permdock 0.3.1 → 0.5.0

package/dist/run-DOfMtc9V.js

@@ -0,0 +1,723 @@
+import { i as dateAt } from "./time-DkWjdL98.js";
+import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-CWTY6uih.js";
+import { s as cliVersion } from "./version-CEbQ5UeM.js";
+import { a as resolveCwd, i as readConfig } from "./config-bs_kZeYq.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-IIolxxKA.js";
+import { r as progressReporter, t as redact } from "./credentials-DPyHmYz5.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { t as createStyle } from "./style-Uao76wO7.js";
+import { a as sarifLog, i as githubAnnotations, n as envelope, t as dataOf } from "./output-Dyw8fyPF.js";
+import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
+import { stripVTControlCharacters } from "node:util";
+import { existsSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
+//#region src/cli/core/agent.ts
+function set(env, name) {
+	const value = env[name];
+	return value !== void 0 && value !== "";
+}
+/**
+* The AI agent running the CLI, from the variables `@vercel/detect-agent`
+* reads, in its order. `CURSOR_TRACE_ID` is also set in Cursor's own
+* terminal, so it counts only when stdout is not a TTY.
+*/
+function detectAgent(env, probe) {
+	const named = env["AI_AGENT"]?.trim();
+	if (named !== void 0 && named !== "") return {
+		isAgent: true,
+		name: named === "github-copilot-cli" ? "github-copilot" : named
+	};
+	if (set(env, "CURSOR_TRACE_ID") && !probe.stdoutIsTty) return {
+		isAgent: true,
+		name: "cursor"
+	};
+	if (set(env, "CURSOR_AGENT") || env["CURSOR_EXTENSION_HOST_ROLE"] === "agent-exec") return {
+		isAgent: true,
+		name: "cursor-cli"
+	};
+	if (set(env, "GEMINI_CLI")) return {
+		isAgent: true,
+		name: "gemini"
+	};
+	if (set(env, "CODEX_SANDBOX") || set(env, "CODEX_CI") || set(env, "CODEX_THREAD_ID")) return {
+		isAgent: true,
+		name: "codex"
+	};
+	if (set(env, "ANTIGRAVITY_AGENT")) return {
+		isAgent: true,
+		name: "antigravity"
+	};
+	if (set(env, "AUGMENT_AGENT")) return {
+		isAgent: true,
+		name: "augment-cli"
+	};
+	if (set(env, "OPENCODE_CLIENT")) return {
+		isAgent: true,
+		name: "opencode"
+	};
+	if (set(env, "CLAUDECODE") || set(env, "CLAUDE_CODE")) return {
+		isAgent: true,
+		name: set(env, "CLAUDE_CODE_IS_COWORK") ? "cowork" : "claude"
+	};
+	if (set(env, "REPL_ID")) return {
+		isAgent: true,
+		name: "replit"
+	};
+	if (set(env, "COPILOT_MODEL") || set(env, "COPILOT_ALLOW_ALL") || set(env, "COPILOT_GITHUB_TOKEN")) return {
+		isAgent: true,
+		name: "github-copilot"
+	};
+	if (probe.exists("/opt/.devin")) return {
+		isAgent: true,
+		name: "devin"
+	};
+	return { isAgent: false };
+}
+const MODES = {
+	yes: "yes",
+	"1": "yes",
+	true: "yes",
+	no: "no",
+	"0": "no",
+	false: "no",
+	auto: "auto"
+};
+function modeOf(value, source) {
+	if (value === void 0 || value === "") return;
+	const key = value.trim().toLowerCase();
+	const mode = Object.hasOwn(MODES, key) ? MODES[key] : void 0;
+	if (mode === void 0) throw new CliError("usage", `${source} takes auto, yes or no, got '${value}'`, {
+		code: "invalid_value",
+		extensions: source.startsWith("--") ? { flag: source } : {}
+	});
+	return mode;
+}
+/**
+* `--agent`, then `PERMDOCK_AGENT`, then detection. An unknown value is a
+* usage error, so a typo never leaves an agent with prompts it cannot answer.
+*/
+function agentMode(flag, env, probe) {
+	const mode = flag === void 0 ? modeOf(env["PERMDOCK_AGENT"], "PERMDOCK_AGENT") ?? "auto" : modeOf(flag, "--agent") ?? "auto";
+	switch (mode) {
+		case "yes": return true;
+		case "no": return false;
+		case "auto": return detectAgent(env, probe).isAgent;
+		default: return mode;
+	}
+}
+//#endregion
+//#region src/cli/core/consent.ts
+/**
+* The reasons a run needs consent: it edits files the project owns, it
+* publishes to the Cloud, or `--force` overwrites files PermDock did not
+* write. A `--dry-run` or `--check` run writes nothing and needs none.
+*/
+function consentReasons(effects, flags) {
+	if (flags["dry-run"] === true || flags["check"] === true) return [];
+	const reasons = [];
+	if (effects.includes("rewrite")) reasons.push("rewrite");
+	if (effects.includes("cloud:write")) reasons.push("cloud:write");
+	if (flags["force"] === true && effects.includes("files")) reasons.push("overwrite");
+	return reasons;
+}
+/** A token as the shell reads it back unchanged. */
+function quote(token) {
+	return /^[\w@%+=:,./-]+$/u.test(token) ? token : `'${token.replaceAll("'", String.raw`'\''`)}'`;
+}
+/**
+* The argv as a command line to run again, `--confirm` dropped. Secrets
+* only arrive through `--*-stdin` flags, so the line holds none.
+*/
+function replayArgv(argv) {
+	const out = [];
+	for (let i = 0; i < argv.length; i += 1) {
+		const token = argv[i] ?? "";
+		if ((token.startsWith("--") ? token.slice(2).split("=", 1)[0] : void 0) === "confirm") {
+			i += token.includes("=") ? 0 : 1;
+			continue;
+		}
+		out.push(token);
+	}
+	return out;
+}
+/**
+* A short token bound to what the person agrees to, the directory and the
+* command line. Hex, because a base64url token may start with `-` and parse
+* as a flag. 16 characters, as better-supabase's.
+*/
+function consentToken(reasons, argv, cwd) {
+	return createHash("sha256").update(JSON.stringify([
+		reasons,
+		cwd,
+		...argv
+	])).digest("hex").slice(0, 16);
+}
+const REASON_TEXT = {
+	rewrite: "edits files the project owns",
+	"cloud:write": "publishes to PermDock Cloud",
+	overwrite: "overwrites files with --force"
+};
+/** The `consent_required` result an agent gets until it passes the token. */
+function consentRequired(command, reasons, argv, token) {
+	return new CliError("action", `permdock ${command} ${reasons.map((reason) => REASON_TEXT[reason]).join(" and ")}. Ask the person to agree, then run it again with --confirm ${token}`, {
+		code: "consent_required",
+		extensions: {
+			reasons,
+			token
+		},
+		next: [{
+			when: "after the person agrees",
+			command: [
+				"permdock",
+				...argv.map(quote),
+				"--confirm",
+				token
+			].join(" ")
+		}]
+	});
+}
+//#endregion
+//#region src/cli/core/help.ts
+const CLI_COMMANDS_SCHEMA = "https://permdock.com/schemas/cli-commands-v1.json";
+function flagLabel(name, flag) {
+	const alias = flag.alias === void 0 ? "" : `-${flag.alias}, `;
+	if (flag.type === "boolean") return `${alias}--${name}`;
+	return `${alias}--${name} <${flag.type === "enum" ? flag.valueHint ?? flag.options.join("|") : flag.valueHint ?? "value"}>`;
+}
+function flagText(flag) {
+	const text = notedText(flag);
+	return flag.type === "enum" && flag.valueHint !== void 0 ? `${text}; one of ${flag.options.join(", ")}` : text;
+}
+function notedText(flag) {
+	const notes = [];
+	if (flag.type !== "boolean" && flag.repeatable === true) notes.push("repeatable");
+	if (flag.type === "enum" && flag.default !== void 0) notes.push(`default ${flag.default}`);
+	return notes.length === 0 ? flag.description : `${flag.description} (${notes.join(", ")})`;
+}
+function table(rows, style) {
+	const width = Math.max(0, ...rows.map(([left]) => left.length));
+	return rows.map(([left, right]) => `  ${style.paint("cyan", left.padEnd(width))}  ${right}`);
+}
+function flagRows(flags) {
+	const rows = [];
+	for (const [name, flag] of Object.entries(flags)) {
+		if (flag.hidden === true) continue;
+		rows.push([flagLabel(name, flag), flagText(flag)]);
+		if (flag.type === "boolean" && flag.negativeDescription !== void 0) rows.push([`--no-${name}`, flag.negativeDescription]);
+	}
+	return rows;
+}
+function positionalUsage(positionals) {
+	return positionals.map((item) => {
+		const name = `${item.name}${item.variadic === true ? "..." : ""}`;
+		return item.required === true ? `<${name}>` : `[${name}]`;
+	}).join(" ");
+}
+function visible(entries) {
+	return entries.filter((entry) => entry.kind === "group" || entry.hidden !== true);
+}
+function rootHelp(color) {
+	const style = createStyle(color);
+	const lines = [
+		`${style.paint("bold", "permdock")} ${cliVersion()}: ${ROOT.summary}`,
+		"",
+		`${style.paint("bold", "Usage")}  permdock <command> [flags]`
+	];
+	for (const section of SECTIONS) lines.push("", style.paint("bold", section.title), ...table(visible(section.entries).map((entry) => [entry.name, entry.summary]), style));
+	lines.push("", style.paint("bold", "Global flags"), ...table([...flagRows(GLOBAL_FLAGS), ["-v, --version", "Print the permdock version"]], style), "", `Run permdock <command> --help for its flags. Docs: ${DOCS_BASE}`);
+	return `${lines.join("\n")}\n`;
+}
+function groupHelp(path, group, color) {
+	const style = createStyle(color);
+	const name = `permdock ${path.join(" ")}`;
+	const rows = visible(group.children).map((child) => [`${path.join(" ")} ${child.name}`, child.summary]);
+	return `${[
+		`${style.paint("bold", name)}: ${group.summary}`,
+		"",
+		`${style.paint("bold", "Usage")}  ${name} <command> [flags]`,
+		"",
+		style.paint("bold", "Commands"),
+		...table(rows, style),
+		"",
+		`Run ${name} <command> --help for its flags. Docs: ${DOCS_BASE}/${group.docs}`
+	].join("\n")}\n`;
+}
+function leafHelp(path, entry, leaf, color) {
+	const style = createStyle(color);
+	const name = `permdock ${path.join(" ")}`;
+	const positionals = positionalUsage(leaf.positionals ?? []);
+	const lines = [
+		`${style.paint("bold", name)}: ${entry.summary}`,
+		"",
+		`${style.paint("bold", "Usage")}  ${name}${positionals === "" ? "" : ` ${positionals}`} [flags]`
+	];
+	const args = leaf.positionals ?? [];
+	if (args.length > 0) lines.push("", style.paint("bold", "Arguments"), ...table(args.map((item) => [item.name, item.description]), style));
+	const rows = flagRows(leaf.flags);
+	if (rows.length > 0) lines.push("", style.paint("bold", "Flags"), ...table(rows, style));
+	lines.push("", style.paint("bold", "Global flags"), `  ${Object.keys(GLOBAL_FLAGS).map((flag) => `--${flag}`).join(" ")}; see permdock --help`);
+	if (entry.examples.length > 0) lines.push("", style.paint("bold", "Examples"), ...entry.examples.map((example) => `  ${example}`));
+	lines.push("", `${style.paint("bold", "Side effects")}  ${entry.effects.length === 0 ? "none: reads only" : entry.effects.join(", ")}`, `${style.paint("bold", "Docs")}  ${DOCS_BASE}/${entry.docs}`);
+	return `${lines.join("\n")}\n`;
+}
+function flagJson(name, flag) {
+	return {
+		name,
+		type: flag.type,
+		description: flag.description,
+		...flag.alias === void 0 ? {} : { aliases: [flag.alias] },
+		...flag.type === "enum" ? { choices: flag.options } : {},
+		...flag.type !== "string" && flag.default !== void 0 ? { default: flag.default } : {},
+		...flag.type !== "boolean" && flag.repeatable === true ? { list: true } : {},
+		...flag.type === "string" && flag.valueHint !== void 0 ? { valueHint: flag.valueHint } : {}
+	};
+}
+function flagsJson(flags) {
+	return Object.entries(flags).filter(([, flag]) => flag.hidden !== true).map(([name, flag]) => flagJson(name, flag));
+}
+/** One leaf as `cli-commands-v1` describes it. */
+function leafJson(path, entry, leaf) {
+	return {
+		name: path.at(-1) ?? "",
+		path: path.join(" "),
+		description: entry.summary,
+		docs: `${DOCS_BASE}/${entry.docs}`,
+		examples: entry.examples,
+		effects: entry.effects,
+		config: entry.config,
+		arguments: (leaf.positionals ?? []).map((item) => ({
+			name: item.name,
+			description: item.description,
+			required: item.required === true,
+			variadic: item.variadic === true
+		})),
+		options: flagsJson(leaf.flags)
+	};
+}
+function document(commands) {
+	return {
+		$schema: CLI_COMMANDS_SCHEMA,
+		name: "permdock",
+		version: cliVersion(),
+		options: flagsJson(GLOBAL_FLAGS),
+		commands
+	};
+}
+/** `<command> --help --json`: the `cli-commands-v1` document with that command only. */
+function leafDocument(path, entry, leaf) {
+	return document([leafJson(path, entry, leaf)]);
+}
+/** `--help --json`: the commands under `path` in the `cli-commands-v1` format. */
+async function commandsJson(path, group) {
+	const listed = leaves(group, path).filter((item) => item.entry.hidden !== true);
+	return document(await Promise.all(listed.map(async (item) => leafJson(item.path, item.entry, await item.entry.load()))));
+}
+//#endregion
+//#region src/cli/core/run.ts
+const NO_CONFIG = {
+	config: {},
+	warnings: [],
+	file: void 0
+};
+/** Takes the global flags out of argv, wherever they sit before `--`. */
+function extractGlobals(argv) {
+	const end = argv.indexOf("--");
+	const before = end === -1 ? argv : argv.slice(0, end);
+	const after = end === -1 ? [] : argv.slice(end);
+	const spellings = /* @__PURE__ */ new Map();
+	for (const [name, flag] of Object.entries(GLOBAL_FLAGS)) {
+		spellings.set(`--${name}`, name);
+		if (flag.type === "boolean") spellings.set(`--no-${name}`, name);
+		if ("alias" in flag) spellings.set(`-${flag.alias}`, name);
+	}
+	const taken = [];
+	const rest = [];
+	for (let i = 0; i < before.length; i += 1) {
+		const token = before[i] ?? "";
+		const spelling = beforeFirst(token, "=");
+		const name = token.startsWith("-") ? spellings.get(spelling) : void 0;
+		if (name === void 0) {
+			rest.push(token);
+			continue;
+		}
+		taken.push(token);
+		const flag = GLOBAL_FLAGS[name];
+		const next = before[i + 1];
+		if (flag !== void 0 && flag.type !== "boolean" && !token.includes("=") && next !== void 0 && (next === "-" || !next.startsWith("-"))) {
+			taken.push(next);
+			i += 1;
+		}
+	}
+	const lenient = {
+		...GLOBAL_FLAGS,
+		format: {
+			type: "string",
+			description: ""
+		},
+		agent: {
+			type: "string",
+			description: ""
+		}
+	};
+	const parsed = parseFlags("permdock", taken, lenient).values;
+	const text = (key) => {
+		const value = parsed.get(key);
+		return typeof value === "string" ? value : void 0;
+	};
+	const flag = (key) => {
+		const value = parsed.get(key);
+		return typeof value === "boolean" ? value : void 0;
+	};
+	const cwd = text("cwd");
+	const config = text("config");
+	const json = flag("json");
+	const format = text("format");
+	const agent = text("agent");
+	const confirm = text("confirm");
+	return {
+		globals: {
+			...cwd === void 0 ? {} : { cwd },
+			...config === void 0 ? {} : { config },
+			...json === void 0 ? {} : { json },
+			...format === void 0 ? {} : { format },
+			...agent === void 0 ? {} : { agent },
+			...confirm === void 0 ? {} : { confirm },
+			yes: flag("yes") === true,
+			debug: flag("debug") === true,
+			color: flag("color") !== false,
+			help: flag("help") === true
+		},
+		rest: [...rest, ...after]
+	};
+}
+function isDirectory(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+function lined(text) {
+	return text === "" || text.endsWith("\n") ? text : `${text}\n`;
+}
+/**
+* The step that answers an `input_required` error without its own `next`:
+* the same command line with each missing flag or positional filled by a
+* placeholder the caller replaces.
+*/
+function missingInputNext(argv, error) {
+	const missing = error.extensions["missing"];
+	if (error.code !== "input_required" || !Array.isArray(missing) || !missing.every((item) => typeof item === "string")) return;
+	const filled = missing.flatMap((item) => item.startsWith("--") ? [item, `<${item.slice(2)}>`] : [item]);
+	return [{
+		when: "with the values the user gives",
+		command: [
+			"permdock",
+			...argv.map(quote),
+			...filled
+		].join(" ")
+	}];
+}
+/** The `--flag` tokens before `--`, as typed without a value. */
+function typedFlags(argv) {
+	const end = argv.indexOf("--");
+	return (end === -1 ? argv : argv.slice(0, end)).filter((token) => token.startsWith("--")).map((token) => beforeFirst(token, "="));
+}
+async function run(argv, options) {
+	const stdoutChunks = [];
+	const stderrChunks = [];
+	const io = options?.io ?? {
+		stdout: (text) => {
+			stdoutChunks.push(text);
+		},
+		stderr: (text) => {
+			stderrChunks.push(text);
+		}
+	};
+	const secrets = /* @__PURE__ */ new Set();
+	const writeOut = (text) => {
+		const line = redact(lined(text), secrets);
+		io.stdout(line);
+		if (options?.io !== void 0) stdoutChunks.push(line);
+	};
+	const writeErrRaw = (raw) => {
+		const text = redact(raw, secrets);
+		io.stderr(text);
+		if (options?.io !== void 0) stderrChunks.push(text);
+	};
+	const writeErr = (text) => {
+		writeErrRaw(lined(text));
+	};
+	const done = (code) => ({
+		code,
+		stdout: stdoutChunks.join(""),
+		stderr: stderrChunks.join("")
+	});
+	const first = argv[0];
+	if (argv.length === 1 && (first === "--version" || first === "-v")) {
+		writeOut(cliVersion());
+		return done(0);
+	}
+	const env = io.env ?? process.env;
+	const { globals, rest } = extractGlobals(argv);
+	let agentProblem;
+	let agent = false;
+	try {
+		agent = agentMode(globals.agent, io.env ?? {}, {
+			stdoutIsTty: io.stdoutIsTty === true,
+			exists: existsSync
+		});
+	} catch (error) {
+		if (!(error instanceof CliError)) throw error;
+		agentProblem = error;
+	}
+	const color = io.color === true && globals.color;
+	const errStyle = createStyle(io.errColor === true && globals.color);
+	const plain = (text) => color ? text : stripVTControlCharacters(text);
+	const trace = (message) => {
+		if (globals.debug) writeErr(errStyle.paint("dim", `debug: ${message}`));
+	};
+	const helpWord = rest[0] === "help";
+	const resolved = resolve(helpWord ? rest.slice(1) : rest);
+	const command = resolved.path.join(" ");
+	const askedHelp = globals.help || helpWord;
+	const agentJson = agent && globals.json !== false && !(resolved.kind === "leaf" && resolved.entry.shellOutput === true);
+	const formatOf = () => {
+		const given = globals.format;
+		if (given === void 0) return globals.json === true || agentJson ? "json" : "text";
+		if (given === "text" || given === "json" || given === "github" || given === "sarif") {
+			if (globals.json === true && given !== "json") return cliProblem("usage", `--json and --format ${given} ask for different output; pick one`, command === "" ? void 0 : command, { code: "invalid_value" });
+			return given;
+		}
+		if (resolved.kind === "leaf") {
+			const rename = flagRename(command, "--format");
+			if (rename !== void 0) return cliProblem("usage", renameMessage(command, rename), command, {
+				code: "flag_renamed",
+				extensions: {
+					flag: "--format",
+					replacement: rename.to
+				}
+			});
+		}
+		return cliProblem("usage", `--format '${given}' is not one of text, json, github, sarif.${suggestion(given, [
+			"text",
+			"json",
+			"github",
+			"sarif"
+		])}`, command === "" ? void 0 : command, { code: "invalid_value" });
+	};
+	const formatOrProblem = formatOf();
+	const format = typeof formatOrProblem === "string" ? formatOrProblem : globals.json === true || agentJson ? "json" : "text";
+	const json = format === "json";
+	const helpJson = globals.json === true || globals.format === "json";
+	const emitProblem = (problem, next) => {
+		if (json) writeOut(JSON.stringify(envelope({
+			status: problem.exitCode === 3 ? "action_required" : "error",
+			error: problem,
+			...next === void 0 ? {} : { next }
+		}), null, 2));
+		else {
+			writeErr(problem.detail);
+			for (const step of next ?? []) writeErr(`  ${step.when}: ${step.command}`);
+		}
+		return done(problem.exitCode);
+	};
+	const fail = (error) => {
+		if (globals.debug && error instanceof Error) {
+			writeErr(errStyle.paint("dim", error.stack ?? error.message));
+			if (error.cause !== void 0) writeErr(errStyle.paint("dim", `cause: ${describeError(error.cause)}`));
+		}
+		return emitProblem(problemOf(error, command === "" ? void 0 : command), error instanceof CliError ? error.next ?? (json ? missingInputNext(argv, error) : void 0) : void 0);
+	};
+	if (typeof formatOrProblem !== "string") return emitProblem(formatOrProblem);
+	if (agentProblem !== void 0) return fail(agentProblem);
+	if (resolved.kind === "group") {
+		if (resolved.unknown !== void 0) {
+			const names = resolved.entry.children.filter((child) => child.kind === "group" || child.hidden !== true).map((child) => child.name);
+			const where = command === "" ? "permdock" : `permdock ${command}`;
+			return fail(new CliError("usage", `unknown command '${resolved.unknown}' for ${where}.${suggestion(resolved.unknown, names)} Commands: ${names.join(", ")}.`, { code: "unknown_command" }));
+		}
+		if (askedHelp) {
+			if (helpJson) {
+				writeOut(JSON.stringify(await commandsJson(resolved.path, resolved.entry), null, 2));
+				return done(0);
+			}
+			writeOut(plain(resolved.path.length === 0 ? rootHelp(color) : groupHelp(resolved.path, resolved.entry, color)));
+			return done(0);
+		}
+		return bareGroup(resolved.path, resolved.entry, rest);
+	}
+	if (askedHelp) {
+		const leaf = await resolved.entry.load();
+		if (helpJson) {
+			writeOut(JSON.stringify(leafDocument(resolved.path, resolved.entry, leaf), null, 2));
+			return done(0);
+		}
+		writeOut(plain(leafHelp(resolved.path, resolved.entry, leaf, color)));
+		return done(0);
+	}
+	return runLeaf(resolved.path, resolved.entry, resolved.rest);
+	function bareGroup(path, group, tokens) {
+		const name = path.join(" ");
+		const moved = COMMAND_MOVES.find((move) => move.from === name);
+		if (moved !== void 0 && tokens.some((token) => token.startsWith("-"))) return fail(new CliError("usage", `permdock ${name} needs a command since 0.5.0: permdock ${moved.to}`, {
+			code: "command_moved",
+			extensions: { replacement: `permdock ${moved.to}` }
+		}));
+		const help = path.length === 0 ? rootHelp(false) : groupHelp(path, group, false);
+		if (json) return emitProblem(cliProblem("usage", `permdock${name === "" ? "" : ` ${name}`} needs a command`, name === "" ? void 0 : name, {
+			code: "usage",
+			extensions: { choices: { "<command>": group.children.filter((child) => child.kind === "group" || child.hidden !== true).map((child) => child.name) } }
+		}));
+		writeErr(help);
+		return done(2);
+	}
+	async function runLeaf(path, entry, tokens) {
+		const name = path.join(" ");
+		if ((format === "github" || format === "sarif") && entry.findings !== true) return fail(new CliError("usage", `--format ${format} renders findings, and permdock ${name} reports none; use text or json`, { code: "invalid_value" }));
+		if (globals.cwd === "") return fail(new CliError("usage", "--cwd needs a directory", { code: "invalid_value" }));
+		const cwd = resolveCwd(globals.cwd, options?.cwd ?? process.cwd());
+		if (!isDirectory(cwd)) return fail(new CliError("usage", `--cwd ${cwd} is not a directory`, { code: "invalid_value" }));
+		let leaf;
+		let input;
+		try {
+			leaf = await entry.load();
+		} catch (error) {
+			return fail(error);
+		}
+		const declared = new Set(flagSpellings(leaf.flags));
+		for (const flag of typedFlags(tokens)) {
+			const rename = declared.has(flag) ? void 0 : flagRename(name, flag);
+			if (rename !== void 0) return fail(new CliError("usage", renameMessage(name, rename), {
+				code: "flag_renamed",
+				extensions: {
+					flag,
+					...rename.to === void 0 ? {} : { replacement: rename.to }
+				}
+			}));
+		}
+		try {
+			input = parseLeaf(name, tokens, leaf.flags, leaf.positionals);
+		} catch (error) {
+			return fail(error);
+		}
+		if (agent) {
+			const reasons = consentReasons(entry.effects, input.flags);
+			if (reasons.length > 0) {
+				const replay = [
+					...replayArgv([...path, ...tokens]),
+					...globals.cwd === void 0 ? [] : ["--cwd", globals.cwd],
+					...globals.config === void 0 ? [] : ["--config", globals.config]
+				];
+				const token = consentToken(reasons, replay, cwd);
+				if (globals.confirm !== token) return fail(consentRequired(name, reasons, replay, token));
+			}
+		}
+		trace(`${name}: agent mode ${agent ? "on" : "off"}, ${format} output, cwd ${cwd}`);
+		let loaded = NO_CONFIG;
+		if (entry.config || globals.config !== void 0) {
+			try {
+				loaded = await readConfig(cwd, globals.config);
+			} catch (error) {
+				return fail(error);
+			}
+			trace(loaded.file === void 0 ? "config file: none found" : `config file: ${loaded.file}`);
+			if (name !== "config") for (const warning of loaded.warnings) writeErr(errStyle.paint("yellow", `permdock: warning: ${warning}`));
+		}
+		const signal = io.signal ?? new AbortController().signal;
+		const interactive = io.interactive === true && !json && !globals.yes && !agent && format === "text";
+		const ctx = {
+			command: name,
+			cwd,
+			config: loaded.config,
+			...globals.config === void 0 ? {} : { configFile: globals.config },
+			...loaded.file === void 0 ? {} : { configPath: loaded.file },
+			configWarnings: loaded.warnings,
+			io: {
+				...io,
+				stdout: writeOut,
+				stderr: writeErr
+			},
+			env,
+			now: io.now?.() ?? dateAt(),
+			json,
+			format,
+			color,
+			errStyle,
+			interactive,
+			agent,
+			yes: globals.yes,
+			debug: globals.debug,
+			signal,
+			argv: [...path, ...tokens],
+			addSecret: (value) => {
+				secrets.add(value);
+			},
+			log: writeErr,
+			trace,
+			progress: progressReporter({
+				write: writeErrRaw,
+				tty: io.stderrIsTty === true && !agent,
+				style: errStyle
+			})
+		};
+		let result;
+		try {
+			result = await leaf.run(ctx, input);
+		} catch (error) {
+			return fail(error);
+		}
+		trace(`${name}: exit ${String(result.code)}`);
+		return render(name, result);
+	}
+	function render(name, result) {
+		if (result.streamed === true) return done(result.code);
+		if (format === "github" || format === "sarif") {
+			const findings = result.findings ?? [];
+			writeOut(format === "github" ? githubAnnotations(findings) || "" : sarifLog(name, findings));
+			return done(result.code);
+		}
+		if (json) {
+			const parsed = dataOf(result.output);
+			const data = result.data ?? parsed;
+			if (result.code === 0) {
+				writeOut(JSON.stringify(envelope({
+					status: "success",
+					...data === void 0 ? {} : { data },
+					...result.next === void 0 ? {} : { next: result.next }
+				}), null, 2));
+				return done(0);
+			}
+			const kind = kindOfCode(result.code);
+			const report = result.data !== void 0 || isReport(data) ? data : void 0;
+			const problem = cliProblem(kind, problemDetail(result.output, parsed), name, { exitCode: result.code });
+			writeOut(JSON.stringify(envelope({
+				status: problem.exitCode === 3 ? "action_required" : "error",
+				...report === void 0 ? {} : { data: report },
+				error: problem
+			}), null, 2));
+			return done(result.code);
+		}
+		const text = plain(result.output);
+		if (text !== "") {
+			if (result.code === 0 || result.code === 1) writeOut(text);
+			else writeErr(text);
+		}
+		return done(result.code);
+	}
+}
+/** A JSON report object, as opposed to text wrapped as `{ message }`. */
+function isReport(data) {
+	return typeof data === "object" && data !== null && !(Object.keys(data).length === 1 && "message" in data);
+}
+function problemDetail(output, data) {
+	if (!isReport(data)) return output.trim();
+	if (typeof data === "object" && data !== null) {
+		const detail = Reflect.get(data, "detail");
+		if (typeof detail === "string") return detail;
+	}
+	return "The command reported a problem; see data";
+}
+//#endregion
+export { run as t };