@bjoernrochel/sevro 0.1.0-rc.8 → 1.1.0

package/dist/src/cli/init.js

@@ -0,0 +1,82 @@
+import { examplePath, sourceRuntime } from "../runner-paths.js";
+import { cp, mkdir, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { nativeReadme, templateCommand, templateSettings, } from "./init-settings.js";
+function initOptions(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        strict: true,
+        allowPositionals: true,
+        options: {
+            template: { type: "string", default: "response" },
+            directory: { type: "string", default: "sevro-evaluation" },
+        },
+    });
+    if (positionals.length ||
+        !["response", "coding", "repository-skill"].includes(values.template))
+        throw new Error("use --template response, coding or repository-skill; run sevro init --help");
+    if (!values.directory.trim())
+        throw new Error("--directory must name a new directory");
+    return { template: values.template, destination: resolve(values.directory) };
+}
+async function reserveDirectory(destination) {
+    await mkdir(dirname(destination), { recursive: true });
+    try {
+        await mkdir(destination);
+    }
+    catch (cause) {
+        throw new Error(`init destination already exists or cannot be created: ${destination}; choose a new --directory`, { cause });
+    }
+}
+function starterReadme(template) {
+    if (template === "repository-skill")
+        return nativeReadme();
+    const assertion = template === "coding"
+        ? "positive, negative and zero addition assertions against edited add.sh"
+        : "an exact response assertion";
+    const prerequisites = template === "coding"
+        ? "Node.js 24.13.0 or newer, or Bun 1.3.13, plus sandbox-exec on macOS or bubblewrap/socat on Linux"
+        : "Node.js 24.13.0 or newer, or Bun 1.3.13";
+    return `# ${template} evaluation\n\nThis deterministic adapter exercises ${assertion}, without model credentials. Prerequisites: ${prerequisites}.\n\n\`\`\`sh\nsevro run --run-manifest-file run.json --dry\nsevro run --run-manifest-file run.json\nsevro report --latest\nSEVRO_TEMPLATE_FAIL=1 sevro run --run-manifest-file run.json\n\`\`\`\n\nThe negative control must report task=failed and exit 1. Dry preparation is not an assessment.\nEdit case.json and ${sourceRuntime ? "adapter.ts" : "adapter.js"}, prepare, then run again. Keep private .sevro evidence out of Git.\nFor a native model, replace the adapter route explicitly with --host, --model and --effort; Codex also requires --codex-auth-file. No model execution or native skill dispatch is established by this adapter.\n`;
+}
+async function initialize(template, destination) {
+    await reserveDirectory(destination);
+    try {
+        await cp(examplePath("templates", template), destination, {
+            recursive: true,
+            errorOnExist: true,
+            force: false,
+        });
+        await writeFile(join(destination, "run.json"), JSON.stringify({ format: "sevro.run.v1", settings: templateSettings(template) }, null, 2) + "\n", { flag: "wx" });
+        if (template === "repository-skill")
+            await writeFile(join(destination, "command.json"), JSON.stringify(templateCommand(destination)) + "\n", { flag: "wx" });
+        await writeFile(join(destination, ".gitignore"), ".sevro/\n", {
+            flag: "wx",
+        });
+        await writeFile(join(destination, "README.md"), starterReadme(template), {
+            flag: "wx",
+        });
+    }
+    catch (cause) {
+        await rm(destination, { recursive: true, force: true });
+        throw cause;
+    }
+}
+export async function initCommand(argv) {
+    try {
+        const { template, destination } = initOptions(argv);
+        await initialize(template, destination);
+        const quoted = `'${destination.replaceAll("'", "'\\''")}'`;
+        const native = template === "repository-skill"
+            ? " --model YOUR_MODEL --effort YOUR_EFFORT --codex-auth-file /absolute/auth.json"
+            : "";
+        process.stdout.write(`Created ${template} evaluation at ${destination}\nOpen README.md, then:\n  cd ${quoted}\n  sevro run --run-manifest-file run.json${native} --dry\n  sevro run --run-manifest-file run.json${native}\n`);
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`sevro: ${error instanceof Error ? error.message : "initialization failed"}\n`);
+        return 64;
+    }
+}
+//# sourceMappingURL=init.js.map

package/dist/src/cli/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,2BAAwB;AAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,yBAAyB;AAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB;AACnD,OAAO,EAAE,SAAS,EAAE,kBAAkB;AACtC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,2BAAwB;AAEzB,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE;YACjD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE;SAC3D;KACF,CAAC,CAAC;IACH,IACE,WAAW,CAAC,MAAM;QAClB,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAErE,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE;QAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,yDAAyD,WAAW,4BAA4B,EAChG,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,QAAQ,KAAK,kBAAkB;QAAE,OAAO,YAAY,EAAE,CAAC;IAC3D,MAAM,SAAS,GACb,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,uEAAuE;QACzE,CAAC,CAAC,6BAA6B,CAAC;IACpC,MAAM,aAAa,GACjB,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,kGAAkG;QACpG,CAAC,CAAC,yCAAyC,CAAC;IAChD,OAAO,KAAK,QAAQ,uDAAuD,SAAS,+CAA+C,aAAa,0TAA0T,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,uRAAuR,CAAC;AAC/wB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,WAAmB;IAC7D,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE;YACxD,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACH,MAAM,SAAS,CACb,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAC7B,IAAI,CAAC,SAAS,CACZ,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAChE,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,EACR,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;QACF,IAAI,QAAQ,KAAK,kBAAkB;YACjC,MAAM,SAAS,CACb,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EACjC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,GAAG,IAAI,EACnD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;QACJ,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE;YAC5D,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE;YACvE,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;QAC3D,MAAM,MAAM,GACV,QAAQ,KAAK,kBAAkB;YAC7B,CAAC,CAAC,gFAAgF;YAClF,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,WAAW,QAAQ,kBAAkB,WAAW,iCAAiC,MAAM,6CAA6C,MAAM,mDAAmD,MAAM,IAAI,CACxM,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAC/E,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { examplePath, sourceRuntime } from \"../runner-paths\";\nimport { cp, mkdir, rm, writeFile } from \"node:fs/promises\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { parseArgs } from \"node:util\";\nimport {\n  nativeReadme,\n  templateCommand,\n  templateSettings,\n} from \"./init-settings\";\n\nfunction initOptions(argv: string[]) {\n  const { values, positionals } = parseArgs({\n    args: argv,\n    strict: true,\n    allowPositionals: true,\n    options: {\n      template: { type: \"string\", default: \"response\" },\n      directory: { type: \"string\", default: \"sevro-evaluation\" },\n    },\n  });\n  if (\n    positionals.length ||\n    ![\"response\", \"coding\", \"repository-skill\"].includes(values.template)\n  )\n    throw new Error(\n      \"use --template response, coding or repository-skill; run sevro init --help\",\n    );\n  if (!values.directory.trim())\n    throw new Error(\"--directory must name a new directory\");\n  return { template: values.template, destination: resolve(values.directory) };\n}\n\nasync function reserveDirectory(destination: string): Promise<void> {\n  await mkdir(dirname(destination), { recursive: true });\n  try {\n    await mkdir(destination);\n  } catch (cause) {\n    throw new Error(\n      `init destination already exists or cannot be created: ${destination}; choose a new --directory`,\n      { cause },\n    );\n  }\n}\n\nfunction starterReadme(template: string) {\n  if (template === \"repository-skill\") return nativeReadme();\n  const assertion =\n    template === \"coding\"\n      ? \"positive, negative and zero addition assertions against edited add.sh\"\n      : \"an exact response assertion\";\n  const prerequisites =\n    template === \"coding\"\n      ? \"Node.js 24.13.0 or newer, or Bun 1.3.13, plus sandbox-exec on macOS or bubblewrap/socat on Linux\"\n      : \"Node.js 24.13.0 or newer, or Bun 1.3.13\";\n  return `# ${template} evaluation\\n\\nThis deterministic adapter exercises ${assertion}, without model credentials. Prerequisites: ${prerequisites}.\\n\\n\\`\\`\\`sh\\nsevro run --run-manifest-file run.json --dry\\nsevro run --run-manifest-file run.json\\nsevro report --latest\\nSEVRO_TEMPLATE_FAIL=1 sevro run --run-manifest-file run.json\\n\\`\\`\\`\\n\\nThe negative control must report task=failed and exit 1. Dry preparation is not an assessment.\\nEdit case.json and ${sourceRuntime ? \"adapter.ts\" : \"adapter.js\"}, prepare, then run again. Keep private .sevro evidence out of Git.\\nFor a native model, replace the adapter route explicitly with --host, --model and --effort; Codex also requires --codex-auth-file. No model execution or native skill dispatch is established by this adapter.\\n`;\n}\n\nasync function initialize(template: string, destination: string) {\n  await reserveDirectory(destination);\n  try {\n    await cp(examplePath(\"templates\", template), destination, {\n      recursive: true,\n      errorOnExist: true,\n      force: false,\n    });\n    await writeFile(\n      join(destination, \"run.json\"),\n      JSON.stringify(\n        { format: \"sevro.run.v1\", settings: templateSettings(template) },\n        null,\n        2,\n      ) + \"\\n\",\n      { flag: \"wx\" },\n    );\n    if (template === \"repository-skill\")\n      await writeFile(\n        join(destination, \"command.json\"),\n        JSON.stringify(templateCommand(destination)) + \"\\n\",\n        { flag: \"wx\" },\n      );\n    await writeFile(join(destination, \".gitignore\"), \".sevro/\\n\", {\n      flag: \"wx\",\n    });\n    await writeFile(join(destination, \"README.md\"), starterReadme(template), {\n      flag: \"wx\",\n    });\n  } catch (cause) {\n    await rm(destination, { recursive: true, force: true });\n    throw cause;\n  }\n}\n\nexport async function initCommand(argv: string[]): Promise<number> {\n  try {\n    const { template, destination } = initOptions(argv);\n    await initialize(template, destination);\n    const quoted = `'${destination.replaceAll(\"'\", \"'\\\\''\")}'`;\n    const native =\n      template === \"repository-skill\"\n        ? \" --model YOUR_MODEL --effort YOUR_EFFORT --codex-auth-file /absolute/auth.json\"\n        : \"\";\n    process.stdout.write(\n      `Created ${template} evaluation at ${destination}\\nOpen README.md, then:\\n  cd ${quoted}\\n  sevro run --run-manifest-file run.json${native} --dry\\n  sevro run --run-manifest-file run.json${native}\\n`,\n    );\n    return 0;\n  } catch (error) {\n    process.stderr.write(\n      `sevro: ${error instanceof Error ? error.message : \"initialization failed\"}\\n`,\n    );\n    return 64;\n  }\n}\n"]}

package/dist/src/cli/invocation.js

@@ -0,0 +1,431 @@
+import { which } from "../executable.js";
+import { join, resolve } from "node:path";
+import { validQualifiedId } from "../value-guards.js";
+import { canonicalRuntimeRoot } from "../runtime/paths.js";
+import { PATH_OPTIONS, PATH_LIST_OPTIONS, EXTENSION_OPTIONS, RUN_OPTIONS, optionsWith, runArguments, } from "./run-options.js";
+import { savedRunValues } from "./run-manifest.js";
+export class InvocationError extends Error {
+}
+function requiredOption(value, name) {
+    if (!value)
+        throw new InvocationError(`missing ${name}; supply ${name} with a value`);
+    return value;
+}
+function optionalDigest(value, name) {
+    if (value !== undefined && !/^[a-f0-9]{64}$/.test(value))
+        throw new InvocationError(`${name} must be a 64-character SHA-256 digest`);
+    return value;
+}
+function conditionOption(value) {
+    const condition = requiredOption(value, "--condition");
+    if (condition !== "passive" && condition !== "enforced")
+        throw new InvocationError("invalid --condition; use passive or enforced");
+    return condition;
+}
+function cliArguments(argv) {
+    try {
+        return runArguments(argv);
+    }
+    catch (cause) {
+        const detail = cause instanceof Error ? `: ${cause.message}` : "";
+        throw new InvocationError(`invalid CLI arguments${detail}`, { cause });
+    }
+}
+function trialParameters(values) {
+    const condition = conditionOption(values.condition);
+    const trialCount = Number(requiredOption(values.trials, "--trials"));
+    const jobs = Number(requiredOption(values.jobs, "--jobs"));
+    const passThreshold = Number(requiredOption(values.threshold, "--threshold"));
+    positiveInteger(trialCount, "--trials");
+    positiveInteger(jobs, "--jobs");
+    if (!Number.isFinite(passThreshold) ||
+        passThreshold <= 0 ||
+        passThreshold > 1)
+        throw new InvocationError("invalid --threshold; supply a number greater than 0 and at most 1");
+    return { condition, trialCount, jobs, passThreshold };
+}
+function positiveInteger(value, option) {
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new InvocationError(`invalid ${option}; supply a positive integer`);
+}
+function hostRoutes(values) {
+    const codex = values.host === "codex";
+    const claude = values.host === "claude";
+    const semanticCodex = values["semantic-host"] === "codex";
+    const advisoryCodex = values["advisory-host"] === "codex";
+    return {
+        codex,
+        claude,
+        builtinHost: codex || claude,
+        semanticCodex,
+        advisoryCodex,
+        anyCodex: codex || semanticCodex || advisoryCodex,
+    };
+}
+const HOST_COMPATIBILITY = [
+    {
+        invalid: (v, r) => v["codex-entrypoint"] !== undefined &&
+            (!r.codex || !["exec", "app-server"].includes(v["codex-entrypoint"])),
+        message: "--codex-entrypoint requires --host codex and exec or app-server",
+    },
+    {
+        invalid: (v, r) => v.host && !r.builtinHost,
+        message: "unsupported --host; use codex or claude",
+    },
+    {
+        invalid: (v, r) => v["semantic-host"] && !r.semanticCodex,
+        message: "unsupported --semantic-host; use codex",
+    },
+    {
+        invalid: (v, r) => v["advisory-host"] && !r.advisoryCodex,
+        message: "unsupported --advisory-host; use codex",
+    },
+    {
+        invalid: (v, r) => r.semanticCodex && v["semantic-adapter-module"],
+        message: "--semantic-host and --semantic-adapter-module are exclusive",
+    },
+    {
+        invalid: (v, r) => r.advisoryCodex && v["advisory-adapter-module"],
+        message: "--advisory-host and --advisory-adapter-module are exclusive",
+    },
+    {
+        invalid: (v, r) => r.builtinHost && v["adapter-module"],
+        message: "--host and --adapter-module are exclusive",
+    },
+    {
+        invalid: (v, r) => !r.builtinHost && !v["adapter-module"],
+        message: "missing --adapter-module or --host",
+    },
+    {
+        invalid: (v, r) => !r.builtinHost && (v.model || v.effort),
+        message: "--model and --effort require a built-in host",
+    },
+    {
+        invalid: (v, r) => !r.semanticCodex && (v["semantic-model"] || v["semantic-effort"]),
+        message: "semantic model options require --semantic-host codex",
+    },
+    {
+        invalid: (v, r) => !r.advisoryCodex && (v["advisory-model"] || v["advisory-effort"]),
+        message: "advisory model options require --advisory-host codex",
+    },
+    {
+        invalid: (v, r) => v["advisory-exclude"]?.length &&
+            !r.advisoryCodex &&
+            !v["advisory-adapter-module"],
+        message: "--advisory-exclude requires an advisory route",
+    },
+    {
+        invalid: (v, r) => !r.anyCodex && hasRouteOptions(v, "codex"),
+        message: "Codex options require a Codex host route",
+    },
+    {
+        invalid: (v, r) => !r.claude && hasRouteOptions(v, "claude"),
+        message: "Claude options require --host claude",
+    },
+    {
+        invalid: (v, r, roots) => roots.length &&
+            !v["shell-isolation"] &&
+            !r.builtinHost &&
+            !r.semanticCodex &&
+            !r.advisoryCodex,
+        message: "--protected-root requires isolation",
+    },
+];
+function hasRouteOptions(values, route) {
+    return optionsWith("route", route).some((name) => {
+        if (RUN_OPTIONS[name].kind === "number")
+            return values[name] !== undefined;
+        return Boolean(values[name]);
+    });
+}
+function validateHostCompatibility(values, routes, roots) {
+    for (const rule of HOST_COMPATIBILITY)
+        if (rule.invalid(values, routes, roots))
+            throw new InvocationError(rule.message);
+}
+function rootParameters(values) {
+    const projectRoot = requiredOption(values["project-root"], "--project-root");
+    const configRoot = values["config-root"] !== undefined
+        ? requiredOption(values["config-root"], "--config-root")
+        : projectRoot;
+    const resultsRoot = requiredOption(values["results-root"], "--results-root");
+    const runStateRoot = values["run-state-root"]
+        ? requiredOption(values["run-state-root"], "--run-state-root")
+        : resultsRoot;
+    return { projectRoot, configRoot, resultsRoot, runStateRoot };
+}
+function validateExtensionSelection(values) {
+    const policy = values["task-verdict-policy"];
+    if (policy !== undefined && !validQualifiedId(policy))
+        throw new InvocationError("invalid --task-verdict-policy");
+    const replacements = values["replace-builtin-grader"] ?? [];
+    validateReplacements(replacements);
+    if (Boolean(values["case-file"]) === Boolean(values["extension-command-file"]))
+        throw new InvocationError("select exactly one of --case-file or --extension-command-file");
+    validateExtensionArguments(values);
+    validatePairedFiles(values);
+}
+function validateReplacements(replacements) {
+    if (new Set(replacements).size !== replacements.length ||
+        replacements.some((id) => !validQualifiedId(id)))
+        throw new InvocationError("invalid --replace-builtin-grader");
+}
+function hasExtensionArguments(values) {
+    return EXTENSION_OPTIONS.some((name) => {
+        const value = values[name];
+        if (Array.isArray(value))
+            return value.length > 0;
+        if (name === "task-verdict-policy")
+            return value !== undefined;
+        return Boolean(value);
+    });
+}
+function extensionSources(values) {
+    const sources = values["extension-source-file"];
+    if (!sources?.length)
+        throw new InvocationError("missing --extension-source-file");
+    return sources;
+}
+function validateExtensionArguments(values) {
+    if (values["extension-command-file"]) {
+        requiredOption(values["case-id"], "--case-id");
+        extensionSources(values);
+    }
+    else if (hasExtensionArguments(values))
+        throw new InvocationError("extension options require --extension-command-file");
+}
+function validatePairedFiles(values) {
+    if (Boolean(values["extension-configuration-file"]) !==
+        Boolean(values["extension-redacted-configuration-file"]))
+        throw new InvocationError("extension configuration requires a redacted file");
+    if (Boolean(values["case-source-root"]) !==
+        Boolean(values["case-source-map-file"]))
+        throw new InvocationError("case sources require a root and map file");
+}
+function privateRootDeclarations(values, configRoot, protectedRoots) {
+    return [
+        configRoot,
+        ...protectedRoots,
+        ...optionsWith("private", true).flatMap((name) => values[name] ?? []),
+    ].filter((value) => Boolean(value));
+}
+function commonCodexOptions(values, roots, privateRoots) {
+    return {
+        binary: requiredOption(values["codex-bin"], "--codex-bin"),
+        authFile: requiredOption(values["codex-auth-file"], "--codex-auth-file"),
+        retainHostDiagnostics: values["retain-host-diagnostics"] === true,
+        timeoutMs: codexTimeout(values["codex-timeout-ms"]),
+        projectRoot: roots.projectRoot,
+        resultsRoot: roots.resultsRoot,
+        additionalProtectedRoots: [...privateRoots, roots.runStateRoot],
+    };
+}
+function codexTimeout(value) {
+    if (value === undefined)
+        return undefined;
+    const timeout = Number(value);
+    if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30 * 60_000)
+        throw new InvocationError("invalid --codex-timeout-ms; supply a positive integer at most 1800000 (30 minutes)");
+    return timeout;
+}
+function claudeHostOptions(values, routes, roots, privateRoots, toolchainBinDir) {
+    if (!routes.claude)
+        return undefined;
+    return {
+        retainHostDiagnostics: values["retain-host-diagnostics"] === true,
+        binary: requiredOption(values["claude-bin"], "--claude-bin"),
+        ...(values["claude-credential-file"]
+            ? {
+                credentialFile: requiredOption(values["claude-credential-file"], "--claude-credential-file"),
+            }
+            : {}),
+        ...(values["claude-uv-cache-dir"]
+            ? {
+                uvCacheDir: requiredOption(values["claude-uv-cache-dir"], "--claude-uv-cache-dir"),
+            }
+            : {}),
+        model: requiredOption(values.model, "--model"),
+        effort: requiredOption(values.effort, "--effort"),
+        toolchainBinDir,
+        projectSettings: values["claude-project-settings"] ?? false,
+        projectRoot: roots.projectRoot,
+        resultsRoot: roots.resultsRoot,
+        additionalProtectedRoots: [...privateRoots, roots.runStateRoot],
+    };
+}
+function extensionInvocation(values) {
+    const command = values["extension-command-file"];
+    if (!command)
+        return undefined;
+    return {
+        commandFile: requiredOption(command, "--extension-command-file"),
+        sourceFiles: extensionSources(values),
+        caseId: requiredOption(values["case-id"], "--case-id"),
+        configurationFile: values["extension-configuration-file"],
+        redactedConfigurationFile: values["extension-redacted-configuration-file"],
+        taskVerdictPolicy: values["task-verdict-policy"],
+        replaceBuiltinGraders: values["replace-builtin-grader"] ?? [],
+    };
+}
+const CODEX_MODEL_KEYS = {
+    candidate: ["model", "effort"],
+    semantic: ["semantic-model", "semantic-effort"],
+    advisory: ["advisory-model", "advisory-effort"],
+};
+function codexRoleOptions(values, common, role) {
+    const [modelKey, effortKey] = CODEX_MODEL_KEYS[role];
+    return {
+        ...(role === "candidate"
+            ? {
+                entrypoint: values["codex-entrypoint"],
+            }
+            : {}),
+        ...common,
+        model: requiredOption(values[modelKey], `--${modelKey}`),
+        effort: requiredOption(values[effortKey], `--${effortKey}`),
+    };
+}
+function selectedCodexOptions(values, routes, roots, privateRoots) {
+    if (!routes.anyCodex)
+        return {};
+    const common = commonCodexOptions(values, roots, privateRoots);
+    return {
+        codex: routes.codex
+            ? codexRoleOptions(values, common, "candidate")
+            : undefined,
+        semanticCodex: routes.semanticCodex
+            ? codexRoleOptions(values, common, "semantic")
+            : undefined,
+        advisoryCodex: routes.advisoryCodex
+            ? codexRoleOptions(values, common, "advisory")
+            : undefined,
+    };
+}
+function invocationInputs(values, context) {
+    const { routes, roots, privateRoots, toolchainBinDir, codexOptions, claudeOptions, trials, } = context;
+    return {
+        json: values.json ?? false,
+        runManifestFile: values["run-manifest-file"],
+        protectedRoots: context.protectedRoots,
+        deprecatedRuntimeOptions: optionsWith("section", "deprecated").filter((name) => values[name] !== undefined),
+        dry: values.dry ?? false,
+        runtimeConfigFile: values["runtime-config-file"],
+        caseFile: values["case-file"],
+        extension: extensionInvocation(values),
+        caseSourceRoot: values["case-source-root"],
+        caseSourceMapFile: values["case-source-map-file"],
+        adapterModule: routes.builtinHost
+            ? undefined
+            : requiredOption(values["adapter-module"], "--adapter-module"),
+        semanticAdapterModule: values["semantic-adapter-module"],
+        advisoryAdapterModule: values["advisory-adapter-module"],
+        advisoryExcludedPaths: values["advisory-exclude"] ?? [],
+        ...codexOptions,
+        claude: claudeOptions,
+        shellIsolation: shellIsolationOptions(values, privateRoots, toolchainBinDir),
+        ...roots,
+        runnerBuildDigest: optionalDigest(values["runner-build-digest"], "--runner-build-digest"),
+        runnerCheckoutRoot: values["runner-checkout-root"],
+        projectDigest: optionalDigest(values["project-digest"], "--project-digest"),
+        ...trials,
+    };
+}
+function shellIsolationOptions(values, protectedRoots, toolchainBinDir) {
+    return values["shell-isolation"]
+        ? {
+            protectedRoots,
+            toolchainBinDir,
+            uvRuntimeCache: !!values["claude-uv-cache-dir"],
+        }
+        : undefined;
+}
+function invocationContext(values) {
+    const trials = trialParameters(values);
+    const protectedRoots = values["protected-root"] ?? [];
+    const toolchainBinDir = values["toolchain-bin-dir"];
+    const routes = hostRoutes(values);
+    const roots = rootParameters(values);
+    validateExtensionSelection(values);
+    const privateRoots = privateRootDeclarations(values, roots.configRoot, protectedRoots);
+    const codexOptions = selectedCodexOptions(values, routes, roots, privateRoots);
+    const claudeOptions = claudeHostOptions(values, routes, roots, privateRoots, toolchainBinDir);
+    return {
+        routes,
+        roots,
+        protectedRoots,
+        privateRoots,
+        toolchainBinDir,
+        codexOptions,
+        claudeOptions,
+        trials,
+    };
+}
+/** Decode CLI flags in their documented validation order. */
+export async function parseInvocation(argv) {
+    if (argv[0] !== "run")
+        throw new InvocationError("unknown command; available commands: demo, init, run, report, prune; run sevro --help");
+    const parsed = cliArguments(argv);
+    if (parsed.positionals.length !== 1)
+        throw new InvocationError("expected the run command");
+    parsed.values = await savedRunValues(parsed.values);
+    applyRunDefaults(parsed.values);
+    validateHostCompatibility(parsed.values, hostRoutes(parsed.values), parsed.values["protected-root"] ?? []);
+    applyRootDefaults(parsed.values);
+    resolveNativeBinaries(parsed.values);
+    await canonicalizePaths(parsed.values);
+    return invocationInputs(parsed.values, invocationContext(parsed.values));
+}
+function resolveNativeBinaries(values) {
+    const routes = hostRoutes(values);
+    if (routes.anyCodex)
+        values["codex-bin"] ??= nativeBinary("codex");
+    if (routes.claude)
+        values["claude-bin"] ??= nativeBinary("claude");
+}
+function nativeBinary(host) {
+    const binary = which(host);
+    if (!binary)
+        throw new InvocationError(`selected ${host} executable was not found on PATH; install ${host} or supply --${host}-bin <path>`);
+    return binary;
+}
+/** Keep all selected native roles visible to protection and evidence callers. */
+export function nativeRoutes(invocation) {
+    return [
+        invocation.codex,
+        invocation.claude,
+        invocation.semanticCodex,
+        invocation.advisoryCodex,
+    ].filter((host) => host !== undefined);
+}
+function applyRunDefaults(values) {
+    values.condition ??= "passive";
+    values.trials ??= "1";
+    values.jobs ??= "3";
+    values.threshold ??= "1";
+}
+function applyRootDefaults(values) {
+    values["project-root"] ??= process.cwd();
+    values["results-root"] ??= join(resolve(values["project-root"]), ".sevro", "results");
+}
+async function canonicalOption(path, option) {
+    try {
+        return await canonicalRuntimeRoot(resolve(path));
+    }
+    catch (cause) {
+        const error = cause;
+        throw new InvocationError(`--${option} cannot be resolved at ${path}: filesystem ${error.syscall ?? "realpath"} failed (${error.code ?? "unknown"}); supply a usable file or directory path`, { cause });
+    }
+}
+async function canonicalizePaths(values) {
+    for (const name of PATH_OPTIONS) {
+        const value = values[name];
+        if (value !== undefined)
+            values[name] = await canonicalOption(requiredOption(value, `--${name}`), name);
+    }
+    for (const name of PATH_LIST_OPTIONS) {
+        const paths = values[name];
+        if (paths)
+            values[name] = await Promise.all(paths.map((path) => canonicalOption(requiredOption(path, `--${name}`), name)));
+    }
+}
+//# sourceMappingURL=invocation.js.map

package/dist/src/cli/invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation.js","sourceRoot":"","sources":["invocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,yBAAsB;AACtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB;AAC1C,OAAO,EAAE,gBAAgB,EAAE,2BAAwB;AACnD,OAAO,EAAE,oBAAoB,EAAE,4BAAyB;AACxD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,YAAY,GACb,yBAAsB;AACvB,OAAO,EAAE,cAAc,EAAE,0BAAuB;AAEhD,MAAM,OAAO,eAAgB,SAAQ,KAAK;CAAG;AAE7C,SAAS,cAAc,CAAC,KAAyB,EAAE,IAAY;IAC7D,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,eAAe,CAAC,WAAW,IAAI,YAAY,IAAI,eAAe,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,IAAY;IAC7D,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QACtD,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,UAAU;QACrD,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;IAC5E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,IAAc;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,eAAe,CAAC,wBAAwB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAID,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9E,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,aAAa,IAAI,CAAC;QAClB,aAAa,GAAG,CAAC;QAEjB,MAAM,IAAI,eAAe,CACvB,mEAAmE,CACpE,CAAC;IACJ,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAC3C,MAAM,IAAI,eAAe,CAAC,WAAW,MAAM,6BAA6B,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;IACxC,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC;IAC1D,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC;IAC1D,OAAO;QACL,KAAK;QACL,MAAM;QACN,WAAW,EAAE,KAAK,IAAI,MAAM;QAC5B,aAAa;QACb,aAAa;QACb,QAAQ,EAAE,KAAK,IAAI,aAAa,IAAI,aAAa;KAClD,CAAC;AACJ,CAAC;AAOD,MAAM,kBAAkB,GAAwB;IAC9C;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAChB,CAAC,CAAC,kBAAkB,CAAC,KAAK,SAAS;YACnC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACvE,OAAO,EAAE,iEAAiE;KAC3E;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW;QAC3C,OAAO,EAAE,yCAAyC;KACnD;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;QACzD,OAAO,EAAE,wCAAwC;KAClD;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;QACzD,OAAO,EAAE,wCAAwC;KAClD;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,yBAAyB,CAAC;QAClE,OAAO,EAAE,6DAA6D;KACvE;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,yBAAyB,CAAC;QAClE,OAAO,EAAE,6DAA6D;KACvE;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,gBAAgB,CAAC;QACvD,OAAO,EAAE,2CAA2C;KACrD;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACzD,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAC1D,OAAO,EAAE,8CAA8C;KACxD;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAChB,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACnE,OAAO,EAAE,sDAAsD;KAChE;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAChB,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACnE,OAAO,EAAE,sDAAsD;KAChE;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAChB,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM;YAC7B,CAAC,CAAC,CAAC,aAAa;YAChB,CAAC,CAAC,CAAC,yBAAyB,CAAC;QAC/B,OAAO,EAAE,+CAA+C;KACzD;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC;QAC7D,OAAO,EAAE,0CAA0C;KACpD;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC;QAC5D,OAAO,EAAE,sCAAsC;KAChD;IACD;QACE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CACvB,KAAK,CAAC,MAAM;YACZ,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACrB,CAAC,CAAC,CAAC,WAAW;YACd,CAAC,CAAC,CAAC,aAAa;YAChB,CAAC,CAAC,CAAC,aAAa;QAClB,OAAO,EAAE,qCAAqC;KAC/C;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,MAAc,EAAE,KAAyB;IAChE,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;QAC3E,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAc,EACd,MAAc,EACd,KAAe;IAEf,KAAK,MAAM,IAAI,IAAI,kBAAkB;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;YACrC,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC7E,MAAM,UAAU,GACd,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;QACjC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;QACxD,CAAC,CAAC,WAAW,CAAC;IAClB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC3C,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;QAC9D,CAAC,CAAC,WAAW,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAChE,CAAC;AAID,SAAS,0BAA0B,CAAC,MAAc;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACnD,MAAM,IAAI,eAAe,CAAC,+BAA+B,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;IAC5D,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACnC,IACE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAE1E,MAAM,IAAI,eAAe,CACvB,+DAA+D,CAChE,CAAC;IACJ,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAsB;IAClD,IACE,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM;QAClD,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAEhD,MAAM,IAAI,eAAe,CAAC,kCAAkC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,qBAAqB;YAAE,OAAO,KAAK,KAAK,SAAS,CAAC;QAC/D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,MAAM;QAClB,MAAM,IAAI,eAAe,CAAC,iCAAiC,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc;IAChD,IAAI,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACrC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;SAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC;QACtC,MAAM,IAAI,eAAe,CACvB,oDAAoD,CACrD,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,IACE,OAAO,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAExD,MAAM,IAAI,eAAe,CACvB,kDAAkD,CACnD,CAAC;IACJ,IACE,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAEvC,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAc,EACd,UAAkB,EAClB,cAAwB;IAExB,OAAO;QACL,UAAU;QACV,GAAG,cAAc;QACjB,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;KACtE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAc,EACd,KAAY,EACZ,YAAsB;IAEtB,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;QAC1D,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;QACxE,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,CAAC,KAAK,IAAI;QACjE,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,wBAAwB,EAAE,CAAC,GAAG,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,MAAM;QACxE,MAAM,IAAI,eAAe,CACvB,oFAAoF,CACrF,CAAC;IACJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,MAAc,EACd,KAAY,EACZ,YAAsB,EACtB,eAAmC;IAEnC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO;QACL,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,CAAC,KAAK,IAAI;QACjE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,wBAAwB,CAAC;YAClC,CAAC,CAAC;gBACE,cAAc,EAAE,cAAc,CAC5B,MAAM,CAAC,wBAAwB,CAAC,EAChC,0BAA0B,CAC3B;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAC/B,CAAC,CAAC;gBACE,UAAU,EAAE,cAAc,CACxB,MAAM,CAAC,qBAAqB,CAAC,EAC7B,uBAAuB,CACxB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC;QAC9C,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC;QACjD,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,yBAAyB,CAAC,IAAI,KAAK;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,wBAAwB,EAAE,CAAC,GAAG,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,OAAO,EAAE,0BAA0B,CAAC;QAChE,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC;QACrC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;QACtD,iBAAiB,EAAE,MAAM,CAAC,8BAA8B,CAAC;QACzD,yBAAyB,EAAE,MAAM,CAAC,uCAAuC,CAAC;QAC1E,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,CAAC;QAChD,qBAAqB,EAAE,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC9B,QAAQ,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;CACvC,CAAC;AAEX,SAAS,gBAAgB,CACvB,MAAc,EACd,MAA6C,EAC7C,IAAmC;IAEnC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,CAAC,IAAI,KAAK,WAAW;YACtB,CAAC,CAAC;gBACE,UAAU,EAAE,MAAM,CAAC,kBAAkB,CACF;aACpC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,MAAM;QACT,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAc,EACd,MAAc,EACd,KAAY,EACZ,YAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACjB,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC;YAC/C,CAAC,CAAC,SAAS;QACb,aAAa,EAAE,MAAM,CAAC,aAAa;YACjC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;YAC9C,CAAC,CAAC,SAAS;QACb,aAAa,EAAE,MAAM,CAAC,aAAa;YACjC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;YAC9C,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAc,EACd,OAA6C;IAE7C,MAAM,EACJ,MAAM,EACN,KAAK,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,aAAa,EACb,MAAM,GACP,GAAG,OAAO,CAAC;IACZ,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,KAAK;QAC1B,eAAe,EAAE,MAAM,CAAC,mBAAmB,CAAC;QAC5C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,wBAAwB,EAAE,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,MAAM,CACnE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CACrC;QACD,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK;QACxB,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,CAAC;QAChD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC;QAC7B,SAAS,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACtC,cAAc,EAAE,MAAM,CAAC,kBAAkB,CAAC;QAC1C,iBAAiB,EAAE,MAAM,CAAC,sBAAsB,CAAC;QACjD,aAAa,EAAE,MAAM,CAAC,WAAW;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;QAChE,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACxD,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACxD,qBAAqB,EAAE,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE;QACvD,GAAG,YAAY;QACf,MAAM,EAAE,aAAa;QACrB,cAAc,EAAE,qBAAqB,CACnC,MAAM,EACN,YAAY,EACZ,eAAe,CAChB;QACD,GAAG,KAAK;QACR,iBAAiB,EAAE,cAAc,CAC/B,MAAM,CAAC,qBAAqB,CAAC,EAC7B,uBAAuB,CACxB;QACD,kBAAkB,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAClD,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;QAC3E,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAc,EACd,cAAwB,EACxB,eAAmC;IAEnC,OAAO,MAAM,CAAC,iBAAiB,CAAC;QAC9B,CAAC,CAAC;YACE,cAAc;YACd,eAAe;YACf,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAChD;QACH,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,uBAAuB,CAC1C,MAAM,EACN,KAAK,CAAC,UAAU,EAChB,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG,oBAAoB,CACvC,MAAM,EACN,MAAM,EACN,KAAK,EACL,YAAY,CACb,CAAC;IACF,MAAM,aAAa,GAAG,iBAAiB,CACrC,MAAM,EACN,MAAM,EACN,KAAK,EACL,YAAY,EACZ,eAAe,CAChB,CAAC;IACF,OAAO;QACL,MAAM;QACN,KAAK;QACL,cAAc;QACd,YAAY;QACZ,eAAe;QACf,YAAY;QACZ,aAAa;QACb,MAAM;KACP,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc;IAClD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QACnB,MAAM,IAAI,eAAe,CACvB,uFAAuF,CACxF,CAAC;IACJ,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QACjC,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;IACxD,MAAM,CAAC,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,yBAAyB,CACvB,MAAM,CAAC,MAAM,EACb,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EACzB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CACtC,CAAC;IACF,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,WAAW,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,YAAY,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,IAAwB;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,eAAe,CACvB,YAAY,IAAI,8CAA8C,IAAI,gBAAgB,IAAI,aAAa,CACpG,CAAC;IACJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAID,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAC1B,UAGC;IAED,OAAO;QACL,UAAU,CAAC,KAAK;QAChB,UAAU,CAAC,MAAM;QACjB,UAAU,CAAC,aAAa;QACxB,UAAU,CAAC,aAAa;KACzB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;IAC/B,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;IACtB,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC;IACpB,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI,CAC7B,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAC/B,QAAQ,EACR,SAAS,CACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,KAA8B,CAAC;QAC7C,MAAM,IAAI,eAAe,CACvB,KAAK,MAAM,0BAA0B,IAAI,gBAAgB,KAAK,CAAC,OAAO,IAAI,UAAU,YAAY,KAAK,CAAC,IAAI,IAAI,SAAS,2CAA2C,EAClK,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc;IAC7C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,eAAe,CAClC,cAAc,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,EAClC,IAAI,CACL,CAAC;IACN,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK;YACP,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjB,eAAe,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CACzD,CACF,CAAC;IACN,CAAC;AACH,CAAC","sourcesContent":["import { which } from \"../executable\";\nimport { join, resolve } from \"node:path\";\nimport { validQualifiedId } from \"../value-guards\";\nimport { canonicalRuntimeRoot } from \"../runtime/paths\";\nimport {\n  PATH_OPTIONS,\n  PATH_LIST_OPTIONS,\n  EXTENSION_OPTIONS,\n  RUN_OPTIONS,\n  optionsWith,\n  runArguments,\n} from \"./run-options\";\nimport { savedRunValues } from \"./run-manifest\";\n\nexport class InvocationError extends Error {}\n\nfunction requiredOption(value: string | undefined, name: string): string {\n  if (!value)\n    throw new InvocationError(`missing ${name}; supply ${name} with a value`);\n  return value;\n}\n\nfunction optionalDigest(value: string | undefined, name: string) {\n  if (value !== undefined && !/^[a-f0-9]{64}$/.test(value))\n    throw new InvocationError(`${name} must be a 64-character SHA-256 digest`);\n  return value;\n}\n\nfunction conditionOption(value: string | undefined): \"passive\" | \"enforced\" {\n  const condition = requiredOption(value, \"--condition\");\n  if (condition !== \"passive\" && condition !== \"enforced\")\n    throw new InvocationError(\"invalid --condition; use passive or enforced\");\n  return condition;\n}\n\nfunction cliArguments(argv: string[]) {\n  try {\n    return runArguments(argv);\n  } catch (cause) {\n    const detail = cause instanceof Error ? `: ${cause.message}` : \"\";\n    throw new InvocationError(`invalid CLI arguments${detail}`, { cause });\n  }\n}\n\ntype Values = ReturnType<typeof cliArguments>[\"values\"];\n\nfunction trialParameters(values: Values) {\n  const condition = conditionOption(values.condition);\n  const trialCount = Number(requiredOption(values.trials, \"--trials\"));\n  const jobs = Number(requiredOption(values.jobs, \"--jobs\"));\n  const passThreshold = Number(requiredOption(values.threshold, \"--threshold\"));\n  positiveInteger(trialCount, \"--trials\");\n  positiveInteger(jobs, \"--jobs\");\n  if (\n    !Number.isFinite(passThreshold) ||\n    passThreshold <= 0 ||\n    passThreshold > 1\n  )\n    throw new InvocationError(\n      \"invalid --threshold; supply a number greater than 0 and at most 1\",\n    );\n  return { condition, trialCount, jobs, passThreshold };\n}\n\nfunction positiveInteger(value: number, option: string): void {\n  if (!Number.isSafeInteger(value) || value < 1)\n    throw new InvocationError(`invalid ${option}; supply a positive integer`);\n}\n\nfunction hostRoutes(values: Values) {\n  const codex = values.host === \"codex\";\n  const claude = values.host === \"claude\";\n  const semanticCodex = values[\"semantic-host\"] === \"codex\";\n  const advisoryCodex = values[\"advisory-host\"] === \"codex\";\n  return {\n    codex,\n    claude,\n    builtinHost: codex || claude,\n    semanticCodex,\n    advisoryCodex,\n    anyCodex: codex || semanticCodex || advisoryCodex,\n  };\n}\n\ntype Routes = ReturnType<typeof hostRoutes>;\ntype CompatibilityRule = {\n  invalid: (values: Values, routes: Routes, roots: string[]) => unknown;\n  message: string;\n};\nconst HOST_COMPATIBILITY: CompatibilityRule[] = [\n  {\n    invalid: (v, r) =>\n      v[\"codex-entrypoint\"] !== undefined &&\n      (!r.codex || ![\"exec\", \"app-server\"].includes(v[\"codex-entrypoint\"])),\n    message: \"--codex-entrypoint requires --host codex and exec or app-server\",\n  },\n  {\n    invalid: (v, r) => v.host && !r.builtinHost,\n    message: \"unsupported --host; use codex or claude\",\n  },\n  {\n    invalid: (v, r) => v[\"semantic-host\"] && !r.semanticCodex,\n    message: \"unsupported --semantic-host; use codex\",\n  },\n  {\n    invalid: (v, r) => v[\"advisory-host\"] && !r.advisoryCodex,\n    message: \"unsupported --advisory-host; use codex\",\n  },\n  {\n    invalid: (v, r) => r.semanticCodex && v[\"semantic-adapter-module\"],\n    message: \"--semantic-host and --semantic-adapter-module are exclusive\",\n  },\n  {\n    invalid: (v, r) => r.advisoryCodex && v[\"advisory-adapter-module\"],\n    message: \"--advisory-host and --advisory-adapter-module are exclusive\",\n  },\n  {\n    invalid: (v, r) => r.builtinHost && v[\"adapter-module\"],\n    message: \"--host and --adapter-module are exclusive\",\n  },\n  {\n    invalid: (v, r) => !r.builtinHost && !v[\"adapter-module\"],\n    message: \"missing --adapter-module or --host\",\n  },\n  {\n    invalid: (v, r) => !r.builtinHost && (v.model || v.effort),\n    message: \"--model and --effort require a built-in host\",\n  },\n  {\n    invalid: (v, r) =>\n      !r.semanticCodex && (v[\"semantic-model\"] || v[\"semantic-effort\"]),\n    message: \"semantic model options require --semantic-host codex\",\n  },\n  {\n    invalid: (v, r) =>\n      !r.advisoryCodex && (v[\"advisory-model\"] || v[\"advisory-effort\"]),\n    message: \"advisory model options require --advisory-host codex\",\n  },\n  {\n    invalid: (v, r) =>\n      v[\"advisory-exclude\"]?.length &&\n      !r.advisoryCodex &&\n      !v[\"advisory-adapter-module\"],\n    message: \"--advisory-exclude requires an advisory route\",\n  },\n  {\n    invalid: (v, r) => !r.anyCodex && hasRouteOptions(v, \"codex\"),\n    message: \"Codex options require a Codex host route\",\n  },\n  {\n    invalid: (v, r) => !r.claude && hasRouteOptions(v, \"claude\"),\n    message: \"Claude options require --host claude\",\n  },\n  {\n    invalid: (v, r, roots) =>\n      roots.length &&\n      !v[\"shell-isolation\"] &&\n      !r.builtinHost &&\n      !r.semanticCodex &&\n      !r.advisoryCodex,\n    message: \"--protected-root requires isolation\",\n  },\n];\n\nfunction hasRouteOptions(values: Values, route: \"codex\" | \"claude\"): boolean {\n  return optionsWith(\"route\", route).some((name) => {\n    if (RUN_OPTIONS[name].kind === \"number\") return values[name] !== undefined;\n    return Boolean(values[name]);\n  });\n}\n\nfunction validateHostCompatibility(\n  values: Values,\n  routes: Routes,\n  roots: string[],\n): void {\n  for (const rule of HOST_COMPATIBILITY)\n    if (rule.invalid(values, routes, roots))\n      throw new InvocationError(rule.message);\n}\n\nfunction rootParameters(values: Values) {\n  const projectRoot = requiredOption(values[\"project-root\"], \"--project-root\");\n  const configRoot =\n    values[\"config-root\"] !== undefined\n      ? requiredOption(values[\"config-root\"], \"--config-root\")\n      : projectRoot;\n  const resultsRoot = requiredOption(values[\"results-root\"], \"--results-root\");\n  const runStateRoot = values[\"run-state-root\"]\n    ? requiredOption(values[\"run-state-root\"], \"--run-state-root\")\n    : resultsRoot;\n  return { projectRoot, configRoot, resultsRoot, runStateRoot };\n}\n\ntype Roots = ReturnType<typeof rootParameters>;\n\nfunction validateExtensionSelection(values: Values): void {\n  const policy = values[\"task-verdict-policy\"];\n  if (policy !== undefined && !validQualifiedId(policy))\n    throw new InvocationError(\"invalid --task-verdict-policy\");\n  const replacements = values[\"replace-builtin-grader\"] ?? [];\n  validateReplacements(replacements);\n  if (\n    Boolean(values[\"case-file\"]) === Boolean(values[\"extension-command-file\"])\n  )\n    throw new InvocationError(\n      \"select exactly one of --case-file or --extension-command-file\",\n    );\n  validateExtensionArguments(values);\n  validatePairedFiles(values);\n}\n\nfunction validateReplacements(replacements: string[]): void {\n  if (\n    new Set(replacements).size !== replacements.length ||\n    replacements.some((id) => !validQualifiedId(id))\n  )\n    throw new InvocationError(\"invalid --replace-builtin-grader\");\n}\n\nfunction hasExtensionArguments(values: Values): boolean {\n  return EXTENSION_OPTIONS.some((name) => {\n    const value = values[name];\n    if (Array.isArray(value)) return value.length > 0;\n    if (name === \"task-verdict-policy\") return value !== undefined;\n    return Boolean(value);\n  });\n}\n\nfunction extensionSources(values: Values): string[] {\n  const sources = values[\"extension-source-file\"];\n  if (!sources?.length)\n    throw new InvocationError(\"missing --extension-source-file\");\n  return sources;\n}\n\nfunction validateExtensionArguments(values: Values): void {\n  if (values[\"extension-command-file\"]) {\n    requiredOption(values[\"case-id\"], \"--case-id\");\n    extensionSources(values);\n  } else if (hasExtensionArguments(values))\n    throw new InvocationError(\n      \"extension options require --extension-command-file\",\n    );\n}\n\nfunction validatePairedFiles(values: Values): void {\n  if (\n    Boolean(values[\"extension-configuration-file\"]) !==\n    Boolean(values[\"extension-redacted-configuration-file\"])\n  )\n    throw new InvocationError(\n      \"extension configuration requires a redacted file\",\n    );\n  if (\n    Boolean(values[\"case-source-root\"]) !==\n    Boolean(values[\"case-source-map-file\"])\n  )\n    throw new InvocationError(\"case sources require a root and map file\");\n}\n\nfunction privateRootDeclarations(\n  values: Values,\n  configRoot: string,\n  protectedRoots: string[],\n): string[] {\n  return [\n    configRoot,\n    ...protectedRoots,\n    ...optionsWith(\"private\", true).flatMap((name) => values[name] ?? []),\n  ].filter((value): value is string => Boolean(value));\n}\n\nfunction commonCodexOptions(\n  values: Values,\n  roots: Roots,\n  privateRoots: string[],\n) {\n  return {\n    binary: requiredOption(values[\"codex-bin\"], \"--codex-bin\"),\n    authFile: requiredOption(values[\"codex-auth-file\"], \"--codex-auth-file\"),\n    retainHostDiagnostics: values[\"retain-host-diagnostics\"] === true,\n    timeoutMs: codexTimeout(values[\"codex-timeout-ms\"]),\n    projectRoot: roots.projectRoot,\n    resultsRoot: roots.resultsRoot,\n    additionalProtectedRoots: [...privateRoots, roots.runStateRoot],\n  };\n}\n\nfunction codexTimeout(value: string | undefined): number | undefined {\n  if (value === undefined) return undefined;\n  const timeout = Number(value);\n  if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30 * 60_000)\n    throw new InvocationError(\n      \"invalid --codex-timeout-ms; supply a positive integer at most 1800000 (30 minutes)\",\n    );\n  return timeout;\n}\n\nfunction claudeHostOptions(\n  values: Values,\n  routes: Routes,\n  roots: Roots,\n  privateRoots: string[],\n  toolchainBinDir: string | undefined,\n) {\n  if (!routes.claude) return undefined;\n  return {\n    retainHostDiagnostics: values[\"retain-host-diagnostics\"] === true,\n    binary: requiredOption(values[\"claude-bin\"], \"--claude-bin\"),\n    ...(values[\"claude-credential-file\"]\n      ? {\n          credentialFile: requiredOption(\n            values[\"claude-credential-file\"],\n            \"--claude-credential-file\",\n          ),\n        }\n      : {}),\n    ...(values[\"claude-uv-cache-dir\"]\n      ? {\n          uvCacheDir: requiredOption(\n            values[\"claude-uv-cache-dir\"],\n            \"--claude-uv-cache-dir\",\n          ),\n        }\n      : {}),\n    model: requiredOption(values.model, \"--model\"),\n    effort: requiredOption(values.effort, \"--effort\"),\n    toolchainBinDir,\n    projectSettings: values[\"claude-project-settings\"] ?? false,\n    projectRoot: roots.projectRoot,\n    resultsRoot: roots.resultsRoot,\n    additionalProtectedRoots: [...privateRoots, roots.runStateRoot],\n  };\n}\n\nfunction extensionInvocation(values: Values) {\n  const command = values[\"extension-command-file\"];\n  if (!command) return undefined;\n  return {\n    commandFile: requiredOption(command, \"--extension-command-file\"),\n    sourceFiles: extensionSources(values),\n    caseId: requiredOption(values[\"case-id\"], \"--case-id\"),\n    configurationFile: values[\"extension-configuration-file\"],\n    redactedConfigurationFile: values[\"extension-redacted-configuration-file\"],\n    taskVerdictPolicy: values[\"task-verdict-policy\"],\n    replaceBuiltinGraders: values[\"replace-builtin-grader\"] ?? [],\n  };\n}\n\nconst CODEX_MODEL_KEYS = {\n  candidate: [\"model\", \"effort\"],\n  semantic: [\"semantic-model\", \"semantic-effort\"],\n  advisory: [\"advisory-model\", \"advisory-effort\"],\n} as const;\n\nfunction codexRoleOptions(\n  values: Values,\n  common: ReturnType<typeof commonCodexOptions>,\n  role: keyof typeof CODEX_MODEL_KEYS,\n) {\n  const [modelKey, effortKey] = CODEX_MODEL_KEYS[role];\n  return {\n    ...(role === \"candidate\"\n      ? {\n          entrypoint: values[\"codex-entrypoint\"] as\n            \"exec\" | \"app-server\" | undefined,\n        }\n      : {}),\n    ...common,\n    model: requiredOption(values[modelKey], `--${modelKey}`),\n    effort: requiredOption(values[effortKey], `--${effortKey}`),\n  };\n}\n\nfunction selectedCodexOptions(\n  values: Values,\n  routes: Routes,\n  roots: Roots,\n  privateRoots: string[],\n) {\n  if (!routes.anyCodex) return {};\n  const common = commonCodexOptions(values, roots, privateRoots);\n  return {\n    codex: routes.codex\n      ? codexRoleOptions(values, common, \"candidate\")\n      : undefined,\n    semanticCodex: routes.semanticCodex\n      ? codexRoleOptions(values, common, \"semantic\")\n      : undefined,\n    advisoryCodex: routes.advisoryCodex\n      ? codexRoleOptions(values, common, \"advisory\")\n      : undefined,\n  };\n}\n\nfunction invocationInputs(\n  values: Values,\n  context: ReturnType<typeof invocationContext>,\n) {\n  const {\n    routes,\n    roots,\n    privateRoots,\n    toolchainBinDir,\n    codexOptions,\n    claudeOptions,\n    trials,\n  } = context;\n  return {\n    json: values.json ?? false,\n    runManifestFile: values[\"run-manifest-file\"],\n    protectedRoots: context.protectedRoots,\n    deprecatedRuntimeOptions: optionsWith(\"section\", \"deprecated\").filter(\n      (name) => values[name] !== undefined,\n    ),\n    dry: values.dry ?? false,\n    runtimeConfigFile: values[\"runtime-config-file\"],\n    caseFile: values[\"case-file\"],\n    extension: extensionInvocation(values),\n    caseSourceRoot: values[\"case-source-root\"],\n    caseSourceMapFile: values[\"case-source-map-file\"],\n    adapterModule: routes.builtinHost\n      ? undefined\n      : requiredOption(values[\"adapter-module\"], \"--adapter-module\"),\n    semanticAdapterModule: values[\"semantic-adapter-module\"],\n    advisoryAdapterModule: values[\"advisory-adapter-module\"],\n    advisoryExcludedPaths: values[\"advisory-exclude\"] ?? [],\n    ...codexOptions,\n    claude: claudeOptions,\n    shellIsolation: shellIsolationOptions(\n      values,\n      privateRoots,\n      toolchainBinDir,\n    ),\n    ...roots,\n    runnerBuildDigest: optionalDigest(\n      values[\"runner-build-digest\"],\n      \"--runner-build-digest\",\n    ),\n    runnerCheckoutRoot: values[\"runner-checkout-root\"],\n    projectDigest: optionalDigest(values[\"project-digest\"], \"--project-digest\"),\n    ...trials,\n  };\n}\n\nfunction shellIsolationOptions(\n  values: Values,\n  protectedRoots: string[],\n  toolchainBinDir: string | undefined,\n) {\n  return values[\"shell-isolation\"]\n    ? {\n        protectedRoots,\n        toolchainBinDir,\n        uvRuntimeCache: !!values[\"claude-uv-cache-dir\"],\n      }\n    : undefined;\n}\n\nfunction invocationContext(values: Values) {\n  const trials = trialParameters(values);\n  const protectedRoots = values[\"protected-root\"] ?? [];\n  const toolchainBinDir = values[\"toolchain-bin-dir\"];\n  const routes = hostRoutes(values);\n  const roots = rootParameters(values);\n  validateExtensionSelection(values);\n  const privateRoots = privateRootDeclarations(\n    values,\n    roots.configRoot,\n    protectedRoots,\n  );\n  const codexOptions = selectedCodexOptions(\n    values,\n    routes,\n    roots,\n    privateRoots,\n  );\n  const claudeOptions = claudeHostOptions(\n    values,\n    routes,\n    roots,\n    privateRoots,\n    toolchainBinDir,\n  );\n  return {\n    routes,\n    roots,\n    protectedRoots,\n    privateRoots,\n    toolchainBinDir,\n    codexOptions,\n    claudeOptions,\n    trials,\n  };\n}\n\n/** Decode CLI flags in their documented validation order. */\nexport async function parseInvocation(argv: string[]) {\n  if (argv[0] !== \"run\")\n    throw new InvocationError(\n      \"unknown command; available commands: demo, init, run, report, prune; run sevro --help\",\n    );\n  const parsed = cliArguments(argv);\n  if (parsed.positionals.length !== 1)\n    throw new InvocationError(\"expected the run command\");\n  parsed.values = await savedRunValues(parsed.values);\n  applyRunDefaults(parsed.values);\n  validateHostCompatibility(\n    parsed.values,\n    hostRoutes(parsed.values),\n    parsed.values[\"protected-root\"] ?? [],\n  );\n  applyRootDefaults(parsed.values);\n  resolveNativeBinaries(parsed.values);\n  await canonicalizePaths(parsed.values);\n  return invocationInputs(parsed.values, invocationContext(parsed.values));\n}\n\nfunction resolveNativeBinaries(values: Values): void {\n  const routes = hostRoutes(values);\n  if (routes.anyCodex) values[\"codex-bin\"] ??= nativeBinary(\"codex\");\n  if (routes.claude) values[\"claude-bin\"] ??= nativeBinary(\"claude\");\n}\n\nfunction nativeBinary(host: \"codex\" | \"claude\"): string {\n  const binary = which(host);\n  if (!binary)\n    throw new InvocationError(\n      `selected ${host} executable was not found on PATH; install ${host} or supply --${host}-bin <path>`,\n    );\n  return binary;\n}\n\nexport type Invocation = Awaited<ReturnType<typeof parseInvocation>>;\n\n/** Keep all selected native roles visible to protection and evidence callers. */\nexport function nativeRoutes(\n  invocation: Pick<\n    Invocation,\n    \"codex\" | \"claude\" | \"semanticCodex\" | \"advisoryCodex\"\n  >,\n) {\n  return [\n    invocation.codex,\n    invocation.claude,\n    invocation.semanticCodex,\n    invocation.advisoryCodex,\n  ].filter((host) => host !== undefined);\n}\n\nfunction applyRunDefaults(values: Values): void {\n  values.condition ??= \"passive\";\n  values.trials ??= \"1\";\n  values.jobs ??= \"3\";\n  values.threshold ??= \"1\";\n}\n\nfunction applyRootDefaults(values: Values): void {\n  values[\"project-root\"] ??= process.cwd();\n  values[\"results-root\"] ??= join(\n    resolve(values[\"project-root\"]),\n    \".sevro\",\n    \"results\",\n  );\n}\n\nasync function canonicalOption(path: string, option: string): Promise<string> {\n  try {\n    return await canonicalRuntimeRoot(resolve(path));\n  } catch (cause) {\n    const error = cause as NodeJS.ErrnoException;\n    throw new InvocationError(\n      `--${option} cannot be resolved at ${path}: filesystem ${error.syscall ?? \"realpath\"} failed (${error.code ?? \"unknown\"}); supply a usable file or directory path`,\n      { cause },\n    );\n  }\n}\n\nasync function canonicalizePaths(values: Values): Promise<void> {\n  for (const name of PATH_OPTIONS) {\n    const value = values[name];\n    if (value !== undefined)\n      values[name] = await canonicalOption(\n        requiredOption(value, `--${name}`),\n        name,\n      );\n  }\n  for (const name of PATH_LIST_OPTIONS) {\n    const paths = values[name];\n    if (paths)\n      values[name] = await Promise.all(\n        paths.map((path) =>\n          canonicalOption(requiredOption(path, `--${name}`), name),\n        ),\n      );\n  }\n}\n"]}