@a5c-ai/genty-runtime 5.1.1-staging.0ad6ac75ae4a

package/dist/execution/policy.js

@@ -0,0 +1,121 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExecutionEnvironment = resolveExecutionEnvironment;
+exports.validateFilesystemPolicy = validateFilesystemPolicy;
+exports.validateFilesystemMounts = validateFilesystemMounts;
+exports.validateLocalExecutionPolicy = validateLocalExecutionPolicy;
+exports.normalizeResourceLimits = normalizeResourceLimits;
+exports.admitExecutionPolicy = admitExecutionPolicy;
+exports.shouldInheritParentEnv = shouldInheritParentEnv;
+const node_path_1 = __importDefault(require("node:path"));
+function resolveExecutionEnvironment(explicitEnv, policy, parentEnv = process.env) {
+    const env = {};
+    const environment = policy?.environment;
+    if (environment?.inheritParentEnv) {
+        for (const [key, value] of Object.entries(parentEnv)) {
+            if (value !== undefined) {
+                env[key] = value;
+            }
+        }
+    }
+    for (const key of environment?.allow ?? []) {
+        const value = parentEnv[key];
+        if (value !== undefined) {
+            env[key] = value;
+        }
+    }
+    Object.assign(env, explicitEnv ?? {}, environment?.values ?? {});
+    for (const key of environment?.deny ?? []) {
+        delete env[key];
+    }
+    return env;
+}
+function validateFilesystemPolicy(cwd, policy) {
+    const filesystem = policy?.filesystem;
+    if (!filesystem?.allowedRoots?.length) {
+        return;
+    }
+    const resolvedCwd = node_path_1.default.resolve(cwd);
+    validatePathAgainstRoots(resolvedCwd, filesystem.allowedRoots, `Execution cwd "${cwd}"`);
+    validateFilesystemMounts(policy);
+}
+function validateFilesystemMounts(policy) {
+    const filesystem = policy?.filesystem;
+    if (!filesystem?.allowedRoots?.length) {
+        return;
+    }
+    for (const mount of filesystem.mounts ?? []) {
+        validatePathAgainstRoots(node_path_1.default.resolve(mount.hostPath), filesystem.allowedRoots, `Execution mount "${mount.hostPath}"`);
+    }
+}
+function validatePathAgainstRoots(candidate, roots, label) {
+    const resolvedCandidate = node_path_1.default.resolve(candidate);
+    const allowedRoots = roots.map((root) => node_path_1.default.resolve(root));
+    if (!allowedRoots.some((root) => isPathInside(resolvedCandidate, root))) {
+        throw new Error(`${label} is outside the configured filesystem allowed roots`);
+    }
+}
+function validateLocalExecutionPolicy(config) {
+    const policy = config.policy;
+    validateFilesystemPolicy(config.cwd, policy);
+    if (!policy) {
+        return;
+    }
+    const allowUnsupported = policy.sandbox?.allowUnsupportedLocal === true;
+    const requestedSandbox = policy.sandbox?.requireNamespaces ||
+        policy.sandbox?.requireChroot ||
+        policy.sandbox?.requireSeccomp ||
+        policy.sandbox?.requireCapabilitiesDrop;
+    if (requestedSandbox && !allowUnsupported) {
+        throw new Error("Local executor cannot enforce sandbox guarantees such as namespaces, chroot, seccomp, or capabilities");
+    }
+    if (policy.network && !allowUnsupported) {
+        throw new Error("Local executor cannot enforce network policy; use Docker/Kubernetes or allowUnsupportedLocal explicitly");
+    }
+    const unsupportedResourceRequests = [];
+    if (policy.resources?.cpuCount !== undefined)
+        unsupportedResourceRequests.push("cpu");
+    if (policy.resources?.memoryBytes !== undefined)
+        unsupportedResourceRequests.push("memory");
+    if (policy.resources?.pidsLimit !== undefined)
+        unsupportedResourceRequests.push("pids");
+    if (policy.resources?.openFilesLimit !== undefined)
+        unsupportedResourceRequests.push("openFiles");
+    if (unsupportedResourceRequests.length > 0 && !allowUnsupported) {
+        throw new Error(`Local executor cannot enforce OS resource limits: ${unsupportedResourceRequests.join(", ")}`);
+    }
+}
+function normalizeResourceLimits(policy) {
+    const resources = policy?.resources;
+    return {
+        cpuCount: resources?.cpuCount,
+        memoryBytes: resources?.memoryBytes,
+        pidsLimit: resources?.pidsLimit,
+        openFilesLimit: resources?.openFilesLimit,
+        timeoutMs: resources?.timeoutMs,
+        maxOutputBytes: resources?.maxOutputBytes,
+    };
+}
+function admitExecutionPolicy(policy) {
+    const osLimits = normalizeResourceLimits(policy);
+    const unsupported = [];
+    if (osLimits.openFilesLimit !== undefined) {
+        unsupported.push("openFilesLimit");
+    }
+    return {
+        accepted: unsupported.length === 0,
+        osLimits,
+        unsupported,
+        warnings: unsupported.map((name) => `${name} is tracked as policy metadata but is not enforced by ResourceManagerImpl`),
+    };
+}
+function shouldInheritParentEnv(policy) {
+    return policy?.environment?.inheritParentEnv === true;
+}
+function isPathInside(candidate, root) {
+    const relative = node_path_1.default.relative(root, candidate);
+    return relative === "" || (!relative.startsWith("..") && !node_path_1.default.isAbsolute(relative));
+}

package/dist/execution/provider.d.ts

@@ -0,0 +1,32 @@
+/**
+ * ExecutionProviderImpl — dispatches spawn/attach/list/destroy calls to
+ * mode-specific executors registered at construction time.
+ *
+ * Usage:
+ *
+ * ```ts
+ * const provider = new ExecutionProviderImpl(
+ *   new Map([
+ *     ["local",      localExecutor],
+ *     ["docker",     dockerExecutor],
+ *     ["ssh",        sshExecutor],
+ *     ["kubernetes", k8sExecutor],
+ *   ]),
+ * );
+ * ```
+ */
+import type { ExecutionConfig, ExecutionHandle, ExecutionMode, ExecutionProvider } from "./types";
+import type { Executor } from "./modes/local";
+export declare class ExecutionProviderImpl implements ExecutionProvider {
+    /** Registered mode executors. */
+    private readonly executors;
+    /** Global index: handleId -> mode, so attach/destroy can route correctly. */
+    private readonly handleIndex;
+    constructor(executors: Map<ExecutionMode, Executor<unknown>>);
+    spawn(config: ExecutionConfig): Promise<ExecutionHandle>;
+    attach(id: string): Promise<ExecutionHandle | undefined>;
+    list(): Promise<ExecutionHandle[]>;
+    destroy(id: string): Promise<void>;
+    private _executorFor;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/execution/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/execution/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EAClB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAM9C,qBAAa,qBAAsB,YAAW,iBAAiB;IAC7D,iCAAiC;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsC;IAChE,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;gBAEpD,SAAS,EAAE,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAQtD,KAAK,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAaxD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAexD,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IASlC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxC,OAAO,CAAC,YAAY;CAOrB"}

package/dist/execution/provider.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * ExecutionProviderImpl — dispatches spawn/attach/list/destroy calls to
+ * mode-specific executors registered at construction time.
+ *
+ * Usage:
+ *
+ * ```ts
+ * const provider = new ExecutionProviderImpl(
+ *   new Map([
+ *     ["local",      localExecutor],
+ *     ["docker",     dockerExecutor],
+ *     ["ssh",        sshExecutor],
+ *     ["kubernetes", k8sExecutor],
+ *   ]),
+ * );
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExecutionProviderImpl = void 0;
+// ---------------------------------------------------------------------------
+// ExecutionProviderImpl
+// ---------------------------------------------------------------------------
+class ExecutionProviderImpl {
+    /** Registered mode executors. */
+    executors;
+    /** Global index: handleId -> mode, so attach/destroy can route correctly. */
+    handleIndex = new Map();
+    constructor(executors) {
+        // Cast once at the boundary — internally we dispatch with the correct
+        // config type per mode so this is type-safe in practice.
+        this.executors = executors;
+    }
+    // ---------- ExecutionProvider interface ------------------------------------
+    async spawn(config) {
+        const executor = this._executorFor(config.mode);
+        // Each executor.spawn() takes (command, args, config). The provider
+        // layer doesn't know the command/args — those are part of the config
+        // at a higher level. For the provider's spawn() we pass a default
+        // shell invocation and forward the mode-specific config.
+        const handle = await executor.spawn("sh", ["-c", "true"], config);
+        this.handleIndex.set(handle.id, config.mode);
+        return handle;
+    }
+    async attach(id) {
+        const mode = this.handleIndex.get(id);
+        if (!mode) {
+            // Try all executors — the handle may predate this provider instance.
+            for (const executor of this.executors.values()) {
+                const handle = await executor.attach(id);
+                if (handle)
+                    return handle;
+            }
+            return undefined;
+        }
+        const executor = this.executors.get(mode);
+        return executor?.attach(id);
+    }
+    async list() {
+        const all = [];
+        for (const executor of this.executors.values()) {
+            const handles = executor.list();
+            all.push(...handles);
+        }
+        return all;
+    }
+    async destroy(id) {
+        const mode = this.handleIndex.get(id);
+        if (!mode) {
+            // Attempt all executors — best effort.
+            for (const executor of this.executors.values()) {
+                await executor.destroy(id);
+            }
+            this.handleIndex.delete(id);
+            return;
+        }
+        const executor = this.executors.get(mode);
+        await executor?.destroy(id);
+        this.handleIndex.delete(id);
+    }
+    // ---------- Helpers -------------------------------------------------------
+    _executorFor(mode) {
+        const executor = this.executors.get(mode);
+        if (!executor) {
+            throw new Error(`No executor registered for execution mode "${mode}"`);
+        }
+        return executor;
+    }
+}
+exports.ExecutionProviderImpl = ExecutionProviderImpl;

package/dist/execution/types.d.ts

@@ -0,0 +1,189 @@
+/**
+ * Execution mode abstraction for Babysitter Agent Runtime.
+ *
+ * Defines how effects and sub-agents are spawned — locally, in Docker,
+ * over SSH, or on Kubernetes. Interface-only stubs; implementations
+ * will follow in issue #217.
+ */
+/** Supported execution environments. */
+export type ExecutionMode = "local" | "docker" | "ssh" | "kubernetes";
+export interface ExecutionEnvironmentPolicy {
+    readonly inheritParentEnv?: boolean;
+    readonly allow?: string[];
+    readonly values?: Record<string, string>;
+    readonly deny?: string[];
+    readonly redact?: string[];
+}
+export interface ExecutionMount {
+    readonly hostPath: string;
+    readonly containerPath: string;
+    readonly readOnly?: boolean;
+}
+export interface ExecutionFilesystemPolicy {
+    readonly allowedRoots?: string[];
+    readonly mounts?: ExecutionMount[];
+    readonly readOnlyRootFilesystem?: boolean;
+}
+export interface ExecutionNetworkPolicy {
+    readonly mode?: "none" | "bridge" | "host" | "custom";
+    readonly name?: string;
+    readonly dns?: string[];
+    readonly allowEgress?: string[];
+    readonly blockEgress?: string[];
+}
+export interface ExecutionResourcePolicy {
+    readonly cpuCount?: number;
+    readonly memoryBytes?: number;
+    readonly pidsLimit?: number;
+    readonly openFilesLimit?: number;
+    readonly timeoutMs?: number;
+    readonly maxOutputBytes?: number;
+}
+export type NormalizedResourceLimits = ExecutionResourcePolicy;
+export interface ExecutionSandboxPolicy {
+    readonly requireNamespaces?: boolean;
+    readonly requireChroot?: boolean;
+    readonly requireSeccomp?: boolean;
+    readonly requireCapabilitiesDrop?: boolean;
+    readonly allowUnsupportedLocal?: boolean;
+}
+export interface DockerPolicy {
+    readonly readOnlyRootFilesystem?: boolean;
+    readonly user?: string;
+    readonly capDrop?: string[];
+    readonly securityOpt?: string[];
+    readonly skipPreflight?: boolean;
+    readonly insecureAllowPrivilegedOptions?: boolean;
+}
+export interface SshHostKeyPolicy {
+    readonly strictHostKeyChecking?: "yes" | "accept-new";
+    readonly knownHostsFile?: string;
+    readonly insecureSkipHostKeyChecking?: boolean;
+}
+export interface KubernetesPolicy {
+    readonly runAsNonRoot?: boolean;
+    readonly readOnlyRootFilesystem?: boolean;
+    readonly allowPrivilegeEscalation?: boolean;
+}
+export interface ExecutionPolicy {
+    readonly environment?: ExecutionEnvironmentPolicy;
+    readonly filesystem?: ExecutionFilesystemPolicy;
+    readonly network?: ExecutionNetworkPolicy;
+    readonly resources?: ExecutionResourcePolicy;
+    readonly sandbox?: ExecutionSandboxPolicy;
+    readonly docker?: DockerPolicy;
+    readonly ssh?: SshHostKeyPolicy;
+    readonly kubernetes?: KubernetesPolicy;
+}
+/** Configuration for local (host-process) execution. */
+export interface LocalExecutionConfig {
+    readonly mode: "local";
+    /** Working directory for spawned processes. */
+    readonly cwd: string;
+    /** Optional environment variable overrides. */
+    readonly env?: Record<string, string>;
+    /** Shared execution policy. Secure defaults apply when omitted. */
+    readonly policy?: ExecutionPolicy;
+}
+/** Configuration for Docker-based execution. */
+export interface DockerExecutionConfig {
+    readonly mode: "docker";
+    /** Container image reference (e.g. "node:20-slim"). */
+    readonly image: string;
+    /** Volume mounts in "host:container" format. */
+    readonly volumes?: string[];
+    /** Docker network to attach to. */
+    readonly network?: string;
+    /** Optional environment variable overrides. */
+    readonly env?: Record<string, string>;
+    /** Shared execution policy. Secure defaults apply when omitted. */
+    readonly policy?: ExecutionPolicy;
+}
+/** Configuration for SSH-based remote execution. */
+export interface SshExecutionConfig {
+    readonly mode: "ssh";
+    /** Remote hostname or IP address. */
+    readonly host: string;
+    /** SSH port; defaults to 22. */
+    readonly port?: number;
+    /** Remote user. */
+    readonly user: string;
+    /** Path to the private key file. */
+    readonly keyPath?: string;
+    /** Optional environment variable overrides. */
+    readonly env?: Record<string, string>;
+    /** Shared execution policy. Secure defaults apply when omitted. */
+    readonly policy?: ExecutionPolicy;
+}
+/** Configuration for Kubernetes pod-based execution. */
+export interface KubernetesExecutionConfig {
+    readonly mode: "kubernetes";
+    /** Kubernetes namespace. */
+    readonly namespace: string;
+    /** Container image reference. */
+    readonly image: string;
+    /** Optional environment variable overrides. */
+    readonly env?: Record<string, string>;
+    /** Service account to run under. */
+    readonly serviceAccount?: string;
+    /** Resource requests/limits (e.g. `{ cpu: "500m", memory: "256Mi" }`). */
+    readonly resources?: Record<string, string>;
+    /** Shared execution policy. Secure defaults apply when omitted. */
+    readonly policy?: ExecutionPolicy;
+    /** Maximum time to wait for Job completion. Defaults to 5 minutes. */
+    readonly timeoutMs?: number;
+    /** Maximum time for each kubectl invocation. */
+    readonly kubectlTimeoutMs?: number;
+    /** Delete the Job after terminal success, failure, or timeout. */
+    readonly cleanupAfterCompletion?: boolean;
+}
+/**
+ * Discriminated union of all execution config types.
+ * Discriminant field is `mode`.
+ */
+export type ExecutionConfig = LocalExecutionConfig | DockerExecutionConfig | SshExecutionConfig | KubernetesExecutionConfig;
+/** Handle to a running or completed execution. */
+export interface ExecutionHandle {
+    /** Unique identifier for this execution instance. */
+    readonly id: string;
+    /** The execution mode this handle was spawned with. */
+    readonly mode: ExecutionMode;
+    /** Current lifecycle status. */
+    readonly status: "running" | "stopped" | "failed";
+    /**
+     * Attach to the execution's I/O streams (e.g. for log tailing).
+     */
+    attach(): Promise<void>;
+    /**
+     * Tear down the execution and release its resources.
+     */
+    destroy(): Promise<void>;
+}
+/** Abstraction over an execution backend. */
+export interface ExecutionProvider {
+    /**
+     * Spawn a new execution from the given config.
+     *
+     * @param config - Discriminated execution configuration.
+     * @returns A handle to the running execution.
+     */
+    spawn(config: ExecutionConfig): Promise<ExecutionHandle>;
+    /**
+     * Re-attach to a previously spawned execution.
+     *
+     * @param id - Execution identifier returned by a prior `spawn`.
+     * @returns The handle, or undefined if not found.
+     */
+    attach(id: string): Promise<ExecutionHandle | undefined>;
+    /**
+     * List all known execution handles managed by this provider.
+     */
+    list(): Promise<ExecutionHandle[]>;
+    /**
+     * Destroy an execution by ID.
+     *
+     * @param id - Execution identifier.
+     */
+    destroy(id: string): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/execution/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/execution/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,wCAAwC;AACxC,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,YAAY,CAAC;AAMtE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAE/D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;CACnD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,GAAG,YAAY,CAAC;IACtD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CAC7C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CACxC;AAMD,wDAAwD;AACxD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,mCAAmC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,wDAAwD;AACxD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oCAAoC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,kEAAkE;IAClE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,qBAAqB,GACrB,kBAAkB,GAClB,yBAAyB,CAAC;AAM9B,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAMD,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,KAAK,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAEzD;;OAEG;IACH,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC"}

package/dist/execution/types.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Execution mode abstraction for Babysitter Agent Runtime.
+ *
+ * Defines how effects and sub-agents are spawned — locally, in Docker,
+ * over SSH, or on Kubernetes. Interface-only stubs; implementations
+ * will follow in issue #217.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { BackgroundProcessRegistry, type BackgroundTaskRecord, type BackgroundCompletionEvent, type SpawnOptions, } from "./backgroundProcessRegistry";
+export { getBackgroundRegistry, disposeBackgroundRegistry, } from "./background/state";
+export { buildShellInvocation, type ShellInvocation, } from "./shellInvocation";
+export { ok, fail, type ApiResult } from "./apiResult";
+export * from "./daemon";
+export * from "./session";
+export * from "./cost";
+export * from "./observability";
+export * from "./telemetry";
+export * from "./execution";
+export * from "./resources";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,oBAAoB,EACpB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAGvD,cAAc,UAAU,CAAC;AAGzB,cAAc,WAAW,CAAC;AAG1B,cAAc,QAAQ,CAAC;AAGvB,cAAc,iBAAiB,CAAC;AAGhC,cAAc,aAAa,CAAC;AAG5B,cAAc,aAAa,CAAC;AAG5B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,44 @@
+"use strict";
+// L5 Agent-Runtime layer exports
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fail = exports.ok = exports.buildShellInvocation = exports.disposeBackgroundRegistry = exports.getBackgroundRegistry = exports.BackgroundProcessRegistry = void 0;
+// Background process management (moved from agent-core)
+var backgroundProcessRegistry_1 = require("./backgroundProcessRegistry");
+Object.defineProperty(exports, "BackgroundProcessRegistry", { enumerable: true, get: function () { return backgroundProcessRegistry_1.BackgroundProcessRegistry; } });
+var state_1 = require("./background/state");
+Object.defineProperty(exports, "getBackgroundRegistry", { enumerable: true, get: function () { return state_1.getBackgroundRegistry; } });
+Object.defineProperty(exports, "disposeBackgroundRegistry", { enumerable: true, get: function () { return state_1.disposeBackgroundRegistry; } });
+var shellInvocation_1 = require("./shellInvocation");
+Object.defineProperty(exports, "buildShellInvocation", { enumerable: true, get: function () { return shellInvocation_1.buildShellInvocation; } });
+// Result envelope utility (used by daemon lifecycle/config)
+var apiResult_1 = require("./apiResult");
+Object.defineProperty(exports, "ok", { enumerable: true, get: function () { return apiResult_1.ok; } });
+Object.defineProperty(exports, "fail", { enumerable: true, get: function () { return apiResult_1.fail; } });
+// Daemon management (moved from agent-platform)
+__exportStar(require("./daemon"), exports);
+// Session state management (moved from agent-platform)
+__exportStar(require("./session"), exports);
+// Cost tracking (moved from agent-platform)
+__exportStar(require("./cost"), exports);
+// Observability (moved from agent-platform)
+__exportStar(require("./observability"), exports);
+// Telemetry (L5 type stubs — issue #217)
+__exportStar(require("./telemetry"), exports);
+// Execution modes (L5 type stubs — issue #217)
+__exportStar(require("./execution"), exports);
+// Resource management (L5 type stubs — issue #217)
+__exportStar(require("./resources"), exports);

package/dist/observability/diagnostics.d.ts

@@ -0,0 +1,25 @@
+import type { DaemonConfig } from "../daemon/types";
+import type { DaemonLoopStatus } from "../daemon/loop";
+import type { RunHealthSnapshot } from "./types";
+export type DiagnosticsRequestPath = "/health" | "/metrics" | "/config" | "/queue";
+export interface DiagnosticsContext {
+    health: RunHealthSnapshot;
+    queue?: DaemonLoopStatus | null;
+    config?: DaemonConfig | Record<string, unknown> | null;
+}
+export interface DiagnosticsSnapshot {
+    health: RunHealthSnapshot;
+    metrics: string;
+    config: unknown;
+    queue: DaemonLoopStatus | null;
+}
+export interface DiagnosticsResponse {
+    status: number;
+    contentType: string;
+    body: unknown;
+}
+export declare function redactDiagnosticsConfig(value: unknown): unknown;
+export declare function buildDiagnosticsSnapshot(context: DiagnosticsContext): DiagnosticsSnapshot;
+export declare function renderPrometheusMetrics(context: Pick<DiagnosticsContext, "health" | "queue">): string;
+export declare function handleDiagnosticsRequest(requestPath: DiagnosticsRequestPath, context: DiagnosticsContext): DiagnosticsResponse;
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/observability/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../src/observability/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAID,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AAmBD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,CAQzF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,MAAM,CAsCrG;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,sBAAsB,EACnC,OAAO,EAAE,kBAAkB,GAC1B,mBAAmB,CAuBrB"}

package/dist/observability/diagnostics.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactDiagnosticsConfig = redactDiagnosticsConfig;
+exports.buildDiagnosticsSnapshot = buildDiagnosticsSnapshot;
+exports.renderPrometheusMetrics = renderPrometheusMetrics;
+exports.handleDiagnosticsRequest = handleDiagnosticsRequest;
+const SECRET_KEY_PATTERN = /(secret|token|api[-_]?key|authorization|password|credential|private[-_]?key)/i;
+function redactDiagnosticsConfig(value) {
+    return redactValue(value, "");
+}
+function redactValue(value, key) {
+    if (SECRET_KEY_PATTERN.test(key)) {
+        return "[REDACTED]";
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item, ""));
+    }
+    if (value && typeof value === "object") {
+        const result = {};
+        for (const [childKey, childValue] of Object.entries(value)) {
+            result[childKey] = redactValue(childValue, childKey);
+        }
+        return result;
+    }
+    return value;
+}
+function buildDiagnosticsSnapshot(context) {
+    const queue = context.queue ?? null;
+    return {
+        health: context.health,
+        queue,
+        config: redactDiagnosticsConfig(context.config ?? null),
+        metrics: renderPrometheusMetrics({ health: context.health, queue }),
+    };
+}
+function renderPrometheusMetrics(context) {
+    const metrics = context.health.metrics;
+    const lines = [
+        "# HELP babysitter_run_effect_latency_ms Run effect latency in milliseconds.",
+        "# TYPE babysitter_run_effect_latency_ms gauge",
+        `babysitter_run_effect_latency_ms{quantile="avg"} ${metrics.avgEffectLatencyMs}`,
+        `babysitter_run_effect_latency_ms{quantile="0.5"} ${metrics.p50EffectLatencyMs}`,
+        `babysitter_run_effect_latency_ms{quantile="0.95"} ${metrics.p95EffectLatencyMs}`,
+        `babysitter_run_effect_latency_ms{quantile="0.99"} ${metrics.p99EffectLatencyMs}`,
+        "# HELP babysitter_run_effects_total Run effects by state.",
+        "# TYPE babysitter_run_effects_total gauge",
+        `babysitter_run_effects_total{state="total"} ${metrics.totalEffects}`,
+        `babysitter_run_effects_total{state="resolved"} ${metrics.resolvedEffects}`,
+        `babysitter_run_effects_total{state="failed"} ${metrics.failedEffects}`,
+        `babysitter_run_effects_total{state="pending"} ${metrics.pendingCount}`,
+        "# HELP babysitter_run_error_rate Run effect error rate.",
+        "# TYPE babysitter_run_error_rate gauge",
+        `babysitter_run_error_rate ${metrics.errorRate}`,
+        "# HELP babysitter_daemon_queue_active_runs Active daemon runs.",
+        "# TYPE babysitter_daemon_queue_active_runs gauge",
+        `babysitter_daemon_queue_active_runs ${context.queue?.activeRuns ?? 0}`,
+        "# HELP babysitter_daemon_queue_pending_runs Pending daemon runs.",
+        "# TYPE babysitter_daemon_queue_pending_runs gauge",
+        `babysitter_daemon_queue_pending_runs ${context.queue?.pendingRuns ?? 0}`,
+        "# HELP babysitter_daemon_queue_dead_letter_runs Dead-lettered daemon runs.",
+        "# TYPE babysitter_daemon_queue_dead_letter_runs gauge",
+        `babysitter_daemon_queue_dead_letter_runs ${context.queue?.deadLetterRuns ?? 0}`,
+        "# HELP babysitter_daemon_trigger_rejections_total Trigger admissions rejected by the daemon.",
+        "# TYPE babysitter_daemon_trigger_rejections_total counter",
+        `babysitter_daemon_trigger_rejections_total ${context.queue?.rejectedTriggers ?? 0}`,
+        "# HELP babysitter_daemon_trigger_duplicates_total Trigger admissions suppressed as duplicates by the daemon.",
+        "# TYPE babysitter_daemon_trigger_duplicates_total counter",
+        `babysitter_daemon_trigger_duplicates_total ${context.queue?.duplicateTriggers ?? 0}`,
+        "# HELP babysitter_daemon_trigger_rate_limited_total Trigger admissions rejected by rate limiting.",
+        "# TYPE babysitter_daemon_trigger_rate_limited_total counter",
+        `babysitter_daemon_trigger_rate_limited_total ${context.queue?.rateLimitedTriggers ?? 0}`,
+    ];
+    return `${lines.join("\n")}\n`;
+}
+function handleDiagnosticsRequest(requestPath, context) {
+    switch (requestPath) {
+        case "/health":
+            return { status: 200, contentType: "application/json", body: context.health };
+        case "/metrics":
+            return {
+                status: 200,
+                contentType: "text/plain; version=0.0.4",
+                body: renderPrometheusMetrics({ health: context.health, queue: context.queue }),
+            };
+        case "/config":
+            return {
+                status: 200,
+                contentType: "application/json",
+                body: redactDiagnosticsConfig(context.config ?? null),
+            };
+        case "/queue":
+            return {
+                status: 200,
+                contentType: "application/json",
+                body: context.queue ?? null,
+            };
+    }
+}