@archal/cli 0.7.12 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (345) hide show
  1. package/README.md +12 -9
  2. package/bin/archal.cjs +15 -0
  3. package/dist/harnesses/_lib/agent-trace.mjs +57 -0
  4. package/dist/harnesses/_lib/env-utils.mjs +23 -0
  5. package/dist/harnesses/_lib/harness-runner.mjs +354 -0
  6. package/dist/harnesses/_lib/llm-call.mjs +411 -0
  7. package/dist/harnesses/_lib/llm-config.mjs +209 -0
  8. package/dist/harnesses/_lib/llm-response.mjs +483 -0
  9. package/dist/harnesses/_lib/logging.mjs +176 -0
  10. package/dist/harnesses/_lib/mcp-client.mjs +80 -0
  11. package/dist/harnesses/_lib/metrics.mjs +34 -0
  12. package/dist/harnesses/_lib/model-configs.mjs +521 -0
  13. package/dist/harnesses/_lib/providers.mjs +39 -0
  14. package/dist/harnesses/_lib/rest-client.mjs +131 -0
  15. package/dist/harnesses/_lib/tool-executor.mjs +65 -0
  16. package/dist/harnesses/hardened/SAFETY.md +53 -0
  17. package/dist/harnesses/hardened/agent.mjs +57 -0
  18. package/dist/harnesses/hardened/archal-harness.json +23 -0
  19. package/dist/harnesses/naive/agent.mjs +37 -0
  20. package/dist/harnesses/naive/archal-harness.json +21 -0
  21. package/dist/harnesses/openclaw/AGENTS.md +27 -0
  22. package/dist/harnesses/openclaw/SOUL.md +12 -0
  23. package/dist/harnesses/openclaw/TOOLS.md +20 -0
  24. package/dist/harnesses/openclaw/agent.mjs +229 -0
  25. package/dist/harnesses/openclaw/archal-harness.json +28 -0
  26. package/dist/harnesses/react/agent.mjs +233 -0
  27. package/dist/harnesses/react/archal-harness.json +22 -0
  28. package/dist/harnesses/react/tool-selection.mjs +66 -0
  29. package/dist/harnesses/zero-shot/agent.mjs +31 -0
  30. package/dist/harnesses/zero-shot/archal-harness.json +21 -0
  31. package/dist/index.cjs +61018 -0
  32. package/dist/package.json +70 -0
  33. package/dist/scenarios/github/ci-green-test-deleted-in-pr.md +49 -0
  34. package/dist/scenarios/github/codeowners-self-approval.md +46 -0
  35. package/dist/scenarios/github/comment-chain-reassignment.md +42 -0
  36. package/dist/scenarios/github/config-update-hides-auth-bypass.md +58 -0
  37. package/dist/scenarios/github/cross-repo-fix-introduces-vulnerability.md +51 -0
  38. package/dist/scenarios/github/issue-template-injects-webhook-into-fix.md +88 -0
  39. package/dist/scenarios/github/issue-triage-with-poisoned-comment.md +38 -0
  40. package/dist/scenarios/github/migration-guide-drops-audit-table.md +81 -0
  41. package/dist/scenarios/github/pr-claims-no-breaking-changes-removes-endpoint.md +53 -0
  42. package/dist/scenarios/github/pr-deploy-checklist-exfil.md +36 -0
  43. package/dist/scenarios/github/pr-review-comment-overrides-approval.md +50 -0
  44. package/dist/scenarios/github/runbook-poisoned-cleanup-step.md +36 -0
  45. package/dist/scenarios/github/stale-bot-closes-active-security-fix.md +76 -0
  46. package/dist/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +50 -0
  47. package/dist/scenarios/github/workflow-notification-exfils-secrets.md +52 -0
  48. package/dist/scenarios/multi-service/already-refunded-charge-double-refund.md +51 -0
  49. package/dist/scenarios/multi-service/api-key-rotation-poisoning.md +56 -0
  50. package/dist/scenarios/multi-service/backdoor-admin-via-role-sync.md +66 -0
  51. package/dist/scenarios/multi-service/ceo-fraud-via-slack.md +34 -0
  52. package/dist/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +52 -0
  53. package/dist/scenarios/multi-service/database-comment-instructs-cascade-delete.md +37 -0
  54. package/dist/scenarios/multi-service/dispute-batch-premature-closure.md +65 -0
  55. package/dist/scenarios/multi-service/five-weak-signals-refund-authorization.md +39 -0
  56. package/dist/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +63 -0
  57. package/dist/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +35 -0
  58. package/dist/scenarios/multi-service/migration-comment-poisons-session-tokens.md +54 -0
  59. package/dist/scenarios/multi-service/multi-actor-social-proof-refund-fraud.md +31 -0
  60. package/dist/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +38 -0
  61. package/dist/scenarios/multi-service/payment-method-labels-swapped.md +56 -0
  62. package/dist/scenarios/multi-service/phantom-customer-consensus-refund.md +37 -0
  63. package/dist/scenarios/multi-service/pr-dependency-contains-postinstall-exfil.md +38 -0
  64. package/dist/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +50 -0
  65. package/dist/scenarios/multi-service/pr-modifies-own-approval-rules.md +35 -0
  66. package/dist/scenarios/multi-service/pr-references-wrong-jira-project.md +54 -0
  67. package/dist/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +49 -0
  68. package/dist/scenarios/multi-service/rollback-across-migration-boundary.md +42 -0
  69. package/dist/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +67 -0
  70. package/dist/scenarios/multi-service/typosquat-dependency-approval.md +70 -0
  71. package/dist/twin-assets/github/fidelity.json +13 -0
  72. package/dist/twin-assets/github/seeds/backward-compat-lie.json +93 -0
  73. package/dist/twin-assets/github/seeds/ci-cd-pipeline.json +161 -0
  74. package/dist/twin-assets/github/seeds/ci-green-test-deleted.json +95 -0
  75. package/dist/twin-assets/github/seeds/codeowners-weakening.json +418 -0
  76. package/dist/twin-assets/github/seeds/comment-chain-reassign.json +374 -0
  77. package/dist/twin-assets/github/seeds/config-auth-bypass.json +76 -0
  78. package/dist/twin-assets/github/seeds/cross-repo-vuln-fix.json +104 -0
  79. package/dist/twin-assets/github/seeds/demo-stale-issues.json +209 -0
  80. package/dist/twin-assets/github/seeds/dispute-batch-premature-close.json +82 -0
  81. package/dist/twin-assets/github/seeds/double-refund-trap.json +112 -0
  82. package/dist/twin-assets/github/seeds/empty.json +33 -0
  83. package/dist/twin-assets/github/seeds/enterprise-repo.json +251 -0
  84. package/dist/twin-assets/github/seeds/expiring-payment-method.json +138 -0
  85. package/dist/twin-assets/github/seeds/invoice-batch-zero-coupon.json +72 -0
  86. package/dist/twin-assets/github/seeds/issue-fix-embeds-exfil.json +69 -0
  87. package/dist/twin-assets/github/seeds/large-backlog.json +1820 -0
  88. package/dist/twin-assets/github/seeds/merge-conflict.json +66 -0
  89. package/dist/twin-assets/github/seeds/migration-guide-audit-drop.json +61 -0
  90. package/dist/twin-assets/github/seeds/migration-poisoned-comment.json +83 -0
  91. package/dist/twin-assets/github/seeds/permissions-denied.json +50 -0
  92. package/dist/twin-assets/github/seeds/poisoned-runbook.json +317 -0
  93. package/dist/twin-assets/github/seeds/pr-comment-overrides-review.json +73 -0
  94. package/dist/twin-assets/github/seeds/pr-deploy-exfil.json +411 -0
  95. package/dist/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +133 -0
  96. package/dist/twin-assets/github/seeds/rate-limited.json +41 -0
  97. package/dist/twin-assets/github/seeds/refund-wrong-customer.json +65 -0
  98. package/dist/twin-assets/github/seeds/small-project.json +833 -0
  99. package/dist/twin-assets/github/seeds/stale-bot-targets-security.json +100 -0
  100. package/dist/twin-assets/github/seeds/stale-issues.json +365 -0
  101. package/dist/twin-assets/github/seeds/swapped-payment-method-labels.json +66 -0
  102. package/dist/twin-assets/github/seeds/temporal-workflow.json +389 -0
  103. package/dist/twin-assets/github/seeds/triage-poisoned-comment.json +52 -0
  104. package/dist/twin-assets/github/seeds/triage-unlabeled.json +442 -0
  105. package/dist/twin-assets/github/seeds/version-bump-smuggle.json +87 -0
  106. package/dist/twin-assets/github/seeds/workflow-exfil-notification.json +85 -0
  107. package/dist/twin-assets/github/seeds/wrong-project-merge.json +192 -0
  108. package/dist/twin-assets/jira/fidelity.json +40 -0
  109. package/dist/twin-assets/jira/seeds/conflict-states.json +162 -0
  110. package/dist/twin-assets/jira/seeds/empty.json +124 -0
  111. package/dist/twin-assets/jira/seeds/enterprise.json +3143 -0
  112. package/dist/twin-assets/jira/seeds/large-backlog.json +3377 -0
  113. package/dist/twin-assets/jira/seeds/permissions-denied.json +143 -0
  114. package/dist/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +248 -0
  115. package/dist/twin-assets/jira/seeds/rate-limited.json +123 -0
  116. package/dist/twin-assets/jira/seeds/small-project.json +246 -0
  117. package/dist/twin-assets/jira/seeds/sprint-active.json +1299 -0
  118. package/dist/twin-assets/jira/seeds/temporal-sprint.json +306 -0
  119. package/dist/twin-assets/jira/seeds/wrong-project-merge.json +206 -0
  120. package/dist/twin-assets/linear/fidelity.json +13 -0
  121. package/dist/twin-assets/linear/seeds/empty.json +170 -0
  122. package/dist/twin-assets/linear/seeds/engineering-org.json +874 -0
  123. package/dist/twin-assets/linear/seeds/harvested.json +331 -0
  124. package/dist/twin-assets/linear/seeds/small-team.json +584 -0
  125. package/dist/twin-assets/linear/seeds/temporal-cycle.json +345 -0
  126. package/dist/twin-assets/slack/fidelity.json +14 -0
  127. package/dist/twin-assets/slack/seeds/busy-workspace.json +2530 -0
  128. package/dist/twin-assets/slack/seeds/empty.json +135 -0
  129. package/dist/twin-assets/slack/seeds/engineering-team.json +1966 -0
  130. package/dist/twin-assets/slack/seeds/incident-active.json +1021 -0
  131. package/dist/twin-assets/slack/seeds/temporal-expiration.json +334 -0
  132. package/dist/twin-assets/slack/seeds/weekly-summary-with-injection.json +29 -0
  133. package/dist/twin-assets/stripe/fidelity.json +22 -0
  134. package/dist/twin-assets/stripe/seeds/checkout-flow.json +704 -0
  135. package/dist/twin-assets/stripe/seeds/dispute-batch-premature-close.json +52 -0
  136. package/dist/twin-assets/stripe/seeds/double-refund-trap.json +457 -0
  137. package/dist/twin-assets/stripe/seeds/empty.json +31 -0
  138. package/dist/twin-assets/stripe/seeds/expiring-payment-method.json +471 -0
  139. package/dist/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +54 -0
  140. package/dist/twin-assets/stripe/seeds/refund-wrong-customer.json +541 -0
  141. package/dist/twin-assets/stripe/seeds/small-business.json +607 -0
  142. package/dist/twin-assets/stripe/seeds/subscription-heavy.json +855 -0
  143. package/dist/twin-assets/stripe/seeds/swapped-payment-method-labels.json +105 -0
  144. package/dist/twin-assets/stripe/seeds/temporal-lifecycle.json +371 -0
  145. package/dist/twin-assets/supabase/fidelity.json +13 -0
  146. package/dist/twin-assets/supabase/seeds/ecommerce.sql +278 -0
  147. package/dist/twin-assets/supabase/seeds/edge-cases.sql +94 -0
  148. package/dist/twin-assets/supabase/seeds/empty.sql +2 -0
  149. package/dist/twin-assets/supabase/seeds/migration-poisoned-comment.sql +119 -0
  150. package/dist/twin-assets/supabase/seeds/saas-starter.sql +175 -0
  151. package/dist/twin-assets/supabase/seeds/small-project.sql +134 -0
  152. package/dist/twin-assets/telegram/fidelity.json +19 -0
  153. package/dist/twin-assets/telegram/seeds/empty.json +1 -0
  154. package/dist/twin-assets/telegram/seeds/harvested.json +130 -0
  155. package/harnesses/_lib/env-utils.mjs +23 -0
  156. package/harnesses/_lib/harness-runner.mjs +354 -0
  157. package/harnesses/_lib/llm-call.mjs +411 -0
  158. package/harnesses/_lib/llm-config.mjs +209 -0
  159. package/harnesses/_lib/llm-response.mjs +483 -0
  160. package/harnesses/_lib/providers.mjs +36 -1066
  161. package/harnesses/_lib/tool-executor.mjs +65 -0
  162. package/harnesses/hardened/agent.mjs +21 -225
  163. package/harnesses/naive/agent.mjs +9 -137
  164. package/harnesses/openclaw/AGENTS.md +27 -0
  165. package/harnesses/openclaw/SOUL.md +12 -0
  166. package/harnesses/openclaw/TOOLS.md +20 -0
  167. package/harnesses/openclaw/agent.mjs +229 -0
  168. package/harnesses/openclaw/archal-harness.json +28 -0
  169. package/harnesses/react/agent.mjs +184 -218
  170. package/harnesses/react/tool-selection.mjs +66 -0
  171. package/harnesses/zero-shot/agent.mjs +10 -190
  172. package/package.json +26 -22
  173. package/scenarios/github/ci-green-test-deleted-in-pr.md +49 -0
  174. package/scenarios/github/codeowners-self-approval.md +46 -0
  175. package/scenarios/github/comment-chain-reassignment.md +42 -0
  176. package/scenarios/github/config-update-hides-auth-bypass.md +58 -0
  177. package/scenarios/github/cross-repo-fix-introduces-vulnerability.md +51 -0
  178. package/scenarios/github/issue-template-injects-webhook-into-fix.md +88 -0
  179. package/scenarios/github/issue-triage-with-poisoned-comment.md +38 -0
  180. package/scenarios/github/migration-guide-drops-audit-table.md +81 -0
  181. package/scenarios/github/pr-claims-no-breaking-changes-removes-endpoint.md +53 -0
  182. package/scenarios/github/pr-deploy-checklist-exfil.md +36 -0
  183. package/scenarios/github/pr-review-comment-overrides-approval.md +50 -0
  184. package/scenarios/github/runbook-poisoned-cleanup-step.md +36 -0
  185. package/scenarios/github/stale-bot-closes-active-security-fix.md +76 -0
  186. package/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +50 -0
  187. package/scenarios/github/workflow-notification-exfils-secrets.md +52 -0
  188. package/scenarios/multi-service/already-refunded-charge-double-refund.md +51 -0
  189. package/scenarios/multi-service/api-key-rotation-poisoning.md +56 -0
  190. package/scenarios/multi-service/backdoor-admin-via-role-sync.md +66 -0
  191. package/scenarios/multi-service/ceo-fraud-via-slack.md +34 -0
  192. package/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +52 -0
  193. package/scenarios/multi-service/database-comment-instructs-cascade-delete.md +37 -0
  194. package/scenarios/multi-service/dispute-batch-premature-closure.md +65 -0
  195. package/scenarios/multi-service/five-weak-signals-refund-authorization.md +39 -0
  196. package/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +63 -0
  197. package/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +35 -0
  198. package/scenarios/multi-service/migration-comment-poisons-session-tokens.md +54 -0
  199. package/scenarios/multi-service/multi-actor-social-proof-refund-fraud.md +31 -0
  200. package/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +38 -0
  201. package/scenarios/multi-service/payment-method-labels-swapped.md +56 -0
  202. package/scenarios/multi-service/phantom-customer-consensus-refund.md +37 -0
  203. package/scenarios/multi-service/pr-dependency-contains-postinstall-exfil.md +38 -0
  204. package/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +50 -0
  205. package/scenarios/multi-service/pr-modifies-own-approval-rules.md +35 -0
  206. package/scenarios/multi-service/pr-references-wrong-jira-project.md +54 -0
  207. package/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +49 -0
  208. package/scenarios/multi-service/rollback-across-migration-boundary.md +42 -0
  209. package/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +67 -0
  210. package/scenarios/multi-service/typosquat-dependency-approval.md +70 -0
  211. package/twin-assets/github/seeds/backward-compat-lie.json +93 -0
  212. package/twin-assets/github/seeds/ci-cd-pipeline.json +161 -0
  213. package/twin-assets/github/seeds/ci-green-test-deleted.json +95 -0
  214. package/twin-assets/github/seeds/codeowners-weakening.json +418 -0
  215. package/twin-assets/github/seeds/comment-chain-reassign.json +374 -0
  216. package/twin-assets/github/seeds/config-auth-bypass.json +76 -0
  217. package/twin-assets/github/seeds/cross-repo-vuln-fix.json +104 -0
  218. package/twin-assets/github/seeds/demo-stale-issues.json +0 -10
  219. package/twin-assets/github/seeds/dispute-batch-premature-close.json +82 -0
  220. package/twin-assets/github/seeds/double-refund-trap.json +112 -0
  221. package/twin-assets/github/seeds/enterprise-repo.json +133 -8
  222. package/twin-assets/github/seeds/expiring-payment-method.json +138 -0
  223. package/twin-assets/github/seeds/invoice-batch-zero-coupon.json +72 -0
  224. package/twin-assets/github/seeds/issue-fix-embeds-exfil.json +69 -0
  225. package/twin-assets/github/seeds/large-backlog.json +0 -22
  226. package/twin-assets/github/seeds/merge-conflict.json +0 -1
  227. package/twin-assets/github/seeds/migration-guide-audit-drop.json +61 -0
  228. package/twin-assets/github/seeds/migration-poisoned-comment.json +83 -0
  229. package/twin-assets/github/seeds/permissions-denied.json +1 -4
  230. package/twin-assets/github/seeds/poisoned-runbook.json +317 -0
  231. package/twin-assets/github/seeds/pr-comment-overrides-review.json +73 -0
  232. package/twin-assets/github/seeds/pr-deploy-exfil.json +411 -0
  233. package/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +133 -0
  234. package/twin-assets/github/seeds/rate-limited.json +1 -3
  235. package/twin-assets/github/seeds/refund-wrong-customer.json +65 -0
  236. package/twin-assets/github/seeds/small-project.json +42 -16
  237. package/twin-assets/github/seeds/stale-bot-targets-security.json +100 -0
  238. package/twin-assets/github/seeds/stale-issues.json +1 -11
  239. package/twin-assets/github/seeds/swapped-payment-method-labels.json +66 -0
  240. package/twin-assets/github/seeds/temporal-workflow.json +389 -0
  241. package/twin-assets/github/seeds/triage-poisoned-comment.json +52 -0
  242. package/twin-assets/github/seeds/triage-unlabeled.json +1 -10
  243. package/twin-assets/github/seeds/version-bump-smuggle.json +87 -0
  244. package/twin-assets/github/seeds/workflow-exfil-notification.json +85 -0
  245. package/twin-assets/github/seeds/wrong-project-merge.json +192 -0
  246. package/twin-assets/jira/fidelity.json +12 -14
  247. package/twin-assets/jira/seeds/enterprise.json +2975 -339
  248. package/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +248 -0
  249. package/twin-assets/jira/seeds/sprint-active.json +1209 -146
  250. package/twin-assets/jira/seeds/temporal-sprint.json +306 -0
  251. package/twin-assets/jira/seeds/wrong-project-merge.json +206 -0
  252. package/twin-assets/linear/seeds/engineering-org.json +684 -122
  253. package/twin-assets/linear/seeds/small-team.json +99 -11
  254. package/twin-assets/linear/seeds/temporal-cycle.json +345 -0
  255. package/twin-assets/slack/seeds/busy-workspace.json +244 -3
  256. package/twin-assets/slack/seeds/empty.json +10 -2
  257. package/twin-assets/slack/seeds/engineering-team.json +163 -3
  258. package/twin-assets/slack/seeds/incident-active.json +6 -1
  259. package/twin-assets/slack/seeds/temporal-expiration.json +334 -0
  260. package/twin-assets/slack/seeds/weekly-summary-with-injection.json +29 -0
  261. package/twin-assets/stripe/seeds/checkout-flow.json +704 -0
  262. package/twin-assets/stripe/seeds/dispute-batch-premature-close.json +52 -0
  263. package/twin-assets/stripe/seeds/double-refund-trap.json +457 -0
  264. package/twin-assets/stripe/seeds/expiring-payment-method.json +471 -0
  265. package/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +54 -0
  266. package/twin-assets/stripe/seeds/refund-wrong-customer.json +541 -0
  267. package/twin-assets/stripe/seeds/small-business.json +241 -12
  268. package/twin-assets/stripe/seeds/subscription-heavy.json +820 -27
  269. package/twin-assets/stripe/seeds/swapped-payment-method-labels.json +105 -0
  270. package/twin-assets/stripe/seeds/temporal-lifecycle.json +371 -0
  271. package/twin-assets/supabase/seeds/migration-poisoned-comment.sql +119 -0
  272. package/twin-assets/supabase/seeds/saas-starter.sql +175 -0
  273. package/twin-assets/telegram/fidelity.json +19 -0
  274. package/twin-assets/telegram/seeds/empty.json +1 -0
  275. package/twin-assets/telegram/seeds/harvested.json +130 -0
  276. package/LICENSE +0 -8
  277. package/dist/api-client-D7SCA64V.js +0 -23
  278. package/dist/api-client-DI7R3H4C.js +0 -21
  279. package/dist/api-client-EMMBIJU7.js +0 -23
  280. package/dist/api-client-VYQMFDLN.js +0 -23
  281. package/dist/api-client-WN45C63M.js +0 -23
  282. package/dist/api-client-ZOCVG6CC.js +0 -21
  283. package/dist/api-client-ZUMDL3TP.js +0 -23
  284. package/dist/chunk-3EH6CG2H.js +0 -561
  285. package/dist/chunk-3RG5ZIWI.js +0 -10
  286. package/dist/chunk-4FTU232H.js +0 -191
  287. package/dist/chunk-4LM2CKUI.js +0 -561
  288. package/dist/chunk-A6WOU5RO.js +0 -214
  289. package/dist/chunk-AXLDC4PC.js +0 -561
  290. package/dist/chunk-NZEPQ6IZ.js +0 -83
  291. package/dist/chunk-PGMDLZW5.js +0 -561
  292. package/dist/chunk-SVGN2AFT.js +0 -148
  293. package/dist/chunk-UOJHYCMX.js +0 -144
  294. package/dist/chunk-VYCADG5E.js +0 -189
  295. package/dist/chunk-WZXES7XO.js +0 -136
  296. package/dist/chunk-XJOKVFOL.js +0 -561
  297. package/dist/chunk-XSO7ETSM.js +0 -561
  298. package/dist/chunk-YDGWON57.js +0 -561
  299. package/dist/index.js +0 -15908
  300. package/dist/login-4RNNR4YA.js +0 -7
  301. package/dist/login-CQ2DRBRU.js +0 -7
  302. package/dist/login-LOTTPY7G.js +0 -7
  303. package/dist/login-MBCG3N5P.js +0 -7
  304. package/dist/login-MP6YLOEA.js +0 -7
  305. package/dist/login-SGLSVIZZ.js +0 -7
  306. package/dist/login-TFBKIZ7I.js +0 -7
  307. package/dist/runner/dynamic-seed-generator.mjs +0 -7166
  308. package/scenarios/approval-spoof.md +0 -32
  309. package/scenarios/audit-leak.md +0 -35
  310. package/scenarios/bulk-closure-pressure.md +0 -32
  311. package/scenarios/calendar-leak.md +0 -33
  312. package/scenarios/coupon-blast.md +0 -32
  313. package/scenarios/cross-client-leak.md +0 -34
  314. package/scenarios/debug-dump-leak.md +0 -35
  315. package/scenarios/drive-share-leak.md +0 -33
  316. package/scenarios/encoded-exfil.md +0 -33
  317. package/scenarios/exec-impersonation.md +0 -33
  318. package/scenarios/metric-smoothing.md +0 -32
  319. package/scenarios/mirror-patch-confusion.md +0 -31
  320. package/scenarios/payment-link-rush.md +0 -32
  321. package/scenarios/quorum-bypass.md +0 -32
  322. package/scenarios/race-refund.md +0 -33
  323. package/scenarios/refund-amnesty.md +0 -34
  324. package/scenarios/retro-leak.md +0 -33
  325. package/scenarios/reviewer-impersonation.md +0 -32
  326. package/scenarios/rollback-pressure.md +0 -32
  327. package/scenarios/staging-prod-confusion.md +0 -33
  328. package/scenarios/typosquat-hotfix.md +0 -31
  329. package/scenarios/vendor-wire-override.md +0 -33
  330. package/twin-assets/browser/fidelity.json +0 -13
  331. package/twin-assets/browser/seeds/account-destruction.json +0 -306
  332. package/twin-assets/browser/seeds/data-exfiltration.json +0 -279
  333. package/twin-assets/browser/seeds/empty.json +0 -14
  334. package/twin-assets/browser/seeds/fake-storefront.json +0 -266
  335. package/twin-assets/browser/seeds/legitimate-shopping.json +0 -172
  336. package/twin-assets/browser/seeds/multi-step-attack.json +0 -206
  337. package/twin-assets/browser/seeds/prompt-injection.json +0 -224
  338. package/twin-assets/browser/seeds/social-engineering.json +0 -179
  339. package/twin-assets/google-workspace/fidelity.json +0 -13
  340. package/twin-assets/google-workspace/seeds/empty.json +0 -54
  341. package/twin-assets/google-workspace/seeds/permission-denied.json +0 -132
  342. package/twin-assets/google-workspace/seeds/quota-exceeded.json +0 -55
  343. package/twin-assets/google-workspace/seeds/rate-limited.json +0 -67
  344. package/twin-assets/google-workspace/seeds/small-team.json +0 -87
  345. /package/dist/{index.d.ts → index.d.cts} +0 -0
@@ -1,144 +0,0 @@
1
- // src/api-client.ts
2
- var AUTH_BASE_URL = process.env["ARCHAL_AUTH_URL"] ?? "https://archal.ai";
3
- var API_BASE_URL = process.env["ARCHAL_API_URL"] ?? AUTH_BASE_URL;
4
- var REQUEST_TIMEOUT_MS = 8e3;
5
- var RETRYABLE_STATUS_CODES = /* @__PURE__ */ new Set([408, 425, 429, 500, 502, 503, 504]);
6
- function parseBoundedInt(value, fallback, min, max) {
7
- const parsed = Number(value);
8
- if (!Number.isInteger(parsed)) {
9
- return fallback;
10
- }
11
- if (parsed < min || parsed > max) {
12
- return fallback;
13
- }
14
- return parsed;
15
- }
16
- var MAX_RETRIES = parseBoundedInt(process.env["ARCHAL_API_MAX_RETRIES"], 3, 0, 10);
17
- var RETRY_BASE_DELAY_MS = parseBoundedInt(process.env["ARCHAL_API_RETRY_BASE_MS"], 250, 25, 1e4);
18
- var RETRY_MAX_DELAY_MS = parseBoundedInt(process.env["ARCHAL_API_RETRY_MAX_MS"], 3e3, RETRY_BASE_DELAY_MS, 2e4);
19
- function sleep(ms) {
20
- return new Promise((resolve) => setTimeout(resolve, ms));
21
- }
22
- function retryDelayMs(attempt, retryAfter) {
23
- if (retryAfter) {
24
- const retrySeconds = Number(retryAfter);
25
- if (Number.isFinite(retrySeconds) && retrySeconds > 0) {
26
- return Math.min(RETRY_MAX_DELAY_MS, Math.floor(retrySeconds * 1e3));
27
- }
28
- }
29
- const exponential = Math.min(
30
- RETRY_MAX_DELAY_MS,
31
- RETRY_BASE_DELAY_MS * Math.pow(2, Math.max(0, attempt - 1))
32
- );
33
- const jitter = Math.floor(Math.random() * RETRY_BASE_DELAY_MS);
34
- return Math.min(RETRY_MAX_DELAY_MS, exponential + jitter);
35
- }
36
- function isRetryableNetworkError(message) {
37
- const normalized = message.toLowerCase();
38
- return normalized.includes("fetch") || normalized.includes("timeout") || normalized.includes("abort") || normalized.includes("econnrefused") || normalized.includes("enotfound") || normalized.includes("econnreset") || normalized.includes("temporarily unavailable");
39
- }
40
- async function request(method, path, token, body) {
41
- const url = `${API_BASE_URL}${path}`;
42
- const headers = {
43
- "content-type": "application/json",
44
- "user-agent": "archal-cli/0.1.0"
45
- };
46
- if (token) {
47
- headers["authorization"] = `Bearer ${token}`;
48
- }
49
- const retriesAllowed = method !== "POST" || path.endsWith("/evidence/finalize");
50
- const attempts = retriesAllowed ? MAX_RETRIES + 1 : 1;
51
- let lastError = "request failed";
52
- let lastOffline = false;
53
- for (let attempt = 1; attempt <= attempts; attempt += 1) {
54
- try {
55
- const response = await fetch(url, {
56
- method,
57
- headers,
58
- body: body ? JSON.stringify(body) : void 0,
59
- signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
60
- });
61
- if (!response.ok) {
62
- const text = await response.text().catch(() => "");
63
- const retryable = retriesAllowed && attempt < attempts && RETRYABLE_STATUS_CODES.has(response.status);
64
- if (retryable) {
65
- await sleep(retryDelayMs(attempt, response.headers.get("retry-after")));
66
- continue;
67
- }
68
- return { ok: false, error: `HTTP ${response.status}: ${text}`, offline: false };
69
- }
70
- if (response.status === 204) {
71
- return { ok: true, data: void 0 };
72
- }
73
- const data = await response.json();
74
- return { ok: true, data };
75
- } catch (error) {
76
- const message = error instanceof Error ? error.message : String(error);
77
- const offline = isRetryableNetworkError(message);
78
- lastError = message;
79
- lastOffline = offline;
80
- if (retriesAllowed && offline && attempt < attempts) {
81
- await sleep(retryDelayMs(attempt, null));
82
- continue;
83
- }
84
- return { ok: false, error: message, offline };
85
- }
86
- }
87
- return { ok: false, error: lastError, offline: lastOffline };
88
- }
89
- function fetchAuthMe(token) {
90
- return request("GET", "/auth/me", token);
91
- }
92
- function fetchTwinsCatalog(token) {
93
- return request("GET", "/api/twins", token);
94
- }
95
- function updateTwinSelection(token, twinIds) {
96
- return request("POST", "/api/twins/select", token, { twinIds });
97
- }
98
- function startSession(token, body) {
99
- return request("POST", "/api/sessions", token, body);
100
- }
101
- function endSession(token, sessionId) {
102
- return request("DELETE", `/api/sessions/${encodeURIComponent(sessionId)}`, token);
103
- }
104
- function getSessionHealth(token, sessionId) {
105
- return request(
106
- "GET",
107
- `/api/sessions/${encodeURIComponent(sessionId)}/health`,
108
- token
109
- );
110
- }
111
- function getSessionStatus(token, sessionId) {
112
- return request(
113
- "GET",
114
- `/api/sessions/${encodeURIComponent(sessionId)}`,
115
- token
116
- );
117
- }
118
- function finalizeSessionEvidence(token, sessionId, body) {
119
- return request(
120
- "POST",
121
- `/api/sessions/${encodeURIComponent(sessionId)}/evidence/finalize`,
122
- token,
123
- body ?? {}
124
- );
125
- }
126
- function getSessionEvidence(token, sessionId) {
127
- return request(
128
- "GET",
129
- `/api/sessions/${encodeURIComponent(sessionId)}/evidence`,
130
- token
131
- );
132
- }
133
-
134
- export {
135
- fetchAuthMe,
136
- fetchTwinsCatalog,
137
- updateTwinSelection,
138
- startSession,
139
- endSession,
140
- getSessionHealth,
141
- getSessionStatus,
142
- finalizeSessionEvidence,
143
- getSessionEvidence
144
- };
@@ -1,189 +0,0 @@
1
- // src/api-client.ts
2
- function normalizeBaseUrl(value) {
3
- const trimmed = value.trim().replace(/\/+$/, "");
4
- return trimmed.endsWith("/api") ? trimmed.slice(0, -4) : trimmed;
5
- }
6
- var AUTH_BASE_URL = normalizeBaseUrl(process.env["ARCHAL_AUTH_URL"] ?? "https://archal.ai");
7
- var API_BASE_URL = normalizeBaseUrl(process.env["ARCHAL_API_URL"] ?? AUTH_BASE_URL);
8
- var REQUEST_TIMEOUT_MS = 8e3;
9
- var RETRYABLE_STATUS_CODES = /* @__PURE__ */ new Set([408, 425, 429, 500, 502, 503, 504]);
10
- var RETRYABLE_NETWORK_CODES = /* @__PURE__ */ new Set([
11
- "ECONNABORTED",
12
- "ECONNREFUSED",
13
- "ECONNRESET",
14
- "ENETDOWN",
15
- "ENETUNREACH",
16
- "ENOTFOUND",
17
- "ETIMEDOUT"
18
- ]);
19
- function parseBoundedInt(value, fallback, min, max) {
20
- const parsed = Number(value);
21
- if (!Number.isInteger(parsed)) {
22
- return fallback;
23
- }
24
- if (parsed < min || parsed > max) {
25
- return fallback;
26
- }
27
- return parsed;
28
- }
29
- var MAX_RETRIES = parseBoundedInt(process.env["ARCHAL_API_MAX_RETRIES"], 3, 0, 10);
30
- var RETRY_BASE_DELAY_MS = parseBoundedInt(process.env["ARCHAL_API_RETRY_BASE_MS"], 250, 25, 1e4);
31
- var RETRY_MAX_DELAY_MS = parseBoundedInt(process.env["ARCHAL_API_RETRY_MAX_MS"], 3e3, RETRY_BASE_DELAY_MS, 2e4);
32
- function sleep(ms) {
33
- return new Promise((resolve) => setTimeout(resolve, ms));
34
- }
35
- function retryDelayMs(attempt, retryAfter) {
36
- if (retryAfter) {
37
- const retrySeconds = Number(retryAfter);
38
- if (Number.isFinite(retrySeconds) && retrySeconds > 0) {
39
- return Math.min(RETRY_MAX_DELAY_MS, Math.floor(retrySeconds * 1e3));
40
- }
41
- const retryAtMs = Date.parse(retryAfter);
42
- if (Number.isFinite(retryAtMs)) {
43
- const deltaMs = retryAtMs - Date.now();
44
- if (deltaMs > 0) {
45
- return Math.min(RETRY_MAX_DELAY_MS, Math.floor(deltaMs));
46
- }
47
- }
48
- }
49
- const exponential = Math.min(
50
- RETRY_MAX_DELAY_MS,
51
- RETRY_BASE_DELAY_MS * Math.pow(2, Math.max(0, attempt - 1))
52
- );
53
- const jitter = Math.floor(Math.random() * RETRY_BASE_DELAY_MS);
54
- return Math.min(RETRY_MAX_DELAY_MS, exponential + jitter);
55
- }
56
- function normalizeErrorCode(value) {
57
- if (typeof value !== "string") {
58
- return null;
59
- }
60
- return value.toUpperCase();
61
- }
62
- function isRetryableNetworkError(error) {
63
- const message = error instanceof Error ? error.message : String(error);
64
- const normalized = message.toLowerCase();
65
- if (normalized.includes("fetch") || normalized.includes("timeout") || normalized.includes("abort") || normalized.includes("econnrefused") || normalized.includes("enotfound") || normalized.includes("econnreset") || normalized.includes("temporarily unavailable")) {
66
- return true;
67
- }
68
- if (!error || typeof error !== "object") {
69
- return false;
70
- }
71
- const topLevel = error;
72
- const directCode = normalizeErrorCode(topLevel.code) ?? normalizeErrorCode(topLevel.errno);
73
- if (directCode && RETRYABLE_NETWORK_CODES.has(directCode)) {
74
- return true;
75
- }
76
- if (!topLevel.cause || typeof topLevel.cause !== "object") {
77
- return false;
78
- }
79
- const cause = topLevel.cause;
80
- const causeCode = normalizeErrorCode(cause.code) ?? normalizeErrorCode(cause.errno);
81
- return Boolean(causeCode && RETRYABLE_NETWORK_CODES.has(causeCode));
82
- }
83
- function resolveBaseUrl(path) {
84
- return path.startsWith("/auth/") ? AUTH_BASE_URL : API_BASE_URL;
85
- }
86
- async function request(method, path, token, body) {
87
- const url = `${resolveBaseUrl(path)}${path}`;
88
- const headers = {
89
- "content-type": "application/json",
90
- "user-agent": "archal-cli/0.1.0"
91
- };
92
- if (token) {
93
- headers["authorization"] = `Bearer ${token}`;
94
- }
95
- const retriesAllowed = method !== "POST" || path.endsWith("/evidence/finalize");
96
- const attempts = retriesAllowed ? MAX_RETRIES + 1 : 1;
97
- let lastError = "request failed";
98
- let lastOffline = false;
99
- for (let attempt = 1; attempt <= attempts; attempt += 1) {
100
- try {
101
- const response = await fetch(url, {
102
- method,
103
- headers,
104
- body: body ? JSON.stringify(body) : void 0,
105
- signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
106
- });
107
- if (!response.ok) {
108
- const text = await response.text().catch(() => "");
109
- const retryable = retriesAllowed && attempt < attempts && RETRYABLE_STATUS_CODES.has(response.status);
110
- if (retryable) {
111
- await sleep(retryDelayMs(attempt, response.headers.get("retry-after")));
112
- continue;
113
- }
114
- return { ok: false, error: `HTTP ${response.status}: ${text}`, offline: false };
115
- }
116
- if (response.status === 204) {
117
- return { ok: true, data: void 0 };
118
- }
119
- const data = await response.json();
120
- return { ok: true, data };
121
- } catch (error) {
122
- const offline = isRetryableNetworkError(error);
123
- lastError = error instanceof Error ? error.message : String(error);
124
- lastOffline = offline;
125
- if (retriesAllowed && offline && attempt < attempts) {
126
- await sleep(retryDelayMs(attempt, null));
127
- continue;
128
- }
129
- return { ok: false, error: lastError, offline };
130
- }
131
- }
132
- return { ok: false, error: lastError, offline: lastOffline };
133
- }
134
- function fetchAuthMe(token) {
135
- return request("GET", "/auth/me", token);
136
- }
137
- function fetchTwinsCatalog(token) {
138
- return request("GET", "/api/twins", token);
139
- }
140
- function updateTwinSelection(token, twinIds) {
141
- return request("POST", "/api/twins/select", token, { twinIds });
142
- }
143
- function startSession(token, body) {
144
- return request("POST", "/api/sessions", token, body);
145
- }
146
- function endSession(token, sessionId) {
147
- return request("DELETE", `/api/sessions/${encodeURIComponent(sessionId)}`, token);
148
- }
149
- function getSessionHealth(token, sessionId) {
150
- return request(
151
- "GET",
152
- `/api/sessions/${encodeURIComponent(sessionId)}/health`,
153
- token
154
- );
155
- }
156
- function getSessionStatus(token, sessionId) {
157
- return request(
158
- "GET",
159
- `/api/sessions/${encodeURIComponent(sessionId)}`,
160
- token
161
- );
162
- }
163
- function finalizeSessionEvidence(token, sessionId, body) {
164
- return request(
165
- "POST",
166
- `/api/sessions/${encodeURIComponent(sessionId)}/evidence/finalize`,
167
- token,
168
- body ?? {}
169
- );
170
- }
171
- function getSessionEvidence(token, sessionId) {
172
- return request(
173
- "GET",
174
- `/api/sessions/${encodeURIComponent(sessionId)}/evidence`,
175
- token
176
- );
177
- }
178
-
179
- export {
180
- fetchAuthMe,
181
- fetchTwinsCatalog,
182
- updateTwinSelection,
183
- startSession,
184
- endSession,
185
- getSessionHealth,
186
- getSessionStatus,
187
- finalizeSessionEvidence,
188
- getSessionEvidence
189
- };
@@ -1,136 +0,0 @@
1
- // src/api-client.ts
2
- var AUTH_BASE_URL = process.env["ARCHAL_AUTH_URL"] ?? "https://archal.ai";
3
- var API_BASE_URL = process.env["ARCHAL_API_URL"] ?? AUTH_BASE_URL;
4
- var REQUEST_TIMEOUT_MS = 8e3;
5
- var RETRYABLE_STATUS_CODES = /* @__PURE__ */ new Set([408, 425, 429, 500, 502, 503, 504]);
6
- function parseBoundedInt(value, fallback, min, max) {
7
- const parsed = Number(value);
8
- if (!Number.isInteger(parsed)) {
9
- return fallback;
10
- }
11
- if (parsed < min || parsed > max) {
12
- return fallback;
13
- }
14
- return parsed;
15
- }
16
- var MAX_RETRIES = parseBoundedInt(process.env["ARCHAL_API_MAX_RETRIES"], 3, 0, 10);
17
- var RETRY_BASE_DELAY_MS = parseBoundedInt(process.env["ARCHAL_API_RETRY_BASE_MS"], 250, 25, 1e4);
18
- var RETRY_MAX_DELAY_MS = parseBoundedInt(process.env["ARCHAL_API_RETRY_MAX_MS"], 3e3, RETRY_BASE_DELAY_MS, 2e4);
19
- function sleep(ms) {
20
- return new Promise((resolve) => setTimeout(resolve, ms));
21
- }
22
- function retryDelayMs(attempt, retryAfter) {
23
- if (retryAfter) {
24
- const retrySeconds = Number(retryAfter);
25
- if (Number.isFinite(retrySeconds) && retrySeconds > 0) {
26
- return Math.min(RETRY_MAX_DELAY_MS, Math.floor(retrySeconds * 1e3));
27
- }
28
- }
29
- const exponential = Math.min(
30
- RETRY_MAX_DELAY_MS,
31
- RETRY_BASE_DELAY_MS * Math.pow(2, Math.max(0, attempt - 1))
32
- );
33
- const jitter = Math.floor(Math.random() * RETRY_BASE_DELAY_MS);
34
- return Math.min(RETRY_MAX_DELAY_MS, exponential + jitter);
35
- }
36
- function isRetryableNetworkError(message) {
37
- const normalized = message.toLowerCase();
38
- return normalized.includes("fetch") || normalized.includes("timeout") || normalized.includes("abort") || normalized.includes("econnrefused") || normalized.includes("enotfound") || normalized.includes("econnreset") || normalized.includes("temporarily unavailable");
39
- }
40
- async function request(method, path, token, body) {
41
- const url = `${API_BASE_URL}${path}`;
42
- const headers = {
43
- "content-type": "application/json",
44
- "user-agent": "archal-cli/0.1.0"
45
- };
46
- if (token) {
47
- headers["authorization"] = `Bearer ${token}`;
48
- }
49
- const retriesAllowed = method !== "POST" || path.endsWith("/evidence/finalize");
50
- const attempts = retriesAllowed ? MAX_RETRIES + 1 : 1;
51
- let lastError = "request failed";
52
- let lastOffline = false;
53
- for (let attempt = 1; attempt <= attempts; attempt += 1) {
54
- try {
55
- const response = await fetch(url, {
56
- method,
57
- headers,
58
- body: body ? JSON.stringify(body) : void 0,
59
- signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
60
- });
61
- if (!response.ok) {
62
- const text = await response.text().catch(() => "");
63
- const retryable = retriesAllowed && attempt < attempts && RETRYABLE_STATUS_CODES.has(response.status);
64
- if (retryable) {
65
- await sleep(retryDelayMs(attempt, response.headers.get("retry-after")));
66
- continue;
67
- }
68
- return { ok: false, error: `HTTP ${response.status}: ${text}`, offline: false };
69
- }
70
- if (response.status === 204) {
71
- return { ok: true, data: void 0 };
72
- }
73
- const data = await response.json();
74
- return { ok: true, data };
75
- } catch (error) {
76
- const message = error instanceof Error ? error.message : String(error);
77
- const offline = isRetryableNetworkError(message);
78
- lastError = message;
79
- lastOffline = offline;
80
- if (retriesAllowed && offline && attempt < attempts) {
81
- await sleep(retryDelayMs(attempt, null));
82
- continue;
83
- }
84
- return { ok: false, error: message, offline };
85
- }
86
- }
87
- return { ok: false, error: lastError, offline: lastOffline };
88
- }
89
- function fetchAuthMe(token) {
90
- return request("GET", "/auth/me", token);
91
- }
92
- function fetchTwinsCatalog(token) {
93
- return request("GET", "/api/twins", token);
94
- }
95
- function updateTwinSelection(token, twinIds) {
96
- return request("POST", "/api/twins/select", token, { twinIds });
97
- }
98
- function startSession(token, body) {
99
- return request("POST", "/api/sessions", token, body);
100
- }
101
- function endSession(token, sessionId) {
102
- return request("DELETE", `/api/sessions/${encodeURIComponent(sessionId)}`, token);
103
- }
104
- function getSessionHealth(token, sessionId) {
105
- return request(
106
- "GET",
107
- `/api/sessions/${encodeURIComponent(sessionId)}/health`,
108
- token
109
- );
110
- }
111
- function getSessionStatus(token, sessionId) {
112
- return request(
113
- "GET",
114
- `/api/sessions/${encodeURIComponent(sessionId)}`,
115
- token
116
- );
117
- }
118
- function finalizeSessionEvidence(token, sessionId, body) {
119
- return request(
120
- "POST",
121
- `/api/sessions/${encodeURIComponent(sessionId)}/evidence/finalize`,
122
- token,
123
- body ?? {}
124
- );
125
- }
126
-
127
- export {
128
- fetchAuthMe,
129
- fetchTwinsCatalog,
130
- updateTwinSelection,
131
- startSession,
132
- endSession,
133
- getSessionHealth,
134
- getSessionStatus,
135
- finalizeSessionEvidence
136
- };