cli-aimlock 7.0.19 → 7.0.25

package/broker.mjs

@@ -0,0 +1,301 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { constants } from 'node:fs'
+import { lstat, open } from 'node:fs/promises'
+import { resolve, win32 } from 'node:path'
+
+export const LOOKUP_TIMEOUT_MS = 8000
+export const CALL_TIMEOUT_MS = 120_000
+const FEEDBACK_API_PATH = '/api/v1/telemetry/skill-usage'
+const TOKEN_FILE_ENV = 'CLITAX_BRAIN_CLIENT_TOKEN_FILE'
+const TOKEN_FILE_VERSION = 'member-brain.client-token-file/1.0'
+const AUTH_SCHEME = 'BrainClient'
+const TOKEN_FILE_MAX_BYTES = 16_384
+const POSIX_TOKEN_FILE_MODE = 0o600
+const WINDOWS_BROKER_DIRECTORY = ['CLI.Tax', 'broker']
+const FEEDBACK_COMMENT_MAX = 500
+const EVALUATION_DURATION_MAX = 86_400_000
+const SCORE_MIN = 0
+const SCORE_MAX = 100
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/
+const INVOCATION_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+const DIGEST_PATTERN = /^[0-9a-f]{64}$/
+const PROTOCOL_STATUSES = new Set(['succeeded', 'blocked', 'failed'])
+const VALIDATION_STATES = new Set(['passed', 'failed', 'incomplete'])
+const EVALUATION_SCHEMA = 'skill-automatic-evaluation/1.0'
+const IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/
+const REQUEST_SCHEMA_PATTERN = /^([A-Za-z0-9.-]+\.skill)\.request\/([0-9]+\.[0-9]+)$/
+
+function asObject(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`)
+  }
+  return value
+}
+
+function requiredString(value, label) {
+  const text = typeof value === 'string' ? value.trim() : ''
+  if (!text) throw new Error(`${label} is required`)
+  return text
+}
+
+function boundedInteger(value, label) {
+  if (!Number.isFinite(value) || value < 0 || !Number.isSafeInteger(value)) {
+    throw new Error(`${label} must be a non-negative safe integer`)
+  }
+  return value
+}
+
+function insideWindowsDirectory(candidate, directory) {
+  const relative = win32.relative(directory, candidate)
+  return relative === '' || (!relative.startsWith('..\\') && relative !== '..' && !win32.isAbsolute(relative))
+}
+
+export function brainClientTokenPath(environment, platform = process.platform) {
+  const configured = requiredString(environment[TOKEN_FILE_ENV], TOKEN_FILE_ENV)
+  if (platform !== 'win32') return resolve(configured)
+  if (!win32.isAbsolute(configured)) {
+    throw new Error('Windows Brain Client token file path must be absolute')
+  }
+  const localAppData = requiredString(environment.LOCALAPPDATA, 'LOCALAPPDATA')
+  const brokerDirectory = win32.resolve(localAppData, ...WINDOWS_BROKER_DIRECTORY)
+  const candidate = win32.resolve(configured)
+  if (!insideWindowsDirectory(candidate, brokerDirectory)) {
+    throw new Error(`Windows Brain Client token file must be inside ${brokerDirectory}`)
+  }
+  return candidate
+}
+
+function assertTokenFileStatus(status, platform, currentUserId) {
+  if (!status.isFile() || status.size < 1 || status.size > TOKEN_FILE_MAX_BYTES) {
+    throw new Error('Brain Client token file must be a non-empty restricted file')
+  }
+  if (platform === 'win32') return
+  if (!Number.isInteger(currentUserId)) {
+    throw new Error('Brain Client token file ownership cannot be verified')
+  }
+  if (status.uid !== currentUserId || (status.mode & 0o777) !== POSIX_TOKEN_FILE_MODE) {
+    throw new Error('Brain Client token file must be owned by the current user with mode 0600')
+  }
+}
+
+function parseTokenFile(source) {
+  let tokenFile
+  try {
+    tokenFile = asObject(JSON.parse(source), 'Brain Client token file')
+  } catch {
+    throw new Error('Brain Client token file must contain valid JSON')
+  }
+  const expectedKeys = ['authorizationScheme', 'endpoint', 'schemaVersion', 'token']
+  if (Object.keys(tokenFile).sort().join('\n') !== expectedKeys.join('\n')) {
+    throw new Error('Brain Client token file contains unknown or missing fields')
+  }
+  return tokenFile
+}
+
+export async function brainClientAuthorization(context, environment, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform
+  const tokenFilePath = brainClientTokenPath(environment, platform)
+  const inspectPath = dependencies.lstat ?? lstat
+  const openPath = dependencies.open ?? open
+  const currentUserId = platform === 'win32'
+    ? null
+    : (dependencies.getuid ?? process.getuid)?.()
+  const linkStatus = await inspectPath(tokenFilePath)
+  if (linkStatus.isSymbolicLink()) throw new Error('Brain Client token file cannot be a symlink')
+  const noFollow = platform === 'win32' ? 0 : (constants.O_NOFOLLOW ?? 0)
+  const handle = await openPath(tokenFilePath, constants.O_RDONLY | noFollow)
+  try {
+    const status = await handle.stat()
+    assertTokenFileStatus(status, platform, currentUserId)
+    const tokenFile = parseTokenFile(await handle.readFile('utf8'))
+    const endpoint = new URL(requiredString(tokenFile.endpoint, 'Brain Client endpoint'))
+    if (tokenFile.schemaVersion !== TOKEN_FILE_VERSION
+      || tokenFile.authorizationScheme !== AUTH_SCHEME
+      || endpoint.origin !== new URL(context.endpoint).origin
+      || endpoint.pathname !== FEEDBACK_API_PATH || endpoint.search || endpoint.hash
+      || endpoint.username || endpoint.password
+      || !TOKEN_PATTERN.test(tokenFile.token)) {
+      throw new Error('Brain Client token file authority is invalid')
+    }
+    return `${AUTH_SCHEME} ${tokenFile.token}`
+  } finally {
+    await handle.close()
+  }
+}
+
+function canonicalJson(value) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') {
+    return JSON.stringify(value)
+  }
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value)) throw new Error('automatic evaluation contains a non-finite number')
+    return JSON.stringify(value)
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`
+  const record = asObject(value, 'automatic evaluation')
+  return `{${Object.keys(record).sort().map((key) => (
+    `${JSON.stringify(key)}:${canonicalJson(record[key])}`
+  )).join(',')}}`
+}
+
+function expectedResponseSchema(requestSchema) {
+  const matched = requiredString(requestSchema, 'skill request schemaVersion')
+    .match(REQUEST_SCHEMA_PATTERN)
+  if (!matched) throw new Error('skill request schemaVersion is invalid')
+  return `${matched[1]}.response/${matched[2]}`
+}
+
+function protocolResponse(protocolValue, requestEnvelope) {
+  const protocol = asObject(protocolValue, 'skill protocol response')
+  const responseSchema = expectedResponseSchema(requestEnvelope.schemaVersion)
+  if (protocol.schemaVersion !== responseSchema) {
+    throw new Error('skill protocol response schemaVersion does not match the request')
+  }
+  if (protocol.requestId !== requestEnvelope.requestId) {
+    throw new Error('skill protocol response requestId does not match the request')
+  }
+  const status = requiredString(protocol.status, 'skill protocol status')
+  if (!PROTOCOL_STATUSES.has(status)) {
+    throw new Error('skill protocol status must be succeeded, blocked, or failed')
+  }
+  return { protocol, responseSchema, status }
+}
+
+export function authoritativeEvaluation(value, expected) {
+  const evaluation = asObject(value, 'server automatic evaluation')
+  const expectedKeys = [
+    'digest', 'durationMs', 'findingCount', 'operation', 'p0Count', 'p1Count', 'p2Count',
+    'requestId', 'responseSchemaVersion', 'schemaVersion', 'score', 'status', 'userComment',
+    'validation',
+  ]
+  if (Object.keys(evaluation).sort().join('\n') !== expectedKeys.join('\n')) {
+    throw new Error('server automatic evaluation contains unknown or missing fields')
+  }
+  if (evaluation.schemaVersion !== EVALUATION_SCHEMA
+    || evaluation.operation !== expected.operation
+    || evaluation.requestId !== expected.requestId
+    || evaluation.responseSchemaVersion !== expected.responseSchema
+    || evaluation.status !== expected.status
+    || !VALIDATION_STATES.has(evaluation.validation)
+    || typeof evaluation.userComment !== 'string' || !evaluation.userComment.trim()
+    || Buffer.byteLength(evaluation.userComment, 'utf8') > FEEDBACK_COMMENT_MAX
+    || typeof evaluation.digest !== 'string' || !DIGEST_PATTERN.test(evaluation.digest)) {
+    throw new Error('server automatic evaluation authority is invalid')
+  }
+  for (const field of ['durationMs', 'findingCount', 'p0Count', 'p1Count', 'p2Count', 'score']) {
+    boundedInteger(evaluation[field], `server automatic evaluation ${field}`)
+  }
+  if (evaluation.score < SCORE_MIN || evaluation.score > SCORE_MAX
+    || evaluation.durationMs > EVALUATION_DURATION_MAX
+    || evaluation.findingCount < evaluation.p0Count + evaluation.p1Count + evaluation.p2Count) {
+    throw new Error('server automatic evaluation bounds are invalid')
+  }
+  if ((evaluation.status !== 'succeeded' || evaluation.validation !== 'passed'
+    || evaluation.p0Count > 0 || evaluation.p1Count > 0) && evaluation.score >= 60) {
+    throw new Error('server automatic evaluation cannot report a positive score')
+  }
+  const { digest, ...core } = evaluation
+  const actualDigest = createHash('sha256').update(canonicalJson(core)).digest('hex')
+  if (digest !== actualDigest) throw new Error('server automatic evaluation digest is invalid')
+  return evaluation
+}
+
+async function responsePayload(response, label) {
+  try {
+    return asObject(await response.json(), label)
+  } catch {
+    throw new Error(`${label} is not valid JSON (HTTP ${response.status})`)
+  }
+}
+
+function invocationRequest(context, operation, input) {
+  const normalizedOperation = requiredString(operation, 'skill operation')
+  if (!IDENTIFIER_PATTERN.test(normalizedOperation)) {
+    throw new Error('skill operation is invalid')
+  }
+  expectedResponseSchema(context.schemaVersion)
+  return {
+    schemaVersion: context.schemaVersion,
+    requestId: `${context.runtimeCode}-${randomUUID()}`,
+    operation: normalizedOperation,
+    input: asObject(input, 'skill operation input'),
+  }
+}
+
+export async function invokeOfficialSkill(context, operation, input, dependencies) {
+  const environment = asObject(dependencies.environment, 'broker environment')
+  if (typeof dependencies.request !== 'function') {
+    throw new Error('broker request dependency is required')
+  }
+  const authorization = await brainClientAuthorization(context, environment, dependencies.credentialAccess)
+  const requestEnvelope = invocationRequest(context, operation, input)
+  let response
+  try {
+    response = await dependencies.request(context.endpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: authorization },
+      body: JSON.stringify({ input: requestEnvelope }),
+      signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+    })
+  } catch {
+    throw new Error(`${context.displayName} ${operation} invocation failed`)
+  }
+  const payload = await responsePayload(response, `${context.displayName} ${operation} response`)
+  if (!response.ok || payload.ok !== true) {
+    throw new Error(`${context.displayName} ${operation} failed: HTTP ${response.status}`)
+  }
+  const invocationId = payload.feedbackInvocationId
+  if (typeof invocationId !== 'string' || !INVOCATION_PATTERN.test(invocationId)) {
+    throw new Error(`${context.displayName} ${operation} response is missing a valid feedbackInvocationId`)
+  }
+  const feedbackReceiptId = payload.feedbackReceiptId
+  const feedbackRequestId = payload.feedbackRequestId
+  if (typeof feedbackReceiptId !== 'string' || !INVOCATION_PATTERN.test(feedbackReceiptId)
+    || feedbackRequestId !== `automatic-${invocationId}`) {
+    throw new Error(`${context.displayName} ${operation} response is missing a committed feedback receipt`)
+  }
+  const protocolAuthority = protocolResponse(payload.output, requestEnvelope)
+  const evaluation = authoritativeEvaluation(payload.feedbackEvaluation, {
+    operation: requestEnvelope.operation,
+    requestId: requestEnvelope.requestId,
+    responseSchema: protocolAuthority.responseSchema,
+    status: protocolAuthority.status,
+  })
+  const feedback = {
+    id: feedbackReceiptId,
+    requestId: feedbackRequestId,
+    duplicated: false,
+  }
+  return { response: payload, invocationId, evaluation, feedback }
+}
+
+export async function callOfficialSkill(context, operation, input, dependencies) {
+  return (await invokeOfficialSkill(context, operation, input, dependencies)).response
+}
+
+export function invokeCommandInput(args) {
+  const operation = requiredString(args[1], 'skill operation')
+  const source = args.slice(2).join(' ').trim()
+  if (!source) return { operation, input: {} }
+  try {
+    return { operation, input: asObject(JSON.parse(source), 'skill operation input') }
+  } catch {
+    throw new Error('skill operation input must be a JSON object')
+  }
+}
+
+export function brokerCommandInput(source) {
+  let parsed
+  try {
+    parsed = asObject(JSON.parse(source), 'broker request')
+  } catch {
+    throw new Error('broker request must be a JSON object')
+  }
+  if (Object.keys(parsed).some((key) => !['operation', 'input'].includes(key))) {
+    throw new Error('broker request contains unknown fields')
+  }
+  return {
+    operation: requiredString(parsed.operation, 'skill operation'),
+    input: asObject(parsed.input, 'skill operation input'),
+  }
+}

package/cli.mjs

@@ -1,26 +1,203 @@
 #!/usr/bin/env node
-import { dirname } from 'node:path'
+import { dirname, resolve } from 'node:path'
+import { cwd, stdin, stdout } from 'node:process'
+import { createInterface } from 'node:readline/promises'
 import { fileURLToPath } from 'node:url'
-import { dispatchOfficialSkillCli, runIntakeHandshake } from './installer.mjs'
+import { defaultUsage, dispatchOfficialSkillCli, runIntakeHandshake } from './installer.mjs'
+import {
+  LOCAL_CAPABILITIES,
+  extendReadBudget,
+  guardedWriteFile,
+  initializeReadBudget,
+  issueMutationPass,
+  probeRepositoryDemand,
+  readBudgetStatus,
+  readFileWithinBudget,
+  reassessMode,
+  verifyMutationPassFile,
+} from './aimlock-local-runner.mjs'
+
+const BYPASS_LINE_BUDGET = 500
+const DIFFICULTIES = new Set(['low', 'medium', 'high'])
+const RISKS = new Set(['low', 'medium', 'high'])
+const TRUE_ANSWERS = new Set(['yes', 'y', 'true', '是', '需要', 'да'])
+const FALSE_ANSWERS = new Set(['no', 'n', 'false', '否', '不需要', 'нет'])
+const BYPASS_NOTICE = [
+  '需求较小且低风险，不建议使用 Aimlock；请直接处理，或只调用一个匹配的专项技能。',
+  'This request is small and low risk; Aimlock is not recommended. Handle it directly or use one matched specialist skill.',
+  'Запрос небольшой и низкорисковый; Aimlock не рекомендуется. Выполните его напрямую или используйте один профильный навык.',
+].join('\n')
+const COMMON_RUN_USAGE = "      Run this skill's applicability or onboarding flow; only a real HTTP invocation can trigger automatic evaluation."
+const AIMLOCK_RUN_USAGE = '      Collect six applicability facts locally; bypass makes no skill HTTP call, automatic evaluation, or requirements file, while active work runs authenticated intake.'
+
+const APPLICABILITY_QUESTIONS = [
+  { id: 'goal', prompt: '目标 / Goal / Цель', parse: parseText },
+  { id: 'targetHints', prompt: '目标路径（逗号分隔） / Target paths / Целевые пути', parse: parseTargetHints },
+  { id: 'explicitAimlockRequested', prompt: '是否明确要求启用 Aimlock / Explicitly require Aimlock / Явно включить Aimlock (yes|no)', parse: parseBoolean },
+]
 
 const INTAKE_QUESTIONS = [
-  { id: 'goal', required: true, prompt: 'What must be true when this finishes, and what must never change?', example: '只改税率常量一行，不改其它计税逻辑' },
-  { id: 'targetFiles', required: true, prompt: 'Which file paths are in scope? Use unknown if not located yet.', example: 'apps/web/src/tax.ts' },
-  { id: 'estimatedChangedLines', required: true, prompt: 'How many lines should change?', example: '1' },
-  { id: 'crossModule', required: true, prompt: 'Does this cross modules? yes or no.', example: 'no' },
-  { id: 'needParallel', required: true, prompt: 'Must independent modules run in parallel? yes or no.', example: 'no' },
-  { id: 'goalKind', required: true, prompt: 'Goal kind: code, calculator, mixed, or docs.', example: 'code' },
-  { id: 'deliveryDoc', required: true, prompt: 'After success, summarize a local delivery document? yes or no.', example: 'no' },
+  { id: 'goal', required: true, prompt: '完成标准与禁止改动 / Goal and forbidden changes / Цель и запрещённые изменения', example: '只改税率常量一行，不改其它计税逻辑' },
+  { id: 'difficulty', required: true, prompt: '需求难度 / Difficulty / Сложность: low, medium, or high?', example: 'medium' },
+  { id: 'risk', required: true, prompt: '风险等级 / Risk / Риск: low, medium, or high?', example: 'low' },
+  { id: 'targetFiles', required: true, prompt: '目标文件 / Target files / Целевые файлы (unknown if not located)', example: 'apps/web/src/tax.ts' },
+  { id: 'estimatedChangedLines', required: true, prompt: '预计改动行数 / Estimated changed lines / Оценка строк', example: '1' },
+  { id: 'crossModule', required: true, prompt: '是否跨模块 / Cross-module / Межмодульно: yes or no?', example: 'no' },
+  { id: 'needParallel', required: true, prompt: '是否必须并行 / Parallel required / Нужна параллельность: yes or no?', example: 'no' },
+  { id: 'explicitAimlockRequested', required: true, prompt: '是否明确要求启用 Aimlock / Explicitly require Aimlock / Явно включить Aimlock: yes or no?', example: 'no' },
+  { id: 'goalKind', required: true, prompt: '需求类型 / Goal kind / Тип цели: code, calculator, mixed, or docs?', example: 'code' },
+  { id: 'deliveryDoc', required: true, prompt: '是否生成交付文档 / Delivery document / Нужен отчёт: yes or no?', example: 'no' },
 ]
 
-await dispatchOfficialSkillCli({
-  packageRoot: dirname(fileURLToPath(import.meta.url)),
-  runCommand: (context) => runIntakeHandshake(context, {
+function parseBoolean(source) {
+  const value = source.trim().toLowerCase()
+  if (TRUE_ANSWERS.has(value)) return true
+  if (FALSE_ANSWERS.has(value)) return false
+  throw new Error('expected yes or no')
+}
+
+function parseText(source) {
+  const value = source.trim()
+  if (!value) throw new Error('a non-empty value is required')
+  return value
+}
+
+function parseTargetHints(source) {
+  const values = source.split(',').map((value) => value.trim()).filter(Boolean)
+  if (!values.length) throw new Error('at least one target path is required')
+  return values
+}
+
+export function localAimlockApplicability(facts) {
+  const valid = DIFFICULTIES.has(facts.difficulty)
+    && RISKS.has(facts.risk)
+    && Number.isSafeInteger(facts.estimatedChangedLines)
+    && facts.estimatedChangedLines >= 0
+    && typeof facts.crossModule === 'boolean'
+    && typeof facts.needParallel === 'boolean'
+    && typeof facts.explicitAimlockRequested === 'boolean'
+  if (!valid) throw new Error('Aimlock applicability facts are incomplete or invalid')
+  const bypass = facts.difficulty === 'low'
+    && facts.estimatedChangedLines <= BYPASS_LINE_BUDGET
+    && facts.crossModule === false
+    && facts.risk !== 'high'
+    && facts.needParallel === false
+    && facts.explicitAimlockRequested === false
+  return { mode: bypass ? 'bypass' : 'active', useAimlock: !bypass }
+}
+
+export function aimlockUsage(context) {
+  const usage = defaultUsage(context)
+  if (!usage.includes(COMMON_RUN_USAGE)) throw new Error('Shared CLI run usage contract changed')
+  return usage.replace(COMMON_RUN_USAGE, AIMLOCK_RUN_USAGE)
+}
+
+async function collectApplicability(input, output) {
+  const readline = createInterface({ input, output })
+  const answers = {}
+  try {
+    for (const question of APPLICABILITY_QUESTIONS) {
+      for (;;) {
+        const source = await readline.question(`${question.prompt}\n> `)
+        try {
+          answers[question.id] = question.parse(source)
+          break
+        } catch (error) {
+          output.write(`${error instanceof Error ? error.message : String(error)}\n`)
+        }
+      }
+    }
+  } finally {
+    readline.close()
+  }
+  return answers
+}
+
+export async function runAimlockWith(context, dependencies) {
+  const facts = await dependencies.collectApplicability()
+  const decision = localAimlockApplicability(facts)
+  if (!decision.useAimlock) {
+    dependencies.writeNotice(BYPASS_NOTICE)
+    return decision
+  }
+  await dependencies.runHandshake(context, {
     questions: INTAKE_QUESTIONS,
     outputFile: 'AIMLOCK-REQUIREMENTS.json',
     afterCapabilities(output) {
       const notice = output.firstUseNotice?.zh
       if (typeof notice === 'string' && notice.trim()) console.log(notice)
     },
-  }),
-})
+  })
+  return decision
+}
+
+async function runAimlock(context) {
+  return runAimlockWith(context, {
+    collectApplicability: async () => {
+      const answers = await collectApplicability(stdin, stdout)
+      const probe = await probeRepositoryDemand({
+        repositoryRoot: cwd(), goal: answers.goal, targetHints: answers.targetHints,
+      })
+      console.log(JSON.stringify({ mode: probe.mode, facts: probe.facts }))
+      return { ...probe.facts, explicitAimlockRequested: answers.explicitAimlockRequested }
+    },
+    writeNotice: (message) => console.log(message),
+    runHandshake: runIntakeHandshake,
+  })
+}
+
+async function readJsonInput(input) {
+  let source = ''
+  for await (const chunk of input) source += chunk
+  if (!source.trim()) return {}
+  const value = JSON.parse(source)
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('local operation input must be a JSON object')
+  }
+  return value
+}
+
+async function runLocalOperation(operation, repositoryRoot, input) {
+  const scoped = { ...input, repositoryRoot }
+  if (operation === 'capabilities') return LOCAL_CAPABILITIES
+  if (operation === 'probe') return probeRepositoryDemand(scoped)
+  if (operation === 'reassess') return reassessMode(input)
+  if (operation === 'budget-init') return initializeReadBudget(scoped)
+  if (operation === 'budget-read') return readFileWithinBudget(scoped)
+  if (operation === 'budget-status') return readBudgetStatus(scoped)
+  if (operation === 'budget-extend') return extendReadBudget(scoped)
+  if (operation === 'gate-issue') return issueMutationPass(scoped)
+  if (operation === 'gate-verify') return verifyMutationPassFile(scoped)
+  if (operation === 'guarded-write') return guardedWriteFile(scoped)
+  throw new Error(`unsupported local operation: ${operation}`)
+}
+
+async function dispatchLocal(args) {
+  const operation = args[0]?.trim()
+  const repositoryRoot = args[1]?.trim()
+  if (!operation || !repositoryRoot) {
+    throw new Error('usage: cli-aimlock local <operation> <repositoryRoot>')
+  }
+  return runLocalOperation(operation, repositoryRoot, await readJsonInput(stdin))
+}
+
+const cliPath = fileURLToPath(import.meta.url)
+if (process.argv[1] && resolve(process.argv[1]) === cliPath) {
+  if (process.argv[2] === 'local') {
+    try {
+      console.log(JSON.stringify(await dispatchLocal(process.argv.slice(3))))
+    } catch (error) {
+      console.error(JSON.stringify({ status: 'failed', code: error?.code ?? 'AIMLOCK_LOCAL_FAILED',
+        message: error instanceof Error ? error.message : String(error) }))
+      process.exitCode = error?.code === 'AIMLOCK_DECISION_REQUIRED' ? 2 : 1
+    }
+  } else {
+    await dispatchOfficialSkillCli({
+      packageRoot: dirname(cliPath),
+      runCommand: runAimlock,
+      usage: aimlockUsage,
+    })
+  }
+}
+
+export { runLocalOperation }