voratiq 0.1.0-beta.0

package/dist/auth/providers/gemini.js

@@ -0,0 +1,159 @@
+import { readFile } from "node:fs/promises";
+import { assertSandboxDestination } from "../staging.js";
+import { buildAuthFailedMessage } from "./messages.js";
+import { disposeHandles, registerSandboxSecrets, stageSecretFile, } from "./secret-staging.js";
+import { teardownAuthProvider } from "./teardown.js";
+import { assertReadableFileOrThrow, composeSandboxEnvResult, copyOptionalDirectoryWithPermissions, copyOptionalFileWithPermissions, createSandboxPaths, ensureDirectories, resolveChildPath, } from "./utils.js";
+const GEMINI_PROVIDER_ID = "gemini";
+const GEMINI_LOGIN_HINT = buildAuthFailedMessage("Gemini");
+const GEMINI_REQUIRED_FILES = [
+    "oauth_creds.json",
+    "google_accounts.json",
+    "settings.json",
+    "state.json",
+];
+const GEMINI_OPTIONAL_FILES = ["installation_id", "GEMINI.md"];
+const GEMINI_API_KEY_ENV_VARS = ["GEMINI_API_KEY", "GOOGLE_API_KEY"];
+class GeminiAuthProviderError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "GeminiAuthProviderError";
+    }
+}
+export const geminiAuthProvider = {
+    id: GEMINI_PROVIDER_ID,
+    async verify(options) {
+        const apiKey = resolveGeminiApiKey(options.runtime.env);
+        if (apiKey) {
+            return { status: "ok" };
+        }
+        const homeDir = options.runtime.homeDir;
+        if (!homeDir) {
+            throw new GeminiAuthProviderError(GEMINI_LOGIN_HINT);
+        }
+        const geminiHome = resolveChildPath(homeDir, ".gemini");
+        for (const filename of GEMINI_REQUIRED_FILES) {
+            const target = resolveChildPath(geminiHome, filename);
+            await assertReadableFileOrThrow(target, (cause) => new GeminiAuthProviderError(GEMINI_LOGIN_HINT, { cause }));
+        }
+        const settingsPath = resolveChildPath(geminiHome, "settings.json");
+        await validateSettingsFile(settingsPath);
+        return { status: "ok" };
+    },
+    async stage(options) {
+        const apiKey = resolveGeminiApiKey(options.runtime.env);
+        if (apiKey) {
+            return composeSandboxEnvResult(options.agentRoot, {
+                GEMINI_API_KEY: apiKey,
+                GOOGLE_API_KEY: apiKey,
+            });
+        }
+        const homeDir = options.runtime.homeDir;
+        if (!homeDir) {
+            throw new GeminiAuthProviderError(GEMINI_LOGIN_HINT);
+        }
+        const geminiHome = resolveChildPath(homeDir, ".gemini");
+        for (const filename of GEMINI_REQUIRED_FILES) {
+            const source = resolveChildPath(geminiHome, filename);
+            await assertReadableFileOrThrow(source, (cause) => new GeminiAuthProviderError(GEMINI_LOGIN_HINT, { cause }));
+        }
+        const sandboxPaths = createSandboxPaths(options.agentRoot, {
+            gemini: [".gemini"],
+        });
+        await ensureDirectories([...Object.values(sandboxPaths)]);
+        const secretHandles = await stageRequiredFiles(geminiHome, sandboxPaths.gemini, sandboxPaths.home);
+        try {
+            await stageOptionalFiles(geminiHome, sandboxPaths.gemini, sandboxPaths.home);
+        }
+        catch (error) {
+            await disposeHandles(secretHandles);
+            throw error;
+        }
+        registerSandboxSecrets(sandboxPaths.home, secretHandles);
+        return composeSandboxEnvResult(sandboxPaths.home, {});
+    },
+    async teardown(options) {
+        await teardownAuthProvider(options);
+    },
+};
+function resolveGeminiApiKey(env) {
+    for (const key of GEMINI_API_KEY_ENV_VARS) {
+        const value = env[key];
+        if (typeof value === "string" && value.trim().length > 0) {
+            return value.trim();
+        }
+    }
+    return undefined;
+}
+async function stageRequiredFiles(geminiHome, sandboxGeminiDir, sandboxHome) {
+    const handles = [];
+    try {
+        for (const filename of GEMINI_REQUIRED_FILES) {
+            const source = resolveChildPath(geminiHome, filename);
+            const bytes = await readFile(source);
+            if (filename === "settings.json") {
+                validateSettingsContent(bytes.toString("utf8"));
+            }
+            const destination = resolveChildPath(sandboxGeminiDir, filename);
+            const handle = await stageSecretFile(sandboxHome, {
+                destinationPath: destination,
+                sourceBytes: bytes,
+                providerId: GEMINI_PROVIDER_ID,
+                fileLabel: filename,
+            });
+            handles.push(handle);
+        }
+        return handles;
+    }
+    catch (error) {
+        await disposeHandles(handles);
+        throw error;
+    }
+}
+async function stageOptionalFiles(geminiHome, sandboxGeminiDir, sandboxHome) {
+    for (const filename of GEMINI_OPTIONAL_FILES) {
+        const source = resolveChildPath(geminiHome, filename);
+        const destination = resolveChildPath(sandboxGeminiDir, filename);
+        assertSandboxDestination({
+            sandboxHome,
+            destinationPath: destination,
+            providerId: GEMINI_PROVIDER_ID,
+            fileLabel: filename,
+        });
+        await copyOptionalFileWithPermissions(source, destination, (cause) => {
+            return new GeminiAuthProviderError(GEMINI_LOGIN_HINT, { cause });
+        });
+    }
+    const tmpSource = resolveChildPath(geminiHome, "tmp");
+    const sandboxTmpDestination = resolveChildPath(sandboxGeminiDir, "tmp");
+    assertSandboxDestination({
+        sandboxHome,
+        destinationPath: sandboxTmpDestination,
+        providerId: GEMINI_PROVIDER_ID,
+        fileLabel: "tmp",
+    });
+    await copyOptionalDirectoryWithPermissions(tmpSource, sandboxTmpDestination, (cause) => new GeminiAuthProviderError(GEMINI_LOGIN_HINT, { cause }));
+}
+async function validateSettingsFile(settingsPath) {
+    let raw;
+    try {
+        raw = await readFile(settingsPath, "utf8");
+    }
+    catch (error) {
+        throw new GeminiAuthProviderError(GEMINI_LOGIN_HINT, { cause: error });
+    }
+    validateSettingsContent(raw);
+}
+function validateSettingsContent(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new GeminiAuthProviderError(GEMINI_LOGIN_HINT, { cause: error });
+    }
+    const selectedType = parsed?.security?.auth?.selectedType;
+    if (typeof selectedType !== "string" || selectedType.trim().length === 0) {
+        throw new GeminiAuthProviderError(GEMINI_LOGIN_HINT);
+    }
+}

package/dist/auth/providers/index.d.ts

@@ -0,0 +1,2 @@
+import type { AuthProvider } from "./types.js";
+export declare function resolveAuthProvider(id: string): AuthProvider | undefined;

package/dist/auth/providers/index.js

@@ -0,0 +1,16 @@
+import { claudeAuthProvider } from "./claude.js";
+import { codexAuthProvider } from "./codex.js";
+import { geminiAuthProvider } from "./gemini.js";
+const REGISTRY = new Map();
+registerAuthProvider(claudeAuthProvider);
+registerAuthProvider(codexAuthProvider);
+registerAuthProvider(geminiAuthProvider);
+function registerAuthProvider(provider) {
+    if (REGISTRY.has(provider.id)) {
+        return;
+    }
+    REGISTRY.set(provider.id, provider);
+}
+export function resolveAuthProvider(id) {
+    return REGISTRY.get(id);
+}

package/dist/auth/providers/messages.d.ts

@@ -0,0 +1 @@
+export declare function buildAuthFailedMessage(label: string): string;

package/dist/auth/providers/messages.js

@@ -0,0 +1,3 @@
+export function buildAuthFailedMessage(label) {
+    return `${label} authentication failed. Authenticate directly via ${label} before continuing.`;
+}

package/dist/auth/providers/secret-staging.d.ts

@@ -0,0 +1,14 @@
+export interface SecretHandle {
+    abort(): void;
+    cleanup(): Promise<void>;
+}
+export interface StageSecretFileOptions {
+    destinationPath: string;
+    sourceBytes: Buffer;
+    providerId: string;
+    fileLabel: string;
+}
+export declare function stageSecretFile(sandboxPath: string, options: StageSecretFileOptions): Promise<SecretHandle>;
+export declare function registerSandboxSecrets(sandboxPath: string, handles: SecretHandle[]): void;
+export declare function cleanupSandbox(sandboxPath: string): Promise<void>;
+export declare function disposeHandles(handles: readonly SecretHandle[]): Promise<void>;

package/dist/auth/providers/secret-staging.js

@@ -0,0 +1,72 @@
+import { mkdir } from "node:fs/promises";
+import { dirname } from "node:path";
+import { safeUnlink } from "../../utils/fs.js";
+import { assertSandboxDestination } from "../staging.js";
+import { writeFileWithPermissions } from "./utils.js";
+const SECRET_FILE_MODE = 0o600;
+const sandboxSecretRegistry = new Map();
+export async function stageSecretFile(sandboxPath, options) {
+    assertSandboxDestination({
+        sandboxHome: sandboxPath,
+        destinationPath: options.destinationPath,
+        providerId: options.providerId,
+        fileLabel: options.fileLabel,
+    });
+    await mkdir(dirname(options.destinationPath), { recursive: true });
+    try {
+        await writeFileWithPermissions(options.destinationPath, options.sourceBytes, { mode: SECRET_FILE_MODE, flag: "w" }, SECRET_FILE_MODE);
+    }
+    catch (error) {
+        throw new Error(`Failed to stage secret file for ${options.providerId}:${options.fileLabel} at ${options.destinationPath}.`, { cause: error });
+    }
+    return new SecretFileHandle(options.destinationPath);
+}
+export function registerSandboxSecrets(sandboxPath, handles) {
+    if (handles.length === 0) {
+        return;
+    }
+    sandboxSecretRegistry.set(sandboxPath, handles);
+}
+export async function cleanupSandbox(sandboxPath) {
+    const handles = sandboxSecretRegistry.get(sandboxPath);
+    if (!handles) {
+        return;
+    }
+    sandboxSecretRegistry.delete(sandboxPath);
+    await disposeHandles(handles);
+}
+export async function disposeHandles(handles) {
+    const uniqueHandles = [...new Set(handles)];
+    const errors = [];
+    for (const handle of uniqueHandles) {
+        try {
+            handle.abort();
+        }
+        catch (error) {
+            errors.push(error);
+        }
+    }
+    for (const handle of uniqueHandles) {
+        try {
+            await handle.cleanup();
+        }
+        catch (error) {
+            errors.push(error);
+        }
+    }
+    if (errors.length > 0) {
+        throw errors[0];
+    }
+}
+class SecretFileHandle {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    abort() {
+        // No-op for regular files
+    }
+    async cleanup() {
+        await safeUnlink(this.path);
+    }
+}

package/dist/auth/providers/teardown.d.ts

@@ -0,0 +1,2 @@
+import type { TeardownOptions } from "./types.js";
+export declare function teardownAuthProvider(options: TeardownOptions): Promise<void>;

package/dist/auth/providers/teardown.js

@@ -0,0 +1,6 @@
+import { cleanupSandbox } from "./secret-staging.js";
+import { teardownSandbox } from "./utils.js";
+export async function teardownAuthProvider(options) {
+    await cleanupSandbox(options.sandboxPath);
+    await teardownSandbox(options);
+}

package/dist/auth/providers/types.d.ts

@@ -0,0 +1,31 @@
+export interface AuthRuntimeContext {
+    platform: NodeJS.Platform;
+    env: NodeJS.ProcessEnv;
+    homeDir: string;
+    username: string;
+}
+export interface VerifyOptions {
+    agentId: string;
+    runtime: AuthRuntimeContext;
+}
+export interface VerifyResult {
+    status: "ok";
+}
+export interface StageOptions extends VerifyOptions {
+    agentRoot: string;
+    runId?: string;
+    root?: string;
+}
+export interface StageResult {
+    sandboxPath: string;
+    env: Record<string, string>;
+}
+export interface TeardownOptions {
+    sandboxPath: string;
+}
+export interface AuthProvider {
+    readonly id: string;
+    verify(options: VerifyOptions): Promise<VerifyResult>;
+    stage(options: StageOptions): Promise<StageResult>;
+    teardown?(options: TeardownOptions): Promise<void>;
+}

package/dist/auth/providers/types.js

@@ -0,0 +1 @@
+export {};

package/dist/auth/providers/utils.d.ts

@@ -0,0 +1,20 @@
+import { writeFile } from "node:fs/promises";
+import { isMissing } from "../../utils/fs.js";
+import type { AuthRuntimeContext, StageResult, TeardownOptions } from "./types.js";
+export declare function resolveProviderHome(runtime: AuthRuntimeContext, envVar: string, defaultSubdir: string): string | undefined;
+export declare function resolveChildPath(root: string, ...segments: string[]): string;
+export interface SandboxPaths extends Record<string, string> {
+    home: string;
+}
+export type SandboxLayout = Record<string, readonly string[]>;
+export { isMissing };
+export declare function createSandboxPaths(agentRoot: string, layout: SandboxLayout): SandboxPaths;
+export declare function ensureDirectories(directories: readonly string[]): Promise<void>;
+export type ErrorFactory = (cause?: unknown) => Error;
+export declare function assertReadableFileOrThrow(path: string, createError: ErrorFactory): Promise<void>;
+export declare function copyFileWithPermissions(source: string, destination: string, mode?: number): Promise<void>;
+export declare function writeFileWithPermissions(destination: string, data: string | NodeJS.ArrayBufferView, options?: Parameters<typeof writeFile>[2], mode?: number): Promise<void>;
+export declare function copyOptionalFileWithPermissions(source: string, destination: string, createError?: ErrorFactory): Promise<void>;
+export declare function copyOptionalDirectoryWithPermissions(source: string, destination: string, createError?: ErrorFactory, fileMode?: number, dirMode?: number): Promise<void>;
+export declare function composeSandboxEnvResult(sandboxPath: string, env: Record<string, string>): StageResult;
+export declare function teardownSandbox({ sandboxPath, }: TeardownOptions): Promise<void>;

package/dist/auth/providers/utils.js

@@ -0,0 +1,148 @@
+import { constants as fsConstants } from "node:fs";
+import { access, chmod, copyFile, mkdir, readdir, rm, stat, writeFile, } from "node:fs/promises";
+import { isAbsolute, resolve as resolveNative } from "node:path";
+import { isMissing } from "../../utils/fs.js";
+import { SANDBOX_DIRNAME } from "../../workspace/structure.js";
+const STAGED_FILE_MODE = 0o600;
+export function resolveProviderHome(runtime, envVar, defaultSubdir) {
+    const configured = runtime.env[envVar]?.trim();
+    if (configured) {
+        if (isAbsolute(configured)) {
+            return configured;
+        }
+        const base = runtime.homeDir ?? process.cwd();
+        return resolveNative(base, configured);
+    }
+    if (runtime.homeDir) {
+        return resolveNative(runtime.homeDir, defaultSubdir);
+    }
+    return undefined;
+}
+export function resolveChildPath(root, ...segments) {
+    return resolveNative(root, ...segments);
+}
+export { isMissing };
+export function createSandboxPaths(agentRoot, layout) {
+    const home = resolveChildPath(agentRoot, SANDBOX_DIRNAME);
+    const paths = { home };
+    for (const [name, segments] of Object.entries(layout)) {
+        paths[name] = resolveChildPath(home, ...segments);
+    }
+    return paths;
+}
+export async function ensureDirectories(directories) {
+    const unique = [...new Set(directories)];
+    await Promise.all(unique.map(async (directory) => {
+        await mkdir(directory, { recursive: true });
+    }));
+}
+const { F_OK } = fsConstants;
+export async function assertReadableFileOrThrow(path, createError) {
+    try {
+        const stats = await stat(path);
+        if (!stats.isFile()) {
+            throw createError();
+        }
+        await access(path, F_OK);
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            throw createError(error);
+        }
+        throw createError(error);
+    }
+}
+export async function copyFileWithPermissions(source, destination, mode = STAGED_FILE_MODE) {
+    await copyFile(source, destination);
+    await chmod(destination, mode);
+}
+export async function writeFileWithPermissions(destination, data, options = { encoding: "utf8" }, mode = STAGED_FILE_MODE) {
+    await writeFile(destination, data, options);
+    await chmod(destination, mode);
+}
+export async function copyOptionalFileWithPermissions(source, destination, createError) {
+    try {
+        await access(source, F_OK);
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            return;
+        }
+        if (createError) {
+            throw createError(error);
+        }
+        throw error;
+    }
+    try {
+        await copyFileWithPermissions(source, destination);
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            return;
+        }
+        if (createError) {
+            throw createError(error);
+        }
+        throw error;
+    }
+}
+export async function copyOptionalDirectoryWithPermissions(source, destination, createError, fileMode = STAGED_FILE_MODE, dirMode = 0o700) {
+    try {
+        const sourceStats = await stat(source);
+        if (!sourceStats.isDirectory()) {
+            if (createError) {
+                throw createError();
+            }
+            return;
+        }
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            return;
+        }
+        if (createError) {
+            throw createError(error);
+        }
+        throw error;
+    }
+    try {
+        await copyDirectoryRecursive(source, destination, fileMode, dirMode);
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            return;
+        }
+        if (createError) {
+            throw createError(error);
+        }
+        throw error;
+    }
+}
+async function copyDirectoryRecursive(source, destination, fileMode, dirMode) {
+    await mkdir(destination, { recursive: true, mode: dirMode });
+    await chmod(destination, dirMode).catch(() => { });
+    const entries = await readdir(source, { withFileTypes: true });
+    for (const entry of entries) {
+        const sourcePath = resolveChildPath(source, entry.name);
+        const destinationPath = resolveChildPath(destination, entry.name);
+        if (entry.isDirectory()) {
+            await copyDirectoryRecursive(sourcePath, destinationPath, fileMode, dirMode);
+            continue;
+        }
+        if (entry.isFile()) {
+            await copyFileWithPermissions(sourcePath, destinationPath, fileMode);
+        }
+    }
+}
+export function composeSandboxEnvResult(sandboxPath, env) {
+    return {
+        sandboxPath,
+        env: {
+            HOME: sandboxPath,
+            ...env,
+        },
+    };
+}
+export async function teardownSandbox({ sandboxPath, }) {
+    await rm(sandboxPath, { recursive: true, force: true });
+}

package/dist/auth/runtime.d.ts

@@ -0,0 +1,2 @@
+import type { AuthRuntimeContext } from "./providers/types.js";
+export declare function buildAuthRuntimeContext(): AuthRuntimeContext;

package/dist/auth/runtime.js

@@ -0,0 +1,17 @@
+import { homedir, userInfo } from "node:os";
+function resolveHomeDir() {
+    const envHome = process.env.HOME;
+    if (envHome && envHome.trim().length > 0) {
+        return envHome;
+    }
+    return homedir();
+}
+export function buildAuthRuntimeContext() {
+    const { username } = userInfo();
+    return {
+        platform: process.platform,
+        env: process.env,
+        homeDir: resolveHomeDir(),
+        username,
+    };
+}

package/dist/auth/staging.d.ts

@@ -0,0 +1,8 @@
+interface SandboxAssertionOptions {
+    sandboxHome: string;
+    destinationPath: string;
+    providerId: string;
+    fileLabel: string;
+}
+export declare function assertSandboxDestination(options: SandboxAssertionOptions): void;
+export {};

package/dist/auth/staging.js

@@ -0,0 +1,7 @@
+import { assertPathWithinRoot } from "../utils/path.js";
+export function assertSandboxDestination(options) {
+    const { sandboxHome, destinationPath, providerId, fileLabel } = options;
+    assertPathWithinRoot(sandboxHome, destinationPath, {
+        message: `Secret staging for ${providerId}:${fileLabel} must target the sandbox home (${sandboxHome}). Received ${destinationPath}.`,
+    });
+}

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function runCli(argv?: readonly string[]): Promise<void>;

package/dist/bin.js

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+import { realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { Command, CommanderError } from "commander";
+import { createApplyCommand } from "./cli/apply.js";
+import { commanderAlreadyRendered } from "./cli/commander-utils.js";
+import { CliError, toCliError } from "./cli/errors.js";
+import { createInitCommand } from "./cli/init.js";
+import { createListCommand } from "./cli/list.js";
+import { writeCommandOutput } from "./cli/output.js";
+import { createPruneCommand } from "./cli/prune.js";
+import { createReviewCommand } from "./cli/review.js";
+import { createRunCommand } from "./cli/run.js";
+import { terminateActiveRun } from "./commands/run/lifecycle.js";
+import { flushAllRunRecordBuffers } from "./records/persistence.js";
+import { renderCliError } from "./render/utils/errors.js";
+import { toErrorMessage } from "./utils/errors.js";
+import { getVoratiqVersion } from "./utils/version.js";
+const SIGNAL_EXIT_CODES = {
+    SIGINT: 130,
+    SIGTERM: 143,
+};
+function installProcessGuards() {
+    process.once("SIGINT", () => {
+        void handleSignal("SIGINT");
+    });
+    process.once("SIGTERM", () => {
+        void handleSignal("SIGTERM");
+    });
+    process.on("uncaughtException", (error) => {
+        void terminateActiveRun("failed")
+            .catch((teardownError) => {
+            console.error(`[voratiq] Failed to teardown run after uncaught exception: ${toErrorMessage(teardownError)}`);
+        })
+            .finally(async () => {
+            await flushPendingHistory();
+            console.error(error);
+            process.exit(1);
+        });
+    });
+    process.on("unhandledRejection", (reason) => {
+        void terminateActiveRun("failed")
+            .catch((teardownError) => {
+            console.error(`[voratiq] Failed to teardown run after unhandled rejection: ${toErrorMessage(teardownError)}`);
+        })
+            .finally(async () => {
+            await flushPendingHistory();
+            console.error(reason);
+            process.exit(1);
+        });
+    });
+}
+async function handleSignal(signal) {
+    const exitCode = SIGNAL_EXIT_CODES[signal] ?? 1;
+    try {
+        await terminateActiveRun("aborted");
+    }
+    catch (error) {
+        console.error(`[voratiq] Failed to teardown run after ${signal}: ${toErrorMessage(error)}`);
+        await flushPendingHistory();
+        process.exit(1);
+        return;
+    }
+    await flushPendingHistory();
+    process.exit(exitCode);
+}
+async function flushPendingHistory() {
+    try {
+        await flushAllRunRecordBuffers();
+    }
+    catch (error) {
+        console.warn(`[voratiq] Failed to flush run history buffers: ${error.message}`);
+    }
+}
+installProcessGuards();
+export async function runCli(argv = process.argv) {
+    const program = new Command();
+    program
+        .name("voratiq")
+        .description("Voratiq CLI")
+        .version(getVoratiqVersion(), "-v, --version", "print the Voratiq version")
+        .exitOverride()
+        .showHelpAfterError();
+    program.addCommand(createInitCommand());
+    program.addCommand(createListCommand());
+    program.addCommand(createRunCommand());
+    program.addCommand(createReviewCommand());
+    program.addCommand(createApplyCommand());
+    program.addCommand(createPruneCommand());
+    if (argv.length <= 2) {
+        writeCommandOutput({ body: program.helpInformation() });
+        return;
+    }
+    try {
+        await program.parseAsync(argv);
+    }
+    catch (error) {
+        if (error instanceof CommanderError) {
+            if (commanderAlreadyRendered(error)) {
+                process.exitCode = error.exitCode ?? 0;
+                return;
+            }
+            writeCommandOutput({
+                body: renderCliError(new CliError(toErrorMessage(error))),
+                exitCode: error.exitCode ?? 1,
+            });
+            return;
+        }
+        const cliError = toCliError(error);
+        const body = renderCliError(cliError);
+        writeCommandOutput({
+            body,
+            exitCode: 1,
+        });
+    }
+}
+function shouldAutorun() {
+    if (process.env.VORATIQ_CLI_SKIP_AUTORUN === "1") {
+        return false;
+    }
+    const modulePath = safeRealpath(fileURLToPath(import.meta.url));
+    const invokedPath = process.argv[1] !== undefined
+        ? safeRealpath(resolve(process.argv[1]))
+        : undefined;
+    if (!invokedPath) {
+        return true;
+    }
+    return modulePath === invokedPath;
+}
+function safeRealpath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+if (shouldAutorun()) {
+    void runCli();
+}