support: migrate support commands to runseal

.runseal/lib/python-module

@@ -0,0 +1,15 @@
+#!/usr/bin/env sh
+set -eu
+
+name=${RUNSEAL_WRAPPER_NAME:?RUNSEAL_WRAPPER_NAME is not set}
+module=$(printf '%s' "$name" | tr '-' '_')
+root=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)
+
+if ! command -v uv >/dev/null 2>&1; then
+  echo "missing dependency: uv" >&2
+  exit 1
+fi
+
+PYTHONPATH="$root/scripts${PYTHONPATH+:$PYTHONPATH}"
+export PYTHONPATH
+exec uv run --project "$root/scripts" python -m "cli.$module" "$@"

.runseal/wrappers/cloudflare

@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+set -eu
+exec "$(dirname -- "$0")/../lib/python-module" "$@"

.runseal/wrappers/pr

@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+set -eu
+exec "$(dirname -- "$0")/../lib/python-module" "$@"

.runseal/wrappers/release

@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+set -eu
+exec "$(dirname -- "$0")/../lib/python-module" "$@"

AGENTS.md

@@ -16,15 +16,15 @@ management.
 - `.github/workflows/` contains CI and release workflows.
 - `.github/scripts/` contains workflow-only helper scripts. Keep workflow-only
   scripts there.
-- `cli.sh` is the repo-local operator entrypoint for support tasks that do not
-  belong in the installable `flavor` product binary. Keep it as a thin command
-  dispatcher, not a second product CLI. Current support commands are
-  `:cloudflare`, `:pr`, and `:release`.
+- `runseal.toml` and `.runseal/wrappers/` are the repo-local operator entrypoints
+  for support tasks that do not belong in the installable `flavor` product
+  binary. Current support commands are `runseal :cloudflare`, `runseal :pr`,
+  and `runseal :release`.
 - `grammars/` contains the repo-visible `.g4` grammar source of truth plus
   `metadata.json` contract metadata. Parser backends, facts, diagnostics, and
   harnesses should align to these files.
 - `scripts/` contains both developer helpers (`scripts/dev/`) and the
-  repo-local uv-managed Python support command tree used by `cli.sh`.
+  repo-local uv-managed Python support command tree used by runseal wrappers.
 - `.local/` is repo-local private operator state (for example Cloudflare
   secrets). It must stay gitignored and must not become a source of truth for
   product behavior.
@@ -87,11 +87,13 @@ cargo clippy --locked --workspace --all-targets -- -D warnings
 cargo test --locked --workspace
 cargo run --locked -p flavor-cli -- check --root . --config flavor.json
 python3 scripts/dev/antlr.py check
+runseal :pr --help
 ```
 
-`python3 scripts/init.py` is the default post-clone command. Use `--force` only
-when intentionally replacing existing non-init hooks; the script backs them up
-first.
+`python3 scripts/init.py` is the default post-clone command. It requires
+`runseal` so repo-local support commands have one entrypoint shape. Use
+`--force` only when intentionally replacing existing non-init hooks; the script
+backs them up first.
 `python3 scripts/dev/antlr.py check` is an optional Dockerized ANTLR validation
 helper. It lazily builds its Docker image when needed, checks `.g4` files under
 `grammars/` in ANTLR dependency mode, and does not generate Java artifacts.

README.md

@@ -192,6 +192,19 @@ cargo run --locked -p flavor-cli -- check --root . --config flavor.json
 python3 scripts/dev/antlr.py check         # optional Dockerized G4 validation
 ```
 
+Repo-local operator commands use runseal wrappers rather than the installable
+`flavor` binary:
+
+```bash
+runseal :cloudflare <command> [args]
+runseal :pr [options]
+runseal :release --channel=stable|beta [options]
+runseal @wrappers
+```
+
+`python3 scripts/init.py` checks that `runseal` is installed before installing
+hooks.
+
 ## Scope
 
 `flavor` does not format, rewrite, run services, manage repositories, or inspect product semantics.

runseal.toml

@@ -0,0 +1,10 @@
+[resources]
+root = ".local"
+
+[[injections]]
+type = "env"
+
+[injections.vars]
+RUNSEAL_REPO_LOCAL_DIR = "resource://"
+RUNSEAL_REPO_SECRETS_DIR = "resource://secrets"
+RUNSEAL_REPO_TMP_DIR = "resource://tmp"

scripts/cli/cloudflare.py

@@ -24,7 +24,7 @@
 
 def usage() -> None:
     print(
-        """Usage: ./cli.sh :cloudflare <command> [args]
+        """Usage: runseal :cloudflare <command> [args]
 
 Commands:
   init                      create repo-local .local/secrets/cloudflare.env template
@@ -138,7 +138,7 @@ def cmd_manage_inspect(args: list[str]) -> int:
 
 
 def cmd_manage_ensure_redirect(args: list[str]) -> int:
-    parser = argparse.ArgumentParser(prog="./cli.sh :cloudflare manage-ensure-redirect", add_help=False)
+    parser = argparse.ArgumentParser(prog="runseal :cloudflare manage-ensure-redirect", add_help=False)
     parser.add_argument("--dry-run", action="store_true")
     parsed = parser.parse_args(args)
 
@@ -187,7 +187,7 @@ def cmd_manage_ensure_redirect(args: list[str]) -> int:
 
 
 def cmd_api(args: list[str]) -> int:
-    parser = argparse.ArgumentParser(prog="./cli.sh :cloudflare api", add_help=False)
+    parser = argparse.ArgumentParser(prog="runseal :cloudflare api", add_help=False)
     parser.add_argument("method")
     parser.add_argument("path")
     parser.add_argument("--query", action="append", default=[])

scripts/cli/pr.py

@@ -10,7 +10,7 @@
 
 def usage() -> None:
     print(
-        """Usage: ./cli.sh :pr [options]
+        """Usage: runseal :pr [options]
 
 Create or update the GitHub PR for the current branch.
 
@@ -97,7 +97,7 @@ def create_pr(branch: str, base: str, title: str | None, body_file: str | None)
 
 
 def cmd_default(args: list[str]) -> int:
-    parser = argparse.ArgumentParser(prog="./cli.sh :pr", add_help=False)
+    parser = argparse.ArgumentParser(prog="runseal :pr", add_help=False)
     parser.add_argument("--base", default="main")
     parser.add_argument("--title")
     parser.add_argument("--body-file")

scripts/cli/release.py

@@ -18,7 +18,7 @@
 
 def usage() -> None:
     print(
-        """Usage: ./cli.sh :release --channel=stable|beta [options]
+        """Usage: runseal :release --channel=stable|beta [options]
 
 Trigger a release workflow.
 
@@ -69,7 +69,7 @@ def latest_run_id(workflow: str, ref: str) -> str:
 
 
 def cmd_default(args: list[str]) -> int:
-    parser = argparse.ArgumentParser(prog="./cli.sh :release", add_help=False)
+    parser = argparse.ArgumentParser(prog="runseal :release", add_help=False)
     parser.add_argument("--channel", choices=sorted(CHANNEL_WORKFLOWS))
     parser.add_argument("--ref", default="main")
     parser.add_argument("--version", default="")

scripts/init.py

@@ -21,6 +21,7 @@
     "git",
     "python3",
     "cargo",
+    "runseal",
     "uv",
     "sh",
     "bash",
@@ -31,10 +32,14 @@
 REQUIRED_PATHS = (
     "Cargo.toml",
     "Cargo.lock",
-    "cli.sh",
     "flavor.json",
     "manage.sh",
     "manage.ps1",
+    "runseal.toml",
+    ".runseal/lib/python-module",
+    ".runseal/wrappers/cloudflare",
+    ".runseal/wrappers/pr",
+    ".runseal/wrappers/release",
     ".github/workflows/guard.yml",
     ".github/scripts/release/r2/publish.sh",
     ".github/scripts/release/smoke/smoke.sh",
@@ -64,7 +69,10 @@
 cargo run --locked -p flavor-cli -- check --root . --config flavor.json
 
 echo "==> shell syntax"
-sh -n cli.sh
+sh -n .runseal/lib/python-module
+sh -n .runseal/wrappers/cloudflare
+sh -n .runseal/wrappers/pr
+sh -n .runseal/wrappers/release
 sh -n manage.sh
 bash -n .github/scripts/release/r2/publish.sh
 sh -n .github/scripts/release/smoke/smoke.sh