@autopilot-harness/cli 0.1.0

package/dist/project-fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-fs.js","sourceRoot":"","sources":["../src/project-fs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,yEAAyE;AACzE,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,UAAkB,EAClB,KAAa;IAEb,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO;IACpC,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,IACE,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,QAAgB,EAChB,KAAa;IAEb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,oBAAoB,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAAmB,EACnB,QAAgB,EAChB,KAAa;IAEb,IAAI,EAAY,CAAC;IACjB,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACpD,CAAC;IACD,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAmB,EACnB,QAAgB,EAChB,KAAa;IAEb,IAAI,CAAC;QACH,8BAA8B,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAmB,EACnB,KAA4D;IAE5D,MAAM,YAAY,GAAc,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,8BAA8B,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,KAAa,EACb,WAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAElC,qFAAqF;IACrF,MAAM,IAAI,GACR,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAE7C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAChC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,EAAE,IAAI,CAAC;YACpD,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI,EAAE,CAAC;QACT,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,KAAa;IAC5D,IAAI,EAAY,CAAC;IACjB,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/read-untrusted-file.d.ts

@@ -0,0 +1,41 @@
+/** Default size cap for untrusted project text files (config.yml, hooks.json, …). */
+export declare const MAX_UNTRUSTED_TEXT_BYTES = 1000000;
+/**
+ * O_NOFOLLOW when the platform provides it; 0 on Windows (callers must
+ * assertNotSymlink + post-open identity checks). Override for tests.
+ */
+export declare function resolveNofollowFlag(override?: number): number;
+/** Refuse writing through a symlink (incl. dangling — existsSync lies). */
+export declare function assertNotSymlink(filePath: string, label: string): void;
+/**
+ * Move tmp → dest. Handles EXDEV (stage+rename) and Windows EPERM/EEXIST
+ * (park dest via lstat, incl. dangling symlink). Never writes through a
+ * symlink at dest.
+ */
+export declare function renameReplaceSync(tmp: string, dest: string): void;
+/**
+ * Write text via exclusive tmp (wx) + renameReplaceSync.
+ * wx refuses a pre-planted symlink at the staging path (no write-through).
+ */
+export declare function writeFileReplaceSync(dest: string, contents: string): void;
+/**
+ * Copy via exclusive tmp (nofollow) + renameReplaceSync.
+ * Source is opened O_NOFOLLOW (no read-through); staging path uses O_EXCL.
+ */
+export declare function copyFileReplaceSync(src: string, dest: string): void;
+/**
+ * Copy src → dest with O_CREAT|O_EXCL on dest, without following a symlink at src.
+ * Node's copyFileSync follows source symlinks; this is for hostile-workspace
+ * backups (e.g. state.db → state.db.bak) where TOCTOU swap must fail closed.
+ */
+export declare function copyFileNoFollowExclSync(src: string, dest: string, label: string, opts?: {
+    nofollow?: number;
+}): void;
+/**
+ * Read untrusted text: no symlink follow, size-capped (fstat + readSync).
+ * Throws on symlink / non-regular file / oversize.
+ */
+export declare function readUntrustedUtf8File(filePath: string, maxBytes: number, label: string, opts?: {
+    nofollow?: number;
+}): string;
+//# sourceMappingURL=read-untrusted-file.d.ts.map

package/dist/read-untrusted-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-untrusted-file.d.ts","sourceRoot":"","sources":["../src/read-untrusted-file.ts"],"names":[],"mappings":"AAGA,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,UAAY,CAAC;AAElD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAY7D;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAUtE;AAmGD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBjE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAazE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAanE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,IAAI,CA0FN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,MAAM,CA4DR"}

package/dist/read-untrusted-file.js

@@ -0,0 +1,362 @@
+import { randomBytes } from "node:crypto";
+import fs from "node:fs";
+/** Default size cap for untrusted project text files (config.yml, hooks.json, …). */
+export const MAX_UNTRUSTED_TEXT_BYTES = 1_000_000;
+/**
+ * O_NOFOLLOW when the platform provides it; 0 on Windows (callers must
+ * assertNotSymlink + post-open identity checks). Override for tests.
+ */
+export function resolveNofollowFlag(override) {
+    const platform = typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0;
+    if (override !== undefined) {
+        // Test-only: allow simulating Windows (0) or forcing the platform flag.
+        // Reject arbitrary bitmasks — `O_RDONLY | weird` can change open mode.
+        if (!Number.isInteger(override) || (override !== 0 && override !== platform)) {
+            throw new Error("invalid nofollow override");
+        }
+        return override;
+    }
+    return platform;
+}
+/** Refuse writing through a symlink (incl. dangling — existsSync lies). */
+export function assertNotSymlink(filePath, label) {
+    try {
+        if (fs.lstatSync(filePath).isSymbolicLink()) {
+            throw new Error(`${label} is a symlink; refusing to open`);
+        }
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT")
+            return;
+        throw err;
+    }
+}
+/** Unpredictable sibling path for exclusive staging (same directory as dest). */
+function exclusiveSiblingPath(dest, kind) {
+    return `${dest}.${process.pid}.${randomBytes(8).toString("hex")}.${kind}`;
+}
+function pathPresentViaLstat(p) {
+    try {
+        fs.lstatSync(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Park dest (incl. dangling symlink via lstat), then rename tmp → dest.
+ * Never copyFileSync onto dest (that follows a raced symlink = write-through).
+ */
+function parkAndRename(tmp, dest, first) {
+    if (!pathPresentViaLstat(dest) || !pathPresentViaLstat(tmp)) {
+        throw first instanceof Error ? first : new Error(String(first));
+    }
+    const bak = exclusiveSiblingPath(dest, "bak");
+    fs.renameSync(dest, bak);
+    try {
+        fs.renameSync(tmp, dest);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(dest);
+        }
+        catch {
+            /* may not exist */
+        }
+        try {
+            fs.renameSync(bak, dest);
+        }
+        catch {
+            /* leave bak for manual recovery */
+        }
+        throw err;
+    }
+    try {
+        fs.unlinkSync(bak);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/**
+ * Cross-device: copy onto a unique same-dir stage (nofollow + O_EXCL), then rename.
+ * Never copyFileSync(tmp, dest) or copyFileSync(tmp, stage) — both follow a
+ * raced symlink at tmp (read-through into the committed bytes).
+ */
+function commitViaSameFsStage(tmp, dest) {
+    const stage = exclusiveSiblingPath(dest, "exdev-stage");
+    try {
+        // O_NOFOLLOW on tmp: a symlink swap between create and EXDEV fallback
+        // must not copy the link target's bytes into stage.
+        copyFileNoFollowExclSync(tmp, stage, "exdev-stage-src");
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(stage);
+        }
+        catch {
+            /* ignore */
+        }
+        throw err;
+    }
+    try {
+        fs.unlinkSync(tmp);
+    }
+    catch {
+        /* stage holds the bytes */
+    }
+    try {
+        fs.renameSync(stage, dest);
+        return;
+    }
+    catch (first) {
+        const code = first?.code;
+        if (code === "EPERM" || code === "EEXIST") {
+            try {
+                parkAndRename(stage, dest, first);
+                return;
+            }
+            catch (err) {
+                try {
+                    fs.unlinkSync(stage);
+                }
+                catch {
+                    /* ignore */
+                }
+                throw err;
+            }
+        }
+        try {
+            fs.unlinkSync(stage);
+        }
+        catch {
+            /* ignore */
+        }
+        throw first;
+    }
+}
+/**
+ * Move tmp → dest. Handles EXDEV (stage+rename) and Windows EPERM/EEXIST
+ * (park dest via lstat, incl. dangling symlink). Never writes through a
+ * symlink at dest.
+ */
+export function renameReplaceSync(tmp, dest) {
+    try {
+        fs.renameSync(tmp, dest);
+        return;
+    }
+    catch (first) {
+        const code = first?.code;
+        if (code === "EXDEV") {
+            commitViaSameFsStage(tmp, dest);
+            return;
+        }
+        if (code === "EPERM" || code === "EEXIST") {
+            parkAndRename(tmp, dest, first);
+            return;
+        }
+        throw first;
+    }
+}
+/**
+ * Write text via exclusive tmp (wx) + renameReplaceSync.
+ * wx refuses a pre-planted symlink at the staging path (no write-through).
+ */
+export function writeFileReplaceSync(dest, contents) {
+    const tmp = exclusiveSiblingPath(dest, "tmp");
+    try {
+        fs.writeFileSync(tmp, contents, { encoding: "utf8", flag: "wx" });
+        renameReplaceSync(tmp, dest);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* ignore cleanup */
+        }
+        throw err;
+    }
+}
+/**
+ * Copy via exclusive tmp (nofollow) + renameReplaceSync.
+ * Source is opened O_NOFOLLOW (no read-through); staging path uses O_EXCL.
+ */
+export function copyFileReplaceSync(src, dest) {
+    const tmp = exclusiveSiblingPath(dest, "tmp");
+    try {
+        copyFileNoFollowExclSync(src, tmp, "copy-src");
+        renameReplaceSync(tmp, dest);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* ignore cleanup */
+        }
+        throw err;
+    }
+}
+/**
+ * Copy src → dest with O_CREAT|O_EXCL on dest, without following a symlink at src.
+ * Node's copyFileSync follows source symlinks; this is for hostile-workspace
+ * backups (e.g. state.db → state.db.bak) where TOCTOU swap must fail closed.
+ */
+export function copyFileNoFollowExclSync(src, dest, label, opts) {
+    const nofollow = resolveNofollowFlag(opts?.nofollow);
+    if (nofollow === 0) {
+        assertNotSymlink(src, label);
+    }
+    let srcFd;
+    try {
+        srcFd = fs.openSync(src, fs.constants.O_RDONLY | nofollow);
+    }
+    catch (err) {
+        if (nofollow !== 0 && err?.code === "ELOOP") {
+            throw new Error(`${label} is a symlink; refusing to open`);
+        }
+        throw err;
+    }
+    let outFd;
+    try {
+        const st = fs.fstatSync(srcFd);
+        if (!st.isFile()) {
+            throw new Error(`${label} is not a regular file`);
+        }
+        let lst;
+        try {
+            lst = fs.lstatSync(src);
+        }
+        catch {
+            throw new Error(`${label} disappeared during read`);
+        }
+        if (lst.isSymbolicLink()) {
+            throw new Error(`${label} is a symlink; refusing to open`);
+        }
+        if (typeof lst.ino === "number" &&
+            typeof st.ino === "number" &&
+            (lst.ino !== 0 || st.ino !== 0) &&
+            (lst.ino !== st.ino || lst.dev !== st.dev)) {
+            throw new Error(`${label} changed during read`);
+        }
+        outFd = fs.openSync(dest, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL);
+        const buf = Buffer.alloc(64 * 1024);
+        let copied = 0;
+        while (copied < st.size) {
+            const toRead = Math.min(buf.length, st.size - copied);
+            const n = fs.readSync(srcFd, buf, 0, toRead, copied);
+            if (n === 0) {
+                throw new Error(`${label} read incomplete (${copied}/${st.size} bytes)`);
+            }
+            fs.writeSync(outFd, buf, 0, n);
+            copied += n;
+        }
+        const stAfter = fs.fstatSync(srcFd);
+        if (stAfter.size !== st.size) {
+            throw new Error(`${label} changed during read`);
+        }
+    }
+    catch (err) {
+        if (outFd !== undefined) {
+            try {
+                fs.closeSync(outFd);
+            }
+            catch {
+                /* ignore */
+            }
+            outFd = undefined;
+            try {
+                fs.unlinkSync(dest);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        throw err;
+    }
+    finally {
+        if (outFd !== undefined) {
+            try {
+                fs.closeSync(outFd);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        try {
+            fs.closeSync(srcFd);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+}
+/**
+ * Read untrusted text: no symlink follow, size-capped (fstat + readSync).
+ * Throws on symlink / non-regular file / oversize.
+ */
+export function readUntrustedUtf8File(filePath, maxBytes, label, opts) {
+    if (!Number.isInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error(`${label}: invalid maxBytes`);
+    }
+    const nofollow = resolveNofollowFlag(opts?.nofollow);
+    if (nofollow === 0) {
+        assertNotSymlink(filePath, label);
+    }
+    let fd;
+    try {
+        fd = fs.openSync(filePath, fs.constants.O_RDONLY | nofollow);
+    }
+    catch (err) {
+        if (nofollow !== 0 && err?.code === "ELOOP") {
+            throw new Error(`${label} is a symlink; refusing to open`);
+        }
+        throw err;
+    }
+    try {
+        const st = fs.fstatSync(fd);
+        if (!st.isFile()) {
+            throw new Error(`${label} is not a regular file`);
+        }
+        // Re-check path identity after open: without O_NOFOLLOW (e.g. Windows),
+        // a symlink swap between assertNotSymlink and open would follow the link.
+        // lstat symlink → refuse; ino/dev mismatch → path no longer the opened file.
+        let lst;
+        try {
+            lst = fs.lstatSync(filePath);
+        }
+        catch {
+            throw new Error(`${label} disappeared during read`);
+        }
+        if (lst.isSymbolicLink()) {
+            throw new Error(`${label} is a symlink; refusing to open`);
+        }
+        if (typeof lst.ino === "number" &&
+            typeof st.ino === "number" &&
+            (lst.ino !== 0 || st.ino !== 0) &&
+            (lst.ino !== st.ino || lst.dev !== st.dev)) {
+            throw new Error(`${label} changed during read`);
+        }
+        if (st.size > maxBytes) {
+            throw new Error(`${label} is too large (>${maxBytes} bytes)`);
+        }
+        const buf = Buffer.alloc(st.size);
+        const n = fs.readSync(fd, buf, 0, st.size, 0);
+        if (n !== st.size) {
+            throw new Error(`${label} read incomplete (${n}/${st.size} bytes)`);
+        }
+        // Concurrent truncate/grow after fstat → refuse (fail closed).
+        const stAfter = fs.fstatSync(fd);
+        if (stAfter.size !== st.size) {
+            throw new Error(`${label} changed during read`);
+        }
+        return buf.toString("utf8");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+//# sourceMappingURL=read-untrusted-file.js.map

package/dist/read-untrusted-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-untrusted-file.js","sourceRoot":"","sources":["../src/read-untrusted-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,qFAAqF;AACrF,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,MAAM,QAAQ,GACZ,OAAO,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,KAAa;IAC9D,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC9B,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,oBAAoB,CAAC,IAAY,EAAE,IAAY;IACtD,OAAO,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,IAAY,EAAE,KAAc;IAC9D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,IAAY;IACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,sEAAsE;QACtE,oDAAoD;QACpD,wBAAwB,CAAC,GAAG,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,EAAE,IAAI,CAAC;QACpD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAY;IACzD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,EAAE,IAAI,CAAC;QACpD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,QAAgB;IACjE,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC/C,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAW,EACX,IAAY,EACZ,KAAa,EACb,IAA4B;IAE5B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,QAAQ,KAAK,CAAC,IAAK,GAA6B,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,IACE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,EAAE,CAAC,GAAG,KAAK,QAAQ;YAC1B,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;YAC/B,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QAClD,CAAC;QAED,KAAK,GAAG,EAAE,CAAC,QAAQ,CACjB,IAAI,EACJ,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CACnE,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,qBAAqB,MAAM,IAAI,EAAE,CAAC,IAAI,SAAS,CACxD,CAAC;YACJ,CAAC;YACD,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/B,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,KAAK,GAAG,SAAS,CAAC;YAClB,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,QAAgB,EAChB,KAAa,EACb,IAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,QAAQ,KAAK,CAAC,IAAK,GAA6B,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;QACpD,CAAC;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,IACE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,EAAE,CAAC,GAAG,KAAK,QAAQ;YAC1B,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;YAC/B,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,QAAQ,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC,CAAC;QACtE,CAAC;QACD,+DAA+D;QAC/D,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,38 @@
+import { shortConversationId } from "@autopilot-harness/core";
+export { shortConversationId as shortSessionId };
+export type SessionCmdOk = {
+    ok: true;
+};
+export type SessionCmdFail = {
+    ok: false;
+    error: string;
+};
+export type SessionCmdResult = SessionCmdOk | SessionCmdFail;
+export type SessionListOk = {
+    ok: true;
+    lines: string[];
+};
+export type SessionListResult = SessionListOk | SessionCmdFail;
+export declare function formatSessionDisplayName(row: {
+    track_title: string | null;
+    session_title: string | null;
+    track_id: string;
+}): string;
+export declare function formatSessionList(opts: {
+    projectRoot: string;
+    staleAfterHours?: number;
+}): SessionListResult;
+export declare function renameProjectSession(opts: {
+    projectRoot: string;
+    id: string;
+    title: string;
+}): SessionCmdResult;
+export declare function purgeProjectSession(opts: {
+    projectRoot: string;
+    id: string;
+}): SessionCmdResult;
+export declare function resetProjectSessionReview(opts: {
+    projectRoot: string;
+    id: string;
+}): SessionCmdResult;
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,mBAAmB,EAGpB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,mBAAmB,IAAI,cAAc,EAAE,CAAC;AAEjD,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AACxC,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,cAAc,CAAC;AAE7D,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAC1D,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,cAAc,CAAC;AA2F/D,wBAAgB,wBAAwB,CAAC,GAAG,EAAE;IAC5C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CAWT;AAkCD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,iBAAiB,CA2CpB;AAyBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,gBAAgB,CAqBnB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,gBAAgB,CAOnB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,gBAAgB,CAOnB"}