@agilno-tech/rivet 0.1.0-alpha.0

package/src/policy/authority.js

@@ -0,0 +1,282 @@
+import { verifyApproval } from './approvals.js';
+
+const ID = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const ACTION = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/;
+const HUMAN_GATED = new Set([
+  'activation', 'scope-change', 'external-write', 'dependency.install',
+  'visual-baseline', 'visual-baseline.accept', 'merge', 'git.merge', 'deploy', 'deploy.execute',
+  'jira.final-state', 'docs.publish', 'publication', 'final-delivery',
+]);
+const envelopes = new WeakSet();
+const WINDOWS_RESERVED = /^(?:con|prn|aux|nul|conin\$|conout\$|com[1-9]|lpt[1-9])(?:\..*)?$/i;
+
+export class AuthorityPolicyError extends Error {
+  constructor(reason = 'invalid-authority') {
+    super(reason === 'overlapping-owned-paths'
+      ? 'Authority contains overlapping owned paths.'
+      : 'Authority policy input is invalid.');
+    this.name = 'AuthorityPolicyError';
+    this.code = 'ERR_AUTHORITY_POLICY';
+    this.safeMessage = this.message;
+    this.details = Object.freeze({ reason });
+  }
+}
+
+function fail(reason) {
+  throw new AuthorityPolicyError(reason);
+}
+
+function capture(value, allowed, required, reason) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) fail(reason);
+  let keys;
+  try { keys = Reflect.ownKeys(value); } catch { fail(reason); }
+  if (keys.some(key => typeof key !== 'string' || !allowed.has(key))) fail(reason);
+  const result = Object.create(null);
+  try {
+    for (const key of keys) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor?.enumerable) fail(reason);
+      result[key] = value[key];
+    }
+  } catch (error) {
+    if (error instanceof AuthorityPolicyError) throw error;
+    fail(reason);
+  }
+  if (required.some(key => !Object.hasOwn(result, key))) fail(reason);
+  return result;
+}
+
+function array(value, limit, reason) {
+  if (!Array.isArray(value)) fail(reason);
+  const result = [];
+  try {
+    const length = value.length;
+    if (!Number.isSafeInteger(length) || length < 0 || length > limit) fail(reason);
+    for (let index = 0; index < length; index += 1) {
+      if (!Object.hasOwn(value, index)) fail(reason);
+      result.push(value[index]);
+    }
+  } catch (error) {
+    if (error instanceof AuthorityPolicyError) throw error;
+    fail(reason);
+  }
+  return result;
+}
+
+function validId(value) {
+  return typeof value === 'string' && value.length <= 64 && ID.test(value);
+}
+
+function uniqueStrings(value, pattern, limit, reason) {
+  const values = array(value, limit, reason);
+  if (values.some(item => typeof item !== 'string' || item.length > 100 || !pattern.test(item))) fail(reason);
+  if (new Set(values).size !== values.length) fail(reason);
+  return values.sort();
+}
+
+function canonicalPath(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > 500) fail('invalid-path');
+  if (value.includes('\\')) fail('invalid-path');
+  const normalized = value.normalize('NFKC');
+  if (normalized !== value && /[/\\:]/.test(normalized)) fail('invalid-path');
+  if (/[\\:]/.test(normalized)) fail('invalid-path');
+  const parts = normalized.split('/');
+  if (
+    normalized.startsWith('/') || /^[A-Za-z]:/.test(normalized) || normalized.endsWith('/')
+    || normalized.includes('//') || /[\u0000\r\n]/.test(normalized)
+    || parts.some(part => (
+      part === '' || part === '.' || part === '..' || part.endsWith('.') || part.endsWith(' ')
+      || WINDOWS_RESERVED.test(part)
+    ))
+  ) fail('invalid-path');
+  return parts.join('/');
+}
+
+function containsPath(parent, child) {
+  return child === parent || child.startsWith(`${parent}/`);
+}
+
+function canonicalOwnedPaths(value) {
+  const paths = array(value, 256, 'invalid-owned-paths').map(canonicalPath).sort();
+  const folded = paths.map(path => path.toUpperCase().toLowerCase().normalize('NFKC')).sort();
+  if (new Set(folded).size !== folded.length) fail('overlapping-owned-paths');
+  for (let left = 0; left < folded.length; left += 1) {
+    for (let right = left + 1; right < folded.length; right += 1) {
+      if (containsPath(folded[left], folded[right])) {
+        throw new AuthorityPolicyError('overlapping-owned-paths');
+      }
+    }
+  }
+  return paths;
+}
+
+function captureProviders(value) {
+  const providers = array(value, 64, 'invalid-providers').map(item => {
+    const provider = capture(item, new Set(['id', 'mode', 'capabilities']), ['id', 'mode', 'capabilities'], 'invalid-provider');
+    if (!validId(provider.id) || !['disabled', 'read-only', 'read-write-with-approval'].includes(provider.mode)) fail('invalid-provider');
+    const capabilities = uniqueStrings(provider.capabilities, ID, 64, 'invalid-provider');
+    return Object.freeze({ id: provider.id, mode: provider.mode, capabilities: Object.freeze(capabilities) });
+  }).sort((left, right) => (left.id < right.id ? -1 : (left.id > right.id ? 1 : 0)));
+  if (new Set(providers.map(provider => provider.id)).size !== providers.length) fail('invalid-providers');
+  return providers;
+}
+
+function authorityMessage(reason) {
+  if (reason === 'action-ceiling' || reason === 'path-ceiling' || reason === 'provider-ceiling' || reason === 'command-ceiling') {
+    const error = new AuthorityPolicyError(reason);
+    error.message = 'Delegated authority exceeds the authority ceiling.';
+    error.safeMessage = error.message;
+    throw error;
+  }
+  fail(reason);
+}
+
+export function createAuthorityEnvelope(input) {
+  try {
+    const value = capture(input, new Set([
+      'actorId', 'principal', 'role', 'actions', 'ownedPaths', 'providers', 'commands',
+    ]), ['actorId', 'principal', 'actions', 'ownedPaths', 'providers', 'commands'], 'invalid-authority');
+    if (!validId(value.actorId) || !['agent', 'human'].includes(value.principal)) fail('invalid-principal');
+    if (value.role !== undefined && (!validId(value.role))) fail('invalid-role-label');
+    const actions = uniqueStrings(value.actions, ACTION, 128, 'invalid-actions');
+    const ownedPaths = canonicalOwnedPaths(value.ownedPaths);
+    const providers = captureProviders(value.providers);
+    const commands = uniqueStrings(value.commands, ID, 64, 'invalid-commands');
+    const envelope = Object.freeze({
+      actorId: value.actorId,
+      principal: value.principal,
+      ...(value.role === undefined ? {} : { role: value.role }),
+      actions: Object.freeze(actions),
+      ownedPaths: Object.freeze(ownedPaths),
+      providers: Object.freeze(providers),
+      commands: Object.freeze(commands),
+    });
+    envelopes.add(envelope);
+    return envelope;
+  } catch (error) {
+    if (error instanceof AuthorityPolicyError) throw error;
+    fail('invalid-authority');
+  }
+}
+
+function providerWithin(child, parent) {
+  const ceiling = parent.providers.find(provider => provider.id === child.id);
+  if (!ceiling) return false;
+  const modes = { disabled: 0, 'read-only': 1, 'read-write-with-approval': 2 };
+  return modes[child.mode] <= modes[ceiling.mode]
+    && child.capabilities.every(capability => ceiling.capabilities.includes(capability));
+}
+
+export function grant(childInput, actionsInput, parent) {
+  try {
+    if (!envelopes.has(parent)) fail('invalid-parent-authority');
+    const child = capture(childInput, new Set([
+      'actorId', 'principal', 'role', 'ownedPaths', 'providers', 'commands',
+    ]), ['actorId'], 'invalid-child-authority');
+    const actions = uniqueStrings(actionsInput, ACTION, 128, 'invalid-actions');
+    if (!actions.every(action => parent.actions.includes(action))) authorityMessage('action-ceiling');
+    const candidate = createAuthorityEnvelope({
+      actorId: child.actorId,
+      principal: child.principal ?? 'agent',
+      ...(child.role === undefined ? {} : { role: child.role }),
+      actions,
+      ownedPaths: child.ownedPaths ?? [],
+      providers: child.providers ?? [],
+      commands: child.commands ?? [],
+    });
+    if (candidate.principal === 'human' && parent.principal !== 'human') authorityMessage('action-ceiling');
+    if (!candidate.ownedPaths.every(path => parent.ownedPaths.some(parentPath => containsPath(parentPath, path)))) authorityMessage('path-ceiling');
+    if (!candidate.providers.every(provider => providerWithin(provider, parent))) authorityMessage('provider-ceiling');
+    if (!candidate.commands.every(command => parent.commands.includes(command))) authorityMessage('command-ceiling');
+    return candidate;
+  } catch (error) {
+    if (error instanceof AuthorityPolicyError) throw error;
+    fail('invalid-grant');
+  }
+}
+
+function decision(value, policyId, reason) {
+  return Object.freeze({ decision: value, policyId, reason });
+}
+
+function approvalResource(request) {
+  if (request.action === 'provider.write') return `${request.providerId}:${request.capability}:${request.resource}`;
+  return request.resource;
+}
+
+function withApproval(authority, request, options, policyId) {
+  if (!options.approval || !options.approvalRegistry || !options.expectedApproverId || options.nowMs === undefined) {
+    return decision('approval-required', policyId, 'human-approval-required');
+  }
+  const verified = verifyApproval(options.approval, {
+    subjectId: authority.actorId,
+    action: request.action,
+    resource: approvalResource(request),
+    policyId,
+  }, {
+    registry: options.approvalRegistry,
+    expectedApproverId: options.expectedApproverId,
+    requireHumanApprover: true,
+    requireSingleUse: true,
+    nowMs: options.nowMs,
+  });
+  return verified.valid
+    ? decision('allow', policyId, 'approved')
+    : decision('approval-required', policyId, verified.reason);
+}
+
+export function evaluateAuthority(authority, requestInput, optionsInput = {}) {
+  try {
+    if (!envelopes.has(authority)) fail('invalid-authority');
+    const request = capture(requestInput, new Set([
+      'actorId', 'action', 'resource', 'providerId', 'capability', 'commandId', 'subjectId',
+    ]), ['actorId', 'action', 'resource'], 'invalid-request');
+    const options = capture(optionsInput, new Set([
+      'approval', 'approvalRegistry', 'expectedApproverId', 'nowMs',
+    ]), [], 'invalid-options');
+    if (!validId(request.actorId) || request.actorId !== authority.actorId) return decision('deny', 'authority.actor-binding', 'actor-mismatch');
+    if (typeof request.action !== 'string' || !ACTION.test(request.action) || request.action.length > 100) fail('invalid-action');
+    if (typeof request.resource !== 'string' || request.resource.length === 0 || request.resource.length > 500 || /[\u0000\r\n]/.test(request.resource)) fail('invalid-resource');
+    if (!authority.actions.includes(request.action)) return decision('deny', 'authority.explicit-action', 'action-not-granted');
+
+    if (request.action === 'file.read' || request.action === 'file.write') {
+      const path = canonicalPath(request.resource);
+      if (!authority.ownedPaths.some(owned => containsPath(owned, path))) {
+        return decision('deny', 'authority.file-ownership', 'resource-not-owned');
+      }
+    }
+
+    if (request.action.startsWith('command.') || request.action === 'dependency.install') {
+      if (!validId(request.commandId) || request.resource !== request.commandId || !authority.commands.includes(request.commandId)) {
+        return decision('deny', 'authority.command-allowlist', 'command-not-allowlisted');
+      }
+    }
+
+    if (request.action === 'provider.read' || request.action === 'provider.write') {
+      if (!validId(request.providerId) || !validId(request.capability)) fail('invalid-provider-request');
+      const provider = authority.providers.find(item => item.id === request.providerId);
+      if (!provider || !provider.capabilities.includes(request.capability) || provider.mode === 'disabled') {
+        return decision('deny', 'authority.provider-capability', 'provider-action-not-granted');
+      }
+      if (request.action === 'provider.write') {
+        if (provider.mode !== 'read-write-with-approval') return decision('deny', 'authority.provider-mode', 'provider-read-only');
+        return withApproval(authority, request, options, 'authority.external-write');
+      }
+    }
+
+    if (request.action === 'approval.record') {
+      if (!validId(request.subjectId)) return decision('deny', 'authority.approval-subject', 'invalid-approval-subject');
+      if (request.subjectId === authority.actorId) {
+        return decision('deny', 'authority.separation-of-duties', 'self-approval-forbidden');
+      }
+    }
+    if (HUMAN_GATED.has(request.action)) {
+      if (authority.principal === 'human') return decision('allow', `authority.human-gate.${request.action}`, 'human-authority');
+      return decision('approval-required', `authority.human-gate.${request.action}`, 'human-approval-required');
+    }
+    return decision('allow', 'authority.explicit-action', 'action-granted');
+  } catch (error) {
+    if (error instanceof AuthorityPolicyError) throw error;
+    fail('invalid-policy-input');
+  }
+}

package/src/policy/budget.js

@@ -0,0 +1,149 @@
+const LIMIT_FIELDS = Object.freeze(['elapsedMs', 'agentTurns', 'retries', 'childCount', 'activeNodes', 'tokens', 'costUsd']);
+const MONOTONIC_FIELDS = Object.freeze(['agentTurns', 'retries', 'childCount', 'tokens', 'costUsd']);
+const snapshots = new WeakSet();
+
+export class BudgetPolicyError extends Error {
+  constructor(reason = 'invalid-budget') {
+    super(reason === 'non-monotonic-observation'
+      ? 'Budget observations must be monotonic.'
+      : 'Budget policy input is invalid.');
+    this.name = 'BudgetPolicyError';
+    this.code = 'ERR_BUDGET_POLICY';
+    this.safeMessage = this.message;
+    this.details = Object.freeze({ reason });
+  }
+}
+
+function fail(reason) { throw new BudgetPolicyError(reason); }
+
+function capture(value, allowed, required, reason) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) fail(reason);
+  let keys;
+  try { keys = Reflect.ownKeys(value); } catch { fail(reason); }
+  if (keys.some(key => typeof key !== 'string' || !allowed.has(key))) fail(reason);
+  const result = Object.create(null);
+  try {
+    for (const key of keys) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor?.enumerable) fail(reason);
+      result[key] = value[key];
+    }
+  } catch (error) {
+    if (error instanceof BudgetPolicyError) throw error;
+    fail(reason);
+  }
+  if (required.some(key => !Object.hasOwn(result, key))) fail(reason);
+  return result;
+}
+
+function integer(value, positive = false) {
+  if (!Number.isSafeInteger(value) || value < (positive ? 1 : 0)) fail('invalid-integer-budget');
+  return value;
+}
+
+function decimal(value) {
+  const source = typeof value === 'number' && Number.isFinite(value) ? value.toString() : value;
+  if (typeof source !== 'string' || source.length === 0 || source.length > 64) fail('invalid-decimal-budget');
+  const match = /^(\d+)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(source);
+  if (!match) fail('invalid-decimal-budget');
+  const exponent = Number(match[3] ?? 0);
+  if (!Number.isSafeInteger(exponent) || Math.abs(exponent) > 100) fail('invalid-decimal-budget');
+  let digits = `${match[1]}${match[2] ?? ''}`.replace(/^0+(?=\d)/, '');
+  let scale = (match[2]?.length ?? 0) - exponent;
+  if (scale < 0) { digits += '0'.repeat(-scale); scale = 0; }
+  while (scale > 0 && digits.endsWith('0')) { digits = digits.slice(0, -1); scale -= 1; }
+  const coefficient = BigInt(digits || '0');
+  return { coefficient, scale, text: scale === 0
+    ? coefficient.toString()
+    : `${coefficient.toString().padStart(scale + 1, '0').slice(0, -scale)}.${coefficient.toString().padStart(scale + 1, '0').slice(-scale)}` };
+}
+
+function compareDecimal(leftValue, rightValue) {
+  const left = decimal(leftValue);
+  const right = decimal(rightValue);
+  const scale = Math.max(left.scale, right.scale);
+  const leftScaled = left.coefficient * (10n ** BigInt(scale - left.scale));
+  const rightScaled = right.coefficient * (10n ** BigInt(scale - right.scale));
+  return leftScaled === rightScaled ? 0 : (leftScaled < rightScaled ? -1 : 1);
+}
+
+function now(options) {
+  const value = options.nowMs ?? Date.now();
+  return integer(value);
+}
+
+function makeSnapshot(limits, usage, startedAtMs, observedAtMs) {
+  const result = Object.freeze({
+    limits: Object.freeze({ ...limits }),
+    usage: Object.freeze({ ...usage }),
+    startedAtMs,
+    observedAtMs,
+  });
+  snapshots.add(result);
+  return result;
+}
+
+export function createBudgetSnapshot(limitsInput, optionsInput = {}) {
+  try {
+    const limitsValue = capture(limitsInput, new Set(LIMIT_FIELDS), LIMIT_FIELDS, 'invalid-limits');
+    const options = capture(optionsInput, new Set(['nowMs']), [], 'invalid-options');
+    const limits = {};
+    for (const field of LIMIT_FIELDS) {
+      limits[field] = field === 'costUsd'
+        ? decimal(limitsValue[field]).text
+        : integer(limitsValue[field], true);
+    }
+    if (compareDecimal(limits.costUsd, '0') <= 0) fail('invalid-decimal-budget');
+    const nowMs = now(options);
+    return makeSnapshot(limits, {
+      elapsedMs: 0, agentTurns: 0, retries: 0, childCount: 0, activeNodes: 0, tokens: 0, costUsd: '0',
+    }, nowMs, nowMs);
+  } catch (error) {
+    if (error instanceof BudgetPolicyError) throw error;
+    fail('invalid-budget');
+  }
+}
+
+export function observeBudget(snapshot, observationInput, optionsInput = {}) {
+  try {
+    if (!snapshots.has(snapshot)) fail('untrusted-snapshot');
+    const observation = capture(observationInput, new Set(LIMIT_FIELDS.filter(field => field !== 'elapsedMs')), [], 'invalid-observation');
+    const options = capture(optionsInput, new Set(['nowMs']), [], 'invalid-options');
+    const observedAtMs = now(options);
+    if (observedAtMs < snapshot.observedAtMs) fail('non-monotonic-observation');
+    const usage = { ...snapshot.usage, elapsedMs: observedAtMs - snapshot.startedAtMs };
+    for (const field of Object.keys(observation)) {
+      const value = field === 'costUsd' ? decimal(observation[field]).text : integer(observation[field]);
+      if (MONOTONIC_FIELDS.includes(field)) {
+        const backwards = field === 'costUsd'
+          ? compareDecimal(value, snapshot.usage[field]) < 0
+          : value < snapshot.usage[field];
+        if (backwards) fail('non-monotonic-observation');
+      }
+      usage[field] = value;
+    }
+    return makeSnapshot(snapshot.limits, usage, snapshot.startedAtMs, observedAtMs);
+  } catch (error) {
+    if (error instanceof BudgetPolicyError) throw error;
+    fail('invalid-budget-observation');
+  }
+}
+
+export function evaluateBudget(snapshot) {
+  try {
+    if (!snapshots.has(snapshot)) fail('untrusted-snapshot');
+    const exhausted = LIMIT_FIELDS.filter(field => field === 'costUsd'
+      ? compareDecimal(snapshot.usage[field], snapshot.limits[field]) >= 0
+      : snapshot.usage[field] >= snapshot.limits[field]);
+    if (exhausted.length === 0) return Object.freeze({
+      decision: 'allow', policyId: 'budget.available', reason: 'budget-available', exhausted: Object.freeze([]),
+    });
+    const firstReason = exhausted[0] === 'elapsedMs' ? 'elapsed-time-exhausted' : `${exhausted[0]}-exhausted`;
+    return Object.freeze({
+      decision: 'deny', policyId: 'budget.exhausted', reason: firstReason, exhausted: Object.freeze(exhausted),
+    });
+  } catch (error) {
+    if (error instanceof BudgetPolicyError) throw error;
+    fail('invalid-budget');
+  }
+}

package/src/policy/command-bootstrap.js

@@ -0,0 +1,219 @@
+import { spawn } from 'node:child_process';
+import { lstat, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, relative } from 'node:path';
+
+const VERSION = 1;
+const STARTUP_TIMEOUT_MS = 1_000;
+const KILL_GRACE_MS = 100;
+const NONCE = /^[a-f0-9]{32}$/;
+const IDENTITY = /^\d+$/;
+const ACTION_ARG_LIMIT = 256;
+const ENV_LIMIT = 256;
+
+function exactObject(value, keys) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && Reflect.ownKeys(value).length === keys.length
+    && keys.every(key => Object.hasOwn(value, key));
+}
+
+function boundedStrings(value, maximum, itemMaximum) {
+  return Array.isArray(value) && value.length <= maximum
+    && value.every(item => typeof item === 'string' && item.length <= itemMaximum && !item.includes('\0'));
+}
+
+function validEnvironment(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const keys = Reflect.ownKeys(value);
+  return keys.length <= ENV_LIMIT && keys.every(key => (
+    typeof key === 'string' && /^[A-Z_][A-Z0-9_]*$/.test(key)
+    && typeof value[key] === 'string' && value[key].length <= 32_768 && !value[key].includes('\0')
+  ));
+}
+
+function within(parent, child) {
+  const path = relative(parent, child);
+  return path === '' || (!path.startsWith('..') && !isAbsolute(path));
+}
+
+function validIdentity(value) {
+  return exactObject(value, ['dev', 'ino']) && IDENTITY.test(value.dev) && IDENTITY.test(value.ino);
+}
+
+function captureInit(message) {
+  if (!exactObject(message, ['version', 'type', 'nonce', 'worktree', 'cwd', 'executable', 'args', 'environment', 'identities', ...(message?.execution === 'argv' ? ['execution', 'invocation'] : [])])) return null;
+  if (message.version !== VERSION || message.type !== 'init' || !NONCE.test(message.nonce)) return null;
+  if (![message.worktree, message.cwd, message.executable].every(value => (
+    typeof value === 'string' && value.length > 0 && value.length <= 1_024 && isAbsolute(value) && !value.includes('\0')
+  ))) return null;
+  if (!boundedStrings(message.args, ACTION_ARG_LIMIT, 4_096) || !validEnvironment(message.environment)) return null;
+  if (!exactObject(message.identities, ['worktree', 'cwd', 'executable'])) return null;
+  if (!Object.values(message.identities).every(validIdentity)) return null;
+  if (message.execution === 'argv') {
+    const invocation = message.invocation;
+    if (!exactObject(invocation, ['target', 'parent', 'identity', 'parentIdentity'])
+      || ![invocation.target, invocation.parent].every(path => typeof path === 'string'
+        && path.length <= 1_024 && isAbsolute(path) && !/[\u0000\r\n]/.test(path))
+      || dirname(message.executable) !== invocation.parent
+      || !validIdentity(invocation.identity) || !validIdentity(invocation.parentIdentity)) return null;
+  }
+  return Object.freeze({
+    version: VERSION,
+    execution: message.execution,
+    ...(message.execution === 'argv' ? { invocation: Object.freeze({
+      target: message.invocation.target, parent: message.invocation.parent,
+      identity: Object.freeze({ ...message.invocation.identity }),
+      parentIdentity: Object.freeze({ ...message.invocation.parentIdentity }),
+    }) } : {}),
+    nonce: message.nonce,
+    worktree: message.worktree,
+    cwd: message.cwd,
+    executable: message.executable,
+    args: Object.freeze([...message.args]),
+    environment: Object.freeze(Object.assign(Object.create(null), message.environment)),
+    identities: Object.freeze({
+      worktree: Object.freeze({ ...message.identities.worktree }),
+      cwd: Object.freeze({ ...message.identities.cwd }),
+      executable: Object.freeze({ ...message.identities.executable }),
+    }),
+  });
+}
+
+function sameIdentity(metadata, expected) {
+  return metadata.dev.toString() === expected.dev && metadata.ino.toString() === expected.ino;
+}
+
+async function verifyAnchor(config) {
+  const [cwdMetadata, cwdReal, worktreeMetadata, worktreeReal, executableMetadata, executableReal] = await Promise.all([
+    lstat('.', { bigint: true }),
+    realpath('.'),
+    lstat(config.worktree, { bigint: true }),
+    realpath(config.worktree),
+    lstat(config.executable, { bigint: true }),
+    realpath(config.executable),
+  ]);
+  let executableValid;
+  if (config.execution === 'argv') {
+    const invocation = config.invocation;
+    const [targetMetadata, targetReal, parentMetadata, parentReal] = await Promise.all([
+      lstat(invocation.target, { bigint: true }), realpath(invocation.target),
+      lstat(invocation.parent, { bigint: true }), realpath(invocation.parent),
+    ]);
+    executableValid = (executableMetadata.isFile() || executableMetadata.isSymbolicLink())
+      && executableReal === invocation.target && targetReal === invocation.target
+      && targetMetadata.isFile() && !targetMetadata.isSymbolicLink() && (targetMetadata.mode & 0o111n) !== 0n
+      && parentMetadata.isDirectory() && !parentMetadata.isSymbolicLink() && parentReal === invocation.parent
+      && sameIdentity(executableMetadata, invocation.identity)
+      && sameIdentity(targetMetadata, config.identities.executable)
+      && sameIdentity(parentMetadata, invocation.parentIdentity);
+  } else {
+    executableValid = executableMetadata.isFile() && !executableMetadata.isSymbolicLink()
+      && executableMetadata.nlink === 1n && executableReal === config.executable
+      && sameIdentity(executableMetadata, config.identities.executable);
+  }
+  return cwdMetadata.isDirectory() && !cwdMetadata.isSymbolicLink()
+    && worktreeMetadata.isDirectory() && !worktreeMetadata.isSymbolicLink()
+    && cwdReal === config.cwd && worktreeReal === config.worktree
+    && within(worktreeReal, cwdReal)
+    && sameIdentity(cwdMetadata, config.identities.cwd)
+    && sameIdentity(worktreeMetadata, config.identities.worktree)
+    && executableValid;
+}
+
+function startBootstrap() {
+  let config;
+  let target;
+  let settled = false;
+  let killTimer;
+  let anchorTimer;
+  const startupTimer = setTimeout(() => shutdown('startup-timeout'), STARTUP_TIMEOUT_MS);
+  startupTimer.unref?.();
+
+  function send(type, fields = {}) {
+    if (process.connected) process.send({ version: VERSION, type, nonce: config?.nonce ?? null, ...fields }, () => {});
+  }
+
+  function terminateTarget() {
+    if (!target) return;
+    const signalTarget = signal => {
+      try {
+        if (process.platform !== 'win32' && Number.isSafeInteger(target.pid) && target.pid > 0) process.kill(-target.pid, signal);
+        else target.kill(signal);
+      } catch {}
+    };
+    signalTarget('SIGTERM');
+    killTimer = setTimeout(() => signalTarget('SIGKILL'), KILL_GRACE_MS);
+  }
+
+  function shutdown(reason, exitCode = 1) {
+    if (settled) return;
+    settled = true;
+    clearTimeout(startupTimer);
+    clearInterval(anchorTimer);
+    terminateTarget();
+    send('failed', { reason });
+    setTimeout(() => process.exit(exitCode), target ? KILL_GRACE_MS + 25 : 0);
+  }
+
+  async function launch() {
+    if (!await verifyAnchor(config)) return shutdown('anchor-invalid');
+    try {
+      target = spawn(config.executable, config.args, {
+        env: config.environment,
+        detached: process.platform !== 'win32',
+        shell: false,
+        stdio: ['ignore', 'inherit', 'inherit'],
+        windowsHide: true,
+      });
+    } catch {
+      return shutdown('target-spawn-failed');
+    }
+    target.once('error', () => shutdown('target-spawn-failed'));
+    anchorTimer = setInterval(async () => {
+      try {
+        if (!await verifyAnchor(config)) shutdown('anchor-changed');
+      } catch {
+        shutdown('anchor-changed');
+      }
+    }, 5);
+    anchorTimer.unref?.();
+    target.once('close', (code, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(killTimer);
+      clearInterval(anchorTimer);
+      send('result', {
+        code: Number.isInteger(code) ? code : null,
+        signal: typeof signal === 'string' ? signal : null,
+      });
+      process.disconnect?.();
+      process.exitCode = 0;
+    });
+  }
+
+  process.on('message', async message => {
+    try {
+      if (!config) {
+        config = captureInit(message);
+        if (!config || !await verifyAnchor(config)) return shutdown('invalid-init');
+        clearTimeout(startupTimer);
+        send('ready');
+        return;
+      }
+      if (!exactObject(message, ['version', 'type', 'nonce']) || message.version !== VERSION || message.nonce !== config.nonce) {
+        return shutdown('invalid-message');
+      }
+      if (message.type === 'launch' && !target) return launch();
+      if (message.type === 'cancel') return shutdown('cancelled');
+      return shutdown('invalid-message');
+    } catch {
+      return shutdown('internal-failure');
+    }
+  });
+  process.once('disconnect', () => shutdown('ipc-closed'));
+  // The foreground process group may receive a second signal while shutdown
+  // is waiting to kill the target group. Keep consuming it until cleanup ends.
+  process.on('SIGTERM', () => shutdown('terminated'));
+  process.on('SIGINT', () => shutdown('terminated'));
+}
+
+if (process.argv[2] === '--agilno-command-bootstrap-v1' && typeof process.send === 'function') startBootstrap();