@apralabs/apra-fleet 0.2.2

package/dist/utils/log-helpers.js

@@ -0,0 +1,128 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { FLEET_DIR } from '../paths.js';
+let _stream = null;
+let _activeLogFile = null;
+/** Returns the resolved path of the active log file, or null if logging is unavailable. */
+export function getActiveLogFile() {
+    getStream(); // ensure initialised
+    return _activeLogFile;
+}
+function getStream() {
+    if (_stream)
+        return _stream;
+    try {
+        const logsDir = path.join(FLEET_DIR, 'logs');
+        fs.mkdirSync(logsDir, { recursive: true });
+        const logFile = path.join(logsDir, `fleet-${process.pid}.log`);
+        _stream = fs.createWriteStream(logFile, { flags: 'a' });
+        _activeLogFile = logFile;
+    }
+    catch {
+        // data dir not available
+    }
+    return _stream;
+}
+function localISOString() {
+    const now = new Date();
+    const off = -now.getTimezoneOffset(); // minutes east of UTC
+    const sign = off >= 0 ? '+' : '-';
+    const absOff = Math.abs(off);
+    const h = String(Math.floor(absOff / 60)).padStart(2, '0');
+    const m = String(absOff % 60).padStart(2, '0');
+    const local = new Date(now.getTime() + off * 60000);
+    return local.toISOString().slice(0, -1) + `${sign}${h}:${m}`;
+}
+function writeLog(level, tag, maskedMsg, agent, inv) {
+    try {
+        const stream = getStream();
+        if (!stream)
+            return;
+        const line = { ts: localISOString(), level, tag };
+        if (inv !== undefined)
+            line.inv = inv;
+        if (agent !== undefined) {
+            line.mid = agent.id;
+            if (agent.friendlyName)
+                line.mem = agent.friendlyName;
+        }
+        line.msg = maskedMsg;
+        stream.write(JSON.stringify(line) + '\n');
+    }
+    catch { /* ignore */ }
+}
+export function logLine(tag, msg, agent, inv) {
+    const maskedMsg = maskSecrets(msg);
+    try {
+        console.error(`[fleet] ${tag} ${maskedMsg}`);
+    }
+    catch { /* ignore */ }
+    writeLog('info', tag, maskedMsg, agent, inv);
+}
+export function logWarn(tag, msg, agent) {
+    const maskedMsg = maskSecrets(msg);
+    try {
+        console.error(`[fleet:warn] ${tag} ${maskedMsg}`);
+    }
+    catch { /* ignore */ }
+    writeLog('warn', tag, maskedMsg, agent);
+}
+export function logError(tag, msg, agent) {
+    const maskedMsg = maskSecrets(msg);
+    try {
+        console.error(`[fleet:error] ${tag} ${maskedMsg}`);
+    }
+    catch { /* ignore */ }
+    writeLog('error', tag, maskedMsg, agent);
+}
+const LEVEL_PREFIX = {
+    info: '[fleet]',
+    warn: '[fleet:warn]',
+    error: '[fleet:error]',
+};
+export class LogScope {
+    inv;
+    start;
+    tag;
+    agent;
+    constructor(tag, entryMsg, agent) {
+        this.inv = Math.random().toString(36).slice(2, 7);
+        this.start = Date.now();
+        this.tag = tag;
+        this.agent = agent;
+        this._emit('info', entryMsg);
+    }
+    getInv() { return this.inv; }
+    info(msg) { this._emit('info', msg); }
+    warn(msg) { this._emit('warn', msg); }
+    error(msg) { this._emit('error', msg); }
+    ok(msg = 'done') { this._exit('info', msg); }
+    fail(msg) { this._exit('warn', msg); }
+    abort(msg) { this._exit('error', msg); }
+    _emit(level, msg) {
+        const masked = maskSecrets(msg);
+        try {
+            console.error(`${LEVEL_PREFIX[level]} ${this.tag} ${masked}`);
+        }
+        catch { /* ignore */ }
+        writeLog(level, this.tag, masked, this.agent, this.inv);
+    }
+    _exit(level, msg) {
+        this._emit(level, `${msg} elapsed=${Date.now() - this.start}ms`);
+    }
+}
+export function maskSecrets(text) {
+    try {
+        return text
+            .replace(/\{\{secure\.[a-zA-Z0-9_-]{1,64}\}\}/g, '[REDACTED]')
+            .replace(/sec:\/\/[a-zA-Z0-9_]+/g, '[REDACTED]');
+    }
+    catch {
+        return text;
+    }
+}
+export function truncateForLog(text, maxLen = 80) {
+    const single = text.replace(/[\n\t]/g, ' ');
+    return single.length <= maxLen ? single : single.slice(0, maxLen) + '...';
+}
+//# sourceMappingURL=log-helpers.js.map

package/dist/utils/log-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-helpers.js","sourceRoot":"","sources":["../../src/utils/log-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,IAAI,OAAO,GAA0B,IAAI,CAAC;AAC1C,IAAI,cAAc,GAAkB,IAAI,CAAC;AAEzC,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB;IAC9B,SAAS,EAAE,CAAC,CAAC,qBAAqB;IAClC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/D,OAAO,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAID,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,sBAAsB;IAC5D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAgC,EAAE,GAAW,EAAE,SAAiB,EAAE,KAAgB,EAAE,GAAY;IAChH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,GAA4B,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC3E,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,YAAY;gBAAE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,GAAW,EAAE,KAAgB,EAAE,GAAY;IAC9E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC5E,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,GAAW,EAAE,KAAgB;IAChE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACjF,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAW,EAAE,KAAgB;IACjE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClF,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,YAAY,GAA8C;IAC9D,IAAI,EAAG,SAAS;IAChB,IAAI,EAAG,cAAc;IACrB,KAAK,EAAE,eAAe;CACvB,CAAC;AAEF,MAAM,OAAO,QAAQ;IACF,GAAG,CAAS;IACZ,KAAK,CAAS;IACd,GAAG,CAAS;IACZ,KAAK,CAAY;IAElC,YAAY,GAAW,EAAE,QAAgB,EAAE,KAAgB;QACzD,IAAI,CAAC,GAAG,GAAK,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAK,GAAG,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,KAAa,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,IAAI,CAAC,GAAW,IAAW,IAAI,CAAC,KAAK,CAAC,MAAM,EAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,GAAW,IAAW,IAAI,CAAC,KAAK,CAAC,MAAM,EAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,KAAK,CAAC,GAAW,IAAU,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtD,EAAE,CAAC,GAAG,GAAG,MAAM,IAAY,IAAI,CAAC,KAAK,CAAC,MAAM,EAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,GAAW,IAAW,IAAI,CAAC,KAAK,CAAC,MAAM,EAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,KAAK,CAAC,GAAW,IAAU,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAE9C,KAAK,CAAC,KAAgC,EAAE,GAAW;QACzD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC7F,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,KAAgC,EAAE,GAAW;QACzD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,YAAY,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACnE,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,IAAI;aACR,OAAO,CAAC,sCAAsC,EAAE,YAAY,CAAC;aAC7D,OAAO,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAM,GAAG,EAAE;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;AAC5E,CAAC"}

package/dist/utils/oob-timeout.d.ts

@@ -0,0 +1,2 @@
+export declare const OOB_TIMEOUT_MS: number;
+//# sourceMappingURL=oob-timeout.d.ts.map

package/dist/utils/oob-timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oob-timeout.d.ts","sourceRoot":"","sources":["../../src/utils/oob-timeout.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,QAAgB,CAAC"}

package/dist/utils/oob-timeout.js

@@ -0,0 +1,2 @@
+export const OOB_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+//# sourceMappingURL=oob-timeout.js.map

package/dist/utils/oob-timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oob-timeout.js","sourceRoot":"","sources":["../../src/utils/oob-timeout.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY"}

package/dist/utils/pid-helpers.d.ts

@@ -0,0 +1,11 @@
+import type { OsCommands } from '../os/os-commands.js';
+import type { AgentStrategy } from '../services/strategy.js';
+/**
+ * Kill the stored PID for an agent, then clear it.
+ * Swallows errors — the process may already be dead.
+ */
+export declare function tryKillPid(agent: {
+    id: string;
+    friendlyName: string;
+}, strategy: AgentStrategy, cmds: OsCommands): Promise<void>;
+//# sourceMappingURL=pid-helpers.d.ts.map

package/dist/utils/pid-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pid-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/pid-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAI7D;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC3C,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/utils/pid-helpers.js

@@ -0,0 +1,21 @@
+import { getStoredPid, clearStoredPid } from './agent-helpers.js';
+import { logLine, logWarn } from './log-helpers.js';
+/**
+ * Kill the stored PID for an agent, then clear it.
+ * Swallows errors — the process may already be dead.
+ */
+export async function tryKillPid(agent, strategy, cmds) {
+    const pid = getStoredPid(agent.id);
+    if (pid === undefined)
+        return;
+    clearStoredPid(agent.id);
+    logLine('pid_kill', `killing pid=${pid}`, agent);
+    try {
+        await strategy.execCommand(cmds.killPid(pid), 5000);
+        logLine('pid_kill', `killed pid=${pid}`, agent);
+    }
+    catch (e) {
+        logWarn('pid_kill', `kill failed pid=${pid}: ${String(e?.message ?? e)}`, agent);
+    }
+}
+//# sourceMappingURL=pid-helpers.js.map

package/dist/utils/pid-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pid-helpers.js","sourceRoot":"","sources":["../../src/utils/pid-helpers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAA2C,EAC3C,QAAuB,EACvB,IAAgB;IAEhB,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,CAAC,UAAU,EAAE,eAAe,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,UAAU,EAAE,cAAc,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,UAAU,EAAE,mBAAmB,GAAG,KAAK,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}

package/dist/utils/platform.d.ts

@@ -0,0 +1,13 @@
+export type RemoteOS = 'windows' | 'macos' | 'linux';
+/**
+ * Check whether a remote path is contained within the member's work folder.
+ * Handles Windows remote members where path.posix.resolve fails on drive letters.
+ */
+export declare function isContainedInWorkFolder(workFolder: string, remotePath: string): boolean;
+/**
+ * Resolves a remote path relative to a work folder, handling Windows drive-letter paths
+ * that path.posix.resolve incorrectly treats as relative (since they don't start with '/').
+ */
+export declare function resolveRemotePath(workFolder: string, subPath: string): string;
+export declare function detectOS(unameOutput: string, verOutput: string): RemoteOS;
+//# sourceMappingURL=platform.d.ts.map

package/dist/utils/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/utils/platform.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAErD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAqBvF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAW7E;AAED,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAWzE"}

package/dist/utils/platform.js

@@ -0,0 +1,60 @@
+import path from 'node:path';
+/**
+ * Check whether a remote path is contained within the member's work folder.
+ * Handles Windows remote members where path.posix.resolve fails on drive letters.
+ */
+export function isContainedInWorkFolder(workFolder, remotePath) {
+    const normWorkFolder = workFolder.replace(/\\/g, '/').replace(/\/$/, '');
+    const normRemotePath = remotePath.replace(/\\/g, '/');
+    const isWindowsWorkFolder = /^[A-Za-z]:/.test(normWorkFolder);
+    let resolved;
+    if (isWindowsWorkFolder) {
+        const isAbsolute = /^[A-Za-z]:/.test(normRemotePath) || normRemotePath.startsWith('/');
+        const joined = isAbsolute ? normRemotePath : `${normWorkFolder}/${normRemotePath}`;
+        // Collapse .. and . segments manually (path.posix.resolve doesn't understand drive letters)
+        const stack = [];
+        for (const part of joined.split('/')) {
+            if (part === '..') {
+                stack.pop();
+            }
+            else if (part !== '.') {
+                stack.push(part);
+            }
+        }
+        resolved = stack.join('/');
+    }
+    else {
+        resolved = path.posix.resolve(normWorkFolder, normRemotePath);
+    }
+    return resolved === normWorkFolder || resolved.startsWith(`${normWorkFolder}/`);
+}
+/**
+ * Resolves a remote path relative to a work folder, handling Windows drive-letter paths
+ * that path.posix.resolve incorrectly treats as relative (since they don't start with '/').
+ */
+export function resolveRemotePath(workFolder, subPath) {
+    const normWorkFolder = workFolder.replace(/\\/g, '/').replace(/\/$/, '');
+    const normSubPath = subPath.replace(/\\/g, '/');
+    const isWindowsWorkFolder = /^[A-Za-z]:/.test(normWorkFolder);
+    if (isWindowsWorkFolder) {
+        const isAbsolute = /^[A-Za-z]:/.test(normSubPath) || normSubPath.startsWith('/');
+        return isAbsolute ? normSubPath : `${normWorkFolder}/${normSubPath}`;
+    }
+    else {
+        return path.posix.resolve(normWorkFolder, normSubPath);
+    }
+}
+export function detectOS(unameOutput, verOutput) {
+    if (verOutput.toLowerCase().includes('windows') || verOutput.toLowerCase().includes('microsoft')) {
+        return 'windows';
+    }
+    const uname = unameOutput.trim().toLowerCase();
+    if (uname === 'darwin')
+        return 'macos';
+    // Git Bash / MSYS2 / Cygwin on Windows report MINGW*, MSYS*, or CYGWIN*
+    if (uname.startsWith('mingw') || uname.startsWith('msys') || uname.startsWith('cygwin')) {
+        return 'windows';
+    }
+    return 'linux';
+}
+//# sourceMappingURL=platform.js.map

package/dist/utils/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/utils/platform.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,UAAkB;IAC5E,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,IAAI,QAAgB,CAAC;IACrB,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,cAAc,EAAE,CAAC;QACnF,4FAA4F;QAC5F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAAC,CAAC;iBAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;QAC9C,CAAC;QACD,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,OAAe;IACnE,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjF,OAAO,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,WAAW,EAAE,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,SAAiB;IAC7D,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACvC,wEAAwE;IACxE,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/utils/prompt-errors.d.ts

@@ -0,0 +1,5 @@
+export type PromptErrorCategory = 'auth' | 'server' | 'overloaded' | 'unknown';
+export declare function classifyPromptError(output: string): PromptErrorCategory;
+export declare function isRetryable(category: PromptErrorCategory): boolean;
+export declare function authErrorAdvice(agentName: string): string;
+//# sourceMappingURL=prompt-errors.d.ts.map

package/dist/utils/prompt-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-errors.d.ts","sourceRoot":"","sources":["../../src/utils/prompt-errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;AAQ/E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAEvE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAElE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/utils/prompt-errors.js

@@ -0,0 +1,15 @@
+const patterns = [
+    { category: 'auth', re: /not logged in|unauthorized|\b401\b|authentication_error|expired.*token|permission_error/i },
+    { category: 'server', re: /\b500\b|\b502\b|\b503\b|internal server error|api_error/i },
+    { category: 'overloaded', re: /\b429\b|\b529\b|overloaded|rate limit/i },
+];
+export function classifyPromptError(output) {
+    return patterns.find(p => p.re.test(output))?.category ?? 'unknown';
+}
+export function isRetryable(category) {
+    return category === 'server' || category === 'overloaded';
+}
+export function authErrorAdvice(agentName) {
+    return `Authentication failed on "${agentName}". Run /login to refresh your credentials, then run provision_llm_auth to deploy them to this agent.`;
+}
+//# sourceMappingURL=prompt-errors.js.map

package/dist/utils/prompt-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-errors.js","sourceRoot":"","sources":["../../src/utils/prompt-errors.ts"],"names":[],"mappings":"AAEA,MAAM,QAAQ,GAAyD;IACrE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,0FAA0F,EAAE;IACpH,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,0DAA0D,EAAE;IACtF,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,wCAAwC,EAAE;CACzE,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,IAAI,SAAS,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAA6B;IACvD,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,6BAA6B,SAAS,sGAAsG,CAAC;AACtJ,CAAC"}

package/dist/utils/resolve-member.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+import type { Agent } from '../types.js';
+/**
+ * Resolve a member from either member_id (UUID or name) or member_name.
+ * member_id takes precedence if both are provided.
+ * Returns the Agent or an error string.
+ */
+export declare function resolveMember(member_id?: string, member_name?: string): Agent | string;
+/**
+ * Shared zod fragment for member identification.
+ * Spread into tool schemas: z.object({ ...memberIdentifier, ...otherFields })
+ * Mutual-exclusivity validation is handled inside resolveMember(), which returns an error string if neither field is provided.
+ */
+export declare const memberIdentifier: {
+    member_id: z.ZodOptional<z.ZodString>;
+    member_name: z.ZodOptional<z.ZodString>;
+};
+//# sourceMappingURL=resolve-member.d.ts.map

package/dist/utils/resolve-member.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-member.d.ts","sourceRoot":"","sources":["../../src/utils/resolve-member.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAKtF;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;CAO5B,CAAC"}

package/dist/utils/resolve-member.js

@@ -0,0 +1,23 @@
+import { getAgentOrFail } from './agent-helpers.js';
+import { z } from 'zod';
+/**
+ * Resolve a member from either member_id (UUID or name) or member_name.
+ * member_id takes precedence if both are provided.
+ * Returns the Agent or an error string.
+ */
+export function resolveMember(member_id, member_name) {
+    if (!member_id && !member_name) {
+        return 'Error: provide either member_id (UUID) or member_name (friendly name).';
+    }
+    return getAgentOrFail(member_id ?? member_name);
+}
+/**
+ * Shared zod fragment for member identification.
+ * Spread into tool schemas: z.object({ ...memberIdentifier, ...otherFields })
+ * Mutual-exclusivity validation is handled inside resolveMember(), which returns an error string if neither field is provided.
+ */
+export const memberIdentifier = {
+    member_id: z.string().optional().describe('UUID of the member. Takes precedence over member_name if both are provided.'),
+    member_name: z.string().optional().describe('Friendly name of the member. Use when UUID is not known. Ignored if member_id is also provided.'),
+};
+//# sourceMappingURL=resolve-member.js.map

package/dist/utils/resolve-member.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-member.js","sourceRoot":"","sources":["../../src/utils/resolve-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB,EAAE,WAAoB;IACpE,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,wEAAwE,CAAC;IAClF,CAAC;IACD,OAAO,cAAc,CAAC,SAAS,IAAI,WAAY,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACvC,6EAA6E,CAC9E;IACD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACzC,iGAAiG,CAClG;CACF,CAAC"}

package/dist/utils/secure-input.d.ts

@@ -0,0 +1,6 @@
+export interface SecureInputOptions {
+    prompt: string;
+    allowEmpty?: boolean;
+}
+export declare function secureInput(opts: SecureInputOptions): Promise<string>;
+//# sourceMappingURL=secure-input.d.ts.map

package/dist/utils/secure-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-input.d.ts","sourceRoot":"","sources":["../../src/utils/secure-input.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6C3E"}

package/dist/utils/secure-input.js

@@ -0,0 +1,60 @@
+import password from '@inquirer/password';
+import readline from 'node:readline';
+export async function secureInput(opts) {
+    const { prompt, allowEmpty = false } = opts;
+    // Non-TTY fallback: read one line from stdin
+    if (!process.stdin.isTTY) {
+        return new Promise((resolve) => {
+            let data = '';
+            process.stdin.setEncoding('utf-8');
+            process.stdin.on('data', (chunk) => {
+                data += chunk;
+                const nl = data.indexOf('\n');
+                if (nl !== -1) {
+                    resolve(data.slice(0, nl));
+                }
+            });
+            process.stdin.on('end', () => resolve(data.trim()));
+        });
+    }
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        let value;
+        try {
+            value = await password({
+                message: prompt,
+                mask: '*',
+                validate: (v) => {
+                    if (v.length === 0 && !allowEmpty) {
+                        return 'Value must not be empty. Please try again.';
+                    }
+                    return true;
+                },
+            });
+        }
+        catch {
+            // Ctrl+C → ExitPromptError; surface as Cancelled to match prior API.
+            throw new Error('Cancelled');
+        }
+        if (value.length === 0 && allowEmpty) {
+            const confirmed = await confirmEmpty();
+            if (!confirmed)
+                continue;
+        }
+        return value;
+    }
+}
+async function confirmEmpty() {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+            terminal: true,
+        });
+        rl.question('Are you sure? [y/N]: ', (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase() === 'y');
+        });
+    });
+}
+//# sourceMappingURL=secure-input.js.map

package/dist/utils/secure-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-input.js","sourceRoot":"","sources":["../../src/utils/secure-input.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,oBAAoB,CAAC;AAC1C,OAAO,QAAQ,MAAM,eAAe,CAAC;AAOrC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IAE5C,6CAA6C;IAC7C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,IAAI,IAAI,KAAK,CAAC;gBACd,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,QAAQ,CAAC;gBACrB,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE;oBACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;wBAClC,OAAO,4CAA4C,CAAC;oBACtD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC,SAAS;gBAAE,SAAS;QAC3B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC,MAAM,EAAE,EAAE;YAC9C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/shell-escape.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Centralized shell escaping functions to prevent command injection (CWE-78).
+ * Used by platform.ts, execute-prompt.ts, and provision-auth.ts.
+ */
+/**
+ * Escape a string for safe use inside single-quoted Unix shell arguments.
+ * Handles embedded single quotes by ending the quote, adding an escaped quote, and reopening.
+ * e.g. "it's" → 'it'\''s'
+ */
+export declare function escapeShellArg(s: string): string;
+/**
+ * Escape a string for safe use inside double-quoted Unix shell arguments.
+ * Escapes: $ ` " \ ! (characters with special meaning inside double quotes).
+ */
+export declare function escapeDoubleQuoted(s: string): string;
+/**
+ * Escape a string for safe use inside double-quoted Windows cmd.exe arguments.
+ * Escapes: " & | ^ < > (cmd.exe metacharacters).
+ */
+export declare function escapeWindowsArg(s: string): string;
+/**
+ * Escape a string for safe use as a PowerShell single-quoted string literal.
+ * Single-quoted strings in PowerShell are fully literal — no variable expansion.
+ * Internal single quotes are escaped by doubling them: ' → ''
+ * Returns the value wrapped in single quotes.
+ */
+export declare function escapePowerShellArg(s: string): string;
+/**
+ * Escape batch (cmd.exe) metacharacters for safe use in .bat file content.
+ * Escapes: & | > < ^ % by prefixing each with ^.
+ */
+export declare function escapeBatchMetachars(s: string): string;
+/**
+ * Escape regex metacharacters for use in `grep -E` patterns.
+ */
+export declare function escapeGrepPattern(s: string): string;
+/**
+ * Validate and sanitize a session ID to prevent injection.
+ * Session IDs must be alphanumeric with dashes and underscores only.
+ * Throws if the ID contains invalid characters.
+ */
+export declare function sanitizeSessionId(s: string): string;
+//# sourceMappingURL=shell-escape.d.ts.map

package/dist/utils/shell-escape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-escape.d.ts","sourceRoot":"","sources":["../../src/utils/shell-escape.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAKnD"}

package/dist/utils/shell-escape.js

@@ -0,0 +1,67 @@
+/**
+ * Centralized shell escaping functions to prevent command injection (CWE-78).
+ * Used by platform.ts, execute-prompt.ts, and provision-auth.ts.
+ */
+/**
+ * Escape a string for safe use inside single-quoted Unix shell arguments.
+ * Handles embedded single quotes by ending the quote, adding an escaped quote, and reopening.
+ * e.g. "it's" → 'it'\''s'
+ */
+export function escapeShellArg(s) {
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+/**
+ * Escape a string for safe use inside double-quoted Unix shell arguments.
+ * Escapes: $ ` " \ ! (characters with special meaning inside double quotes).
+ */
+export function escapeDoubleQuoted(s) {
+    return s
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')
+        .replace(/\$/g, '\\$')
+        .replace(/`/g, '\\`')
+        .replace(/!/g, '\\!');
+}
+/**
+ * Escape a string for safe use inside double-quoted Windows cmd.exe arguments.
+ * Escapes: " & | ^ < > (cmd.exe metacharacters).
+ */
+export function escapeWindowsArg(s) {
+    return s
+        .replace(/"/g, '""')
+        .replace(/([&|^<>])/g, '^$1');
+}
+/**
+ * Escape a string for safe use as a PowerShell single-quoted string literal.
+ * Single-quoted strings in PowerShell are fully literal — no variable expansion.
+ * Internal single quotes are escaped by doubling them: ' → ''
+ * Returns the value wrapped in single quotes.
+ */
+export function escapePowerShellArg(s) {
+    return "'" + s.replace(/'/g, "''") + "'";
+}
+/**
+ * Escape batch (cmd.exe) metacharacters for safe use in .bat file content.
+ * Escapes: & | > < ^ % by prefixing each with ^.
+ */
+export function escapeBatchMetachars(s) {
+    return s.replace(/([&|><^%])/g, '^$1');
+}
+/**
+ * Escape regex metacharacters for use in `grep -E` patterns.
+ */
+export function escapeGrepPattern(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Validate and sanitize a session ID to prevent injection.
+ * Session IDs must be alphanumeric with dashes and underscores only.
+ * Throws if the ID contains invalid characters.
+ */
+export function sanitizeSessionId(s) {
+    if (!/^[a-zA-Z0-9_-]+$/.test(s)) {
+        throw new Error(`Invalid session ID: contains disallowed characters`);
+    }
+    return s;
+}
+//# sourceMappingURL=shell-escape.js.map

package/dist/utils/shell-escape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-escape.js","sourceRoot":"","sources":["../../src/utils/shell-escape.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,OAAO,CAAC;SACL,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;SACnB,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAS;IAC3C,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAS;IAC5C,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/utils/ssh-error-messages.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Maps raw ssh2 error strings to user-friendly guidance messages.
+ */
+export declare function classifySshError(error: string): string;
+//# sourceMappingURL=ssh-error-messages.d.ts.map

package/dist/utils/ssh-error-messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-error-messages.d.ts","sourceRoot":"","sources":["../../src/utils/ssh-error-messages.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBtD"}

package/dist/utils/ssh-error-messages.js

@@ -0,0 +1,20 @@
+/**
+ * Maps raw ssh2 error strings to user-friendly guidance messages.
+ */
+export function classifySshError(error) {
+    const msg = error ?? '';
+    if (/Authentication failed|All configured authentication methods failed/i.test(msg)) {
+        return 'Authentication failed — wrong password or key not accepted';
+    }
+    if (/ECONNREFUSED/i.test(msg)) {
+        return 'Connection refused — check host and port';
+    }
+    if (/ETIMEDOUT|ENOTFOUND|EHOSTUNREACH/i.test(msg)) {
+        return 'Host unreachable — check hostname and network';
+    }
+    if (/password prompt could not be opened|OOB|auth-socket/i.test(msg)) {
+        return "Password prompt could not be opened. Try passing the password directly via the 'password' field.";
+    }
+    return msg;
+}
+//# sourceMappingURL=ssh-error-messages.js.map

package/dist/utils/ssh-error-messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-error-messages.js","sourceRoot":"","sources":["../../src/utils/ssh-error-messages.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC;IAExB,IAAI,qEAAqE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,4DAA4D,CAAC;IACtE,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,IAAI,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,+CAA+C,CAAC;IACzD,CAAC;IACD,IAAI,sDAAsD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,kGAAkG,CAAC;IAC5G,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Core version resolution logic with injectable root directory.
+ *
+ * The `rootDir` parameter is a testability seam: callers may pass a path that
+ * does not contain a valid version.json to exercise the catch -> 'v0.0.0-unknown'
+ * fallback without needing to mock native built-ins.  Production code always
+ * calls this via resolveVersion() which supplies the real package root.
+ *
+ * NOTE: the seam is intentionally minimal -- only rootDir is injectable.
+ * The require() loader is NOT injected because changing it would undermine
+ * the createRequire(import.meta.url) lazy-load strategy that keeps this
+ * module from being perturbed by consumers that mock 'node:fs' at module scope
+ * (see update.test.ts).  For the fallback test, a non-existent rootDir is
+ * sufficient to trigger the catch without mocking anything.
+ */
+export declare function resolveVersionFromRoot(rootDir: string): string;
+export declare const serverVersion: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA6C9D;AAqCD,eAAO,MAAM,aAAa,QAAmB,CAAC"}