codelocal 1.5.0-beta.4 → 1.5.0

package/README.md

@@ -1,27 +1,30 @@
 # CodeLocal
 
-Local code intelligence and execution runtime for ChatGPT.
+Native Go local development runtime for ChatGPT.
 
 ## Install
 
 ```bash
-npm i -g codelocal
+npm i -g codelocal@beta
 ```
 
-## Run
+## Authorize a project
 
 ```bash
-codelocal
+cd /path/to/project
+codelocal .
 ```
 
-CodeLocal starts the machine runtime in your terminal and connects it to ChatGPT.
+`codelocal .` only authorizes that folder locally. It does not pair the machine or connect to CodeLocal Cloud.
 
-To authorize the current project once:
+## Start CodeLocal
 
 ```bash
-codelocal .
+codelocal
 ```
 
-This npm package contains compiled runtime files only. The CodeLocal source repository and cloud backend are not distributed in this package.
+The Go runtime pairs this machine on first use, syncs authorized workspaces, then waits for ChatGPT. One machine runs one runtime; multiple workspaces activate lazily inside it.
+
+Use `codelocal status` to inspect it and `codelocal stop` to stop it.
 
-Copyright © CodeLocal. All rights reserved.
+This npm package contains compiled native binaries only. CodeLocal source code and the Cloud backend are not distributed in the package.

package/bin/codelocal.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+const { spawnSync } = require('node:child_process');
+const path = require('node:path');
+const key = process.platform + '-' + process.arch;
+const files = {
+  'darwin-arm64': 'codelocal-darwin-arm64',
+  'darwin-x64': 'codelocal-darwin-x64',
+  'linux-arm64': 'codelocal-linux-arm64',
+  'linux-x64': 'codelocal-linux-x64',
+  'win32-x64': 'codelocal-win32-x64.exe',
+  'win32-arm64': 'codelocal-win32-arm64.exe'
+};
+const file = files[key];
+if (!file) {
+  console.error('CodeLocal does not have a native binary for ' + key + '.');
+  process.exit(1);
+}
+const binary = path.join(__dirname, 'native', file);
+const result = spawnSync(binary, process.argv.slice(2), { stdio: 'inherit', env: process.env });
+if (result.error) {
+  console.error(result.error.message);
+  process.exit(1);
+}
+if (result.signal) {
+  process.kill(process.pid, result.signal);
+}
+process.exit(result.status ?? 1);

package/package.json

@@ -1,31 +1,23 @@
 {
-  "name": "codelocal",
-  "version": "1.5.0-beta.4",
-  "description": "CodeLocal local code intelligence and execution runtime for ChatGPT.",
-  "license": "UNLICENSED",
-  "type": "module",
   "bin": {
-    "codelocal": "dist/cli-saas.js"
+    "codelocal": "bin/codelocal.js"
+  },
+  "description": "Native Go runtime that securely connects ChatGPT to local development workspaces.",
+  "engines": {
+    "node": ">=20"
   },
   "files": [
-    "dist/*.js",
+    "bin/",
     "README.md"
   ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.18.2",
-    "@parcel/watcher": "^2.6.0",
-    "chokidar": "^4.0.3",
-    "ignore": "^7.0.5",
-    "typescript": "^5.9.2",
-    "ws": "^8.18.3"
-  },
-  "optionalDependencies": {
-    "node-pty": "^1.0.0"
-  },
-  "engines": {
-    "node": ">=20"
-  }
+  "keywords": [
+    "chatgpt",
+    "mcp",
+    "coding",
+    "local",
+    "go"
+  ],
+  "license": "UNLICENSED",
+  "name": "codelocal",
+  "version": "1.5.0"
 }

package/dist/approval-memory.js

@@ -1,105 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { promises as fs } from "node:fs";
-import path from "node:path";
-import { DEFAULT_STATE_DIR, readJsonFile, writeJsonAtomic } from "./state.js";
-function workspaceHash(workspaceKey) {
-    return createHash("sha256").update(workspaceKey).digest("hex").slice(0, 24);
-}
-export class ApprovalMemory {
-    rootDir;
-    constructor(rootDir = path.join(DEFAULT_STATE_DIR, "approvals")) {
-        this.rootDir = rootDir;
-    }
-    fileFor(workspaceKey) {
-        return path.join(this.rootDir, `${workspaceHash(workspaceKey)}.json`);
-    }
-    async read(workspaceKey) {
-        const value = await readJsonFile(this.fileFor(workspaceKey), { version: 1, workspaceKey, approvals: [] });
-        const approvals = Array.isArray(value.approvals)
-            ? value.approvals.filter((entry) => entry?.workspaceKey === workspaceKey && typeof entry.actionKey === "string")
-            : [];
-        return { version: 1, workspaceKey, approvals };
-    }
-    async write(workspaceKey, approvals) {
-        const unique = new Map();
-        for (const entry of approvals)
-            unique.set(entry.actionKey, entry);
-        await writeJsonAtomic(this.fileFor(workspaceKey), {
-            version: 1,
-            workspaceKey,
-            approvals: [...unique.values()].sort((a, b) => b.lastUsedAt - a.lastUsedAt),
-        });
-    }
-    async find(workspaceKey, actionKey) {
-        const data = await this.read(workspaceKey);
-        return data.approvals.find((entry) => entry.actionKey === actionKey) ?? null;
-    }
-    async remember(workspaceKey, decision) {
-        if (decision.approvalPolicy !== "rememberable" || !decision.approvalKey)
-            return null;
-        const data = await this.read(workspaceKey);
-        const previous = data.approvals.find((entry) => entry.actionKey === decision.approvalKey);
-        const now = Date.now();
-        const entry = {
-            id: previous?.id ?? randomUUID(),
-            workspaceKey,
-            actionKey: decision.approvalKey,
-            label: decision.approvalLabel ?? decision.redactedCommand,
-            redactedCommand: decision.redactedCommand,
-            riskLevel: decision.riskLevel,
-            matchedRules: [...decision.matchedRules],
-            createdAt: previous?.createdAt ?? now,
-            lastUsedAt: now,
-            useCount: (previous?.useCount ?? 0) + 1,
-        };
-        await this.write(workspaceKey, [...data.approvals.filter((item) => item.actionKey !== entry.actionKey), entry]);
-        return entry;
-    }
-    async touch(workspaceKey, actionKey) {
-        const data = await this.read(workspaceKey);
-        const entry = data.approvals.find((item) => item.actionKey === actionKey);
-        if (!entry)
-            return null;
-        entry.lastUsedAt = Date.now();
-        entry.useCount = Math.max(0, Number(entry.useCount) || 0) + 1;
-        await this.write(workspaceKey, data.approvals);
-        return entry;
-    }
-    async list(workspaceKey) {
-        if (workspaceKey)
-            return (await this.read(workspaceKey)).approvals;
-        const names = await fs.readdir(this.rootDir).catch(() => []);
-        const output = [];
-        for (const name of names) {
-            if (!name.endsWith(".json"))
-                continue;
-            const value = await readJsonFile(path.join(this.rootDir, name), { version: 1, workspaceKey: "", approvals: [] });
-            if (!value.workspaceKey || !Array.isArray(value.approvals))
-                continue;
-            output.push(...value.approvals.filter((entry) => entry?.workspaceKey === value.workspaceKey && typeof entry.actionKey === "string"));
-        }
-        return output.sort((a, b) => b.lastUsedAt - a.lastUsedAt);
-    }
-    async revoke(identifier, workspaceKey) {
-        const targets = workspaceKey ? [workspaceKey] : [...new Set((await this.list()).map((entry) => entry.workspaceKey))];
-        let removed = 0;
-        for (const key of targets) {
-            const data = await this.read(key);
-            const next = data.approvals.filter((entry) => entry.id !== identifier && entry.actionKey !== identifier);
-            removed += data.approvals.length - next.length;
-            if (next.length !== data.approvals.length)
-                await this.write(key, next);
-        }
-        return removed;
-    }
-    async reset(workspaceKey) {
-        if (workspaceKey) {
-            const data = await this.read(workspaceKey);
-            await fs.rm(this.fileFor(workspaceKey), { force: true });
-            return data.approvals.length;
-        }
-        const count = (await this.list()).length;
-        await fs.rm(this.rootDir, { recursive: true, force: true });
-        return count;
-    }
-}

package/dist/audit.js

@@ -1,34 +0,0 @@
-import path from "node:path";
-import { appendPrivateJsonl, DEFAULT_STATE_DIR } from "./state.js";
-import { redactCommand } from "./security-policy.js";
-const AUDIT_ENABLED = process.env.CODELOCAL_AUDIT_FILE !== "0";
-const AUDIT_FILE = process.env.CODELOCAL_AUDIT_PATH ?? path.join(DEFAULT_STATE_DIR, "audit.jsonl");
-function sanitize(value, key = "") {
-    if (value instanceof Error)
-        return { name: value.name, message: value.message };
-    if (Array.isArray(value))
-        return value.map((item) => sanitize(item));
-    if (typeof value === "string") {
-        if (/command|detail|query/i.test(key))
-            return redactCommand(value).slice(0, 2000);
-        if (/content|patch|input|oldText|newText/i.test(key))
-            return `[${Buffer.byteLength(value, "utf8")} bytes]`;
-        return value.slice(0, 4000);
-    }
-    if (!value || typeof value !== "object")
-        return value;
-    const out = {};
-    for (const [childKey, childValue] of Object.entries(value)) {
-        if (/token|secret|password|authorization|cookie|credentialSecret/i.test(childKey))
-            out[childKey] = "[REDACTED]";
-        else
-            out[childKey] = sanitize(childValue, childKey);
-    }
-    return out;
-}
-export async function audit(event) {
-    if (!AUDIT_ENABLED)
-        return;
-    const record = sanitize({ ts: event.ts ?? new Date().toISOString(), ...event });
-    await appendPrivateJsonl(AUDIT_FILE, record).catch(() => undefined);
-}

package/dist/chat-approval.js

@@ -1,77 +0,0 @@
-import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
-function hash(value) {
-    return createHash("sha256").update(value).digest("hex");
-}
-function sameHex(a, b) {
-    const aa = Buffer.from(a, "hex");
-    const bb = Buffer.from(b, "hex");
-    return aa.length === bb.length && timingSafeEqual(aa, bb);
-}
-export class ChatApprovalBroker {
-    ttlMs;
-    pending = new Map();
-    constructor(ttlMs = Number(process.env.CODELOCAL_CHAT_APPROVAL_TTL_MS ?? 5 * 60_000)) {
-        this.ttlMs = ttlMs;
-    }
-    fingerprint(command, cwd, decision) {
-        return hash(JSON.stringify({
-            rawCommandHash: hash(command),
-            redactedCommand: decision.redactedCommand,
-            cwd,
-            rules: [...decision.matchedRules].sort(),
-            risk: decision.riskLevel,
-            approvalPolicy: decision.approvalPolicy,
-            approvalKey: decision.approvalKey ?? null,
-        }));
-    }
-    prune() {
-        const now = Date.now();
-        for (const [id, approval] of this.pending)
-            if (approval.expiresAt <= now)
-                this.pending.delete(id);
-    }
-    preflight(command, cwd, decision) {
-        this.prune();
-        if (decision.blocked)
-            return { status: "blocked", riskLevel: decision.riskLevel, reason: decision.reason, matchedRules: decision.matchedRules, command: decision.redactedCommand, approvalPolicy: decision.approvalPolicy, approvalKey: decision.approvalKey, approvalLabel: decision.approvalLabel };
-        if (!decision.requiresApproval)
-            return { status: "safe", riskLevel: decision.riskLevel, reason: decision.reason, matchedRules: decision.matchedRules, command: decision.redactedCommand, approvalPolicy: decision.approvalPolicy, approvalKey: decision.approvalKey, approvalLabel: decision.approvalLabel };
-        const approvalToken = randomUUID() + randomUUID().replaceAll("-", "");
-        const id = randomUUID();
-        const expiresAt = Date.now() + this.ttlMs;
-        this.pending.set(id, { tokenHash: hash(approvalToken), fingerprint: this.fingerprint(command, cwd, decision), expiresAt });
-        return {
-            status: "approval_required",
-            riskLevel: decision.riskLevel,
-            reason: decision.reason,
-            matchedRules: decision.matchedRules,
-            command: decision.redactedCommand,
-            approvalPolicy: decision.approvalPolicy,
-            approvalKey: decision.approvalKey,
-            approvalLabel: decision.approvalLabel,
-            approvalToken: `${id}.${approvalToken}`,
-            expiresAt,
-        };
-    }
-    consume(approvalToken, command, cwd, decision) {
-        this.prune();
-        if (!decision.requiresApproval || decision.blocked)
-            return !decision.blocked;
-        if (!approvalToken)
-            return false;
-        const dot = approvalToken.indexOf(".");
-        if (dot <= 0)
-            return false;
-        const id = approvalToken.slice(0, dot);
-        const secret = approvalToken.slice(dot + 1);
-        const pending = this.pending.get(id);
-        if (!pending)
-            return false;
-        this.pending.delete(id);
-        if (pending.expiresAt <= Date.now())
-            return false;
-        if (!sameHex(pending.tokenHash, hash(secret)))
-            return false;
-        return sameHex(pending.fingerprint, this.fingerprint(command, cwd, decision));
-    }
-}

package/dist/cli-saas.js

@@ -1,311 +0,0 @@
-#!/usr/bin/env node
-import path from "node:path";
-import os from "node:os";
-import { promises as fs } from "node:fs";
-import { spawn } from "node:child_process";
-import { defaultDeviceIdentity, deleteLocalCredential, loadLocalCredential, saveLocalCredential } from "./identity.js";
-import { WorkspaceRegistry } from "./workspace-registry.js";
-import { ApprovalMemory } from "./approval-memory.js";
-import { RuntimeDaemon } from "./runtime-daemon.js";
-const DEFAULT_CLOUD = process.env.CODELOCAL_SERVER ?? "https://codelocal.cloud";
-function usage() {
-    console.log(`CodeLocal CLI · machine runtime
-
-Quick start:
-  codelocal
-
-One-time workspace access:
-  codelocal grant ~/Projects/my-app
-
-Then keep only this running:
-  codelocal
-
-ChatGPT can list your previously granted workspaces and activate the one you choose in chat.
-
-Commands:
-  codelocal                       Start the machine runtime; no project cwd required
-  codelocal grant <project>       Authorize a project folder locally
-  codelocal ungrant <id|project>  Remove a project's local authorization
-  codelocal workspaces            List authorized local workspaces
-  codelocal .                     Backward-compatible: grant + activate current project
-  codelocal <project-path>        Backward-compatible: grant + activate a project
-  codelocal login                 Open CodeLocal login
-  codelocal dashboard             Open CodeLocal dashboard
-  codelocal pair [gateway]        Pair this machine manually
-  codelocal status                Show pairing + workspace status
-  codelocal approvals             List remembered local approvals
-  codelocal approvals revoke <id> Revoke one remembered approval
-  codelocal approvals reset       Forget all remembered approvals
-  codelocal doctor <project>      Run local environment checks
-  codelocal mcp ...               Manage local MCP extensions
-
-Default cloud:
-  ${DEFAULT_CLOUD}
-`);
-}
-function normalizeBase(value) {
-    const url = new URL(value);
-    if (url.protocol === "ws:")
-        url.protocol = "http:";
-    if (url.protocol === "wss:")
-        url.protocol = "https:";
-    url.pathname = "";
-    url.search = "";
-    url.hash = "";
-    return url.toString().replace(/\/$/, "");
-}
-function httpToWs(base) {
-    const url = new URL(normalizeBase(base));
-    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-    url.pathname = "/client";
-    return url.toString();
-}
-function wsToHttp(value) {
-    return normalizeBase(value);
-}
-function openBrowser(url) {
-    try {
-        let command;
-        let args;
-        if (process.platform === "darwin") {
-            command = "open";
-            args = [url];
-        }
-        else if (process.platform === "win32") {
-            command = "cmd";
-            args = ["/c", "start", "", url];
-        }
-        else {
-            command = "xdg-open";
-            args = [url];
-        }
-        const child = spawn(command, args, { detached: true, stdio: "ignore", shell: false });
-        child.unref();
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function pair(baseArg = DEFAULT_CLOUD) {
-    const base = normalizeBase(baseArg || DEFAULT_CLOUD);
-    const wsUrl = httpToWs(base);
-    const existing = await loadLocalCredential(wsUrl);
-    if (existing)
-        return existing;
-    const device = defaultDeviceIdentity();
-    const response = await fetch(`${base}/pair/start`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(device),
-        signal: AbortSignal.timeout(15_000),
-    });
-    if (!response.ok)
-        throw new Error(`Unable to start device pairing (${response.status}).`);
-    const pairing = await response.json();
-    console.log(`\nCodeLocal needs to pair this machine.\n`);
-    console.log(`Pairing code: ${pairing.code}`);
-    console.log(`Approve: ${pairing.approveUrl}\n`);
-    if (openBrowser(pairing.approveUrl))
-        console.log("Opened your default browser. Sign in to CodeLocal and approve this device.");
-    else
-        console.log("Open the approval URL in your browser, sign in, and approve this device.");
-    console.log("Waiting for approval…");
-    while (Date.now() < pairing.expiresAt) {
-        await new Promise((resolve) => setTimeout(resolve, 1800));
-        const claim = await fetch(`${base}/pair/claim`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ pairingId: pairing.pairingId, code: pairing.code }),
-            signal: AbortSignal.timeout(10_000),
-        }).catch(() => null);
-        if (!claim?.ok)
-            continue;
-        const credential = await claim.json();
-        const saved = await saveLocalCredential({ ...credential, serverUrl: wsUrl });
-        console.log(`✓ ${credential.deviceName} paired with CodeLocal Cloud.\n`);
-        return saved;
-    }
-    throw new Error("Pairing expired. Run `codelocal` again to create a new pairing request.");
-}
-async function validateCredential(server, credential) {
-    try {
-        const response = await fetch(`${wsToHttp(server)}/api/client/auth/check`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                "x-codelocal-credential-id": credential.credentialId,
-                authorization: `Device ${credential.credentialSecret}`,
-            },
-            body: "{}",
-            signal: AbortSignal.timeout(8_000),
-        });
-        if (response.status === 401 || response.status === 403 || response.status === 404)
-            return false;
-        return true;
-    }
-    catch {
-        return true;
-    }
-}
-async function resolvedRuntime(serverArg) {
-    // The selected gateway must come from an explicit override or this build's default.
-    // Never let a credential saved for an older gateway silently retarget CodeLocal.
-    const configured = serverArg || process.env.SERVER_URL || httpToWs(DEFAULT_CLOUD);
-    const server = configured.startsWith("ws://") || configured.startsWith("wss://") ? configured : httpToWs(configured);
-    let credential = await loadLocalCredential(server);
-    if (credential && !(await validateCredential(server, credential))) {
-        console.log("Stored CodeLocal credential is no longer valid or the gateway is incompatible. Pairing this machine again…");
-        await deleteLocalCredential();
-        credential = null;
-    }
-    if (!credential)
-        credential = await pair(wsToHttp(server));
-    return { server, credential };
-}
-async function runRuntime(projectArg, serverArg) {
-    const registry = new WorkspaceRegistry();
-    let initialWorkspaceId;
-    if (projectArg) {
-        const granted = await registry.grant(projectArg);
-        initialWorkspaceId = granted.workspaceId;
-        console.log(`✓ Workspace granted: ${granted.workspaceName}`);
-    }
-    const { server, credential } = await resolvedRuntime(serverArg);
-    const daemon = new RuntimeDaemon({ baseUrl: wsToHttp(server), serverUrl: server, credential, initialWorkspaceId });
-    const stop = async () => { await daemon.stop(); process.exit(0); };
-    process.once("SIGINT", () => { void stop(); });
-    process.once("SIGTERM", () => { void stop(); });
-    await daemon.run();
-}
-async function grant(projectArg) {
-    if (!projectArg)
-        throw new Error("Usage: codelocal grant <project-folder>");
-    const entry = await new WorkspaceRegistry().grant(projectArg);
-    console.log(`✓ Granted ${entry.workspaceName}`);
-    console.log(`  ID: ${entry.workspaceId}`);
-    console.log(`  Path: ${entry.localPath}`);
-    console.log("If `codelocal` is already running, it will sync this workspace shortly.");
-}
-async function ungrant(identifier) {
-    if (!identifier)
-        throw new Error("Usage: codelocal ungrant <workspace-id|project-folder>");
-    const removed = await new WorkspaceRegistry().revoke(identifier);
-    console.log(removed ? "✓ Workspace authorization removed." : "Workspace was not found in the local authorization registry.");
-}
-async function listWorkspaces() {
-    const workspaces = await new WorkspaceRegistry().list();
-    if (!workspaces.length) {
-        console.log("No authorized workspaces. Use `codelocal grant /path/to/project`.");
-        return;
-    }
-    for (const workspace of workspaces) {
-        console.log(`${workspace.workspaceName}\n  ${workspace.workspaceId}\n  ${workspace.localPath}${workspace.lastActivatedAt ? `\n  last activated ${new Date(workspace.lastActivatedAt).toLocaleString()}` : ""}\n`);
-    }
-}
-async function approvalsCommand(args) {
-    const memory = new ApprovalMemory();
-    const action = args[0] ?? "list";
-    if (action === "list") {
-        const approvals = await memory.list();
-        if (!approvals.length) {
-            console.log("No remembered approvals.");
-            return;
-        }
-        for (const approval of approvals) {
-            console.log(`${approval.label}\n  ID: ${approval.id}\n  Workspace: ${approval.workspaceKey}\n  Key: ${approval.actionKey}\n  Used: ${approval.useCount} · last ${new Date(approval.lastUsedAt).toLocaleString()}\n`);
-        }
-        return;
-    }
-    if (action === "revoke") {
-        const id = args[1];
-        if (!id)
-            throw new Error("Usage: codelocal approvals revoke <id|action-key>");
-        const removed = await memory.revoke(id);
-        console.log(removed ? `✓ Removed ${removed} remembered approval${removed === 1 ? "" : "s"}.` : "Approval not found.");
-        return;
-    }
-    if (action === "reset") {
-        const removed = await memory.reset();
-        console.log(`✓ Forgot ${removed} remembered approval${removed === 1 ? "" : "s"}.`);
-        return;
-    }
-    throw new Error("Usage: codelocal approvals [list|revoke <id|action-key>|reset]");
-}
-async function status() {
-    const credential = await loadLocalCredential();
-    const workspaces = await new WorkspaceRegistry().list();
-    console.log(JSON.stringify({
-        device: defaultDeviceIdentity(),
-        paired: !!credential,
-        authorizedWorkspaces: workspaces.map(({ workspaceId, workspaceName, localPath, grantedAt, lastActivatedAt }) => ({ workspaceId, workspaceName, localPath, grantedAt, lastActivatedAt })),
-        credential: credential ? {
-            credentialId: credential.credentialId,
-            deviceId: credential.deviceId,
-            deviceName: credential.deviceName,
-            serverUrl: credential.serverUrl,
-            createdAt: credential.createdAt,
-            credentialSecret: "[REDACTED]",
-        } : null,
-        stateDir: process.env.CODELOCAL_STATE_DIR ?? path.join(os.homedir(), ".codelocal"),
-    }, null, 2));
-}
-async function login(baseArg = DEFAULT_CLOUD, dashboard = false) {
-    const base = normalizeBase(baseArg || DEFAULT_CLOUD);
-    const url = dashboard ? `${base}/dashboard` : `${base}/login`;
-    console.log(url);
-    if (!openBrowser(url))
-        console.log("Open the URL above in your browser.");
-}
-async function looksLikeProjectPath(value) {
-    if (!value || value.startsWith("-"))
-        return false;
-    if (value === "." || value === ".." || value.startsWith("./") || value.startsWith("../") || path.isAbsolute(value))
-        return true;
-    return fs.stat(path.resolve(value)).then((stat) => stat.isDirectory()).catch(() => false);
-}
-async function delegateLegacyCli() {
-    await import("./cli.js");
-}
-const [, , command, ...args] = process.argv;
-try {
-    if (!command)
-        await runRuntime();
-    else if (command === "help" || command === "--help" || command === "-h")
-        usage();
-    else if (command === "login")
-        await login(args[0] ?? DEFAULT_CLOUD, false);
-    else if (command === "dashboard")
-        await login(args[0] ?? DEFAULT_CLOUD, true);
-    else if (command === "pair") {
-        await pair(args[0] ?? DEFAULT_CLOUD);
-    }
-    else if (command === "status")
-        await status();
-    else if (command === "approvals")
-        await approvalsCommand(args);
-    else if (command === "workspaces")
-        await listWorkspaces();
-    else if (command === "grant")
-        await grant(args[0]);
-    else if (command === "ungrant")
-        await ungrant(args[0]);
-    else if (command === "start")
-        await runRuntime(args[0] ?? ".", args[1]);
-    else if (command === "doctor" || command === "mcp")
-        await delegateLegacyCli();
-    else if (command === "rotate" || command === "revoke") {
-        console.log("Device rotation/revocation is account-scoped in SaaS mode. Opening Security/Devices dashboard…");
-        await login(DEFAULT_CLOUD, true);
-    }
-    else if (await looksLikeProjectPath(command))
-        await runRuntime(command, args[0]);
-    else {
-        usage();
-        process.exitCode = 1;
-    }
-}
-catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
-}