home-hosted 0.5.0 → 0.6.0

package/dist/cli.js

@@ -88,9 +88,11 @@ function applyDirFlags(flags) {
 *
 * `help`/`version` are commands here, not flags, and a help or version flag on a
 * command is answered the same way instead of being parsed as one of that
-* command's options. A first token that starts with `-` is the one-shot form
-* (`home-hosted -p 4000`), so `up` is prepended. Anything else has to name a
-* command, which keeps the old `unknown command:` text exact.
+* command's options. A help flag after a command keeps that command's name, so
+* the curated text can stay scoped to it; the bare `help` (or a top-level flag)
+* is the whole reference. A first token that starts with `-` is the one-shot
+* form (`home-hosted -p 4000`), so `up` is prepended. Anything else has to name
+* a command, which keeps the old `unknown command:` text exact.
 */
 function resolveInvocation(argv, commands) {
 	if (argv.length === 0) return {
@@ -109,7 +111,10 @@ function resolveInvocation(argv, commands) {
 		command: first
 	};
 	for (const arg of argv.slice(1)) {
-		if (HELP_FLAGS.has(arg)) return { kind: "help" };
+		if (HELP_FLAGS.has(arg)) return {
+			kind: "help",
+			command: first
+		};
 		if (VERSION_FLAGS.has(arg)) return { kind: "version" };
 	}
 	return {
@@ -242,13 +247,15 @@ async function confirm(question, fallback) {
 	if (answer.length === 0) return fallback;
 	return answer === "y" || answer === "yes";
 }
-var isTty, paint, dim, bold, green, style;
+var isTty, paint, dim, bold, cyan, green, heading, style;
 var init_io = __esmMin((() => {
 	isTty = () => process.stdout.isTTY === true;
 	paint = (code, text) => isTty() ? `\x1B[${code}m${text}\x1B[0m` : text;
 	dim = (text) => paint("2", text);
 	bold = (text) => paint("1", text);
+	cyan = (text) => paint("36", text);
 	green = (text) => paint("32", text);
+	heading = (text) => paint("1;4", text);
 	style = {
 		bold,
 		dim,
@@ -297,10 +304,12 @@ function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, portSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
+var bindSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	portSchema = type("1 <= number.integer <= 65535 | null");
+	onPortConflictSchema = type.enumerated("block", "warn", "follow", "reclaim", "kill");
+	onPortConflictDefaultSchema = onPortConflictSchema.default("block");
 	restartSchema = type({
 		enabled: "boolean = true",
 		maxRetries: "number.integer >= 0 = 3",
@@ -371,7 +380,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		bootstrap: bootstrapOrNullSchema.optional(),
 		port: portSchema.optional(),
 		bind: bindSchema.default(() => "local"),
-		onPortConflict: "\"block\" | \"warn\" | \"follow\" | \"reclaim\" = \"block\"",
+		onPortConflict: onPortConflictDefaultSchema,
 		restart: restartSchema.default(() => ({})),
 		health: healthSchema.default(() => ({})),
 		stop: stopSchema.default(() => ({})),
@@ -452,7 +461,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		enabled: "boolean = true",
 		autostart: "boolean = false",
 		bind: bindSchema.default(() => "local"),
-		onPortConflict: "\"block\" | \"warn\" | \"follow\" | \"reclaim\" = \"block\"",
+		onPortConflict: onPortConflictDefaultSchema,
 		restart: restartSchema.default(() => ({})),
 		health: healthSchema.default(() => ({})),
 		stop: stopSchema.default(() => ({})),
@@ -543,7 +552,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		enabled: "boolean?",
 		autostart: "boolean?",
 		bind: bindSchema.optional(),
-		onPortConflict: "\"block\" | \"warn\" | \"follow\" | \"reclaim\"?",
+		onPortConflict: onPortConflictSchema.optional(),
 		restart: restartPatchSchema.optional(),
 		health: healthPatchSchema.optional(),
 		stop: stopPatchSchema.optional(),
@@ -561,7 +570,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		bootstrap: bootstrapOrNullSchema.optional(),
 		port: portSchema.optional(),
 		bind: bindSchema.optional(),
-		onPortConflict: "\"block\" | \"warn\" | \"follow\" | \"reclaim\"?",
+		onPortConflict: onPortConflictSchema.optional(),
 		restart: restartPatchSchema.optional(),
 		health: healthPatchSchema.optional(),
 		stop: stopPatchSchema.optional(),
@@ -1206,7 +1215,7 @@ var SESSION_COOKIE, MAX_SESSIONS, MAX_LOCKOUT_MS, MAX_ATTEMPT_RECORDS, ATTEMPT_R
 var init_auth$1 = __esmMin((() => {
 	init_secrets();
 	init_cookies();
-	SESSION_COOKIE = "hh2_session";
+	SESSION_COOKIE = "hh_session";
 	MAX_SESSIONS = 100;
 	MAX_LOCKOUT_MS = 9e5;
 	MAX_ATTEMPT_RECORDS = 1e4;
@@ -1294,7 +1303,7 @@ var init_auth$1 = __esmMin((() => {
 			};
 		}
 		tokenFromCookie(cookieHeader) {
-			return parseCookies(cookieHeader)["hh2_session"] ?? null;
+			return parseCookies(cookieHeader)["hh_session"] ?? null;
 		}
 		/** Sliding expiry: an active panel stays logged in, an idle one does not. */
 		validate(token) {
@@ -2307,19 +2316,19 @@ function createMetricsRoute(deps) {
 			if (samples.length === 0) return;
 			lines.push(`# HELP ${name} ${help}`, `# TYPE ${name} gauge`, ...samples);
 		};
-		metric("hh2_control_up", "Control plane is serving", ["hh2_control_up 1"]);
-		metric("hh2_servers_total", "Configured servers", [`hh2_servers_total ${state.servers.length}`]);
-		metric("hh2_server_up", "Server process is running", state.servers.map((server) => `hh2_server_up{server="${server.id}"} ${server.status === "running" ? 1 : 0}`));
-		metric("hh2_server_restarts_total", "Restarts since the control plane started", state.servers.map((server) => `hh2_server_restarts_total{server="${server.id}"} ${server.restarts}`));
-		metric("hh2_server_crashes_24h", "Crashes in the last 24 hours", state.servers.map((server) => `hh2_server_crashes_24h{server="${server.id}"} ${server.history.crashes}`));
-		metric("hh2_server_uptime_ratio_24h", "Share of the last 24 hours the server was up", state.servers.filter((server) => server.history.uptimeRatio !== null).map((server) => `hh2_server_uptime_ratio_24h{server="${server.id}"} ${server.history.uptimeRatio.toFixed(4)}`));
-		metric("hh2_server_response_ms", "Last health probe latency in milliseconds", state.servers.filter((server) => server.responseMs !== null).map((server) => `hh2_server_response_ms{server="${server.id}"} ${server.responseMs}`));
-		metric("hh2_server_rss_bytes", "RSS of the server process tree", state.servers.filter((server) => server.resources?.rssBytes != null).map((server) => `hh2_server_rss_bytes{server="${server.id}"} ${server.resources.rssBytes}`));
-		metric("hh2_server_cpu_percent", "CPU percent of the server process tree", state.servers.filter((server) => server.resources?.cpuPercent != null).map((server) => `hh2_server_cpu_percent{server="${server.id}"} ${server.resources.cpuPercent}`));
-		metric("hh2_host_disk_used_percent", "Disk usage percent per configured path", state.host.disks.map((disk) => `hh2_host_disk_used_percent{mount="${disk.path}"} ${disk.usedPercent.toFixed(2)}`));
-		metric("hh2_host_memory_used_percent", "Memory usage percent", [`hh2_host_memory_used_percent ${state.host.memoryUsedPercent.toFixed(2)}`]);
-		metric("hh2_host_swap_used_percent", "Swap usage percent", [`hh2_host_swap_used_percent ${state.host.swapUsedPercent.toFixed(2)}`]);
-		metric("hh2_host_load1_per_cpu", "1 minute load average per cpu", [`hh2_host_load1_per_cpu ${((state.host.loadAvg[0] ?? 0) / Math.max(1, state.host.cpus)).toFixed(3)}`]);
+		metric("hh_control_up", "Control plane is serving", ["hh_control_up 1"]);
+		metric("hh_servers_total", "Configured servers", [`hh_servers_total ${state.servers.length}`]);
+		metric("hh_server_up", "Server process is running", state.servers.map((server) => `hh_server_up{server="${server.id}"} ${server.status === "running" ? 1 : 0}`));
+		metric("hh_server_restarts_total", "Restarts since the control plane started", state.servers.map((server) => `hh_server_restarts_total{server="${server.id}"} ${server.restarts}`));
+		metric("hh_server_crashes_24h", "Crashes in the last 24 hours", state.servers.map((server) => `hh_server_crashes_24h{server="${server.id}"} ${server.history.crashes}`));
+		metric("hh_server_uptime_ratio_24h", "Share of the last 24 hours the server was up", state.servers.filter((server) => server.history.uptimeRatio !== null).map((server) => `hh_server_uptime_ratio_24h{server="${server.id}"} ${server.history.uptimeRatio.toFixed(4)}`));
+		metric("hh_server_response_ms", "Last health probe latency in milliseconds", state.servers.filter((server) => server.responseMs !== null).map((server) => `hh_server_response_ms{server="${server.id}"} ${server.responseMs}`));
+		metric("hh_server_rss_bytes", "RSS of the server process tree", state.servers.filter((server) => server.resources?.rssBytes != null).map((server) => `hh_server_rss_bytes{server="${server.id}"} ${server.resources.rssBytes}`));
+		metric("hh_server_cpu_percent", "CPU percent of the server process tree", state.servers.filter((server) => server.resources?.cpuPercent != null).map((server) => `hh_server_cpu_percent{server="${server.id}"} ${server.resources.cpuPercent}`));
+		metric("hh_host_disk_used_percent", "Disk usage percent per configured path", state.host.disks.map((disk) => `hh_host_disk_used_percent{mount="${disk.path}"} ${disk.usedPercent.toFixed(2)}`));
+		metric("hh_host_memory_used_percent", "Memory usage percent", [`hh_host_memory_used_percent ${state.host.memoryUsedPercent.toFixed(2)}`]);
+		metric("hh_host_swap_used_percent", "Swap usage percent", [`hh_host_swap_used_percent ${state.host.swapUsedPercent.toFixed(2)}`]);
+		metric("hh_host_load1_per_cpu", "1 minute load average per cpu", [`hh_host_load1_per_cpu ${((state.host.loadAvg[0] ?? 0) / Math.max(1, state.host.cpus)).toFixed(3)}`]);
 		return c.text(`${lines.join("\n")}\n`, 200, { "Content-Type": "text/plain; version=0.0.4; charset=utf-8" });
 	});
 }
@@ -4093,7 +4102,7 @@ function parseNetstatListeners(output, port) {
 }
 async function listPortHolders(port) {
 	if (process.platform === "win32") try {
-		const { stdout } = await execFileAsync$3("netstat", [
+		const { stdout } = await execFileAsync$4("netstat", [
 			"-ano",
 			"-p",
 			"tcp"
@@ -4103,7 +4112,7 @@ async function listPortHolders(port) {
 		return [];
 	}
 	try {
-		const { stdout } = await execFileAsync$3("lsof", [
+		const { stdout } = await execFileAsync$4("lsof", [
 			"-ti",
 			`tcp:${port}`,
 			"-sTCP:LISTEN"
@@ -4111,7 +4120,7 @@ async function listPortHolders(port) {
 		return parsePids(stdout);
 	} catch {}
 	try {
-		const { stdout } = await execFileAsync$3("fuser", [`${port}/tcp`], { timeout: 3e3 });
+		const { stdout } = await execFileAsync$4("fuser", [`${port}/tcp`], { timeout: 3e3 });
 		return parsePids(stdout);
 	} catch {
 		return [];
@@ -4120,9 +4129,9 @@ async function listPortHolders(port) {
 function parsePids(stdout) {
 	return [...new Set(stdout.split(/\s+/).map((entry) => Number.parseInt(entry, 10)).filter((pid) => Number.isInteger(pid) && pid > 0 && pid !== process.pid))];
 }
-var execFileAsync$3;
+var execFileAsync$4;
 var init_port = __esmMin((() => {
-	execFileAsync$3 = promisify(execFile);
+	execFileAsync$4 = promisify(execFile);
 }));
 //#endregion
 //#region src/helpers/env-file.ts
@@ -4489,7 +4498,7 @@ function parseWindowsCsv(text) {
 async function getClockTicks() {
 	if (clockTicks !== null) return clockTicks;
 	try {
-		const { stdout } = await execFileAsync$2("getconf", ["CLK_TCK"], { timeout: 2e3 });
+		const { stdout } = await execFileAsync$3("getconf", ["CLK_TCK"], { timeout: 2e3 });
 		const parsed = Number.parseInt(stdout.trim(), 10);
 		clockTicks = Number.isFinite(parsed) && parsed > 0 ? parsed : 100;
 	} catch {
@@ -4541,7 +4550,7 @@ async function readLinux() {
 	return rows;
 }
 async function readPosix() {
-	const { stdout } = await execFileAsync$2("ps", ["-Ao", "pid=,ppid=,rss=,%cpu="], {
+	const { stdout } = await execFileAsync$3("ps", ["-Ao", "pid=,ppid=,rss=,%cpu="], {
 		timeout: 5e3,
 		maxBuffer: 16777216
 	});
@@ -4550,7 +4559,7 @@ async function readPosix() {
 async function readWindows() {
 	const script = "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,WorkingSetSize,KernelModeTime,UserModeTime | ConvertTo-Csv -NoTypeInformation";
 	try {
-		const { stdout } = await execFileAsync$2("powershell.exe", [
+		const { stdout } = await execFileAsync$3("powershell.exe", [
 			"-NoProfile",
 			"-NonInteractive",
 			"-Command",
@@ -4562,7 +4571,7 @@ async function readWindows() {
 		return parseWindowsCsv(stdout);
 	} catch {
 		try {
-			const { stdout } = await execFileAsync$2("wmic", [
+			const { stdout } = await execFileAsync$3("wmic", [
 				"process",
 				"get",
 				"ProcessId,ParentProcessId,WorkingSetSize,KernelModeTime,UserModeTime",
@@ -4614,7 +4623,7 @@ async function processCarriesServerId(pid, serverId) {
 		return false;
 	}
 	if (process.platform === "darwin") try {
-		const { stdout } = await execFileAsync$2("ps", [
+		const { stdout } = await execFileAsync$3("ps", [
 			"-p",
 			String(pid),
 			"-E",
@@ -4628,9 +4637,9 @@ async function processCarriesServerId(pid, serverId) {
 	}
 	return false;
 }
-var execFileAsync$2, clockTicks, ProcessSampler;
+var execFileAsync$3, clockTicks, ProcessSampler;
 var init_proc = __esmMin((() => {
-	execFileAsync$2 = promisify(execFile);
+	execFileAsync$3 = promisify(execFile);
 	clockTicks = null;
 	ProcessSampler = class {
 		previous = /* @__PURE__ */ new Map();
@@ -4703,6 +4712,224 @@ var init_proc = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/providers/identity.ts
+/**
+* Splits a command line into words, undoing the quoting Windows put there. `CommandLine`
+* is the raw string from the spawn call, so `"C:\a b\x.cmd" /c` is one argv entry plus
+* two words, and a quoted argument that contains spaces has to come back as one word.
+*
+* Windows also *escapes* a quote inside an argument as `\"` (Node does this for any argv
+* containing a quote), so the escape is undone here — otherwise every argument with a
+* quote in it survives as a stray backslash and never matches what the panel spawned.
+*/
+function splitCommandLine(line) {
+	const words = [];
+	let current = "";
+	let quoted = false;
+	let started = false;
+	for (const char of line.trim()) {
+		if (char === "\"") {
+			quoted = !quoted;
+			started = true;
+			continue;
+		}
+		if (!quoted && /\s/.test(char)) {
+			if (started) words.push(current);
+			current = "";
+			started = false;
+			continue;
+		}
+		current += char;
+		started = true;
+	}
+	if (started) words.push(current);
+	return words;
+}
+function comparable(target) {
+	const value = target.replace(/^"(.*)"$/, "$1").replace(/\\(?=")/g, "");
+	return process.platform === "win32" ? value.toLowerCase() : value;
+}
+/**
+* Literal comparison for an argument: the same text, modulo the case folding Windows needs
+* and the quoting a command line shuffles around.
+*
+* Deliberately *not* `sameWord`: folding an argument to its basename would let this
+* entry's `/srv/web/build/server.js` equal a stranger's `/tmp/evil/build/server.js`, and a
+* match here is what `reclaim` kills. Nor is it a plain string equality: reading an argv
+* back out of a Windows `CommandLine` cannot preserve quotes exactly — the OS escapes an
+* argument's own quote as `\"` and strips the structural ones — so quotes and backslashes
+* are dropped from both sides. That leaves the arguments' actual text, which is what the
+* match is about.
+*/
+function sameArg(a, b) {
+	const normalize = (value) => comparable(value).replace(/["\\]/g, "");
+	return normalize(a) === normalize(b);
+}
+/** The same file spelled differently (`node`, `node.exe`, a relative path) compares equal. */
+function sameWord(a, b) {
+	const left = comparable(a);
+	const right = comparable(b);
+	if (left === right || path.basename(left) === path.basename(right)) return true;
+	return path.extname(b) === "" && path.basename(left, path.extname(left)) === right;
+}
+/**
+* True when the argv a process is running is the entry's own: the image must match where
+* `spawn` would have looked it up — the image Path, or the first word of the command line
+* — and the words after it must open with the entry's args, compared literally. So
+* `spawn --port 4000` also covers `spawn -p 4000 --extra`, which is what a self-restarting
+* wrapper does, while `/tmp/evil/server.js` never covers `/srv/web/server.js`.
+*
+* `words` must already be the process's own argv. A command-line *string* is only correct
+* on Windows, where the OS hands one out; `/proc/<pid>/cmdline` quotes are literal bytes
+* of an argument, so re-joining that argv into one string corrupts it.
+*/
+function matchesSpawn(info, spawn) {
+	const { words } = info;
+	const first = words[0] ?? "";
+	if (!(sameWord(first, spawn.command) || info.imagePath != null && info.imagePath !== "" && sameWord(info.imagePath, spawn.command))) return false;
+	const offset = sameWord(first, spawn.command) ? 1 : 0;
+	if (words.length < spawn.args.length + offset) return false;
+	return spawn.args.every((arg, index) => sameArg(words[index + offset], arg));
+}
+/** The argv of a pid on the platforms whose process table can answer it; null otherwise. */
+async function processArgv(pid) {
+	if (process.platform === "win32") return null;
+	if (process.platform === "linux") try {
+		const argv = (await fs.promises.readFile(`/proc/${pid}/cmdline`)).toString("utf8").split("\0").filter((part) => part.length > 0);
+		return argv.length > 0 ? argv : null;
+	} catch {
+		return null;
+	}
+	try {
+		const { stdout } = await execFileAsync$2("ps", [
+			"-p",
+			String(pid),
+			"-ww",
+			"-o",
+			"command="
+		], { timeout: 3e3 });
+		const words = splitCommandLine(stdout.trim());
+		return words.length > 0 ? words : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The first two rows of `ConvertTo-Csv` output: the header and the first record. PowerShell
+* quotes and doubles its way around CSV, so `a,"b""c"` is three fields with the second
+* reading `b"c`.
+*/
+function parseCsvRows(output) {
+	const rows = [];
+	let row = [];
+	let field = "";
+	let quoted = false;
+	for (let index = 0; index < output.length; index++) {
+		const char = output[index];
+		if (quoted) {
+			if (char !== "\"") {
+				field += char;
+				continue;
+			}
+			if (output[index + 1] === "\"") {
+				field += "\"";
+				index++;
+				continue;
+			}
+			quoted = false;
+			continue;
+		}
+		if (char === "\"") {
+			quoted = true;
+			continue;
+		}
+		if (char === ",") {
+			row.push(field);
+			field = "";
+			continue;
+		}
+		if (char === "\n") {
+			row.push(field.replace(/\r$/, ""));
+			rows.push(row);
+			row = [];
+			field = "";
+			continue;
+		}
+		field += char;
+	}
+	if (field.length > 0 || row.length > 0) rows.push([...row, field.replace(/\r$/, "")]);
+	return [rows[0] ?? null, rows[1] ?? null];
+}
+/**
+* `Win32_Process` for one pid, or null when it cannot be read.
+*
+* The whole round trip — launching PowerShell, loading the CIM provider, serializing —
+* costs seconds on a cold runner, so the timeout is generous and the result is converted
+* to CSV rather than JSON: CSV survives a value that contains a quote or a newline, which
+* an argv legitimately can.
+*/
+async function windowsProcessInfo(pid) {
+	if (!windowsFilter.test(String(pid))) return null;
+	try {
+		const script = `Get-CimInstance Win32_Process -Filter "ProcessId=${pid}" | Select-Object CommandLine,ExecutablePath | ConvertTo-Csv -NoTypeInformation`;
+		const { stdout } = await execFileAsync$2("powershell", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			script
+		], {
+			timeout: 2e4,
+			windowsHide: true
+		});
+		const [headers, values] = parseCsvRows(stdout);
+		if (!headers || !values) return null;
+		const commandLineIndex = headers.indexOf("CommandLine");
+		const imageIndex = headers.indexOf("ExecutablePath");
+		const commandLine = commandLineIndex >= 0 ? values[commandLineIndex] : void 0;
+		if (commandLine === void 0 || commandLine.length === 0) return null;
+		const imagePath = imageIndex >= 0 ? values[imageIndex] : void 0;
+		return {
+			commandLine,
+			imagePath: imagePath && imagePath.length > 0 ? imagePath : null
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Which of these pids look like this entry's own detached successor. The environment
+* marker is authoritative where the platform can read it; otherwise the answer rests on
+* the entry's own argv, which is the only signal a detached successor is obliged to keep
+* — and the only one Windows exposes at all.
+*/
+async function identifyHolders(serverId, spawn, pids) {
+	const found = [];
+	for (const pid of pids) {
+		if (await processCarriesServerId(pid, serverId)) {
+			found.push(pid);
+			continue;
+		}
+		if (spawn.args.length === 0) continue;
+		if (process.platform === "win32") {
+			const info = await windowsProcessInfo(pid);
+			if (info && matchesSpawn({
+				words: splitCommandLine(info.commandLine),
+				imagePath: info.imagePath
+			}, spawn)) found.push(pid);
+			continue;
+		}
+		const argv = await processArgv(pid);
+		if (argv !== null && matchesSpawn({ words: argv }, spawn)) found.push(pid);
+	}
+	return found;
+}
+var execFileAsync$2, windowsFilter;
+var init_identity = __esmMin((() => {
+	init_proc();
+	execFileAsync$2 = promisify(execFile);
+	windowsFilter = /^\d+$/;
+}));
+//#endregion
 //#region src/providers/process.ts
 /**
 * Resolves a bare command through the entry's own directory and the project's
@@ -4966,6 +5193,7 @@ var init_supervisor = __esmMin((() => {
 	init_paths();
 	init_template();
 	init_health_check();
+	init_identity();
 	init_port();
 	init_proc();
 	init_process();
@@ -5110,11 +5338,8 @@ var init_supervisor = __esmMin((() => {
 				port,
 				error: `server "${id}" is busy — try again in a moment`
 			};
-			const supervised = this.supervisedPids();
-			const holders = await listPortHolders(port);
-			const ours = holders.filter((pid) => supervised.has(pid));
-			const foreign = holders.filter((pid) => !supervised.has(pid));
-			if (holders.length === 0) return {
+			const { ours, foreign } = await this.portHolders(port);
+			if ([...ours, ...foreign].length === 0) return {
 				...empty,
 				port,
 				error: `nothing is listening on port ${port} any more`
@@ -5129,7 +5354,7 @@ var init_supervisor = __esmMin((() => {
 				};
 			}
 			this.log(entry, "system", `freeing port ${port}: asking pid ${foreign.join(", ")} to stop`);
-			const { stopped, forced } = await terminatePids(foreign);
+			const { stopped, forced } = await terminatePids(foreign, { graceMs: entry.config.stop.graceMs });
 			if (forced.length > 0) this.log(entry, "system", `pid ${forced.join(", ")} ignored SIGTERM and was killed`);
 			const free = await this.waitForPortRelease(entry, port);
 			if (free) {
@@ -5154,6 +5379,20 @@ var init_supervisor = __esmMin((() => {
 				free
 			};
 		}
+		/**
+		* Splits the port's listeners into the processes this panel owns and everyone
+		* else. Only the foreign half may ever be signalled — a port held by a sibling
+		* is a config mistake, not a stray process. That also keeps a stale `(pid 1234)`
+		* in an old banner from killing a recycled pid.
+		*/
+		async portHolders(port) {
+			const supervised = this.supervisedPids();
+			const holders = await listPortHolders(port);
+			return {
+				ours: holders.filter((pid) => supervised.has(pid)),
+				foreign: holders.filter((pid) => !supervised.has(pid))
+			};
+		}
 		/** Pids of the child processes this panel owns, plus itself. */
 		supervisedPids() {
 			const pids = /* @__PURE__ */ new Set([process.pid]);
@@ -5320,7 +5559,7 @@ var init_supervisor = __esmMin((() => {
 			this.publishState();
 		}
 		isActive(entry) {
-			return entry.child !== null || entry.status === "backoff";
+			return entry.child !== null || entry.pid !== null || entry.adopted || entry.status === "backoff";
 		}
 		/** Loopback first, then the configured address, so a custom bind is still probed. */
 		probeHosts(entry) {
@@ -5343,15 +5582,24 @@ var init_supervisor = __esmMin((() => {
 			return (await Promise.all(this.occupancyHosts(entry).map((host) => probePort(host, port, timeoutMs)))).some(Boolean);
 		}
 		/**
-		* The port holders that carry this entry's own marker — a program that restarted
-		* itself leaves a detached process behind, and that process is the *same server*,
-		* not a stranger to kill. Read from the environment the supervisor gave the entry,
-		* which a successor inherits unless it scrubs it.
+		* The port holder that is this entry's own detached successor — a program that
+		* restarted itself leaves a process behind, and that process is the *same server*,
+		* not a stranger to kill.
+		*
+		* The environment marker is authoritative where the platform can read it (Linux,
+		* macOS). Failing that — Windows has no per-process environment at all — the entry's
+		* own argv answers, which a successor keeps unless it re-execs under a different
+		* image. Ambiguity is not resolved by guessing: two holders that both look like this
+		* entry means we do not know which one is ours, so we act on neither.
 		*/
-		async ownPortHolders(entry, holders) {
-			const own = [];
-			for (const pid of holders) if (await processCarriesServerId(pid, entry.config.id)) own.push(pid);
-			return own;
+		async ownPortHolder(entry, holders) {
+			const spawn = this.resolveSpawn(entry);
+			const candidates = await identifyHolders(entry.config.id, spawn, holders);
+			if (candidates.length > 1) {
+				this.log(entry, "system", `pid ${candidates.join(", ")} all look like this entry: refusing to guess which is ours, set onPortConflict to "kill" to clear the port anyway`);
+				return null;
+			}
+			return candidates[0] ?? null;
 		}
 		async preflight(entry) {
 			const port = entry.config.port;
@@ -5367,16 +5615,49 @@ var init_supervisor = __esmMin((() => {
 			}
 			entry.portState = free ? "free" : "in-use";
 			if (free) return { kind: "free" };
-			const holders = await listPortHolders(port);
-			const own = await this.ownPortHolders(entry, holders);
+			const { ours, foreign } = await this.portHolders(port);
+			const holders = [...ours, ...foreign];
+			const own = await this.ownPortHolder(entry, foreign);
 			const suffix = holders.length > 0 ? ` (pid ${holders.join(", ")})` : "";
-			if (own.length > 0 && entry.config.onPortConflict === "follow") return {
+			if (entry.config.onPortConflict === "kill") {
+				if (ours.length > 0) {
+					entry.status = "conflict";
+					entry.lastError = `port ${port} is held by pid ${ours.join(", ")}, which this panel supervises — stop that server instead`;
+					this.log(entry, "system", `${entry.lastError} — not starting (onPortConflict: kill)`);
+					this.publishServer(entry);
+					return {
+						kind: "blocked",
+						error: entry.lastError
+					};
+				}
+				if (foreign.length === 0) {
+					this.log(entry, "system", `port ${port} looks busy but no listener could be found — starting anyway`);
+					return { kind: "free" };
+				}
+				this.log(entry, "system", `port ${port} is held by pid ${foreign.join(", ")} — onPortConflict: kill, stopping the holder`);
+				const { forced } = await terminatePids(foreign, { graceMs: entry.config.stop.graceMs });
+				if (forced.length > 0) this.log(entry, "system", `pid ${forced.join(", ")} ignored SIGTERM and was killed`);
+				await delay(PORT_RELEASE_RECHECK_MS);
+				if (await freeOnAll()) {
+					entry.portState = "free";
+					return { kind: "free" };
+				}
+				entry.status = "conflict";
+				entry.lastError = `port ${port} is still in use after killing pid ${foreign.join(", ")}`;
+				this.log(entry, "system", entry.lastError);
+				this.publishServer(entry);
+				return {
+					kind: "blocked",
+					error: entry.lastError
+				};
+			}
+			if (own !== null && entry.config.onPortConflict === "follow") return {
 				kind: "adopt",
-				pid: own[0]
+				pid: own
 			};
-			if (own.length > 0 && entry.config.onPortConflict === "reclaim") {
-				this.log(entry, "system", `port ${port} is held by pid ${own.join(", ")}, a detached restart of this entry — replacing it with a supervised process`);
-				const { forced } = await terminatePids(own);
+			if (own !== null && entry.config.onPortConflict === "reclaim") {
+				this.log(entry, "system", `port ${port} is held by pid ${own}, a detached restart of this entry — replacing it with a supervised process`);
+				const { forced } = await terminatePids([own], { graceMs: entry.config.stop.graceMs });
 				if (forced.length > 0) this.log(entry, "system", `pid ${forced.join(", ")} ignored SIGTERM and was killed`);
 				await delay(PORT_RELEASE_RECHECK_MS);
 				if (await freeOnAll()) {
@@ -5384,7 +5665,7 @@ var init_supervisor = __esmMin((() => {
 					return { kind: "free" };
 				}
 				entry.status = "conflict";
-				entry.lastError = `port ${port} is still in use after replacing pid ${own.join(", ")}`;
+				entry.lastError = `port ${port} is still in use after replacing pid ${own}`;
 				this.log(entry, "system", entry.lastError);
 				this.publishServer(entry);
 				return {
@@ -5392,7 +5673,7 @@ var init_supervisor = __esmMin((() => {
 					error: entry.lastError
 				};
 			}
-			const hint = own.length > 0 ? ` — pid ${own.join(", ")} is a detached restart of this entry: set onPortConflict to "follow" to adopt it, or "reclaim" to replace it with a supervised process` : "";
+			const hint = own !== null ? ` — pid ${own} is a detached restart of this entry: set onPortConflict to "follow" to adopt it, "reclaim" to replace it with a supervised process, or "kill" to stop whatever holds the port` : "";
 			if (entry.config.onPortConflict !== "warn") {
 				entry.status = "conflict";
 				entry.lastError = `port ${port} is already in use${suffix}${hint}`;
@@ -5487,7 +5768,13 @@ var init_supervisor = __esmMin((() => {
 			if (code === 0) this.log(entry, "system", "bootstrap finished");
 			else if (code !== null) this.log(entry, "system", `bootstrap exited with code ${code} — continuing anyway`);
 		}
-		spawnEntry(entry) {
+		/**
+		* Everything `spawn` needs for an entry: the resolved image, the expanded argv, the
+		* cwd and the environment. The argv is also what the preflight recognizes the entry's
+		* own detached successor by, so spawn and identification must never resolve it twice
+		* with two different rules.
+		*/
+		resolveSpawn(entry) {
 			const vars = this.buildVars(entry);
 			const cwd = resolveCwd(entry.config.cwd);
 			const command = resolveCommand(entry.config.command, cwd, projectDir);
@@ -5503,15 +5790,26 @@ var init_supervisor = __esmMin((() => {
 				...process.env,
 				...fileEnv
 			};
-			const args = expandEnvList(resolveTemplates(entry.config.args, vars), expansionVars);
+			const dataEnvs = resolveRecord(entry.config.dataEnvs, vars);
 			const env = {
 				...expandEnvRecord(resolveRecord(entry.config.env, vars), expansionVars),
 				...fileEnv,
-				...expandEnvRecord(resolveRecord(entry.config.dataEnvs, vars), expansionVars),
+				...expandEnvRecord(dataEnvs, expansionVars),
 				HHOSTED_SERVER_ID: entry.config.id,
 				HHOSTED_CONTROL_PORT: String(this.options.control.port)
 			};
-			this.log(entry, "system", `start: ${command} ${resolveTemplates(entry.config.args, vars).join(" ")}`);
+			for (const key of Object.keys(dataEnvs)) env[key] = path.resolve(cwd, env[key]);
+			return {
+				command,
+				args: expandEnvList(resolveTemplates(entry.config.args, vars), expansionVars),
+				env,
+				cwd,
+				loggedArgs: resolveTemplates(entry.config.args, vars)
+			};
+		}
+		spawnEntry(entry) {
+			const { command, args, env, cwd, loggedArgs } = this.resolveSpawn(entry);
+			this.log(entry, "system", `start: ${command} ${loggedArgs.join(" ")}`);
 			let child;
 			try {
 				child = spawnManaged({
@@ -8978,7 +9276,7 @@ async function downloadToTemp(url, headers, context) {
 	if (!Number.isFinite(declared) || declared < 0) throw new Error(`the download from ${url} reported an unusable size`);
 	if (declared > 536870912) throw new Error(tooLargeMessage(declared));
 	if (response.body === null) throw new Error(`the download from ${url} had no body`);
-	const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "hh2-ui-"));
+	const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "hh-ui-"));
 	const file = path.join(dir, "ui.zip");
 	const handle = await fs.promises.open(file, "w");
 	let received = 0;
@@ -9132,66 +9430,186 @@ init_io();
 * module) is a dynamic import behind `subCommands`.
 */
 var CLI_ENTRY = fileURLToPath(import.meta.url);
-var USAGE = `home-hosted — a control panel for the processes on your home server
-
-Usage
-  home-hosted up [options]      start it in the background (detached)
-  home-hosted down              stop it, and everything it supervises
-  home-hosted restart [options] down, then up
-  home-hosted status [--json]   is it running, where, and how to reach it
-  home-hosted set-password      set the panel password without the API
-  home-hosted set-token         set the API token that scripts and agents use
-  home-hosted migrate           bring the config up to this release's schema
-  home-hosted init              scaffold a project that keeps its state in the repo
-  home-hosted ui-switch         install a UI from a release asset, a zip file or a URL
-  home-hosted ui-revert         go back to the stock control panel UI
-
-Options for up/restart
-  -c, --config <file>   servers config (default: <state>/servers.config.json)
-  -p, --port <port>     control panel port (default: 3999)
-      --host <bind>     local | lan | an ipv4 address (default: local)
-      --open            open the panel in a browser once it is up
-      --no-autostart    do not start the entries marked autostart
-      --foreground      run in this process instead of detaching (systemd/docker)
-      --print-config    print the effective config and exit
-
-Options for set-token
-      --generate        create a strong token and print it once
-      --clear           remove the token, so it stops working
-
-Options for migrate
-      --dry-run         print what would change, write nothing
-  -y, --yes             apply without asking (or set HHOSTED_MIGRATE=allow)
-
-Options for init
-      --dir <dir>       where to scaffold (default: ./my-servers)
-      --name <name>     package name (default: the directory name)
-      --pm <manager>    pnpm | npm | yarn | bun (default: the first one installed)
-      --no-install      write the files, install nothing
-  -y, --yes             take every default, ask nothing
-
-Options for ui-switch
-      --repo <owner/name>   release repo (default: NamesMT/home-hosted)
-      --tag <tag>           release tag (default: this release's tag, or latest for another repo)
-      --asset <name>        asset to install (exact or unambiguous match)
-      --file <path|url>     install a zip from a local path or an http(s) URL
-      --list                list the usable assets and install nothing
-      --token <token>       GitHub token (or GITHUB_TOKEN / GH_TOKEN)
-  -y, --yes                 take the only asset instead of asking
-
-Everywhere
-      --home <dir>      state directory (default: $HHOSTED_HOME or ~/.home-hosted)
-      --project <dir>   base for relative entry paths (default: the current directory)
-  -h, --help            this text
-  -v, --version         the version
-
-Environment
-  HHOSTED_HOME          where config, secrets, logs, TLS and backups live
-  HHOSTED_PROJECT       base for relative entry paths
-  HHOSTED_PASSWORD      the password for a non-interactive set-password
-  HHOSTED_TOKEN         the token for a non-interactive set-token
-  GITHUB_TOKEN          a GitHub token for ui-switch (GH_TOKEN also works)
-`;
+/**
+* The curated prose, kept here because citty cannot generate it. One named
+* piece per command, so the full reference and a single command's help are
+* composed from the same lines and can never drift apart. Every section lays
+* its left column out at the same width, so the two views read alike.
+*/
+var HEADER = "home-hosted — a control panel for the processes on your home server";
+/** The one line the full reference lists for a command. */
+var SYNOPSIS = {
+	"up": "home-hosted up [options]",
+	"down": "home-hosted down",
+	"restart": "home-hosted restart [options]",
+	"status": "home-hosted status [--json]",
+	"set-password": "home-hosted set-password",
+	"set-token": "home-hosted set-token",
+	"migrate": "home-hosted migrate",
+	"init": "home-hosted init",
+	"ui-switch": "home-hosted ui-switch",
+	"ui-revert": "home-hosted ui-revert"
+};
+var SUMMARIES = {
+	"up": "start it in the background (detached)",
+	"down": "stop it, and everything it supervises",
+	"restart": "down, then up",
+	"status": "is it running, where, and how to reach it",
+	"set-password": "set the panel password without the API",
+	"set-token": "set the API token that scripts and agents use",
+	"migrate": "bring the config up to this release's schema",
+	"init": "scaffold a project that keeps its state in the repo",
+	"ui-switch": "install a UI from a release asset, a zip file or a URL",
+	"ui-revert": "go back to the stock control panel UI"
+};
+/** Every section lays its left column out at this width, so the two views align. */
+var OPTION_WIDTH = 19;
+var UP_SECTION = {
+	heading: "Options for up/restart",
+	lines: [
+		["-c, --config <file>", "servers config (default: <state>/servers.config.json)"],
+		["-p, --port <port>", "control panel port (default: 3999)"],
+		["--host <bind>", "local | lan | an ipv4 address (default: local)"],
+		["--open", "open the panel in a browser once it is up"],
+		["--no-autostart", "do not start the entries marked autostart"],
+		["--foreground", "run in this process instead of detaching (systemd/docker)"],
+		["--print-config", "print the effective config and exit"]
+	]
+};
+var STATUS_SECTION = {
+	heading: "Options for status",
+	lines: [["--json", "print machine-readable JSON"]]
+};
+var SET_PASSWORD_SECTION = {
+	heading: "Options for set-password",
+	lines: [["--clear", "remove the password, which disables authentication"]]
+};
+var SET_TOKEN_SECTION = {
+	heading: "Options for set-token",
+	lines: [["--generate", "create a strong token and print it once"], ["--clear", "remove the token, so it stops working"]]
+};
+var MIGRATE_SECTION = {
+	heading: "Options for migrate",
+	lines: [["--dry-run", "print what would change, write nothing"], ["-y, --yes", "apply without asking (or set HHOSTED_MIGRATE=allow)"]]
+};
+var INIT_SECTION = {
+	heading: "Options for init",
+	lines: [
+		["--dir <dir>", "where to scaffold (default: ./my-servers)"],
+		["--name <name>", "package name (default: the directory name)"],
+		["--pm <manager>", "pnpm | npm | yarn | bun (default: the first one installed)"],
+		["--no-install", "write the files, install nothing"],
+		["-y, --yes", "take every default, ask nothing"]
+	]
+};
+var UI_SWITCH_SECTION = {
+	heading: "Options for ui-switch",
+	lines: [
+		["--repo <owner/name>", "release repo (default: NamesMT/home-hosted)"],
+		["--tag <tag>", "release tag (default: this release's tag, or latest for another repo)"],
+		["--asset <name>", "asset to install (exact or unambiguous match)"],
+		["--file <path|url>", "install a zip from a local path or an http(s) URL"],
+		["--list", "list the usable assets and install nothing"],
+		["--token <token>", "GitHub token (or GITHUB_TOKEN / GH_TOKEN)"],
+		["-y, --yes", "take the only asset instead of asking"]
+	]
+};
+var EVERYWHERE_SECTION = {
+	heading: "Everywhere",
+	lines: [
+		["--home <dir>", "state directory (default: $HHOSTED_HOME or ~/.home-hosted)"],
+		["--project <dir>", "base for relative entry paths (default: the current directory)"],
+		["-h, --help", "this text"],
+		["-v, --version", "the version"]
+	]
+};
+var ALIAS_SECTION = {
+	heading: "Alias",
+	lines: [["hh", "the same CLI, on a machine where home-hosted is installed"]]
+};
+var ENVIRONMENT_SECTION = {
+	heading: "Environment",
+	lines: [
+		["HHOSTED_HOME", "where config, secrets, logs, TLS and backups live"],
+		["HHOSTED_PROJECT", "base for relative entry paths"],
+		["HHOSTED_PASSWORD", "the password for a non-interactive set-password"],
+		["HHOSTED_TOKEN", "the token for a non-interactive set-token"],
+		["GITHUB_TOKEN", "a GitHub token for ui-switch (GH_TOKEN also works)"]
+	]
+};
+/** The command list of the full reference, aligned as it always was. */
+function renderCommandList() {
+	const width = Math.max(...Object.values(SYNOPSIS).map((synopsis) => synopsis.length));
+	return Object.keys(SYNOPSIS).map((name) => {
+		const synopsis = SYNOPSIS[name];
+		return `  ${cyan(synopsis)}${" ".repeat(width + 1 - synopsis.length)}   ${SUMMARIES[name]}`;
+	}).join("\n");
+}
+function renderSection(section) {
+	const lines = section.lines.map(([left, right]) => `  ${cyan(left)}${" ".repeat(Math.max(0, OPTION_WIDTH - left.length))}   ${right}`).join("\n");
+	return `${heading(section.heading)}\n${lines}`;
+}
+/** The trailer every command shares: the global flags, the alias and the environment. */
+var SHARED_TRAILER = [
+	renderSection(EVERYWHERE_SECTION),
+	"",
+	renderSection(ALIAS_SECTION),
+	"",
+	renderSection(ENVIRONMENT_SECTION),
+	""
+].join("\n");
+/** The full reference: every command, every option, the trailer. */
+var USAGE = [
+	dim(HEADER),
+	"",
+	heading("Usage"),
+	renderCommandList(),
+	"",
+	renderSection(UP_SECTION),
+	"",
+	renderSection(SET_PASSWORD_SECTION),
+	"",
+	renderSection(SET_TOKEN_SECTION),
+	"",
+	renderSection(MIGRATE_SECTION),
+	"",
+	renderSection(INIT_SECTION),
+	"",
+	renderSection(UI_SWITCH_SECTION),
+	"",
+	renderSection(STATUS_SECTION),
+	"",
+	SHARED_TRAILER
+].join("\n");
+var UP_COMMANDS = /* @__PURE__ */ new Set(["up", "restart"]);
+var SECTIONS = {
+	"status": STATUS_SECTION,
+	"set-password": SET_PASSWORD_SECTION,
+	"set-token": SET_TOKEN_SECTION,
+	"migrate": MIGRATE_SECTION,
+	"init": INIT_SECTION,
+	"ui-switch": UI_SWITCH_SECTION
+};
+/**
+* `home-hosted <command> --help`: the usage line, that command's own options,
+* and the shared trailer. A command with no options says so instead of printing
+* an empty heading.
+*/
+function commandHelp(command) {
+	const synopsis = SYNOPSIS[command];
+	if (synopsis === void 0) return USAGE;
+	const section = UP_COMMANDS.has(command) ? UP_SECTION : SECTIONS[command];
+	const options = section === void 0 ? dim("no options") : renderSection(section);
+	return [
+		dim(HEADER),
+		"",
+		cyan(synopsis),
+		"",
+		options,
+		"",
+		SHARED_TRAILER
+	].join("\n");
+}
 function manifestVersion() {
 	try {
 		return JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")).version ?? "0.0.0";
@@ -9233,7 +9651,7 @@ async function main() {
 	applyDirFlags(dirFlags);
 	const invocation = resolveInvocation(dirFlags.rest, commandNames);
 	if (invocation.kind === "help") {
-		process.stdout.write(USAGE);
+		process.stdout.write(invocation.command === void 0 ? USAGE : commandHelp(invocation.command));
 		return;
 	}
 	if (invocation.kind === "version") {
@@ -9258,6 +9676,6 @@ main().catch((error) => {
 	fail(error instanceof Error ? error.message : String(error));
 });
 //#endregion
-export {};
+export { commandHelp };
 
 //# sourceMappingURL=cli.js.map