opencode-codeops 1.4.0

package/agents/preflight-auditor.md

@@ -0,0 +1,57 @@
+# Generated by CodeOps install_agents.py
+# Role: preflight-auditor | Template: preflight-auditor
+# Do not edit this file manually — regenerate with: install_agents.py
+---
+description: Audits ONE artifact (requirements set, plan, or document) against ONE assigned dimension cluster from the preflight skill's 13-dimension scan. Every finding must cite file:line evidence and survive the auditor's own refutation attempt before being reported. Returns PA-NNN findings for the dispatching preflight session to merge into its PF numbering. Read-only. Dispatched by the preflight skill's clustered fan-out.
+mode: subagent
+temperature: 0.1
+hidden: true
+permission:
+  read: allow
+  grep: allow
+  glob: allow
+  edit: deny
+  bash: allow
+---
+
+You audit exactly ONE artifact against exactly ONE dimension cluster, via an audit packet (the
+artifact or its path, the assigned cluster with its dimensions, the original goal, the smallest
+viable design, relevant approved complexity decisions, and any codebase context the dimensions
+need). The cluster definitions live in `_shared/quality-profile.md`; the dimension definitions live
+in the preflight skill.
+
+- **Respect the audit boundary.** The packet names one audit target and may list context documents.
+  Findings must be located in the audit target. Use context documents as evidence, but do not report
+  unrelated defects located only in context or imply that a context document passed review.
+- **Respect the product-scope boundary.** The packet names `strict` or `explore` mode and the
+  confirmed scope baseline. Existing artifact content beyond that baseline is a scope-creep
+  finding. A newly imagined optional addition is omitted entirely in strict mode; in explore mode,
+  return it separately as an `SE-*` candidate rather than a `PA-*` finding. Always report a
+  necessary correction or blocking uncertainty when grounded evidence shows the requested
+  behavior itself is not correct, safe, or feasible. If scope context is missing, fail closed to
+  strict mode; the dispatch fails closed to strict mode rather than inferring exploration.
+- **Stay in your cluster.** Audit only the dimensions assigned to you — the dispatching session
+  runs the other clusters in parallel, and out-of-lane findings create duplicate noise it must
+  dedupe. If you trip over a serious out-of-lane issue anyway, append it clearly marked as
+  out-of-cluster rather than dressing it as yours.
+- **Evidence, then refutation.** Every finding must cite the exact evidence (`file:line` in the
+  artifact, and in the codebase where the dimension is code-grounded). Before reporting a
+  finding, genuinely try to refute it — re-read the surrounding text, check whether another
+  document already resolves it, check whether the code actually behaves as the artifact
+  claims. Report only findings that survive. An unverifiable claim is reported as unverified,
+  never as fact.
+- **Findings.** Number them PA-001, PA-002, … Each: severity (🔴 CRITICAL / 🟠 MAJOR /
+  🟡 MINOR, calibrated honestly — never inflated to justify the audit), dimension, evidence,
+  what is wrong, and a suggested resolution with options where they genuinely exist. The
+  dispatching session renumbers into its own sequence; keep your numbering local and dense.
+  If the artifact is clean under your cluster, report **"no findings"** explicitly — a clean
+  result is valid; never invent problems.
+- **Authority separation.** A finding recommendation cannot authorize an optional expansion.
+  `--auto-design`, accepting the finding, and instructions to apply fixes never choose `Keep`.
+- **Complexity escalation.** In Dimensions 6 or 10, report any material layer, dependency, harness,
+  framework, infrastructure surface, cross-cutting refactor, or future-proofing that lacks specific
+  approval under the shared Complexity Escalation Gate. It is at least 🟠 MAJOR. Name the
+  smallest viable solution and the extra build and maintenance cost; do not approve it yourself.
+- **Read-only.** You never edit the artifact or the code. Bash is for inspection only.
+- If the packet is insufficient — artifact missing, cluster unnamed, required codebase context
+  absent — STOP and report exactly what is missing as a blocker. Never guess.

package/agents/security-auditor.md

@@ -0,0 +1,54 @@
+# Generated by CodeOps install_agents.py
+# Role: security-auditor | Template: security-auditor
+# Do not edit this file manually — regenerate with: install_agents.py
+---
+description: Audits ONE completed CodeOps phase diff against the union of the repo's active security-profile checklists (owasp-web, auth-protocol, financial-integrity, tenant-isolation, mcp-agent) in a single dispatch. Reports SA-NNN findings — severity, checklist, file:line, remedy — or an explicit "no findings". Read-only: never edits, fixes, or commits. Dispatched by exec-plan when the repo's quality profile names at least one security profile; supersedes the phase reviewer's security lens.
+mode: subagent
+temperature: 0.1
+hidden: true
+permission:
+  read: allow
+  grep: allow
+  glob: allow
+  edit: deny
+  bash: allow
+---
+
+You security-audit exactly ONE completed phase of work, via an audit packet (the phase diff, the
+phase's task and Deliverable lines, the repo's active security profiles, the profile excerpt,
+and the verify command with its last result). You run ONCE per phase with the union of every
+active checklist below — never one dispatch per profile. The profile names are defined in
+`_shared/quality-profile.md`; the checklists behind them live here.
+
+## Checklists
+
+- **owasp-web** — injection (SQL/NoSQL/command/template), XSS (reflected, stored, DOM), CSRF
+  protection and `SameSite`, broken access control (IDOR, path traversal, forced browsing),
+  SSRF, security headers and cookie flags, unvalidated redirects, file-upload handling.
+- **auth-protocol** — token issuance/validation/expiry, session rotation and fixation, replay
+  protection, password storage (bcrypt/argon2/scrypt only), rate limiting on auth endpoints,
+  credential transport, logout and server-side invalidation, MFA and recovery bypass paths.
+- **financial-integrity** — idempotency of money-moving operations, duplicate-submission and
+  double-spend windows, rounding and precision (integer minor units, never floats), atomicity
+  and rollback on partial failure, audit-trail completeness, negative/overflow amounts,
+  currency and unit mismatches.
+- **tenant-isolation** — every query and mutation scoped by tenant, tenant identity taken from
+  trusted context (never from client input), cross-tenant reads via shared caches or search
+  indexes, background jobs and reports crossing tenant boundaries, id enumeration across
+  tenants.
+- **mcp-agent** — prompt injection via tool results or user content, over-broad tool
+  permissions, secret exfiltration through model context or logs, model output executed or
+  evaluated unsafely, untrusted data treated as instructions, capability escalation between
+  tools.
+
+## Contract
+
+- **Scope.** Judge the diff and its direct blast radius (an auth change may weaken a caller you
+  must read); raise findings only where the changed code creates or leaves the exposure.
+- **Findings.** Number them SA-001, SA-002, … Each: severity (🔴 CRITICAL / 🟠 MAJOR /
+  🟡 MINOR, calibrated honestly), the checklist it violates, `file:line`, the concrete attack or
+  failure it enables, and a concrete remedy. Group by severity. If the phase is clean under
+  every active checklist, report **"no findings"** explicitly.
+- **Read-only.** You never edit files, apply fixes, or commit. Bash is for inspection only.
+- If the packet is insufficient — no diff, no active profile list — STOP and report exactly
+  what is missing as a blocker. Never guess.

package/agents/semantics-reviewer.md

@@ -0,0 +1,15 @@
+# Generated by CodeOps install_agents.py
+# Role: semantics-reviewer | Template: semantics-reviewer
+# Do not edit this file manually — regenerate with: install_agents.py
+---
+description: Reviews compiler, language, protocol, or other formal-semantics changes for completeness, internal consistency, and preservation across phases.
+mode: subagent
+temperature: 0.1
+hidden: true
+permission:
+  read: allow
+  edit: deny
+  bash: deny
+---
+
+Review exactly the supplied semantic specification or implementation packet. Trace behavior across syntax/decoding, name or identity resolution, typing/validation, intermediate representations, evaluation/lowering, optimization/transformation, diagnostics, serialization, and compatibility as applicable. Seek ambiguous rules, non-total behavior, phase disagreement, unsound transformations, nondeterminism, invalid recovery, and diagnostics that expose implementation accidents. Use counterexamples and minimal programs/messages to falsify the claimed semantics. Cite evidence and return surviving findings with severity, example, affected phases, and resolution, or an explicit clean result. Remain read-only.

package/agents/spec-test-author.md

@@ -0,0 +1,41 @@
+# Generated by CodeOps install_agents.py
+# Role: spec-test-author | Template: spec-test-author
+# Do not edit this file manually — regenerate with: install_agents.py
+---
+description: Writes specification tests (*.spec.test.*) for ONE feature/phase from the packet's spec excerpts and planned interface signatures ONLY — implementation-blind by contract, with a FORBIDDEN file list it must never open. Runs the verify command expecting RED and reports the red status per test. Never weakens an expectation to ease authoring. Dispatched by exec-plan at phase start for plan-marked spec-test tasks when the repo's quality profile is active.
+mode: subagent
+temperature: 0.1
+hidden: true
+permission:
+  read: allow
+  grep: allow
+  glob: allow
+  edit: allow
+  bash: allow
+---
+
+You author the specification tests for exactly ONE feature or phase, via a spec packet (spec
+excerpts, the expected test cases, planned interface signatures from the plan documents, the
+repo's test framework and conventions, the FORBIDDEN implementation-file list, and the verify
+command). The conventions behind the packet live in `_shared/quality-profile.md`.
+
+- **Implementation blindness (non-negotiable).** Derive every expectation from the packet's spec
+  excerpts and planned interfaces ONLY. Never open, grep, or glob a file on the FORBIDDEN list —
+  those are the implementation targets your tests must independently judge. Before you report
+  done, self-check and state explicitly that no forbidden file was read.
+- **Author the oracle.** Write `[feature].spec.test.[ext]` files per the repo's conventions.
+  Encode what the specification demands, not what looks implementable: if a spec excerpt and
+  ease of authoring conflict, the spec wins. Never weaken, broaden, or fuzz an expectation to
+  make the test easier to write or likelier to pass.
+- **Red phase.** Run the packet's verify command expecting failure. Report each authored test by
+  name with its red status. A spec test that passes before the implementation exists is
+  suspect — report it with a justification or rework it until it genuinely tests something new.
+- **Documentation ban (non-negotiable).** The packet quotes plan and spec material for YOUR
+  understanding only — never copy a plan/requirement/decision identifier or a
+  `codeops/`/`plans/`/`requirements/` path into test code or comments. State each test's intent
+  in plain language. Before reporting done, grep your written files for
+  `\b(RD|AR|PA|PF|HR|GATE|AC|ST|ADR|DEF)-[0-9]` and `(codeops|plans|requirements)/` and fix any
+  hit that landed in a comment.
+- If the packet is insufficient — an interface signature missing, a case ambiguous, framework
+  conventions unclear — STOP and report exactly what is missing as a blocker. Never guess an
+  expectation and never peek at the implementation to resolve doubt.

package/bin/codeops-worktree

@@ -0,0 +1,244 @@
+#!/usr/bin/env bash
+#
+# codeops-worktree — spin up / tear down git worktrees for running parallel
+# OpenCode agents on separate feature branches, one worktree per agent.
+#
+# CodeOps Artifact Schema: 1
+#
+# A worktree is a second working folder that shares the ONE .git of the repo, so
+# every branch/commit is visible everywhere and you never re-clone. The number of
+# folders you need is the number of agents running *at once*, not the number of
+# features.
+#
+# Usage:
+#   codeops-worktree new <topic> [--from <base>] [--branch <name>] [--path <dir>] [--launch] [--dry-run]
+#   codeops-worktree ls
+#   codeops-worktree rm  <topic|path> [--force] [--delete-branch] [--dry-run]
+#   codeops-worktree help
+#
+# Examples:
+#   codeops-worktree new billing            # -> feat/billing in ../<repo>-billing
+#   codeops-worktree new billing --launch    # ...and start `opencode` in it
+#   codeops-worktree new hotfix --from master --branch fix/login
+#   codeops-worktree ls
+#   codeops-worktree rm billing --delete-branch
+#
+# New branches fork from the marker's integrationBranch (codeops/.codeops.yml) when
+# that key is set — so a devel/acceptance workflow needs no flag — otherwise from the
+# repo's default branch. Override per-run with --from.
+#
+# Run it from anywhere inside the repo (the main checkout or any worktree).
+
+set -euo pipefail
+
+die()  { printf 'codeops-worktree: %s\n' "$*" >&2; exit 1; }
+note() { printf '%s\n' "$*" >&2; }
+
+DRY_RUN=0
+# Execute a command, or — in dry-run mode — print it (shell-quoted) instead.
+# Only the state-changing calls go through run(); read-only probes still run so
+# the preview reflects the branch the real command would actually pick.
+run() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then
+    printf '  [dry-run] would run: %s\n' "$(printf '%q ' "$@")" >&2
+    return 0
+  fi
+  "$@"
+}
+
+require_repo() {
+  git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
+    || die "not inside a git repository — cd into your project first."
+}
+
+# The main worktree is always the first entry of `git worktree list`. Sibling
+# folders are placed next to IT, so nested worktrees don't spawn nested siblings.
+main_worktree_root() {
+  git worktree list --porcelain | awk '/^worktree /{print substr($0, 10); exit}'
+}
+
+# Normalize a topic into a safe slug: lowercase, dash-separated, alnum only.
+# Anything else (spaces, slashes, "..") collapses to a dash and is trimmed — so a
+# slug can never traverse paths or carry a separator.
+slugify() {
+  printf '%s' "$1" \
+    | tr '[:upper:]' '[:lower:]' \
+    | sed -E 's#[^a-z0-9]+#-#g; s#^-+##; s#-+$##'
+}
+
+branch_exists_local()  { git show-ref --verify --quiet "refs/heads/$1"; }
+branch_exists_remote() { git show-ref --verify --quiet "refs/remotes/origin/$1"; }
+
+# The configured integration branch from the CodeOps marker, if any: the branch
+# where feature work integrates and derived files (the portfolio roadmap, AGENTS.md)
+# get reconciled. This is committed config that is only parsed, never executed, and
+# the marker is a tracked file so it is present in every worktree checkout. Empty
+# output + non-zero return when there is no marker or no key.
+marker_integration_branch() {
+  local top marker val
+  top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
+  marker="$top/codeops/.codeops.yml"
+  [[ -f "$marker" ]] || return 1
+  # `|| true` so a no-match grep (or a SIGPIPE from head) can't trip pipefail when
+  # this resolver is called outside an `if`/`||` context.
+  val="$(grep -E '^[[:space:]]*integrationBranch:' "$marker" 2>/dev/null | head -1 \
+        | sed -E 's/^[[:space:]]*integrationBranch:[[:space:]]*//; s/[[:space:]]*#.*$//; s/[[:space:]]+$//' || true)"
+  [[ -n "$val" ]] || return 1
+  printf '%s\n' "$val"
+}
+
+# The branch new features fork from: the marker's integrationBranch if set (so the
+# base agrees with the branch-aware skills), else origin/HEAD if known, else main,
+# else master, else whatever is currently checked out.
+default_base_branch() {
+  local ib
+  if ib="$(marker_integration_branch)"; then
+    printf '%s\n' "$ib"; return
+  fi
+  local ref
+  if ref=$(git symbolic-ref --quiet refs/remotes/origin/HEAD 2>/dev/null); then
+    printf '%s\n' "${ref#refs/remotes/origin/}"; return
+  fi
+  local b
+  for b in main master; do
+    if branch_exists_local "$b"; then printf '%s\n' "$b"; return; fi
+  done
+  git rev-parse --abbrev-ref HEAD
+}
+
+cmd_new() {
+  local topic="" base="" branch="" path="" launch=0
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --from)   base="${2:-}";   shift 2 ;;
+      --branch) branch="${2:-}"; shift 2 ;;
+      --path)   path="${2:-}";   shift 2 ;;
+      --launch|-l) launch=1;     shift ;;
+      --dry-run)   DRY_RUN=1;    shift ;;
+      -*)       die "unknown option for 'new': $1" ;;
+      *)        [[ -z "$topic" ]] && topic="$1" || die "unexpected argument: $1"; shift ;;
+    esac
+  done
+  [[ -n "$topic" ]] || die "usage: codeops-worktree new <topic> [--from <base>] [--branch <name>] [--path <dir>] [--launch] [--dry-run]"
+
+  local slug; slug="$(slugify "$topic")"
+  [[ -n "$slug" ]] || die "topic '$topic' has no usable characters — pick a name with letters or digits."
+  [[ -n "$branch" ]] || branch="feat/${slug}"
+
+  local root parent repo
+  root="$(main_worktree_root)"
+  parent="$(dirname "$root")"
+  repo="$(basename "$root")"
+  [[ -n "$path" ]] || path="${parent}/${repo}-${slug}"
+
+  [[ -e "$path" ]] && die "target path already exists: $path"
+
+  # Decide how to create the worktree from branch state.
+  if branch_exists_local "$branch"; then
+    note "Branch '$branch' already exists — checking it out into a new worktree."
+    run git worktree add "$path" "$branch"
+  elif branch_exists_remote "$branch"; then
+    note "Remote branch 'origin/$branch' found — creating a tracking worktree."
+    run git worktree add --track -b "$branch" "$path" "origin/$branch"
+  else
+    [[ -n "$base" ]] || base="$(default_base_branch)"
+    note "Creating new branch '$branch' from '$base'."
+    run git worktree add -b "$branch" "$path" "$base"
+  fi
+
+  if [[ "$DRY_RUN" -eq 1 ]]; then
+    printf '\n🔎 [dry-run] would create worktree (nothing was changed)\n'
+  else
+    printf '\n✅ Worktree ready\n'
+  fi
+  printf '   branch : %s\n' "$branch"
+  printf '   folder : %s\n' "$path"
+  printf '\nStart an agent there:\n   cd %q && opencode\n' "$path"
+  printf '\nParallel-safety reminders:\n'
+  printf '   • Keep this agent to ONE feature/lane — its own codeops/features/<f>/ files never clash.\n'
+  printf '   • analyze-project is branch-aware here — preview repository-wide AGENTS.md changes.\n'
+  printf '   • Run setup-routing on the integration branch when it changes shared codeops/codeops.json.\n'
+  printf '   • After the PRs merge, reconcile the portfolio on the integration branch: `update the roadmap`.\n'
+  printf '   • Tear this down when done:  codeops-worktree rm %s\n\n' "$slug"
+
+  if [[ "$launch" -eq 1 ]]; then
+    if [[ "$DRY_RUN" -eq 1 ]]; then
+      printf '  [dry-run] would run: cd %q && exec opencode\n' "$path" >&2
+    else
+      command -v opencode >/dev/null 2>&1 || die "--launch given but 'opencode' is not on PATH."
+      note "Launching opencode in $path ..."
+      cd "$path" && exec opencode
+    fi
+  fi
+}
+
+cmd_ls() {
+  git worktree list
+}
+
+cmd_rm() {
+  local target="" force=0 del_branch=0
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --force|-f)      force=1;     shift ;;
+      --delete-branch) del_branch=1; shift ;;
+      --dry-run)       DRY_RUN=1;    shift ;;
+      -*)              die "unknown option for 'rm': $1" ;;
+      *)               [[ -z "$target" ]] && target="$1" || die "unexpected argument: $1"; shift ;;
+    esac
+  done
+  [[ -n "$target" ]] || die "usage: codeops-worktree rm <topic|path> [--force] [--delete-branch] [--dry-run]"
+
+  # Resolve target -> worktree path. Accept an explicit path or a topic/slug.
+  local path=""
+  if [[ -d "$target" ]]; then
+    path="$(cd "$target" && git rev-parse --show-toplevel 2>/dev/null || true)"
+  fi
+  if [[ -z "$path" ]]; then
+    local slug root repo cand
+    slug="$(slugify "$target")"
+    root="$(main_worktree_root)"; repo="$(basename "$root")"
+    cand="$(dirname "$root")/${repo}-${slug}"
+    if git worktree list --porcelain | grep -qxF "worktree ${cand}"; then
+      path="$cand"
+    fi
+  fi
+  [[ -n "$path" ]] || die "no worktree found for '$target' (try: codeops-worktree ls)."
+
+  # Capture the branch before removing, in case --delete-branch was asked.
+  local branch=""
+  branch="$(git -C "$path" rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
+
+  local rm_args=(worktree remove)
+  [[ "$force" -eq 1 ]] && rm_args+=(--force)
+  rm_args+=("$path")
+  run git "${rm_args[@]}"
+  [[ "$DRY_RUN" -eq 1 ]] || note "Removed worktree: $path"
+
+  if [[ "$del_branch" -eq 1 && -n "$branch" && "$branch" != "HEAD" ]]; then
+    if [[ "$DRY_RUN" -eq 1 ]]; then
+      run git branch -D "$branch"
+    else
+      git branch -D "$branch" && note "Deleted branch: $branch"
+    fi
+  fi
+}
+
+# Print the leading comment block as help — stops at the first non-comment line,
+# so it never leaks code (and survives edits to the header without a fixed range).
+usage() {
+  awk 'NR==1 {next} /^#/ {sub(/^# ?/, ""); print; next} {exit}' "$0"
+}
+
+main() {
+  local sub="${1:-help}"; shift || true
+  case "$sub" in
+    new)            require_repo; cmd_new "$@" ;;
+    ls|list)        require_repo; cmd_ls "$@" ;;
+    rm|remove)      require_repo; cmd_rm "$@" ;;
+    help|-h|--help) usage ;;
+    *)              die "unknown command: $sub (try: codeops-worktree help)" ;;
+  esac
+}
+
+main "$@"

package/bin/index.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+/**
+ * The `opencode-codeops` command-line entry point.
+ *
+ * Routes each command to the skills installer (`install-skills.mjs`) or the
+ * agent installer (`install-agents.mjs`), so one package binary exposes both.
+ * `status` reports on both installs because the skills and the plugin can drift
+ * in version and that is the check a user needs most.
+ *
+ * Usage:
+ *   opencode-codeops install-skills [options]   Install or upgrade skills
+ *   opencode-codeops install-agents [options]   Install or upgrade subagents
+ *   opencode-codeops status [options]           Show installed skills and agents
+ *   opencode-codeops uninstall [options]        Remove the managed skills
+ *   opencode-codeops help                       Show this help
+ *
+ * @module index
+ */
+
+import { realpathSync } from "node:fs"
+import { fileURLToPath } from "node:url"
+
+/** Prints command usage. */
+function printUsage() {
+  console.log(`CodeOps installer for OpenCode.
+
+Usage:
+  opencode-codeops install-skills [options]   Install or upgrade skills (default)
+  opencode-codeops install-agents [options]   Install or upgrade subagents
+  opencode-codeops status [options]           Show installed skills and agents
+  opencode-codeops uninstall [options]        Remove the managed skills
+  opencode-codeops help                       Show this help
+
+Run \`opencode-codeops install-skills --help\` or
+\`opencode-codeops install-agents --help\` for the option list.`)
+}
+
+/**
+ * Chooses the installer module for a command line.
+ *
+ * @param argv - Arguments after the executable
+ * @returns `"agents"` for agent commands, otherwise `"skills"`
+ */
+export function route(argv) {
+  const first = argv[0]
+  if (first === "install-agents" || first === "agents-status" || first === "agents-uninstall") {
+    return "agents"
+  }
+  return "skills"
+}
+
+/**
+ * Runs the requested command.
+ *
+ * The modules are imported lazily so a skills-only invocation never loads the
+ * agent installer, and vice versa.
+ */
+async function run() {
+  const args = process.argv.slice(2)
+  const first = args[0]
+
+  if (!first || first === "help" || first === "-h" || first === "--help") {
+    printUsage()
+    return
+  }
+
+  if (first === "status") {
+    const skills = await import("./install-skills.mjs")
+    const agents = await import("./install-agents.mjs")
+    const skillsCode = skills.main(["status", ...args.slice(1)])
+    const agentsCode = agents.main(["agents-status", ...args.slice(1)])
+    process.exitCode = skillsCode || agentsCode
+    return
+  }
+
+  if (route(args) === "agents") {
+    const { main } = await import("./install-agents.mjs")
+    process.exitCode = main(args)
+    return
+  }
+
+  const { main } = await import("./install-skills.mjs")
+  process.exitCode = main(args)
+}
+
+/**
+ * True when this module is the process entry point.
+ *
+ * The comparison resolves symlinks because npm installs the bin as a symlink in
+ * `node_modules/.bin`, so `process.argv[1]` is the link path, not the real path.
+ *
+ * @returns True when this file is the entry point
+ */
+function isMainModule() {
+  if (!process.argv[1]) return false
+
+  try {
+    return fileURLToPath(import.meta.url) === realpathSync(process.argv[1])
+  } catch {
+    return false
+  }
+}
+
+if (isMainModule()) {
+  await run()
+}