getclaros 0.0.0-stage → 0.1.0

package/dist/cli.js

@@ -0,0 +1,456 @@
+#!/usr/bin/env node
+// getclaros guard: a stdio MCP proxy. Relays newline-delimited JSON-RPC between the agent (our stdin/stdout) and
+// the wrapped MCP server (child stdin/stdout) byte for byte, except tools/call on write tools: those are checked
+// with POST <url>/v1/check first and, when stopped (stop or ask), answered with an isError result and never forwarded;
+// when nudged, forwarded, and the server's result comes back with one more text item: the rule and its fix.
+// A remote server (--remote <url>) is reached over Streamable HTTP instead; the client still speaks stdio to us.
+// When Claros needs the record a call targets (a submit by name, a partial record, an item's group), it answers
+// `need`; the guard reads those records itself through the wrapped server's read tools (ids the client never sees),
+// or through another guarded server's guard when the need names its app (peers.ts), and asks again. stdout carries the protocol: every log line goes to stderr.
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { parseArgs } from "node:util";
+import { reduceRows, rowsOf } from "./query.js";
+import { ask, serve } from "./peers.js";
+import { DEFAULT_WEB, loadConfig, relocate, resolve } from "./config.js";
+// the package name lives in package.json only (placeholder until decided)
+const NAME = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).name;
+// until Claros has classified a tool (GET /v1/tools/kinds): readOnlyHint, else this name rule (same as the server's)
+const READ = /^(get|list|search|read|find|describe|fetch)|^(check|run|export)_|^(version|ping)$/i;
+const LOOKUP_TTL = 60_000, KINDS_TTL = 30_000;
+const GUARD_USAGE = `       ${NAME} guard --server <name> [--url <claros server> | --web <claros web app>] [--key <key> | env CLAROS_KEY]
+                [--timeout <ms>] [--fail-open] (-- <command> [args...] | --remote <mcp url> [--header "K: V" ...])
+       ${NAME} mcp     (the Claros MCP server over stdio, with the saved key)
+Server: --url / CLAROS_URL, else the saved one, else asked from the web app (--web / CLAROS_WEB, default
+https://claros-eta.vercel.app, at /.well-known/claros.json). Help: ${NAME} <command> --help`;
+const log = (s) => process.stderr.write(`[${NAME} guard] ${s}\n`);
+/** {a: {b: [{c: 1}]}, d: 2} → {"a.b.0.c": 1, d: 2}. Empty objects/arrays vanish. */
+function flatten(v, prefix = "", out = {}) {
+    if (v !== null && typeof v === "object") {
+        for (const [k, x] of Object.entries(v))
+            flatten(x, prefix ? `${prefix}.${k}` : k, out);
+    }
+    else if (prefix)
+        out[prefix] = v;
+    return out;
+}
+/** Splits a byte stream into lines (without the \n), keeping each line's exact bytes. */
+function lines(stream, onLine, onEnd) {
+    let buf = Buffer.alloc(0);
+    stream.on("data", (chunk) => {
+        buf = buf.length ? Buffer.concat([buf, chunk]) : chunk;
+        let i;
+        while ((i = buf.indexOf(0x0a)) >= 0) {
+            onLine(buf.subarray(0, i));
+            buf = buf.subarray(i + 1);
+        }
+    });
+    stream.on("end", () => {
+        if (buf.length)
+            onLine(buf);
+        onEnd();
+    });
+}
+function parse(b) {
+    try {
+        return JSON.parse(b.toString("utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+function stopText(r) {
+    const hits = (r.violations || []).filter((v) => v.action === "stop" || v.action === "ask");
+    const maps = [...new Set(hits.map((v) => v.workflow_id ?? r.workflow_id))];
+    const from = `expert-approved Work Map${maps.length > 1 ? "s" : ""} ${maps.map((m) => `"${m}"`).join(", ")}`;
+    const out = [r.result === "ask" // ask only: not refused for good, waiting on a person
+            ? `Claros held this action: ${hits.length === 1 ? "a rule" : "rules"} from the ${from} ${hits.length === 1 ? "says" : "say"} to ask first. Do not run it without that answer.`
+            : `Claros stopped this action: it breaks ${hits.length === 1 ? "a rule" : "rules"} from the ${from}. Do not retry it as is.`];
+    for (const v of hits) {
+        const who = v.who_to_ask || v.owner || v.expert || "the process owner";
+        out.push("", `Rule: ${v.rule}`);
+        if (v.reason)
+            out.push(`Why Claros stopped it: ${v.reason}`); // fuzzy rules: the judge's one-line reason
+        if (v.quote)
+            out.push(`${v.source === "doc" ? "In the written policy" : "In the expert's words"}${v.expert ? ` (${v.expert})` : ""}: "${v.quote}"`);
+        out.push(`Who to ask: ${who}`);
+        out.push(v.action === "ask"
+            ? `Next: stop and ask ${who} before doing this; continue only with their answer.`
+            : `Next: change the record so the rule holds, or ask ${who} to approve an exception. Tell the user why.`);
+    }
+    // an override goes to the rule's expert as a report; the rule stays as it is until they confirm a change
+    if (r.check_id) {
+        out.push("", "If this stop is wrong, tell the rule's expert why (the rule stays until they change it):");
+        for (const v of hits)
+            out.push(`npx ${NAME} override ${r.check_id} --rule ${v.guardrail_id} --reason "<why it was fine>"`);
+    }
+    return out.join("\n");
+}
+// a nudge lets the call through; "warn" is its old name (older Claros servers)
+const nudgesOf = (r) => (r.violations || []).filter((v) => v.action === "nudge" || v.action === "warn");
+/** The extra text item on a nudged call's result: the rule, the expert's words and the fix, so the agent can
+ *  correct this record (if it still can) and the next ones. */
+function nudgeText(r) {
+    const hits = nudgesOf(r);
+    const out = [`Claros nudge: the call went through, but it doesn't follow ${hits.length === 1 ? "a rule" : "rules"} ` +
+            `your team holds. Fix it if you still can, and follow ${hits.length === 1 ? "it" : "them"} from now on.`];
+    for (const v of hits) {
+        out.push("", `Rule: ${v.rule}`);
+        if (v.reason)
+            out.push(`Why: ${v.reason}`);
+        if (v.quote)
+            out.push(`${v.source === "doc" ? "In the written policy" : "In the expert's words"}${v.expert ? ` (${v.expert})` : ""}: "${v.quote}"`);
+        if (v.fix)
+            out.push(`Suggested fix: ${v.fix}`);
+    }
+    return out.join("\n");
+}
+/** fetch, and once more at the web app's current server address if this one didn't answer (it moved). */
+async function reach(o, path, init = {}) {
+    const go = async () => {
+        if (!o.url)
+            throw new Error("no Claros server address (the web app didn't say where it is)");
+        return fetch(o.url + path, { ...init, signal: AbortSignal.timeout(o.timeout) });
+    };
+    try {
+        return await go();
+    }
+    catch (e) {
+        if (e.name === "TimeoutError" || !(await relocate(o)))
+            throw e;
+        log(`Claros moved: now ${o.url}`);
+        return go();
+    }
+}
+async function check(o, tool, args, fetched = {}) {
+    const res = await reach(o, "/v1/check", {
+        method: "POST",
+        headers: { "content-type": "application/json", ...(o.key ? { authorization: `Bearer ${o.key}` } : {}) },
+        body: JSON.stringify({ app: o.server, tool, action: tool, state: flatten(args ?? {}), arguments: args ?? {},
+            ...(Object.keys(fetched).length ? { fetched } : {}) }),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    return res.json();
+}
+/** A read tool's result → the record: structuredContent, else JSON in the text (whole, or its outermost {...}). */
+function recordOf(tool, m) {
+    if (m?.error || m?.result?.isError)
+        throw new Error(`couldn't read the record: ${tool} returned an error`);
+    if (m.result?.structuredContent && typeof m.result.structuredContent === "object")
+        return m.result.structuredContent;
+    const text = (m.result?.content ?? []).filter((c) => c?.type === "text").map((c) => c.text).join("\n");
+    for (const s of [text, text.slice(text.indexOf("{"), text.lastIndexOf("}") + 1)]) {
+        try {
+            const v = JSON.parse(s);
+            if (v && typeof v === "object" && !Array.isArray(v))
+                return v;
+        }
+        catch { /* next */ }
+    }
+    throw new Error(`couldn't read the record: ${tool} returned no record`);
+}
+/** Registers tools seen in tools/list with Claros (POST /v1/tools) so it can map their arguments to a Work Map.
+ *  Fire and forget: never awaited by the relay; a failure is logged and retried on the next tools/list.
+ *  `onDone` runs after a successful registration (the guard then asks for the tools' read/write kinds). */
+function registrar(o, onDone) {
+    const sent = new Map(); // tool name → hash of what Claros has
+    return (list) => {
+        const fresh = list.filter((t) => t?.name && sent.get(t.name) !== hashOf(t));
+        if (!fresh.length)
+            return false;
+        for (const t of fresh)
+            sent.set(t.name, hashOf(t));
+        const tools = fresh.map(({ name, description, inputSchema, annotations }) => ({ name, description, inputSchema, annotations }));
+        reach(o, "/v1/tools", {
+            method: "POST",
+            headers: { "content-type": "application/json", ...(o.key ? { authorization: `Bearer ${o.key}` } : {}) },
+            body: JSON.stringify({ app: o.server, tools }),
+        }).then((r) => {
+            if (!r.ok)
+                throw new Error(`HTTP ${r.status}`);
+            log(`registered ${tools.length} tool(s) with Claros`);
+            onDone();
+        }).catch((e) => {
+            for (const t of fresh)
+                sent.delete(t.name);
+            log(`tool registration failed (${e.message}); calls are still checked`);
+        });
+        return true;
+    };
+}
+const hashOf = (t) => createHash("sha256").update(JSON.stringify(t)).digest("hex");
+/** A local server: a child process speaking newline-delimited JSON-RPC; we exit with its exit code. */
+const stdio = (cmd, argv) => (onLine) => {
+    // ponytail: plain spawn, no shell — Windows .cmd shims (npx) need shell:true; add when someone runs it there
+    const child = spawn(cmd, argv, { stdio: ["pipe", "pipe", "inherit"] });
+    lines(child.stdout, onLine, () => { });
+    child.stdin.on("error", () => { }); // server gone: its exit below ends us
+    child.on("error", (e) => { log(`could not start ${cmd}: ${e.message}`); process.exit(127); });
+    child.on("close", (code, sig) => process.stdout.write("", () => process.exit(code ?? (sig ? 1 : 0))));
+    for (const s of ["SIGINT", "SIGTERM", "SIGHUP"])
+        process.on(s, () => child.kill(s));
+    return { send: (b) => child.stdin.write(Buffer.concat([b, Buffer.from("\n")])), end: () => child.stdin.end() };
+};
+/** A remote server over Streamable HTTP: one POST per message (with the client config's headers, which go nowhere
+ *  else); the answer is JSON or an SSE stream of messages. A request it can't deliver is answered with an error. */
+const http = (url, headers) => (onLine) => {
+    const host = new URL(url).host; // in messages: the URL's path or query may carry a token
+    let session, version, inflight = 0, ending = false;
+    const emit = (s) => {
+        if (!s.trim())
+            return;
+        const m = parse(Buffer.from(s));
+        version ??= m?.result?.protocolVersion;
+        onLine(Buffer.from(s.includes("\n") && m ? JSON.stringify(m) : s)); // stdout carries one message per line
+    };
+    const done = () => { if (ending && !inflight)
+        process.stdout.write("", () => process.exit(0)); };
+    // ponytail: no GET stream for server-initiated messages and no re-initialize on an expired session (404);
+    // add when a server needs them
+    async function post(b) {
+        const msg = parse(b);
+        try {
+            const r = await fetch(url, { method: "POST", body: b.toString("utf8"), headers: { ...headers, "content-type": "application/json",
+                    accept: "application/json, text/event-stream", ...(session ? { "mcp-session-id": session } : {}),
+                    ...(version ? { "mcp-protocol-version": version } : {}) } });
+            session = r.headers.get("mcp-session-id") ?? session;
+            if (!r.ok)
+                throw new Error(`HTTP ${r.status}`);
+            if (!(r.headers.get("content-type") ?? "").includes("event-stream") || !r.body)
+                return emit(await r.text());
+            let buf = "";
+            const event = (ev) => emit(ev.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("\n"));
+            for await (const chunk of r.body.pipeThrough(new TextDecoderStream())) {
+                buf = (buf + chunk).replace(/\r\n?/g, "\n");
+                for (let i; (i = buf.indexOf("\n\n")) >= 0; buf = buf.slice(i + 2))
+                    event(buf.slice(0, i));
+            }
+            event(buf);
+        }
+        catch (e) {
+            log(`${host}: ${e.message}`);
+            if (msg?.method && msg.id !== undefined) { // a request: its caller (the client, or our own read) gets the error
+                emit(JSON.stringify({ jsonrpc: "2.0", id: msg.id, error: { code: -32000, message: `MCP server at ${host}: ${e.message}` } }));
+            }
+        }
+    }
+    return {
+        send: (b) => { inflight++; post(b).finally(() => { inflight--; done(); }); },
+        end: () => { ending = true; done(); },
+    };
+};
+function guard(o, connect) {
+    const kinds = new Map(); // tool → read | write, as Claros classified it (LLM or expert)
+    let kindsAt = 0;
+    const refreshKinds = () => {
+        kindsAt = Date.now();
+        reach(o, `/v1/tools/kinds?app=${encodeURIComponent(o.server)}`, {
+            headers: o.key ? { authorization: `Bearer ${o.key}` } : {},
+        }).then(async (r) => {
+            if (!r.ok)
+                throw new Error(`HTTP ${r.status}`);
+            for (const [k, v] of Object.entries((await r.json()).kinds ?? {}))
+                kinds.set(k, String(v));
+        }).catch((e) => log(`tool kinds unavailable (${e.message}); using names`));
+    };
+    const register = registrar(o, refreshKinds);
+    const tools = new Map(); // from tools/list responses passing through
+    const listIds = new Set(); // ids of tools/list requests in flight
+    const nudges = new Map(); // id of a nudged call in flight → the text its result gets
+    let pending = 0, stdinDone = false;
+    const toClient = (b) => process.stdout.write(Buffer.concat([Buffer.from(b), Buffer.from("\n")]));
+    // the guard's own reads of the wrapped server: ids under a per-process prefix, answered here, never relayed
+    const PREFIX = `claros-guard-${randomUUID()}-`;
+    const own = new Map();
+    const up = connect((line) => {
+        if (line.includes(PREFIX)) {
+            const msg = parse(line);
+            if (typeof msg?.id === "string" && msg.id.startsWith(PREFIX))
+                return own.get(msg.id)?.(msg); // ours, late or not
+        }
+        if (listIds.size) {
+            const msg = parse(line), id = JSON.stringify(msg?.id);
+            if (msg && listIds.has(id)) {
+                listIds.delete(id);
+                for (const t of msg.result?.tools ?? [])
+                    tools.set(t.name, t);
+                if (Array.isArray(msg.result?.tools) && !register(msg.result.tools))
+                    refreshKinds();
+            }
+        }
+        if (nudges.size) {
+            const msg = parse(line), id = JSON.stringify(msg?.id), text = msg && nudges.get(id);
+            if (text !== undefined) {
+                nudges.delete(id);
+                if (Array.isArray(msg.result?.content)) { // a JSON-RPC error has no content: relayed as is
+                    msg.result.content.push({ type: "text", text });
+                    return toClient(JSON.stringify(msg));
+                }
+            }
+        }
+        toClient(line);
+    });
+    const toServer = (b) => up.send(b);
+    const maybeEnd = () => { if (stdinDone && !pending)
+        up.end(); };
+    const isRead = (name) => kinds.has(name) ? kinds.get(name) === "read"
+        : tools.get(name)?.annotations?.readOnlyHint === true || READ.test(name);
+    let seq = 0;
+    const callServer = (tool, args) => new Promise((ok, no) => {
+        const id = PREFIX + ++seq;
+        const t = setTimeout(() => { own.delete(id); no(new Error(`reading ${tool} timed out after ${o.timeout}ms`)); }, o.timeout);
+        own.set(id, (m) => { clearTimeout(t); own.delete(id); ok(m); });
+        toServer(Buffer.from(JSON.stringify({ jsonrpc: "2.0", id, method: "tools/call", params: { name: tool, arguments: args } })));
+    });
+    // ponytail: lookups (an item's group, a supplier's invoice count) cached per process for a minute, unbounded below
+    // 1000 entries; two queries with the same arguments but different reducers each call the tool
+    const cache = new Map();
+    // the user's other guards may read through this one (cross-server lookups, peers.ts), read tools only
+    serve(o.server, o.key, isRead, callServer, log);
+    async function read(n) {
+        const peer = typeof n.app === "string" && n.app !== o.server; // a read tool of another guarded server
+        if (!peer && !isRead(String(n.tool)))
+            throw new Error(`asked to read with ${n.tool}, which isn't a read tool`);
+        const hit = n.cache && cache.get(n.key);
+        if (hit && Date.now() - hit.t < LOOKUP_TTL)
+            return hit.v;
+        const m = peer ? await ask(n.app, o.key, n.tool, n.arguments, o.timeout) : await callServer(n.tool, n.arguments);
+        // a query lookup: the rows stay here, only the reduced value goes to Claros
+        const v = n.reduce ? { value: reduceRows(rowsOf(n.tool, m, n.reduce.rows), n.reduce) } : recordOf(n.tool, m);
+        if (n.cache) {
+            if (cache.size > 1000)
+                cache.clear();
+            cache.set(n.key, { v, t: Date.now() });
+        }
+        return v;
+    }
+    async function intercept(line, msg) {
+        const name = String(msg.params?.name ?? ""), args = msg.params?.arguments;
+        const t0 = Date.now();
+        const reply = (text) => msg.id !== undefined && // an id-less call (invalid) is just dropped
+            toClient(JSON.stringify({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text }], isError: true } }));
+        let r, reads = 0;
+        try {
+            const fetched = {};
+            r = await check(o, name, args);
+            for (let round = 0; r.need?.length; round++) { // fetch the record, then lookups on it
+                if (round >= 3)
+                    throw new Error("couldn't resolve the record");
+                const got = await Promise.all(r.need.map((n) => read(n)));
+                r.need.forEach((n, i) => (fetched[n.key] = got[i]));
+                reads += got.length;
+                r = await check(o, name, args, fetched);
+            }
+        }
+        catch (e) {
+            const why = e.name === "TimeoutError" ? `timed out after ${o.timeout}ms` : e.message;
+            if (o.failOpen) {
+                log(`${o.server} ${name} → pass (fail-open: check failed, ${why})`);
+                return toServer(line);
+            }
+            log(`${o.server} ${name} → blocked (check failed, ${why})`);
+            return reply(`Claros couldn't check this action (${why}), so it was not run. ` +
+                "Ask a person to confirm it is allowed before trying again.");
+        }
+        const multi = (r.workflow_ids?.length ?? 0) > 1; // routed to several maps: name them all
+        const wf = multi ? r.workflow_ids.join("+") : r.workflow_id;
+        const ids = (r.violations || []).map((v) => multi ? `${v.workflow_id}:${v.guardrail_id}` : v.guardrail_id).join(",");
+        const ms = `${Date.now() - t0}ms${reads ? ` (${reads} read${reads > 1 ? "s" : ""})` : ""}`;
+        if (r.allowed) {
+            const nudged = nudgesOf(r);
+            log(`${o.server} ${name} → ${nudged.length ? "nudge" : "allow"} ${wf ?? `(${r.reason ?? "no map"})`}${ids ? ` ${ids}` : ""} ${ms} ${r.check_id ?? ""}`);
+            for (const v of nudged)
+                log(`  nudge: ${v.rule}${v.fix ? ` (fix: ${v.fix})` : ""}`);
+            // forwarded either way; a nudge rides back on the result (an id-less call has no result to carry it)
+            if (nudged.length && msg.id !== undefined)
+                nudges.set(JSON.stringify(msg.id), nudgeText(r));
+            return toServer(line);
+        }
+        log(`${o.server} ${name} → ${r.result === "ask" ? "ask" : "stop"} ${wf} ${ids} ${ms} ${r.check_id ?? ""}`);
+        reply(stopText(r));
+    }
+    lines(process.stdin, (line) => {
+        const msg = parse(line);
+        if (msg?.method === "tools/list" && msg.id !== undefined)
+            listIds.add(JSON.stringify(msg.id));
+        if (Array.isArray(msg) && msg.some((m) => m?.method === "tools/call" && !isRead(String(m.params?.name ?? "")))) {
+            log(`${o.server} batch with a write tools/call → rejected`); // MCP dropped batching in 2025-06-18
+            return toClient(JSON.stringify(msg.filter((m) => m?.id !== undefined).map((m) => ({ jsonrpc: "2.0", id: m.id,
+                error: { code: -32600, message: "Claros guard: send tools/call one at a time, not in a batch" } }))));
+        }
+        if (msg?.method !== "tools/call")
+            return toServer(line);
+        const name = String(msg.params?.name ?? "");
+        // in the background, on reads too (a tool Claros reclassified as write must not pass forever); this call uses what's known
+        if (Date.now() - kindsAt > KINDS_TTL && tools.size)
+            refreshKinds();
+        if (isRead(name)) {
+            log(`${o.server} ${name} → pass (read)`);
+            return toServer(line);
+        }
+        pending++; // ponytail: checks run concurrently; a write may reach the server after later messages (ids keep JSON-RPC sound)
+        intercept(line, msg).finally(() => { pending--; maybeEnd(); });
+    }, () => { stdinDone = true; maybeEnd(); });
+}
+async function main(argv) {
+    const sep = argv.indexOf("--");
+    const head = sep < 0 ? argv : argv.slice(0, sep), cmd = sep < 0 ? [] : argv.slice(sep + 1);
+    const usage = async () => `${(await import("./setup.js")).USAGE}\n${GUARD_USAGE}\n`;
+    if (head.includes("--help") || head.includes("-h") || head[0] === "help") { // any command: usage on stdout, exit 0
+        process.stdout.write(await usage());
+        return;
+    }
+    if (argv[0] === "mcp")
+        return void import("./bridge.js").then((m) => m.bridge());
+    if (["init", "test", "status", "undo", "export", "override"].includes(argv[0])) {
+        process.exitCode = await (await import("./setup.js")).run(argv);
+        return;
+    }
+    const fail = async (why = "") => {
+        process.stderr.write(why + await usage());
+        process.exit(2);
+    };
+    if (head[0] !== "guard")
+        return fail();
+    let v;
+    try {
+        v = parseArgs({
+            args: head.slice(1),
+            options: {
+                server: { type: "string" }, url: { type: "string" }, web: { type: "string" }, key: { type: "string" },
+                timeout: { type: "string" }, "fail-open": { type: "boolean" }, remote: { type: "string" },
+                header: { type: "string", multiple: true },
+            },
+        }).values;
+    }
+    catch (e) {
+        return fail(`${e.message}\n`);
+    }
+    if (!v.server || !cmd.length === !v.remote)
+        return fail(); // a command or a remote URL, not both
+    if (v.remote && !/^https?:\/\/\S+$/.test(v.remote))
+        return fail("--remote wants an http(s) URL\n");
+    const headers = {};
+    for (const h of v.header ?? []) {
+        const i = h.indexOf(":");
+        if (i < 1)
+            return fail(`--header wants "Name: value"\n`);
+        headers[h.slice(0, i).trim()] = h.slice(i + 1).trim();
+    }
+    let at;
+    try {
+        at = await resolve(v); // flag → env → ~/.config/getclaros (written by init) → the web app's /.well-known/claros.json
+    }
+    catch (e) { // still start the server: reads pass, writes fail closed, and each check asks the web app again
+        log(`${e.message} Write checks fail closed until it answers.`);
+        const s = loadConfig();
+        at = { url: "", key: v.key ?? process.env.CLAROS_KEY ?? s.key ?? "", source: "discovered",
+            web: (v.web ?? process.env.CLAROS_WEB ?? s.web ?? DEFAULT_WEB).replace(/\/+$/, "") };
+    }
+    if (!at.key)
+        log("no key (set CLAROS_KEY): every write check will fail" + (v["fail-open"] ? " open" : " closed"));
+    guard({ ...at, server: v.server, failOpen: !!v["fail-open"], timeout: Number(v.timeout ?? 5000) }, v.remote ? http(v.remote, headers) : stdio(cmd[0], cmd.slice(1)));
+}
+main(process.argv.slice(2));