cuelo 0.5.0

package/Tools/OMP_Global_Config/patches/apply-notices.mjs

@@ -0,0 +1,135 @@
+// 매직 키워드(`ultrathink`, `orchestrate`, `workflowz`) 알림 문구에 내 규칙을 덧붙인다.
+//
+// 대상은 이 저장소 밖의 전역 npm 패키지 `@oh-my-pi/pi-coding-agent` 의
+// `src/prompts/system/*-notice.md` 다. CUELO는 이 소스를 그대로 실행하므로 파일을
+// 고치면 다음 세션부터 반영된다. `omp.exe`(TUI)는 컴파일된 바이너리라 영향이 없다.
+//
+//   node apply-notices.mjs           적용
+//   node apply-notices.mjs --check   적용 여부만 확인
+//   node apply-notices.mjs --revert  덧붙인 블록 제거(업스트림 원문으로)
+//
+// 업스트림 문구는 손대지 않는다. `</system-notice>` 바로 앞에 마커로 감싼 블록만
+// 넣거나 갱신한다. 그래서 CUELO를 업데이트해 문구가 바뀌어도 병합 충돌이 없고,
+// 업스트림 개선을 조용히 덮어쓰지도 않는다. 내용은 미러의 `notices/<키워드>.md` 다.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const BEGIN = "<!-- omp-global-config:notice-begin -->";
+const END = "<!-- omp-global-config:notice-end -->";
+const CLOSING = "</system-notice>";
+
+// 미러 `notices/<이름>.md` -> 패키지 `src/prompts/system/<파일>`
+const NOTICES = [
+	{ name: "ultrathink", target: "ultrathink-notice.md" },
+	{ name: "orchestrate", target: "orchestrate-notice.md" },
+	{ name: "workflow", target: "workflow-notice.md" },
+];
+
+const MirrorRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+/**
+ * 전역 npm 설치 위치는 PC마다 다르다. apply-core-patch.mjs 와 같은 순서로 찾는다.
+ * 같은 패키지를 두 스크립트가 다르게 고르면 한쪽만 반영돼 원인 찾기가 어려워진다.
+ */
+function resolveTarget() {
+	const probe = "src/prompts/system/ultrathink-notice.md";
+	const seen = [];
+	const add = p => {
+		if (p && !seen.includes(p)) seen.push(p);
+	};
+
+	if (process.env.OMP_CORE_PATCH_TARGET) return process.env.OMP_CORE_PATCH_TARGET;
+
+	const roots = [join(process.env.APPDATA ?? join(homedir(), "AppData/Roaming"), "npm/node_modules")];
+	for (const root of roots) {
+		add(join(root, "cuelo/node_modules/@oh-my-pi/pi-coding-agent"));
+		add(join(root, "cuelo/node_modules/@oh-my-pi/pi-coding-agent"));
+		add(join(root, "omp-web/node_modules/@oh-my-pi/pi-coding-agent"));
+		add(join(root, "@oh-my-pi/pi-coding-agent"));
+	}
+	let found = seen.find(p => existsSync(join(p, probe)));
+	if (found) return found;
+
+	try {
+		const npmRoot = execFileSync("npm", ["root", "-g"], { encoding: "utf8", shell: true }).trim();
+		add(join(npmRoot, "cuelo/node_modules/@oh-my-pi/pi-coding-agent"));
+		add(join(npmRoot, "cuelo/node_modules/@oh-my-pi/pi-coding-agent"));
+		add(join(npmRoot, "omp-web/node_modules/@oh-my-pi/pi-coding-agent"));
+		add(join(npmRoot, "@oh-my-pi/pi-coding-agent"));
+	} catch {
+		// npm 이 없으면 위 후보만으로 판단한다.
+	}
+	return seen.find(p => existsSync(join(p, probe)));
+}
+
+/** 미러 파일에서 주석과 공백을 걷어낸 실제 주입 본문. 비면 주입하지 않는다. */
+function readBlock(name) {
+	const path = join(MirrorRoot, "notices", `${name}.md`);
+	if (!existsSync(path)) return "";
+	const text = readFileSync(path, "utf8").replace(/<!--[\s\S]*?-->/g, "");
+	return text.trim();
+}
+
+/** 마커 블록을 제거한 원문. 적용 전 상태를 계산할 때와 --revert 에 쓴다. */
+function stripBlock(text) {
+	const begin = text.indexOf(BEGIN);
+	if (begin === -1) return text;
+	const end = text.indexOf(END, begin);
+	if (end === -1) return text;
+	return (text.slice(0, begin) + text.slice(end + END.length)).replace(/\n{3,}/g, "\n\n");
+}
+
+/**
+ * 원문의 마지막 `</system-notice>` 바로 앞에 블록을 넣는다. 닫는 태그가 없으면
+ * (업스트림이 형식을 바꾼 경우) 맨 뒤에 붙인다 — 알림 자체는 여전히 전달된다.
+ */
+function merge(original, block) {
+	const base = stripBlock(original);
+	if (!block) return base;
+	const wrapped = `${BEGIN}\n${block}\n${END}`;
+	const at = base.lastIndexOf(CLOSING);
+	if (at === -1) return `${base.trimEnd()}\n\n${wrapped}\n`;
+	return `${base.slice(0, at).trimEnd()}\n\n${wrapped}\n${base.slice(at)}`;
+}
+
+const mode = process.argv.includes("--check") ? "check" : process.argv.includes("--revert") ? "revert" : "apply";
+const target = resolveTarget();
+if (!target) {
+	console.log("SKIP  CUELO 전역 설치를 찾지 못했다 (알림 문구 대상 없음).");
+	process.exit(2);
+}
+console.log(`  대상 ${target}`);
+
+let changed = 0;
+let missing = 0;
+let drift = 0;
+for (const notice of NOTICES) {
+	const path = join(target, "src/prompts/system", notice.target);
+	if (!existsSync(path)) {
+		console.log(`  없음         ${notice.target} (업스트림이 파일을 옮겼다)`);
+		missing++;
+		continue;
+	}
+	const current = readFileSync(path, "utf8");
+	const wanted = mode === "revert" ? stripBlock(current) : merge(current, readBlock(notice.name));
+	if (current === wanted) {
+		console.log(`  일치         ${notice.target}`);
+		continue;
+	}
+	if (mode === "check") {
+		console.log(`  어긋남       ${notice.target}`);
+		drift++;
+		continue;
+	}
+	writeFileSync(path, wanted);
+	console.log(`  ${mode === "revert" ? "복원" : "적용"}         ${notice.target}`);
+	changed++;
+}
+
+if (missing > 0) process.exit(1);
+if (mode === "check") process.exit(drift > 0 ? 1 : 0);
+console.log(changed > 0 ? "완료. CUELO를 재시작하면 새 세션에 반영된다." : "이미 적용돼 있다.");
+process.exit(0);

package/bin/cuelo-options.js

@@ -0,0 +1,38 @@
+"use strict";
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { parseArgs } = require("util");
+
+const TRUE_VALUES = new Set(["1", "true", "yes", "on"]);
+
+function isEnabled(value) {
+  return typeof value === "string" && TRUE_VALUES.has(value.trim().toLowerCase());
+}
+
+function parseLaunchOptions(args = process.argv.slice(2), env = process.env) {
+  const { values: cliArgs } = parseArgs({
+    args,
+    options: {
+      port:      { type: "string", short: "p" },
+      hostname:  { type: "string", short: "H" },
+      "no-open": { type: "boolean" },
+      // Turns the password lock on for this run and every later one, asking for
+      // a password on the terminal when none has been set yet.
+      authenticated: { type: "boolean" },
+      // Recovery from the machine itself: replaces the stored password without
+      // needing the old one.
+      "reset-password": { type: "boolean" },
+    },
+    strict: false,
+  });
+
+  return {
+    port: cliArgs.port ?? env.PORT ?? "30141",
+    hostname: cliArgs.hostname ?? env.CUELO_HOSTNAME ?? "127.0.0.1",
+    openBrowser: !cliArgs["no-open"] && !isEnabled(env.CUELO_NO_OPEN),
+    authenticated: Boolean(cliArgs.authenticated) || isEnabled(env.CUELO_AUTHENTICATED),
+    resetPassword: Boolean(cliArgs["reset-password"]),
+  };
+}
+
+module.exports = { parseLaunchOptions };

package/bin/cuelo.js

@@ -0,0 +1,268 @@
+#!/usr/bin/env node
+"use strict";
+
+const {
+  getMissingBunMessage,
+  getUnsupportedBunVersionMessage,
+  getUnsupportedNodeVersionMessage,
+  isBunVersionSupported,
+  isNodeVersionSupported,
+  resolveBunPath,
+  withLoopbackNoProxy,
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+} = require("./runtime");
+
+if (process.versions.bun && !isBunVersionSupported(process.versions.bun)) {
+  console.error(getUnsupportedBunVersionMessage(process.versions.bun));
+  process.exit(1);
+}
+
+if (!process.versions.bun && !isNodeVersionSupported(process.versions.node)) {
+  console.error(getUnsupportedNodeVersionMessage(process.versions.node));
+  process.exit(1);
+}
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { spawn, spawnSync } = require("child_process");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const path = require("path");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const fs = require("fs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { parseLaunchOptions } = require("./cuelo-options");
+const {
+  getWebAuthStatus,
+  resolveWebAuthFile,
+  setWebPassword,
+  setWebPasswordEnabled,
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+} = require("./web-auth-store");
+const {
+  PromptAbortedError,
+  isInteractive,
+  readNewPassword,
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+} = require("./password-prompt");
+
+if (process.argv.includes("--help") || process.argv.includes("-h")) {
+  console.log(`CUELO — open-source AI coding agent workspace and harness for omp (oh-my-pi)
+
+Usage: cuelo [options]
+       cuelo setup [--home <dir>] [--model <provider/model>] [--role <name>=<provider/model[:effort]>]
+       cuelo start [--home <dir>]
+       cuelo health
+
+Options:
+  -p, --port <port>         Server port (default: 30141)
+  -H, --hostname <host>     Listen address (default: 127.0.0.1)
+      --no-open             Do not open a browser
+      --authenticated       Enable password access
+      --reset-password      Replace the stored web password
+  -h, --help                Show this help
+
+Requires Bun >=1.4.2 to run the server. Node >=22.19.0 may launch the CLI.
+If install scripts did not run, use \"npm run prepare:runtime\" from the installed package before starting.`);
+  process.exit(0);
+}
+
+// 설치·서비스 묶음 명령은 공개 install.mjs가 소유한다. 인자·신호·종료 코드를 전달한다.
+if (["setup", "start", "health"].includes(process.argv[2])) {
+  const child = spawn(process.execPath, [path.join(__dirname, "..", "install.mjs"), ...process.argv.slice(2)], {
+    cwd: path.join(__dirname, ".."),
+    stdio: "inherit",
+  });
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => child.kill(signal));
+  }
+  child.on("error", (error) => {
+    console.error(`CUELO installer failed: ${error.message}`);
+    process.exitCode = 1;
+  });
+  child.on("exit", (code, signal) => {
+    process.exitCode = code ?? (signal === "SIGINT" ? 130 : 1);
+  });
+  return;
+}
+
+const pkgDir = path.join(__dirname, "..");
+const nextDir = path.join(pkgDir, ".next");
+
+// Resolve next's CLI entry directly to avoid relying on .bin symlinks (which
+// may not exist when installed via npx/bunx).
+let nextBin;
+try {
+  nextBin = require.resolve("next/dist/bin/next", { paths: [pkgDir] });
+} catch {
+  // Fallback: locate next package root and derive the bin path manually.
+  try {
+    const nextPkg = require.resolve("next/package.json", { paths: [pkgDir] });
+    nextBin = path.join(path.dirname(nextPkg), "dist", "bin", "next");
+  } catch {
+    nextBin = path.join(pkgDir, "node_modules", "next", "dist", "bin", "next");
+  }
+}
+
+
+const { port, hostname, openBrowser, authenticated, resetPassword } = parseLaunchOptions();
+const loopbackHostnames = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+// Resolved once here and handed to the server through the environment, so the
+// launcher and the Next.js process can never disagree about which credential
+// file is in force.
+const webAuthFile = resolveWebAuthFile();
+
+if (!fs.existsSync(nextDir)) {
+  console.error("Build artifacts not found. Please report this issue.");
+  process.exit(1);
+}
+
+// 소스 실행은 README의 별도 native patch 경로를 유지한다. tarball에는
+// 소스와 bun.lock이 없으므로 기존 patch --check로 실행 준비를 판정한다.
+const sourceCheckout = fs.existsSync(path.join(pkgDir, "bun.lock")) &&
+  fs.existsSync(path.join(pkgDir, "app", "layout.tsx"));
+if (!sourceCheckout) {
+  const ready = spawnSync(process.execPath, [path.join(__dirname, "prepare-runtime.js"), "--check"], {
+    cwd: pkgDir,
+    encoding: "utf8",
+  });
+  if (ready.error || ready.status !== 0) {
+    if (ready.stdout) process.stderr.write(ready.stdout);
+    if (ready.stderr) process.stderr.write(ready.stderr);
+    if (ready.error) console.error(ready.error.message);
+    process.exit(1);
+  }
+}
+
+const bunPath = resolveBunPath();
+if (!bunPath) {
+  console.error(getMissingBunMessage());
+  process.exit(1);
+}
+
+/** Refuse to hang on a password prompt nobody is there to answer. */
+function requireTerminal(flag) {
+  if (isInteractive()) return;
+  throw new Error([
+    `${flag} has to ask for a password, but CUELO is not attached to a terminal.`,
+    "Run CUELO once interactively to set the password, or pass CUELO_PASSWORD in the environment.",
+  ].join("\n"));
+}
+
+async function setPasswordInteractively(intro) {
+  console.log(intro);
+  console.log(`It is stored as a scrypt hash in ${webAuthFile} — CUELO never keeps the password itself.`);
+  const password = await readNewPassword();
+  const status = setWebPassword(password, { file: webAuthFile });
+  console.log(`Password saved. CUELO now asks for the username "${status.username}" and this password.`);
+}
+
+/**
+ * Settle password access before the server starts.
+ *
+ * A run that was asked to be locked must never come up unlocked, so the
+ * credential is written first and `next start` is spawned afterwards.
+ */
+async function configurePasswordAccess() {
+  const status = getWebAuthStatus({ file: webAuthFile });
+
+  if (resetPassword) {
+    if (status.managedByEnvironment) {
+      console.warn(
+        "Warning: CUELO_PASSWORD is set and takes precedence over the stored password. Unset it for this reset to have any effect.",
+      );
+    }
+    requireTerminal("--reset-password");
+    await setPasswordInteractively("Setting a new CUELO password.");
+    return;
+  }
+
+  if (!authenticated) return;
+
+  if (status.managedByEnvironment) {
+    console.log("Password access is already required: CUELO_PASSWORD is set.");
+    return;
+  }
+  if (status.stored) {
+    if (!status.enabled) {
+      setWebPasswordEnabled(true, { file: webAuthFile });
+      console.log("Password access enabled with the password already stored on this machine.");
+    }
+    return;
+  }
+
+  requireTerminal("--authenticated");
+  await setPasswordInteractively("--authenticated was requested and no CUELO password has been set yet.");
+}
+
+function warnAboutExposure() {
+  if (loopbackHostnames.has(hostname)) return;
+  if (getWebAuthStatus({ file: webAuthFile }).enabled) {
+    console.warn(
+      `Warning: CUELO is listening on ${hostname} with Basic Auth over HTTP. Use HTTPS or a trusted VPN to protect the password in transit.`,
+    );
+  } else {
+    console.warn(
+      `Warning: CUELO is listening on ${hostname} without authentication. Only use this on a trusted network, or start it with --authenticated.`,
+    );
+  }
+}
+
+function startServer() {
+  warnAboutExposure();
+
+  // `--bun` forces Bun's own runtime for next's CLI entry (it would otherwise
+  // hand shebang'd scripts to node). The omp SDK ships TypeScript sources and
+  // `bun:` builtins, so the API routes only resolve under Bun.
+  const child = spawn(bunPath, ["--bun", nextBin, "start", "-p", port, "-H", hostname], {
+    cwd: pkgDir,
+    stdio: ["inherit", "pipe", "inherit"],
+    env: withLoopbackNoProxy({
+      ...process.env,
+      CUELO_HOSTNAME: hostname,
+      CUELO_AUTH_FILE: webAuthFile,
+      // Preserve the directory from which `cuelo` was launched so relative
+      // project paths in the browser resolve against the user's shell cwd.
+      CUELO_LAUNCH_CWD: process.cwd(),
+      // `next start` overwrites NODE_ENV and PORT inside the server; the agent's child shells get
+      // these launch-time values back instead (core patch `stripHostNextServerEnv`).
+      CUELO_SHELL_ENV_BASELINE: JSON.stringify({ NODE_ENV: process.env.NODE_ENV, PORT: process.env.PORT }),
+    }),
+  });
+
+  child.on("error", (error) => {
+    console.error(`Failed to launch CUELO through Bun (${bunPath}): ${error.message}`);
+    process.exit(1);
+  });
+
+  let browserOpened = false;
+  const url = `http://${hostname}:${port}`;
+
+  child.stdout.on("data", (chunk) => {
+    const text = chunk.toString();
+    process.stdout.write(text);
+    if (openBrowser && !browserOpened && text.includes("Ready")) {
+      browserOpened = true;
+      const isWindows = process.platform === "win32";
+      const isMac = process.platform === "darwin";
+      const openCmd = isWindows ? "start" : isMac ? "open" : "xdg-open";
+      const opener = spawn(openCmd, [url], {
+        shell: isWindows,
+        stdio: "ignore",
+        detached: true,
+      });
+
+      opener.on("error", (error) => {
+        console.warn(`Could not open browser automatically: ${error.message}`);
+      });
+
+      opener.unref();
+    }
+  });
+
+  child.on("exit", (code) => process.exit(code ?? 0));
+}
+
+configurePasswordAccess().then(startServer, (error) => {
+  if (error instanceof PromptAbortedError) process.exit(130);
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

package/bin/password-prompt.js

@@ -0,0 +1,100 @@
+"use strict";
+
+/**
+ * Terminal password entry for `cuelo --authenticated` and `--reset-password`.
+ *
+ * Reads in raw mode and echoes nothing rather than going through readline's
+ * private output hook, so the same code works under Node and under Bun.
+ */
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { validatePassword } = require("./web-auth-store");
+
+const ETX = "\u0003"; // Ctrl+C
+const EOT = "\u0004"; // Ctrl+D
+const BACKSPACE = "\u007f";
+const ESCAPE = "\u001b";
+
+/** Thrown when the operator interrupts the prompt (Ctrl+C / Ctrl+D). */
+class PromptAbortedError extends Error {
+  constructor() {
+    super("Password entry cancelled");
+    this.name = "PromptAbortedError";
+  }
+}
+
+/** Whether a person is actually there to answer. Services and pipes are not. */
+function isInteractive(stdin = process.stdin, stdout = process.stdout) {
+  return Boolean(stdin.isTTY && stdout.isTTY);
+}
+
+function promptHidden(query) {
+  return new Promise((resolvePrompt, rejectPrompt) => {
+    const { stdin, stdout } = process;
+    if (!isInteractive()) {
+      rejectPrompt(new Error("A terminal is required to enter a password."));
+      return;
+    }
+
+    stdout.write(query);
+    const wasRaw = Boolean(stdin.isRaw);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+
+    let value = "";
+    const finish = (result, error) => {
+      stdin.removeListener("data", onData);
+      stdin.setRawMode(wasRaw);
+      stdin.pause();
+      stdout.write("\n");
+      if (error) rejectPrompt(error);
+      else resolvePrompt(result);
+    };
+
+    const onData = (chunk) => {
+      for (const char of chunk) {
+        if (char === "\r" || char === "\n") return finish(value);
+        // Ctrl+C always cancels; Ctrl+D cancels an empty entry, the usual EOF.
+        if (char === ETX || (char === EOT && value.length === 0)) {
+          return finish(undefined, new PromptAbortedError());
+        }
+        if (char === BACKSPACE || char === "\b") {
+          value = value.slice(0, -1);
+          continue;
+        }
+        // An escape introduces a key sequence (arrows, function keys). Nothing
+        // in one belongs in a password, and the rest of the chunk is its body.
+        if (char === ESCAPE) return;
+        if (char >= " ") value += char;
+      }
+    };
+
+    stdin.on("data", onData);
+  });
+}
+
+/**
+ * Ask for a new password twice, re-asking until the two entries agree and the
+ * result is acceptable to the credential store.
+ */
+async function readNewPassword(options = {}) {
+  const prompt = options.prompt ?? "New password: ";
+  for (;;) {
+    const password = await promptHidden(prompt);
+    const invalid = validatePassword(password);
+    if (invalid) {
+      process.stdout.write(`${invalid}\n`);
+      continue;
+    }
+
+    const confirmation = await promptHidden("Confirm password: ");
+    if (confirmation !== password) {
+      process.stdout.write("The passwords do not match. Try again.\n");
+      continue;
+    }
+    return password;
+  }
+}
+
+module.exports = { PromptAbortedError, isInteractive, promptHidden, readNewPassword };

package/bin/prepare-runtime.js

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+"use strict";
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const fs = require("node:fs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const path = require("node:path");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { spawnSync } = require("node:child_process");
+
+const pkgDir = path.resolve(__dirname, "..");
+const isCheck = process.argv.length === 3 && process.argv[2] === "--check";
+if (process.argv.length > (isCheck ? 3 : 2)) {
+  console.error("Usage: node bin/prepare-runtime.js [--check]");
+  process.exit(1);
+}
+
+// 소스 체크아웃의 npm postinstall은 작업 중인 node_modules를 수정하지 않는다.
+// 서버 준비 검사는 bun.lock을 추가해도 이 소스 분기를 사용하지 않는다.
+if (!isCheck &&
+    fs.existsSync(path.join(pkgDir, "bun.lock")) &&
+    fs.existsSync(path.join(pkgDir, "app", "layout.tsx"))) {
+  console.log("CUELO source install: runtime patch preparation is handled by the source release path.");
+  process.exit(0);
+}
+
+const buildId = path.join(pkgDir, ".next", "BUILD_ID");
+if (!fs.existsSync(buildId)) {
+  console.error("CUELO npm package has no production build (.next/BUILD_ID). Install a prepared tarball.");
+  process.exit(1);
+}
+
+const coreRoot = path.join(pkgDir, "node_modules", "@oh-my-pi");
+const corePackages = ["pi-coding-agent", "pi-agent-core", "pi-ai", "pi-tui"];
+const actualRoot = fs.realpathSync(pkgDir);
+for (const name of corePackages) {
+  const expected = path.join(coreRoot, name);
+  let actual;
+  try {
+    actual = fs.realpathSync(expected);
+  } catch {
+    console.error(`CUELO requires a package-owned SDK at ${expected}. Install globally into an isolated prefix, not a hoisted/shared dependency tree.`);
+    process.exit(1);
+  }
+  const expectedRelative = path.join("node_modules", "@oh-my-pi", name);
+  const actualRelative = path.relative(actualRoot, actual);
+  if ((process.platform === "win32" ? actualRelative.toLowerCase() : actualRelative) !==
+      (process.platform === "win32" ? expectedRelative.toLowerCase() : expectedRelative)) {
+    console.error(`CUELO refuses to patch an SDK outside its own package: ${actual}`);
+    process.exit(1);
+  }
+}
+
+const sdk = path.join(coreRoot, "pi-coding-agent");
+const home = path.join(pkgDir, ".runtime-patch-home");
+if (!isCheck) fs.mkdirSync(home, { recursive: true });
+const env = { ...process.env, OMP_CORE_PATCH_TARGET: sdk, HOME: home, USERPROFILE: home };
+const mode = isCheck ? ["--check"] : [];
+const commands = [
+  [path.join(pkgDir, "Tools", "CUELO_Setup", "files", "native-runtime-patch.js"), ["--target", pkgDir, ...mode]],
+  [path.join(pkgDir, "Tools", "OMP_Global_Config", "patches", "apply-core-patch.mjs"), mode],
+  [path.join(pkgDir, "Tools", "OMP_Global_Config", "patches", "apply-notices.mjs"), mode],
+];
+for (const [script, args] of commands) {
+  const result = spawnSync(process.execPath, [script, ...args], {
+    cwd: pkgDir,
+    env,
+    encoding: "utf8",
+    stdio: isCheck ? "pipe" : "inherit",
+  });
+  if (result.error || result.status !== 0) {
+    if (isCheck) {
+      if (result.stdout) process.stderr.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+    }
+    console.error(`CUELO runtime preparation ${isCheck ? "check" : "apply"} failed at ${path.basename(script)}: ${result.error?.message ?? `exit ${result.status}`}`);
+    if (isCheck) console.error("If installation scripts did not run, use npm run prepare:runtime inside the installed cuelo package.");
+    process.exit(1);
+  }
+}
+if (!isCheck) console.log("CUELO npm runtime patches applied and verified inside this package.");