@alpacakit/agents 0.1.0-beta.37 → 0.1.0-beta.39

package/dist/internal/controlled-process/host-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-controller.d.ts","sourceRoot":"","sources":["../../../src/internal/controlled-process/host-controller.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EAErB,6BAA6B,EAC9B,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA6BtE,OAAO,KAAK,EACV,uBAAuB,EAEvB,uBAAuB,EACxB,MAAM,uBAAuB,CAAC;AAqC/B,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;CAC3C,CAAC;AAEF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACvD;AAsED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAoJtC;AAgnBD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;CACrE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA4BzC"}
+{"version":3,"file":"host-controller.d.ts","sourceRoot":"","sources":["../../../src/internal/controlled-process/host-controller.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EAErB,6BAA6B,EAC9B,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA6BtE,OAAO,KAAK,EACV,uBAAuB,EAEvB,uBAAuB,EACxB,MAAM,uBAAuB,CAAC;AAqC/B,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;CAC3C,CAAC;AAEF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACvD;AAsED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAoJtC;AA6oBD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;CACrE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA4BzC"}

package/dist/internal/controlled-process/host-controller.js

@@ -366,7 +366,17 @@ async function requestTerminationBeforeDeadline(input) {
     if (raced.kind === "closed") {
         return null;
     }
-    if (raced.kind === "failure" || raced.kind === "deadline") {
+    if (raced.kind === "deadline") {
+        throw raced.error;
+    }
+    if (raced.kind === "failure") {
+        // A supervisor that rolled back before reporting its launch failure has
+        // already unlinked its socket, so this request can fail while its close is
+        // the only remaining evidence. Join that close within the same deadline;
+        // the caller still has to prove absence from the signed record.
+        if (await closedBeforeDeadline(input.supervisorClose, input.deadline)) {
+            return null;
+        }
         throw raced.error;
     }
     if (raced.response.kind !== SUPERVISOR_RESPONSE_KIND.termination) {
@@ -379,6 +389,18 @@ async function requestTerminationBeforeDeadline(input) {
         supervisorExit: null,
     };
 }
+function closedBeforeDeadline(supervisorClose, deadline) {
+    if (supervisorClose.didClose()) {
+        return Promise.resolve(true);
+    }
+    return new Promise((resolve) => {
+        const timeout = setTimeout(() => resolve(false), Math.max(0, deadline - Date.now()));
+        void supervisorClose.promise.then(() => {
+            clearTimeout(timeout);
+            resolve(true);
+        });
+    });
+}
 async function raceSupervisorRequestWithClose(input) {
     if (input.supervisorClose.didClose()) {
         return {

package/dist/internal/controlled-process/supervisor-runtime.js

@@ -238,7 +238,6 @@ async function runSupervisorSession(input) {
         shimControl = shim.stdio[SHIM_CONTROL_FD];
         shimStatus = shim.stdio[SHIM_STATUS_FD];
         shimInput = shim.stdio.at(SHIM_INPUT_FD);
-        shimInput.on("error", () => { });
         const pid = requireShimPid(shim);
         shimPid = pid;
         const record = {
@@ -701,9 +700,23 @@ function spawnShim(bootstrap) {
         env: {},
         stdio: ["ignore", "pipe", "pipe", "pipe", "pipe", "pipe"],
     });
+    containShimStdioErrors(shim);
     shim.once("error", () => { });
     return shim;
 }
+/**
+ * The supervisor owns every shim stdio error from spawn until the shim closes.
+ * Framed writes, status reads, and output pumps keep their own listeners and
+ * remain responsible for their outcomes; this owner only contains the pipe
+ * errors a dying shim raises once those operations have settled, so a late
+ * reset can never end supervisor custody before its failure is reported.
+ */
+function containShimStdioErrors(shim) {
+    for (const stream of shim.stdio) {
+        stream?.on("error", consumeShimStdioError);
+    }
+}
+function consumeShimStdioError() { }
 function waitForShimClose(shim) {
     return new Promise((resolve) => {
         shim.once("close", () => resolve());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alpacakit/agents",
-  "version": "0.1.0-beta.37",
+  "version": "0.1.0-beta.39",
   "description": "Run AI coding agents programmatically: execute, stream, classify failures, fail over.",
   "license": "MIT",
   "type": "module",
@@ -45,7 +45,7 @@
   },
   "dependencies": {
     "zod": "^4.3.6",
-    "@alpacakit/core": "0.1.0-beta.37"
+    "@alpacakit/core": "0.1.0-beta.39"
   },
   "devDependencies": {
     "typescript": "^5.9.3",

package/dist/auth/profile-store.d.ts

@@ -1,14 +0,0 @@
-/**
- * Minimal file-backed profile store (A11): rows follow rule 2 and never
- * contain secret values (A9) — materials carry refs and paths only.
- * Profile management UX is consumer territory. Unlike fleet state, this
- * is durable user data: malformed or unknown-version files are typed
- * errors, never silent resets.
- */
-import { type AuthProfile } from "./material.js";
-export interface ProfileStore {
-    list(): Promise<AuthProfile[]>;
-    save(profiles: AuthProfile[]): Promise<void>;
-}
-export declare function fileProfileStore(filePath: string): ProfileStore;
-//# sourceMappingURL=profile-store.d.ts.map

package/dist/auth/profile-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"profile-store.d.ts","sourceRoot":"","sources":["../../src/auth/profile-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAcrE,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AA+FD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAE/D"}

package/dist/auth/profile-store.js

@@ -1,102 +0,0 @@
-/**
- * Minimal file-backed profile store (A11): rows follow rule 2 and never
- * contain secret values (A9) — materials carry refs and paths only.
- * Profile management UX is consumer territory. Unlike fleet state, this
- * is durable user data: malformed or unknown-version files are typed
- * errors, never silent resets.
- */
-import { readFile } from "node:fs/promises";
-import { AGENT_ERROR_CODE, AgentError } from "../core/error.js";
-import { isErrnoCode, writeFileAtomically } from "../core/fs.js";
-import { readUnknownRecord } from "../core/json.js";
-import { TEXT_ENCODING } from "../core/values.js";
-import { AUTH_MATERIAL_KIND } from "./material.js";
-const PROFILE_FILE_VERSION = 1;
-const PROFILE_STORE_ERROR_REASON = {
-    unreadable: "unreadable file",
-    malformedJson: "malformed JSON",
-    rootMustBeObject: "root must be an object",
-    unsupportedVersion: "unsupported version",
-    invalidProfiles: "profiles must be auth profile records",
-};
-function profileStoreError(reason, cause) {
-    return new AgentError({
-        code: AGENT_ERROR_CODE.invalidInput,
-        classification: AgentError.agentFailure(AGENT_ERROR_CODE.invalidInput),
-        message: `Invalid auth profile store: ${reason}`,
-        data: { reason },
-        ...(cause === undefined ? {} : { cause }),
-    });
-}
-function isSecretRef(value) {
-    const record = readUnknownRecord(value);
-    if (record === null) {
-        return false;
-    }
-    const { resolver, id } = record;
-    return typeof resolver === "string" && typeof id === "string";
-}
-function isAuthProfile(value) {
-    const record = readUnknownRecord(value);
-    if (record === null) {
-        return false;
-    }
-    const { id, agentId, material: materialValue } = record;
-    const material = readUnknownRecord(materialValue);
-    if (material === null) {
-        return false;
-    }
-    const { kind, path, secret } = material;
-    const materialValid = (kind === AUTH_MATERIAL_KIND.homeDir && typeof path === "string") ||
-        (kind === AUTH_MATERIAL_KIND.apiKey && isSecretRef(secret));
-    return typeof id === "string" && typeof agentId === "string" && materialValid;
-}
-function parseProfileFile(raw) {
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (error) {
-        throw profileStoreError(PROFILE_STORE_ERROR_REASON.malformedJson, error);
-    }
-    const root = readUnknownRecord(parsed);
-    if (root === null) {
-        throw profileStoreError(PROFILE_STORE_ERROR_REASON.rootMustBeObject);
-    }
-    const { version, profiles } = root;
-    if (version !== PROFILE_FILE_VERSION) {
-        throw profileStoreError(PROFILE_STORE_ERROR_REASON.unsupportedVersion);
-    }
-    if (!Array.isArray(profiles) || !profiles.every(isAuthProfile)) {
-        throw profileStoreError(PROFILE_STORE_ERROR_REASON.invalidProfiles);
-    }
-    return profiles;
-}
-class FileProfileStore {
-    filePath;
-    constructor(filePath) {
-        this.filePath = filePath;
-    }
-    async list() {
-        let raw;
-        try {
-            raw = await readFile(this.filePath, TEXT_ENCODING);
-        }
-        catch (error) {
-            // Durable user data: only "not created yet" reads as empty; any
-            // other read failure surfaces instead of masking real profiles.
-            if (isErrnoCode(error, "ENOENT")) {
-                return [];
-            }
-            throw profileStoreError(PROFILE_STORE_ERROR_REASON.unreadable, error);
-        }
-        return parseProfileFile(raw);
-    }
-    async save(profiles) {
-        const file = { version: PROFILE_FILE_VERSION, profiles };
-        await writeFileAtomically(this.filePath, `${JSON.stringify(file, null, 2)}\n`);
-    }
-}
-export function fileProfileStore(filePath) {
-    return new FileProfileStore(filePath);
-}

package/dist/keyring/index.d.ts

@@ -1,2 +0,0 @@
-export { keyringResolver, type KeyringResolverOptions, } from "./resolver.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/keyring/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC"}

package/dist/keyring/index.js

@@ -1 +0,0 @@
-export { keyringResolver, } from "./resolver.js";

package/dist/keyring/resolver.d.ts

@@ -1,9 +0,0 @@
-import type { SecretResolver } from "../core/ports.js";
-export type KeyringResolverOptions = {
-    readonly service: string;
-};
-type KeyringModuleLoader = () => Promise<unknown>;
-export declare function keyringResolver(options: KeyringResolverOptions): SecretResolver;
-export declare function createKeyringResolver(options: KeyringResolverOptions, loader: KeyringModuleLoader): SecretResolver;
-export {};
-//# sourceMappingURL=resolver.d.ts.map

package/dist/keyring/resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/keyring/resolver.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,KAAK,mBAAmB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;AAiBlD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,sBAAsB,GAC9B,cAAc,CAEhB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,mBAAmB,GAC1B,cAAc,CA4BhB"}

package/dist/keyring/resolver.js

@@ -1,64 +0,0 @@
-// biome-ignore-all lint/style/useNamingConvention: Keyring peer exports mirror upstream PascalCase names.
-import { AGENT_ERROR_CODE, AgentError, NOT_AVAILABLE_CAUSE, } from "../core/error.js";
-const KEYRING_PEER_PACKAGE = "@napi-rs/keyring";
-const KEYRING_ENTRY_EXPORT = "Entry";
-const EMPTY_SECRET_VALUE = "";
-const defaultKeyringModuleLoader = () => import(KEYRING_PEER_PACKAGE);
-export function keyringResolver(options) {
-    return createKeyringResolver(options, defaultKeyringModuleLoader);
-}
-export function createKeyringResolver(options, loader) {
-    const service = options.service;
-    let modulePromise = null;
-    const load = () => {
-        modulePromise ??= loadKeyringModule(loader);
-        return modulePromise;
-    };
-    return {
-        resolve: async (id) => {
-            const module = await load();
-            try {
-                // Absent entries are the `null` return (`Entry.getPassword():
-                // string | null` in @napi-rs/keyring); anything thrown is a real
-                // keychain failure, never "missing secret".
-                const value = await new module.Entry(service, id).getPassword();
-                return value === EMPTY_SECRET_VALUE ? null : value;
-            }
-            catch (error) {
-                throw new AgentError({
-                    code: AGENT_ERROR_CODE.failed,
-                    classification: AgentError.agentFailure(AGENT_ERROR_CODE.failed),
-                    message: `Keyring secret "${id}" could not be read`,
-                    data: { exitCode: null, stdoutTail: null, stderrTail: null },
-                    cause: error,
-                });
-            }
-        },
-    };
-}
-async function loadKeyringModule(loader) {
-    let loaded;
-    try {
-        loaded = await loader();
-    }
-    catch (error) {
-        throw keyringNotInstalledError(error);
-    }
-    if (typeof loaded !== "object" || loaded === null) {
-        throw keyringNotInstalledError(null);
-    }
-    const entry = Reflect.get(loaded, KEYRING_ENTRY_EXPORT);
-    if (typeof entry !== "function") {
-        throw keyringNotInstalledError(null);
-    }
-    return { Entry: entry };
-}
-function keyringNotInstalledError(cause) {
-    return new AgentError({
-        code: AGENT_ERROR_CODE.notAvailable,
-        classification: AgentError.agentFailure(AGENT_ERROR_CODE.notAvailable),
-        message: "Keyring peer is not installed",
-        data: { cause: NOT_AVAILABLE_CAUSE.notInstalled },
-        cause,
-    });
-}