skills/autoconverge/workflow/converge.mjs

@@ -91,6 +91,7 @@ const HEADLESS_READONLY_PREAMBLE = HEADLESS_EDIT_PREAMBLE.replace(
 )
 
 let activeRepoPath = null
+let activeGithubTransport = 'local'
 
 /**
  * Build the per-agent worktree directive for a path-scoped run.
@@ -111,33 +112,11 @@ const worktreeDirective = (repoPath) =>
     ? `WORKTREE — this PR is checked out at ${repoPath}. Unless a step explicitly names a different repository directory (for example an environment-hardening repo checkout, which you cd into exactly as that step directs), run every git, gh, diff, edit, commit, push, and test command for this PR in that worktree: cd "${repoPath}" before any such command, and resolve repository roots from there.\n\n`
     : ''
 
-/**
- * Spawn a workflow agent that edits code, with the full edit preamble prepended
- * to its prompt. An edit agent may run rm during cleanup, so it inherits the
- * rm-shape rules alongside the no-confirmation-prompt guidance. On a path-scoped
- * run the worktree directive is prepended too, so the agent runs in the PR's own
- * worktree (activeRepoPath); on a single-PR run that directive is empty and the
- * agent keeps its own working directory. A read-only agent (a review, verify, or
- * utility spawn) routes through convergeReadOnlyAgent for the trimmed preamble.
- * @param {string} prompt the agent's role-specific instruction body
- * @param {object} options the agent() options (label, phase, schema, agentType, model)
- * @returns {Promise<*>} the agent() result
- */
 const convergeAgent = (prompt, options) =>
-  agent(`${HEADLESS_EDIT_PREAMBLE}${worktreeDirective(activeRepoPath)}${prompt}`, options)
+  agent(`${HEADLESS_EDIT_PREAMBLE}${githubTransportDirective(activeGithubTransport)}${worktreeDirective(activeRepoPath)}${prompt}`, options)
 
-/**
- * Spawn a read-only workflow agent with the trimmed read-only preamble prepended
- * to its prompt. A review, verify, or utility agent edits nothing and never runs
- * rm, so it receives the read-only preamble that drops the rm-shape-rules bullet.
- * The worktree directive is prepended on a path-scoped run exactly as for
- * convergeAgent, so a read-only agent still runs in the PR's own worktree.
- * @param {string} prompt the agent's role-specific instruction body
- * @param {object} options the agent() options (label, phase, schema, agentType, model)
- * @returns {Promise<*>} the agent() result
- */
 const convergeReadOnlyAgent = (prompt, options) =>
-  agent(`${HEADLESS_READONLY_PREAMBLE}${worktreeDirective(activeRepoPath)}${prompt}`, options)
+  agent(`${HEADLESS_READONLY_PREAMBLE}${githubTransportDirective(activeGithubTransport)}${worktreeDirective(activeRepoPath)}${prompt}`, options)
 
 /**
  * Spawn a fresh git-utility Explore agent for a specific task. The one task,
@@ -1627,19 +1606,32 @@ function normalizeRunInput(rawArgs) {
   }
 }
 
-/**
- * Validate the normalized run input into either usable coordinates or a
- * structured blocker. The run cannot build a single GitHub call without owner,
- * repo, and prNumber, so a null payload (failed parse or missing args) or a
- * payload missing any coordinate yields a blocker the top-level run reports as
- * {converged:false, blocker} rather than throwing on input.owner at startup.
- * @param {string|object} rawArgs the workflow args global (JSON string or object)
- * @returns {{input: object|null, blocker: string|null}} usable coordinates or a blocker
- */
+const DEFAULT_GITHUB_TRANSPORT = 'local'
+const GITHUB_TRANSPORT_DIRECTIVES = {
+  local:
+    'LOCAL GITHUB TRANSPORT DIRECTIVE. Use the authenticated local GitHub CLI for GitHub operations. Report local authentication or permission failures directly.\n\n',
+  cloud:
+    'CLOUD GITHUB TRANSPORT DIRECTIVE. Use the connected GitHub MCP tools for every GitHub API read and write. Load the GitHub MCP schemas before the first MCP call and resolve the connected identity with mcp__github__get_me. Do not invoke a local GitHub CLI for authentication, account switching, token lookup, pull-request operations, review operations, or push setup. Replace local CLI steps in this prompt with the matching operation in docs/references/cloud-pr-loop-compatibility.md. For a local commit push, use only the credentialed push path supplied by the Cloud session. If no credentialed path is available, return a named blocker instead of attempting a login.\n\n',
+}
+const VALID_GITHUB_TRANSPORTS = new Set(Object.keys(GITHUB_TRANSPORT_DIRECTIVES))
+
+function githubTransportDirective(transport) {
+  return GITHUB_TRANSPORT_DIRECTIVES[transport] || GITHUB_TRANSPORT_DIRECTIVES[DEFAULT_GITHUB_TRANSPORT]
+}
+
 function classifyRunInput(rawArgs) {
   const candidate = normalizeRunInput(rawArgs)
   const hasUsableCoordinates =
     candidate != null && candidate.owner && candidate.repo && candidate.prNumber
+  const hasValidTransport =
+    candidate != null &&
+    (candidate.transport === undefined || VALID_GITHUB_TRANSPORTS.has(candidate.transport))
+  if (hasUsableCoordinates && !hasValidTransport) {
+    return {
+      input: null,
+      blocker: 'invalid run transport: expected "local" or "cloud"',
+    }
+  }
   if (hasUsableCoordinates) return { input: candidate, blocker: null }
   return {
     input: null,
@@ -1654,6 +1646,7 @@ if (runInput.blocker) {
 }
 const input = runInput.input
 activeRepoPath = typeof input.repoPath === 'string' && input.repoPath ? input.repoPath : null
+activeGithubTransport = input.transport === undefined ? DEFAULT_GITHUB_TRANSPORT : input.transport
 const prCoordinates = `owner=${input.owner} repo=${input.repo} PR #${input.prNumber} (https://github.com/${input.owner}/${input.repo}/pull/${input.prNumber})`
 
 /**

package/.agents/skills/autoconverge/workflow/converge.run-input.test.mjs

@@ -17,10 +17,10 @@ function sourceSliceBetween(startNeedle, endNeedle) {
 
 const productionModule = new Function(
   `${sourceSliceBetween('function normalizeRunInput(', '\nconst runInput =')}\n` +
-    'return { normalizeRunInput, classifyRunInput };',
+    'return { normalizeRunInput, classifyRunInput, githubTransportDirective };',
 )();
 
-const { normalizeRunInput, classifyRunInput } = productionModule;
+const { normalizeRunInput, classifyRunInput, githubTransportDirective } = productionModule;
 
 const VALID_COORDINATES = { owner: 'jl-cmd', repo: 'claude-dev-env', prNumber: 543 };
 
@@ -46,6 +46,19 @@ test('classifyRunInput accepts coordinates carrying owner, repo, and prNumber',
   assert.equal(classified.blocker, null);
 });
 
+test('classifyRunInput accepts the cloud transport without changing the input shape', () => {
+  const cloudInput = { ...VALID_COORDINATES, transport: 'cloud' };
+  const classified = classifyRunInput(cloudInput);
+  assert.deepEqual(classified.input, cloudInput);
+  assert.equal(classified.blocker, null);
+});
+
+test('classifyRunInput blocks an unknown transport before any GitHub work starts', () => {
+  const classified = classifyRunInput({ ...VALID_COORDINATES, transport: 'proxy' });
+  assert.equal(classified.input, null);
+  assert.match(classified.blocker, /transport/i);
+});
+
 test('classifyRunInput blocks a failed parse with a structured blocker and no input', () => {
   const classified = classifyRunInput('not json at all');
   assert.equal(classified.input, null);
@@ -90,3 +103,14 @@ test('classifyRunInput leaves copilotDisabled undefined when the input omits it'
   const classified = classifyRunInput(VALID_COORDINATES);
   assert.equal(classified.input.copilotDisabled, undefined);
 });
+
+test('the cloud transport directive selects MCP and contains no local CLI auth command', () => {
+  const cloudDirective = githubTransportDirective('cloud');
+  assert.match(cloudDirective, /mcp__github__/);
+  assert.match(cloudDirective, /credentialed push path/);
+  assert.doesNotMatch(cloudDirective, /gh auth/);
+});
+
+test('the local transport directive keeps the local CLI path', () => {
+  assert.match(githubTransportDirective('local'), /authenticated local GitHub CLI/);
+});

package/.agents/skills/autoconverge/workflow/converge_multi.mjs

@@ -57,18 +57,9 @@ function isUsablePrEntry(prEntry) {
   )
 }
 
-/**
- * Validate the normalized multi-PR input into usable coordinates or a blocker.
- *
- * A fan-out run needs the absolute converge.mjs script path and a non-empty list
- * of PR entries that each carry owner, repo, prNumber, and the absolute worktree
- * path the PR is checked out in. A payload that fails to parse, a non-string
- * convergeScriptPath, a missing or empty prs list, or any entry missing a
- * coordinate yields a blocker the top-level run reports as
- * {converged:false, blocker} rather than throwing on a missing field.
- * @param {string|object} rawArgs the workflow args global (JSON string or object)
- * @returns {{input: object|null, blocker: string|null}} usable coordinates or a blocker
- */
+const DEFAULT_GITHUB_TRANSPORT = 'local'
+const VALID_GITHUB_TRANSPORTS = new Set(['local', 'cloud'])
+
 function classifyMultiInput(rawArgs) {
   const candidate = normalizeMultiInput(rawArgs)
   if (candidate == null) {
@@ -84,6 +75,12 @@ function classifyMultiInput(rawArgs) {
         'invalid run coordinates: convergeScriptPath (absolute path to converge.mjs) is required',
     }
   }
+  if (candidate.transport !== undefined && !VALID_GITHUB_TRANSPORTS.has(candidate.transport)) {
+    return {
+      input: null,
+      blocker: 'invalid run transport: expected "local" or "cloud"',
+    }
+  }
   if (!Array.isArray(candidate.prs) || candidate.prs.length === 0) {
     return {
       input: null,
@@ -102,21 +99,7 @@ function classifyMultiInput(rawArgs) {
   return { input: candidate, blocker: null }
 }
 
-/**
- * Build the converge.mjs child-run args for one validated PR entry.
- *
- * Every per-run opt-out the child converge.mjs reads is forwarded here so the
- * fan-out honors it: bugbotDisabled skips the Bugbot phase, and copilotDisabled
- * short-circuits the Copilot quota gate when the account is out of premium
- * requests. An entry that omits an opt-out defaults it to false so the child
- * runs that phase. homeDirectory is a run-level value forwarded to every child
- * so the child can build its codex-review scripts path: the workflow sandbox
- * exposes no process global, so the child reads home from its args, not env.
- * @param {object} prEntry one validated element of the args.prs array
- * @param {string} homeDirectory the run-level home directory for every child
- * @returns {object} the args object passed to the converge.mjs child run
- */
-function childRunInput(prEntry, homeDirectory) {
+function childRunInput(prEntry, homeDirectory, transport = DEFAULT_GITHUB_TRANSPORT) {
   return {
     owner: prEntry.owner,
     repo: prEntry.repo,
@@ -125,6 +108,7 @@ function childRunInput(prEntry, homeDirectory) {
     bugbotDisabled: Boolean(prEntry.bugbotDisabled),
     copilotDisabled: Boolean(prEntry.copilotDisabled),
     homeDirectory,
+    transport,
   }
 }
 
@@ -141,7 +125,7 @@ const childResults = await parallel(
   input.prs.map((eachPr) => async () => {
     const childOutcome = await workflow(
       { scriptPath: input.convergeScriptPath },
-      childRunInput(eachPr, input.homeDirectory),
+      childRunInput(eachPr, input.homeDirectory, input.transport),
     )
     return {
       owner: eachPr.owner,

package/.agents/skills/autoconverge/workflow/converge_multi.run-input.test.mjs

@@ -68,6 +68,18 @@ test('valid coordinates classify with no blocker and keep every PR entry', () =>
   assert.equal(classified.input.prs.length, 2);
 });
 
+test('a cloud transport classifies with no blocker', () => {
+  const classified = classifyMultiInput({ ...validArgs(), transport: 'cloud' });
+  assert.equal(classified.blocker, null);
+  assert.equal(classified.input.transport, 'cloud');
+});
+
+test('an unknown transport is blocked before child workflows start', () => {
+  const classified = classifyMultiInput({ ...validArgs(), transport: 'proxy' });
+  assert.equal(classified.input, null);
+  assert.match(classified.blocker, /transport/i);
+});
+
 test('a missing convergeScriptPath is blocked', () => {
   const classified = classifyMultiInput({ prs: [validEntry(101)] });
   assert.equal(classified.input, null);
@@ -138,6 +150,10 @@ test('childRunInput defaults bugbotDisabled to false when the entry omits it', (
   assert.equal(childRunInput(validEntry(101)).bugbotDisabled, false);
 });
 
+test('childRunInput forwards the selected cloud transport', () => {
+  assert.equal(childRunInput(validEntry(101), '/home/dev', 'cloud').transport, 'cloud');
+});
+
 test('childRunInput forwards the run-level home directory to the child run', () => {
   const childArgs = childRunInput(validEntry(101), '/home/dev');
   assert.equal(childArgs.homeDirectory, '/home/dev');

package/bin/cde.mjs

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+import { spawn, spawnSync } from "node:child_process";
+import { constants as osConstants } from "node:os";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const lintScriptPath = path.join(packageRoot, "scripts", "cde_lint.py");
+const posixSignalStatusOffset = 128;
+const lintCommandName = "lint";
+const pythonOptionName = "--python";
+const pythonEnvironmentName = "CDE_PYTHON";
+
+
+export function createHelpText() {
+    return [
+        "Usage: cde lint [options]",
+        "",
+        "Run the policy linter. Source modes are mutually exclusive:",
+        "  --files PATH [PATH ...]  Current worktree files",
+        "  --staged                 Staged index content",
+        "  --base REVISION          Changes from a base revision",
+        "  --repository             Tracked worktree files",
+        "  --text-as PATH           One editor buffer from standard input",
+        "",
+        "Report formats: --format text|json|editor",
+        "",
+        "Launcher options:",
+        "  --python <command>       Python interpreter override",
+        "  Exit 0 clean, 1 diagnostics, 2 invalid input or start failure, 3 failed rule",
+        "",
+        "Python may also be selected with CDE_PYTHON.",
+    ].join("\n");
+}
+
+
+export function pythonInterpreterNames(platformName = process.platform) {
+    if (platformName === "win32") return ["py", "python"];
+    return ["python3", "python"];
+}
+
+
+export function findPython(
+    commandNames = pythonInterpreterNames(),
+    canRun = (commandName) => spawnSync(commandName, ["--version"], { stdio: "ignore", shell: false }).status === 0,
+) {
+    for (const eachCommand of commandNames) {
+        if (canRun(eachCommand)) return eachCommand;
+    }
+    return undefined;
+}
+
+
+export function buildLintCommand(interpreter, forwardedArguments) {
+    return {
+        executable: interpreter,
+        arguments: [lintScriptPath, ...forwardedArguments],
+    };
+}
+
+
+function takePythonOverride(allArguments) {
+    const remainingArguments = [];
+    let interpreterOverride;
+    for (let index = 0; index < allArguments.length; index += 1) {
+        if (allArguments[index] === pythonOptionName) {
+            const nextArgument = allArguments[index + 1];
+            if (nextArgument === undefined || nextArgument.startsWith("--")) {
+                return { error: "--python requires an interpreter command" };
+            }
+            interpreterOverride = nextArgument;
+            index += 1;
+            continue;
+        }
+        remainingArguments.push(allArguments[index]);
+    }
+    return { interpreterOverride, remainingArguments, error: undefined };
+}
+
+
+function attachSignalForwarding(childProcess, processEmitter) {
+    const allSignals = ["SIGINT", "SIGTERM"];
+    if (process.platform !== "win32") {
+        allSignals.push("SIGHUP");
+    }
+    const listenerBySignal = [];
+    for (const eachSignal of allSignals) {
+        const listener = () => {
+            try {
+                childProcess.kill(eachSignal);
+            } catch {
+                return;
+            }
+        };
+        processEmitter.on(eachSignal, listener);
+        listenerBySignal.push([eachSignal, listener]);
+    }
+    return () => {
+        for (const [eachSignal, listener] of listenerBySignal) {
+            processEmitter.off(eachSignal, listener);
+        }
+    };
+}
+
+
+function statusCodeForSignal(signalName) {
+    const signalNumber = osConstants.signals?.[signalName];
+    if (signalNumber === undefined) return 1;
+    return posixSignalStatusOffset + signalNumber;
+}
+
+
+export function runLintCommand(command, dependencies = {}) {
+    const runChild = dependencies.runChild ?? spawn;
+    const processEmitter = dependencies.processEmitter ?? process;
+    return new Promise((resolve) => {
+        let childProcess;
+        try {
+            childProcess = runChild(command.executable, command.arguments, {
+                stdio: "inherit",
+                shell: false,
+                windowsHide: true,
+            });
+        } catch {
+            processEmitter.stderr.write("Unable to start the policy linter.\n");
+            resolve(2);
+            return;
+        }
+        const detachSignals = attachSignalForwarding(childProcess, processEmitter);
+        childProcess.on("error", () => {
+            detachSignals();
+            processEmitter.stderr.write("Unable to start the policy linter.\n");
+            resolve(2);
+        });
+        childProcess.on("close", (exitCode, signalName) => {
+            detachSignals();
+            if (exitCode !== null) {
+                resolve(exitCode);
+                return;
+            }
+            resolve(statusCodeForSignal(signalName));
+        });
+    });
+}
+
+
+export async function main(argumentsList = process.argv.slice(2), dependencies = {}) {
+    if (argumentsList.length === 0 || argumentsList.includes("--help") || argumentsList.includes("-h")) {
+        process.stdout.write(`${createHelpText()}\n`);
+        return 0;
+    }
+    if (argumentsList[0] !== lintCommandName) {
+        process.stderr.write(`${createHelpText()}\n`);
+        return 2;
+    }
+    const { interpreterOverride, remainingArguments, error } = takePythonOverride(argumentsList.slice(1));
+    if (error) {
+        process.stderr.write(`${error}\n`);
+        return 2;
+    }
+    const resolvePython = dependencies.findPython ?? findPython;
+    const interpreter = interpreterOverride ?? process.env[pythonEnvironmentName] ?? await resolvePython();
+    if (!interpreter) {
+        process.stderr.write("No usable Python interpreter found. Use --python or CDE_PYTHON.\n");
+        return 2;
+    }
+    const command = buildLintCommand(interpreter, remainingArguments);
+    const runCommand = dependencies.runCommand ?? runLintCommand;
+    return await runCommand(command, dependencies);
+}
+
+
+const isLaunchedDirectly = process.argv[1] !== undefined
+    && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
+if (isLaunchedDirectly) process.exitCode = await main();