dominds 0.1.0

package/dist/access-control.js

@@ -0,0 +1,253 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchesPattern = matchesPattern;
+exports.hasReadAccess = hasReadAccess;
+exports.hasWriteAccess = hasWriteAccess;
+exports.getAccessDeniedMessage = getAccessDeniedMessage;
+/**
+ * Module: access-control
+ *
+ * Directory-based access control helpers:
+ * - `matchesPattern` for glob-like directory scope matching (supports `*` and `**`)
+ * - `hasReadAccess`/`hasWriteAccess` to evaluate member permissions
+ * - `getAccessDeniedMessage` to format denial responses
+ */
+const path_1 = __importDefault(require("path"));
+const log_1 = require("./log");
+function isEncapsulatedTaskPath(targetPath) {
+    const normalized = targetPath.replace(/\\/g, '/');
+    // Matches: "foo.tsk", "foo.tsk/", "a/b/foo.tsk/x", etc.
+    return /(^|\/)[^/]+\.tsk(\/|$)/.test(normalized);
+}
+/**
+ * Directory-specific pattern matching for access control.
+ * This function determines if a target path (file or directory) should be controlled
+ * by a directory pattern. The pattern represents a directory scope.
+ *
+ * Supports:
+ * - "*" matches any single directory/file name within a path segment
+ * - "**" matches any number of directory levels (including zero)
+ * - Exact directory matches
+ *
+ * Directory semantics:
+ * - Pattern "src" matches "src/file.txt", "src/subdir/file.js", etc.
+ * - Pattern "src" does NOT match "src-backup/file.txt" (prevents false positives)
+ * - Pattern "src/tools" matches "src/tools/fs.ts" but not "src/other/file.ts"
+ */
+function matchesPattern(targetPath, dirPattern) {
+    // Normalize paths - remove leading/trailing slashes, convert to forward slashes, handle empty paths
+    const normalizedTarget = targetPath.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '') || '.';
+    let normalizedDirPattern = dirPattern.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '') || '.';
+    // Patterns ending in `/**` represent a directory scope and should match the directory itself too.
+    // Example: `.minds/**` must match both `.minds` and `.minds/team.yaml`.
+    while (normalizedDirPattern.endsWith('/**')) {
+        normalizedDirPattern = normalizedDirPattern.slice(0, -3) || '.';
+    }
+    // Handle root directory pattern
+    if (normalizedDirPattern === '.' || normalizedDirPattern === '') {
+        return true; // Root pattern matches everything
+    }
+    // Handle exact match (target is exactly the directory or a file with same name as directory)
+    if (normalizedDirPattern === normalizedTarget) {
+        return true;
+    }
+    // Handle wildcard patterns
+    if (normalizedDirPattern.includes('*')) {
+        // For patterns like **/*secret*, check if any path segment contains "secret"
+        const patternParts = normalizedDirPattern.split('/');
+        const targetParts = normalizedTarget.split('/');
+        // Special handling for **/* patterns - check if any target segment matches the final pattern
+        if (normalizedDirPattern.includes('**/*') && patternParts.length >= 2) {
+            const lastPatternPart = patternParts[patternParts.length - 1];
+            if (lastPatternPart.includes('*')) {
+                // Convert the last part to regex (e.g., *secret* -> .*secret.*)
+                let segmentRegex = lastPatternPart
+                    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+                    .replace(/\*/g, '.*');
+                segmentRegex = '^' + segmentRegex + '$';
+                try {
+                    const regex = new RegExp(segmentRegex);
+                    // Check if any target segment matches
+                    for (const segment of targetParts) {
+                        if (regex.test(segment)) {
+                            return true;
+                        }
+                    }
+                }
+                catch (err) {
+                    log_1.log.warn(`Invalid regex pattern in segment matching: ${segmentRegex}`, err);
+                    // Invalid regex, fall through to other matching
+                }
+            }
+        }
+        // Full path regex matching for complex patterns
+        let regexPattern = normalizedDirPattern
+            // Escape special regex characters except * and **
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+            // Handle ** first (matches any number of path segments including none)
+            .replace(/\*\*/g, '___DOUBLESTAR___')
+            // Handle single * (matches any characters within a single path segment, but not path separators)
+            .replace(/\*/g, '[^/]*')
+            // Replace ** placeholder with pattern that matches any path segments
+            .replace(/___DOUBLESTAR___/g, '.*');
+        // For directory semantics, the pattern should match:
+        // 1. Exact path match
+        // 2. Path that starts with pattern followed by a path separator
+        regexPattern = '^' + regexPattern + '(?:/.*)?$';
+        try {
+            const regex = new RegExp(regexPattern);
+            return regex.test(normalizedTarget);
+        }
+        catch (err) {
+            log_1.log.warn(`Invalid regex pattern in path matching: ${regexPattern}`, err);
+            // If regex is invalid, fall back to exact match
+            return normalizedDirPattern === normalizedTarget;
+        }
+    }
+    // For non-wildcard directory patterns, use proper directory semantics
+    // Pattern should match if target is:
+    // 1. Exactly the directory path
+    // 2. A path that starts with the directory path followed by a path separator
+    // Ensure we don't match partial directory names (e.g., "src" shouldn't match "src-backup")
+    // by requiring either exact match or match followed by path separator
+    const targetParts = normalizedTarget.split('/');
+    const patternParts = normalizedDirPattern.split('/');
+    // Pattern must be a prefix of target path segments
+    if (patternParts.length > targetParts.length) {
+        return false; // Pattern is deeper than target
+    }
+    // Check each pattern segment against corresponding target segment
+    for (let i = 0; i < patternParts.length; i++) {
+        if (patternParts[i] !== targetParts[i]) {
+            return false;
+        }
+    }
+    return true; // All pattern segments matched
+}
+/**
+ * Check if a member has read access to a specific path.
+ *
+ * Access control logic:
+ * 1. Check blacklist first (no_read_dirs) - if path matches any blacklist pattern, deny access
+ * 2. Check whitelist (read_dirs) - if path matches any whitelist pattern, allow access
+ * 3. If no whitelist patterns are defined, allow access (default allow)
+ * 4. If whitelist patterns exist but none match, deny access
+ */
+function hasReadAccess(member, targetPath) {
+    // Get resolved relative path from workspace root
+    const cwd = path_1.default.resolve(process.cwd());
+    const resolvedPath = path_1.default.resolve(cwd, targetPath);
+    // Ensure path is within workspace
+    if (!resolvedPath.startsWith(cwd)) {
+        return false;
+    }
+    // Get relative path from workspace root
+    const relativePath = path_1.default.relative(cwd, resolvedPath);
+    // Task Docs (`*.tsk/`) are encapsulated and forbidden to all general file tools.
+    if (isEncapsulatedTaskPath(relativePath)) {
+        return false;
+    }
+    // Check blacklist first (no_read_dirs)
+    const blacklist = member.no_read_dirs || [];
+    for (const pattern of blacklist) {
+        if (matchesPattern(relativePath, pattern)) {
+            return false; // Explicitly denied
+        }
+    }
+    // Check whitelist (read_dirs)
+    const whitelist = member.read_dirs || [];
+    // If no whitelist is defined, allow access (after blacklist check)
+    if (whitelist.length === 0) {
+        return true;
+    }
+    // Check if path matches any whitelist pattern
+    for (const pattern of whitelist) {
+        if (matchesPattern(relativePath, pattern)) {
+            return true; // Explicitly allowed
+        }
+    }
+    // Path doesn't match any whitelist pattern
+    return false;
+}
+/**
+ * Check if a member has write access to a specific path.
+ *
+ * Access control logic:
+ * 1. Check blacklist first (no_write_dirs) - if path matches any blacklist pattern, deny access
+ * 2. Check whitelist (write_dirs) - if path matches any whitelist pattern, allow access
+ * 3. If no whitelist patterns are defined, allow access (default allow)
+ * 4. If whitelist patterns exist but none match, deny access
+ */
+function hasWriteAccess(member, targetPath) {
+    // Get resolved relative path from workspace root
+    const cwd = path_1.default.resolve(process.cwd());
+    const resolvedPath = path_1.default.resolve(cwd, targetPath);
+    // Ensure path is within workspace
+    if (!resolvedPath.startsWith(cwd)) {
+        return false;
+    }
+    // Get relative path from workspace root
+    const relativePath = path_1.default.relative(cwd, resolvedPath);
+    // Task Docs (`*.tsk/`) are encapsulated and forbidden to all general file tools.
+    if (isEncapsulatedTaskPath(relativePath)) {
+        return false;
+    }
+    // Check blacklist first (no_write_dirs)
+    const blacklist = member.no_write_dirs || [];
+    for (const pattern of blacklist) {
+        if (matchesPattern(relativePath, pattern)) {
+            return false; // Explicitly denied
+        }
+    }
+    // Check whitelist (write_dirs)
+    const whitelist = member.write_dirs || [];
+    // If no whitelist is defined, allow access (after blacklist check)
+    if (whitelist.length === 0) {
+        return true;
+    }
+    // Check if path matches any whitelist pattern
+    for (const pattern of whitelist) {
+        if (matchesPattern(relativePath, pattern)) {
+            return true; // Explicitly allowed
+        }
+    }
+    // Path doesn't match any whitelist pattern
+    return false;
+}
+/**
+ * Get an access denied error message for a specific operation and path.
+ */
+function getAccessDeniedMessage(operation, targetPath, language = 'en') {
+    const lines = language === 'zh'
+        ? [
+            '❌ **访问被拒绝**',
+            '',
+            `- 操作：\`${operation}\``,
+            `- 路径：\`${targetPath}\``,
+            `- 代码：\`ACCESS_DENIED\``,
+        ]
+        : [
+            '❌ **Access Denied**',
+            '',
+            `- Operation: \`${operation}\``,
+            `- Path: \`${targetPath}\``,
+            `- Code: \`ACCESS_DENIED\``,
+        ];
+    if (isEncapsulatedTaskPath(targetPath)) {
+        lines.push('');
+        if (language === 'zh') {
+            lines.push(`- 说明：\`*.tsk/\` 是封装差遣牒。通用文件工具不得读/写/列目录/删除其中内容。`);
+            lines.push(`- 提示：写入/更新请使用函数工具 \`change_mind\`（顶层：\`change_mind({\"selector\":\"goals|constraints|progress\",\"content\":\"...\"})\`；额外章节：\`change_mind({\"category\":\"<category>\",\"selector\":\"<selector>\",\"content\":\"...\"})\`）。`);
+            lines.push(`- 提示：读取额外章节请使用函数工具 \`recall_taskdoc\`：\`recall_taskdoc({\"category\":\"<category>\",\"selector\":\"<selector>\"})\`。`);
+        }
+        else {
+            lines.push(`- Note: \`*.tsk/\` is an encapsulated Taskdoc. General file tools must not read/write/list/delete it.`);
+            lines.push(`- Hint: For updates, use the function tool \`change_mind\` (top-level: \`change_mind({\"selector\":\"goals|constraints|progress\",\"content\":\"...\"})\`; extra sections: \`change_mind({\"category\":\"<category>\",\"selector\":\"<selector>\",\"content\":\"...\"})\`).`);
+            lines.push(`- Hint: To read extra sections, use \`recall_taskdoc({\"category\":\"<category>\",\"selector\":\"<selector>\"})\`.`);
+        }
+    }
+    return lines.join('\n');
+}

package/dist/cli/create.js

@@ -0,0 +1,263 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Create/new subcommand for dominds CLI
+ *
+ * Usage:
+ *   dominds create <template> [directory] [--repo-url <url>]
+ *   dominds new <template> [directory]    [--repo-url <url>]   # alias for create
+ *
+ * Notes:
+ * - Template can be a short name (resolved via DOMINDS_TEMPLATE_BASE) or a git URL.
+ * - Workspace directory is `process.cwd()`. Use 'dominds -C <dir> create ...' to create under another base dir.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.main = main;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+function getPackageVersion() {
+    try {
+        const packagePath = path.join(__dirname, '../package.json');
+        const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+        return typeof packageJson.version === 'string' && packageJson.version.trim()
+            ? packageJson.version
+            : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function looksLikeGitUrl(s) {
+    if (s.includes('://'))
+        return true;
+    if (s.startsWith('git@'))
+        return true;
+    // scp-like syntax: user@host:org/repo(.git)
+    if (/^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+:/.test(s))
+        return true;
+    return false;
+}
+function parseTemplateSpec(template, cwd) {
+    const trimmed = template.trim();
+    if (!trimmed) {
+        return { kind: 'short-name', name: '' };
+    }
+    if (looksLikeGitUrl(trimmed)) {
+        return { kind: 'git-url', url: trimmed };
+    }
+    // Treat existing paths as local templates.
+    const absCandidate = path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);
+    if (fs.existsSync(absCandidate)) {
+        return { kind: 'local-path', absPath: absCandidate };
+    }
+    return { kind: 'short-name', name: trimmed };
+}
+function resolveTemplateRepoUrl(spec, env) {
+    switch (spec.kind) {
+        case 'git-url':
+            return spec.url;
+        case 'local-path':
+            return spec.absPath;
+        case 'short-name': {
+            const rawBase = env.DOMINDS_TEMPLATE_BASE;
+            const base = typeof rawBase === 'string' && rawBase.trim() ? rawBase.trim().replace(/\/+$/g, '') : '';
+            const baseOrDefault = base || 'https://github.com/longrun-ai';
+            const name = spec.name.endsWith('.git') ? spec.name.slice(0, -'.git'.length) : spec.name;
+            return `${baseOrDefault}/${name}.git`;
+        }
+        default: {
+            const _exhaustive = spec;
+            return _exhaustive;
+        }
+    }
+}
+function deriveTargetDirName(template) {
+    const trimmed = template.trim().replace(/\/+$/g, '');
+    if (!trimmed)
+        return 'dominds-workspace';
+    // URL-like cases
+    const lastSlash = trimmed.lastIndexOf('/');
+    const lastColon = trimmed.lastIndexOf(':');
+    const lastSep = Math.max(lastSlash, lastColon);
+    const tail = lastSep >= 0 ? trimmed.slice(lastSep + 1) : trimmed;
+    const withoutGit = tail.endsWith('.git') ? tail.slice(0, -'.git'.length) : tail;
+    return withoutGit || 'dominds-workspace';
+}
+function parseArgs(argv) {
+    let template;
+    let directory;
+    let repoUrl;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--help' || a === '-h') {
+            return { kind: 'help' };
+        }
+        if (a === '--version' || a === '-v') {
+            return { kind: 'version' };
+        }
+        if (a === '--repo-url') {
+            const next = argv[i + 1];
+            if (next == null || next.trim() === '') {
+                throw new Error('--repo-url requires a value');
+            }
+            repoUrl = next;
+            i++;
+            continue;
+        }
+        if (a.startsWith('-')) {
+            throw new Error(`Unknown option: ${a}`);
+        }
+        if (!template) {
+            template = a;
+            continue;
+        }
+        if (!directory) {
+            directory = a;
+            continue;
+        }
+        throw new Error(`Unexpected argument: ${a}`);
+    }
+    if (!template || template.trim() === '') {
+        return { kind: 'help' };
+    }
+    return { kind: 'run', template, directory, repoUrl };
+}
+function printHelp() {
+    console.log(`dominds v${getPackageVersion()}`);
+    console.log('');
+    console.log('Usage:');
+    console.log('  dominds create <template> [directory] [--repo-url <url>]');
+    console.log('  dominds new <template> [directory]    [--repo-url <url>]   # alias for create');
+    console.log('');
+    console.log('Create a new dominds-powered workspace by cloning a template repository.');
+    console.log('');
+    console.log('Template resolution:');
+    console.log('  - If <template> looks like a git URL, it is used as-is.');
+    console.log('  - Otherwise it resolves to: ${DOMINDS_TEMPLATE_BASE}/<template>.git');
+    console.log('  - Default DOMINDS_TEMPLATE_BASE = https://github.com/longrun-ai');
+    console.log('');
+    console.log('Options:');
+    console.log('  --repo-url <url>     After cloning, set git origin to this URL (and keep template as remote).');
+    console.log('  -h, --help           Show this help message');
+    console.log('  -v, --version        Show version information');
+    console.log('');
+    console.log('Examples:');
+    console.log('  dominds create web-scaffold my-project');
+    console.log('  DOMINDS_TEMPLATE_BASE=https://github.com/myorg dominds create web-scaffold my-project');
+    console.log('  dominds create https://github.com/myorg/custom-template.git my-project');
+    console.log('  dominds create web-scaffold my-project --repo-url git@github.com:myorg/my-project.git');
+}
+async function run(cmd, args, cwd) {
+    const child = (0, child_process_1.spawn)(cmd, [...args], { cwd, stdio: 'inherit' });
+    return await new Promise((resolve, reject) => {
+        child.on('error', (err) => reject(err));
+        child.on('close', (code, signal) => {
+            if (code === 0) {
+                resolve({ kind: 'ok' });
+                return;
+            }
+            resolve({ kind: 'error', cmd: `${cmd} ${args.join(' ')}`, code, signal });
+        });
+    });
+}
+async function runGit(args, cwd) {
+    const res = await run('git', args, cwd);
+    if (res.kind === 'ok')
+        return;
+    const detail = res.signal ? `signal ${res.signal}` : `exit code ${String(res.code)}`;
+    throw new Error(`git failed (${detail}): ${res.cmd}`);
+}
+async function main() {
+    try {
+        const parsed = parseArgs(process.argv.slice(2));
+        switch (parsed.kind) {
+            case 'help':
+                printHelp();
+                return;
+            case 'version':
+                console.log(`dominds v${getPackageVersion()}`);
+                return;
+            case 'run': {
+                const cwd = process.cwd();
+                const spec = parseTemplateSpec(parsed.template, cwd);
+                const templateRepoUrl = resolveTemplateRepoUrl(spec, process.env);
+                const targetName = parsed.directory
+                    ? parsed.directory
+                    : deriveTargetDirName(parsed.template);
+                const targetAbs = path.resolve(cwd, targetName);
+                if (fs.existsSync(targetAbs)) {
+                    throw new Error(`Target directory already exists: ${targetAbs}`);
+                }
+                fs.mkdirSync(path.dirname(targetAbs), { recursive: true });
+                console.log(`Creating workspace: ${targetAbs}`);
+                console.log(`Template: ${templateRepoUrl}`);
+                await runGit(['clone', '--depth', '1', templateRepoUrl, targetAbs], cwd);
+                if (parsed.repoUrl) {
+                    // Keep the template remote for future pulls/inspection.
+                    try {
+                        await runGit(['-C', targetAbs, 'remote', 'add', 'template', templateRepoUrl], cwd);
+                    }
+                    catch {
+                        await runGit(['-C', targetAbs, 'remote', 'set-url', 'template', templateRepoUrl], cwd);
+                    }
+                    await runGit(['-C', targetAbs, 'remote', 'set-url', 'origin', parsed.repoUrl], cwd);
+                    console.log(`Set git origin to: ${parsed.repoUrl}`);
+                }
+                const mindsDir = path.join(targetAbs, '.minds');
+                if (!fs.existsSync(mindsDir)) {
+                    console.warn(`Warning: template does not contain '.minds/' (${mindsDir})`);
+                }
+                console.log('Done.');
+                return;
+            }
+            default: {
+                const _exhaustive = parsed;
+                return _exhaustive;
+            }
+        }
+    }
+    catch (err) {
+        console.error('Error:', err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+if (require.main === module) {
+    main().catch((err) => {
+        console.error('Unhandled error:', err);
+        process.exit(1);
+    });
+}

package/dist/cli/read.js

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Read subcommand for dominds CLI
+ *
+ * Usage:
+ *   dominds read [options] [<member-id>]
+ *
+ * Options:
+ *   --no-hints           Don't show hints
+ *   --only-prompt        Show only system prompt
+ *   --only-mem           Show only memories
+ *   --help               Show help
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.main = main;
+const load_1 = require("../minds/load");
+function printUsage() {
+    console.log('Usage: dominds read [<member-id>] [--no-hints] [--only-prompt|--only-mem]');
+    console.log('');
+    console.log('Print agent system prompt and memories with filtering flags.');
+    console.log('');
+    console.log("Note: Workspace directory is `process.cwd()`. Use 'dominds -C <dir> read' to run in another workspace.");
+    console.log('');
+    console.log('Examples:');
+    console.log('  dominds read                    # Read all team members');
+    console.log('  dominds read developer          # Read specific member');
+    console.log('  dominds read --only-prompt      # Show only system prompts');
+    console.log('  dominds read --only-mem         # Show only memories');
+}
+async function main() {
+    const args = process.argv.slice(2);
+    let memberId;
+    let onlyPrompt = false;
+    let onlyMem = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--only-prompt') {
+            onlyPrompt = true;
+        }
+        else if (arg === '--only-mem') {
+            onlyMem = true;
+        }
+        else if (arg === '--no-hints') {
+            // Deprecated, but keep for compatibility
+            console.warn('Warning: --no-hints is deprecated, use --only-prompt or --only-mem instead');
+        }
+        else if (arg === '-h' || arg === '--help') {
+            printUsage();
+            process.exit(0);
+        }
+        else if (!memberId) {
+            memberId = arg;
+        }
+        else {
+            console.error(`Error: unexpected argument '${arg}'`);
+            printUsage();
+            process.exit(1);
+        }
+    }
+    try {
+        const { systemPrompt, memories } = await (0, load_1.loadAgentMinds)(memberId);
+        if (!onlyMem) {
+            process.stdout.write(systemPrompt.trim() + '\n');
+        }
+        if (!onlyPrompt) {
+            for (const mem of memories) {
+                if ('content' in mem && typeof mem.content === 'string' && mem.content.trim()) {
+                    process.stdout.write('\n' + mem.content.trim() + '\n');
+                }
+            }
+        }
+    }
+    catch (err) {
+        console.error('Error loading agent minds:', err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+if (require.main === module) {
+    main().catch((err) => {
+        console.error('Unhandled error:', err);
+        process.exit(1);
+    });
+}