@bjoernrochel/sevro 1.0.0 → 1.1.0

package/dist/src/runtime/config.js

@@ -0,0 +1,323 @@
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { declaredRuntimeRoots, optionalRuntimeRoots, runtimePathDirectories, runtimeInheritedPath, requireRuntimeReadRoots, } from "./paths.js";
+import validate from "../generated/runtime.cjs";
+import { requireArtifactDirectories, } from "../candidate-artifacts.js";
+import { runtimeSeedDigest } from "./seeds.js";
+import { resolveSharedCaches, requireSharedCachePolicy, } from "./shared-cache.js";
+import { discoverRuntimeSupport, } from "./discovery.js";
+/** Canonical roles; schemas:generate projects this list into the runtime schema. */
+export const RUNTIME_ROLES = [
+    "candidate",
+    "checks",
+    "hooks",
+    "semantic",
+    "advisory",
+];
+export function runtimeLocalHttpEnabled(policy, role) {
+    const network = policy?.network;
+    return network?.localHttp === true && ["candidate", "checks"].includes(role);
+}
+export function runtimeNativeGoalEnabled(policy) {
+    const hooks = policy?.hooks;
+    return hooks?.nativeGoal === true;
+}
+const validatedPolicies = new WeakSet();
+export function runtimePolicySnapshot(policy) {
+    if (!policy)
+        return undefined;
+    const snapshot = structuredClone(policy);
+    if (!validatedPolicies.has(policy))
+        requireRuntimePolicy(snapshot);
+    Object.freeze(snapshot.network);
+    freezeArtifactDirectories(snapshot);
+    Object.freeze(snapshot.environment);
+    Object.freeze(snapshot.readOnlyRoots);
+    freezeDiscovery(snapshot);
+    freezeRuntimeCaches(snapshot);
+    Object.freeze(snapshot.seedReadDenyRoots);
+    const hooks = snapshot.hooks;
+    if (hooks) {
+        Object.freeze(hooks.plugins);
+        Object.freeze(hooks);
+    }
+    Object.freeze(snapshot);
+    validatedPolicies.add(snapshot);
+    return snapshot;
+}
+/** Loaded snapshots are already validated; mutable direct API inputs still need validation. */
+export function requireRuntimePolicy(policy) {
+    if (validatedPolicies.has(policy))
+        return;
+    snapshotEnvironment([], policy.environment);
+    requireRuntimeCaches(policy.seeds ?? [], policy.sharedCacheDirectories ?? []);
+    requireSharedCachePolicy(policy);
+    requireArtifactDirectories(policy.artifactDirectories ?? []);
+}
+function requireRuntimeCaches(seeds, caches) {
+    requireRuntimeSeedTargets([...seeds, ...caches]);
+    for (const seed of seeds)
+        if (seed.roles !== undefined)
+            requireRuntimeRoles(seed.roles, "seed");
+    for (const cache of caches)
+        requireRuntimeRoles(cache.roles, "shared cache");
+}
+function freezeRuntimeCaches(snapshot) {
+    for (const seed of [
+        ...(snapshot.seeds ?? []),
+        ...(snapshot.sharedCacheDirectories ?? []),
+    ]) {
+        Object.freeze(seed.roles);
+        Object.freeze(seed);
+    }
+    Object.freeze(snapshot.seeds);
+    Object.freeze(snapshot.sharedCacheDirectories);
+}
+function freezeDiscovery(snapshot) {
+    for (const source of snapshot.discovery ?? []) {
+        Object.freeze(source.readOnlyRoots);
+        Object.freeze(source);
+    }
+    Object.freeze(snapshot.discovery);
+    Object.freeze(snapshot.skippedOptionalReadOnlyRoots);
+}
+function freezeArtifactDirectories(snapshot) {
+    const directories = snapshot.artifactDirectories ?? [];
+    for (const directory of directories)
+        Object.freeze(directory);
+    Object.freeze(snapshot.artifactDirectories);
+}
+function assertRuntimeConfiguration(value) {
+    if (!validate(value)) {
+        // Ajv always populates errors when validation fails.
+        const issue = validate.errors[0];
+        throw new Error(`runtime configuration schema ${runtimeSchemaPath(issue)}: ${issue.message}`);
+    }
+}
+function runtimeSchemaPath(issue) {
+    const params = issue.params;
+    const property = params.additionalProperty ?? params.missingProperty;
+    const suffix = typeof property === "string"
+        ? "/" + property.replaceAll("~", "~0").replaceAll("/", "~1")
+        : "";
+    return safeFilesystemPath(issue.instancePath + suffix || "/");
+}
+const RESERVED_ENVIRONMENT = /^(HOME|TMPDIR|TMPPREFIX|TMP|TEMP|CODEX_HOME|CODEX_THREAD_ID|CLAUDE_CONFIG_DIR|CLAUDE_EFFORT|BASH_ENV|ENV|ZDOTDIR|NODE_OPTIONS|BUN_OPTIONS|UV_OFFLINE|GIT_CONFIG.*|LD_.*|DYLD_.*|CLAUDE_CODE_.*|SEVRO_CODEX_.*|SEVRO_NATIVE_.*|SEVRO_CANDIDATE_.*)$/i;
+function requireEnvironmentName(name) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(name))
+        throw new Error("invalid runtime environment variable name");
+    if (RESERVED_ENVIRONMENT.test(name) ||
+        /KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH/i.test(name))
+        throw new Error(`runtime environment variable is protected: ${name}`);
+}
+function snapshotEnvironment(names, values) {
+    const inherited = Object.fromEntries(names.map((name) => {
+        requireEnvironmentName(name);
+        const value = process.env[name];
+        if (value === undefined)
+            throw new Error(`runtime environment variable is missing: ${name}`);
+        return [name, value];
+    }));
+    const environment = { ...inherited, ...values };
+    for (const [name, value] of Object.entries(environment)) {
+        requireEnvironmentName(name);
+        if (value.includes("\0") || Buffer.byteLength(value) > 8192)
+            throw new Error("runtime environment value is invalid or oversized");
+    }
+    return environment;
+}
+function requireRuntimeSeedTargets(seeds) {
+    const targets = seeds.map((seed) => seed.target);
+    if (targets.some((target) => !/^[a-z][a-z0-9-]{0,63}$/.test(target) ||
+        ["home", "tmp"].includes(target)))
+        throw new Error("runtime seed target is invalid or reserved");
+    if (new Set(targets).size !== targets.length)
+        throw new Error("runtime seed targets overlap");
+}
+/** Read the operator's repository configuration before any candidate starts. */
+export async function loadRuntimeConfiguration(projectRoot, explicitFile, protectedRoots = []) {
+    const path = await selectedRuntimeFile(projectRoot, explicitFile);
+    if (path === undefined)
+        return undefined;
+    try {
+        const canonical = await realpath(path);
+        const source = await readFile(canonical, "utf8");
+        if (Buffer.byteLength(source) > 65536)
+            throw new Error("runtime configuration exceeds 64 KiB");
+        return runtimePolicySnapshot(await resolveRuntimeConfiguration(parseRuntimeConfiguration(source), dirname(canonical), protectedRoots));
+    }
+    catch (cause) {
+        throw new Error(`${runtimeConfigurationDiagnostic(cause)} at ${safeFilesystemPath(path)}`, { cause });
+    }
+}
+function parseRuntimeConfiguration(source) {
+    try {
+        return JSON.parse(source);
+    }
+    catch (cause) {
+        throw new Error("runtime configuration $: invalid JSON; check the JSON syntax", { cause });
+    }
+}
+function runtimeConfigurationDiagnostic(cause) {
+    if (cause instanceof Error &&
+        /^(runtime |declared runtime |selected Apple )/.test(cause.message))
+        return `invalid runtime configuration: ${cause.message}`;
+    const filesystem = runtimeFilesystemDiagnostic(cause);
+    if (filesystem)
+        return filesystem;
+    return "invalid runtime configuration";
+}
+function runtimeFilesystemDiagnostic(cause) {
+    if (!(cause instanceof Error))
+        return undefined;
+    const error = cause;
+    if (!validFilesystemCode(error.code) ||
+        !validFilesystemOperation(error.syscall) ||
+        typeof error.path !== "string")
+        return undefined;
+    const path = safeFilesystemPath(error.path);
+    return `invalid runtime configuration: filesystem ${error.syscall} failed (${error.code}) at ${path}`;
+}
+function validFilesystemCode(code) {
+    return code !== undefined && /^E[A-Z0-9]+$/.test(code);
+}
+function validFilesystemOperation(operation) {
+    return operation !== undefined && /^[A-Za-z][A-Za-z0-9_]*$/.test(operation);
+}
+function safeFilesystemPath(path) {
+    return Array.from(path.slice(0, 256), (character) => {
+        const code = character.charCodeAt(0);
+        return code < 0x20 || code === 0x7f ? "?" : character;
+    }).join("");
+}
+async function selectedRuntimeFile(projectRoot, explicitFile) {
+    const path = explicitFile ?? join(projectRoot, "sevro.json");
+    const info = await selectedRuntimeStat(path, Boolean(explicitFile));
+    if (!info)
+        return undefined;
+    if (!info.isFile() || info.size > 65536)
+        throw new Error("invalid runtime configuration: expected a regular file up to 64 KiB");
+    return path;
+}
+async function selectedRuntimeStat(path, explicit) {
+    try {
+        return await lstat(path);
+    }
+    catch (cause) {
+        if (!explicit && cause.code === "ENOENT")
+            return undefined;
+        throw new Error(runtimeFilesystemDiagnostic(cause) ?? "invalid runtime configuration", { cause });
+    }
+}
+async function resolvedSeeds(seeds, environment, base) {
+    return Promise.all(seeds.map(async (seed) => {
+        const roots = await declaredRuntimeRoots([seed.source], environment, base);
+        requireRuntimeReadRoots(roots, []);
+        const [source] = roots;
+        if (!source)
+            throw new Error("runtime seed source is missing");
+        return {
+            source,
+            target: seed.target,
+            ...(seed.roles ? { roles: seed.roles } : {}),
+            sha256: await runtimeSeedDigest(source),
+        };
+    }));
+}
+async function resolveRuntimeConfiguration(value, base, protectedRoots) {
+    assertRuntimeConfiguration(value);
+    const environment = await resolvedRuntimeEnvironment(value);
+    const optional = await optionalRuntimeRoots(value.filesystem?.optionalReadOnlyRoots ?? [], environment, base, protectedRoots);
+    const pathRoots = await runtimePathDirectories(environment.PATH);
+    requireRuntimeReadRoots(pathRoots, protectedRoots);
+    requireRuntimeReadRoots(optional.roots, protectedRoots);
+    const discovery = await discoverRuntimeSupport(environment, protectedRoots);
+    const readOnlyRoots = [
+        ...optional.roots,
+        ...discovery.sources.flatMap((source) => source.readOnlyRoots),
+        ...pathRoots.filter((root) => !discovery.excludedPrefixes.includes(root)),
+        ...(await declaredRuntimeRoots(configurationReadRoots(value), environment, base)),
+    ];
+    requireRuntimeReadRoots(readOnlyRoots, protectedRoots);
+    return {
+        format: value.format,
+        ...selectedRuntimeCapabilities(value),
+        ...artifactConfiguration(value.runtime),
+        environment,
+        readOnlyRoots: [...new Set(readOnlyRoots)].sort(),
+        discovery: discovery.sources,
+        skippedOptionalReadOnlyRoots: optional.skipped,
+        ...(await resolvedRuntimeCaches(value, environment, base, [
+            ...protectedRoots,
+            ...readOnlyRoots,
+        ])),
+        hooks: resolvedHooks(value.hooks),
+    };
+}
+async function resolvedRuntimeCaches(value, environment, base, protectedRoots) {
+    const seeds = await resolvedSeeds(configurationSeeds(value), environment, base);
+    const caches = await resolveSharedCaches(value.runtime?.sharedCacheDirectories ?? [], environment, base, [...protectedRoots, ...seeds.map((seed) => seed.source)]);
+    return {
+        seeds,
+        ...(caches.length ? { sharedCacheDirectories: caches } : {}),
+    };
+}
+function selectedRuntimeCapabilities(value) {
+    return {
+        ...(value.network === undefined ? {} : { network: value.network }),
+        ...(value.codexState === undefined ? {} : { codexState: value.codexState }),
+        ...(value.nativeTranscripts === undefined
+            ? {}
+            : { nativeTranscripts: value.nativeTranscripts }),
+    };
+}
+async function resolvedRuntimeEnvironment(value) {
+    const { inherit, set } = configurationEnvironment(value);
+    const environment = snapshotEnvironment(inherit, set);
+    for (const [name, value] of Object.entries(environment)) {
+        if (name === "PATH" && inherit.includes(name) && !Object.hasOwn(set, name))
+            environment[name] = await runtimeInheritedPath(value);
+    }
+    return environment;
+}
+function configurationEnvironment(value) {
+    const environment = value.environment;
+    return { inherit: environment?.inherit ?? [], set: environment?.set ?? {} };
+}
+function artifactConfiguration(runtime) {
+    const directories = runtime?.artifactDirectories;
+    if (directories === undefined)
+        return {};
+    return { artifactDirectories: directories };
+}
+function configurationReadRoots(value) {
+    return value.filesystem?.readOnlyRoots ?? [];
+}
+function configurationSeeds(value) {
+    return value.runtime?.seedDirectories ?? [];
+}
+function resolvedHooks(hooks) {
+    return {
+        nativeGoal: hooks?.nativeGoal ?? false,
+        plugins: hooks?.plugins ?? [],
+    };
+}
+function requireRuntimeRoles(roles, kind) {
+    if (!validRoleArray(roles) ||
+        new Set(roles).size !== roles.length ||
+        roles.some((role) => !RUNTIME_ROLES.includes(role)))
+        throw new Error(`runtime ${kind} roles are invalid`);
+}
+export function runtimeRoleSeeds(policy, role) {
+    return (policy.seeds ?? []).filter((seed) => seed.roles?.includes(role) ?? role !== "checks");
+}
+function validRoleArray(roles) {
+    return Array.isArray(roles) && roles.length > 0;
+}
+export function runtimeSeedSources(policy) {
+    return [
+        ...(policy?.seedReadDenyRoots ?? []),
+        ...(policy?.seeds ?? []).map((seed) => seed.source),
+    ];
+}
+//# sourceMappingURL=config.js.map

package/dist/src/runtime/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,yBAAyB;AAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB;AAE1C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,GACxB,mBAAgB;AACjB,OAAO,QAAQ,iCAAiC;AAChD,OAAO,EACL,0BAA0B,GAE3B,kCAA+B;AAChC,OAAO,EAAE,iBAAiB,EAAE,mBAAgB;AAC5C,OAAO,EACL,mBAAmB,EACnB,wBAAwB,GAEzB,0BAAuB;AACxB,OAAO,EACL,sBAAsB,GAEvB,uBAAoB;AAErB,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,WAAW;IACX,QAAQ;IACR,OAAO;IACP,UAAU;IACV,UAAU;CACF,CAAC;AAuCX,MAAM,UAAU,uBAAuB,CACrC,MAAiC,EACjC,IAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;IAChC,OAAO,OAAO,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiC;IAEjC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,CAAC;IAC5B,OAAO,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;AACpC,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAAiB,CAAC;AAMvD,MAAM,UAAU,qBAAqB,CACnC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACtC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IAC1C,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,oBAAoB,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAC9E,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,0BAA0B,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAoB,EACpB,MAA8B;IAE9B,yBAAyB,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK;QACtB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAuB;IAClD,KAAK,MAAM,IAAI,IAAI;QACjB,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,sBAAsB,IAAI,EAAE,CAAC;KAC3C,EAAE,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,QAAuB;IAC9C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAuB;IACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC;IACvD,KAAK,MAAM,SAAS,IAAI,WAAW;QAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,qDAAqD;QACrD,MAAM,KAAK,GAAI,QAAQ,CAAC,MAA0C,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,gCAAgC,iBAAiB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAiC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,eAAe,CAAC;IACrE,MAAM,MAAM,GACV,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,kBAAkB,CAAC,KAAK,CAAC,YAAY,GAAG,MAAM,IAAI,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,oBAAoB,GACxB,qPAAqP,CAAC;AAExP,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,IACE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC;QAEvD,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAe,EACf,MAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAClC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IACF,MAAM,WAAW,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI;YACzD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAoB;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,IACE,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;QACtC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnC;QAED,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAC1C,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAAmB,EACnB,YAAqB,EACrB,iBAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,KAAK;YACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,OAAO,qBAAqB,CAC1B,MAAM,2BAA2B,CAC/B,yBAAyB,CAAC,MAAM,CAAC,EACjC,OAAO,CAAC,SAAS,CAAC,EAClB,cAAc,CACf,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAc;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8DAA8D,EAC9D,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAc;IACpD,IACE,KAAK,YAAY,KAAK;QACtB,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAEnE,OAAO,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3D,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,OAAO,+BAA+B,CAAC;AACzC,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAc;IACjD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,KAAK,GAAG,KAA8B,CAAC;IAC7C,IACE,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC;QAChC,CAAC,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAE9B,OAAO,SAAS,CAAC;IACnB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,6CAA6C,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,IAAI,QAAQ,IAAI,EAAE,CAAC;AACxG,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB;IACnD,OAAO,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,wBAAwB,CAAC,SAA6B;IAC7D,OAAO,SAAS,KAAK,SAAS,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAAmB,EACnB,YAAqB;IAErB,MAAM,IAAI,GAAG,YAAY,IAAI,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;QACrC,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAiB;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,QAAQ,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YACjE,OAAO,SAAS,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,2BAA2B,CAAC,KAAK,CAAC,IAAI,+BAA+B,EACrE,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAoB,EACpB,WAAmC,EACnC,IAAY;IAEZ,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC,CAAC,IAAI,CAAC,MAAM,CAAC,EACb,WAAW,EACX,IAAI,CACL,CAAC;QACF,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC/D,OAAO;YACL,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,EAAE,MAAM,iBAAiB,CAAC,MAAM,CAAC;SACxC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAc,EACd,IAAY,EACZ,cAAwB;IAExB,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,KAAK,CAAC,UAAU,EAAE,qBAAqB,IAAI,EAAE,EAC7C,WAAW,EACX,IAAI,EACJ,cAAc,CACf,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACjE,uBAAuB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACnD,uBAAuB,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG;QACpB,GAAG,QAAQ,CAAC,KAAK;QACjB,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;QAC9D,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,oBAAoB,CAC5B,sBAAsB,CAAC,KAAK,CAAC,EAC7B,WAAW,EACX,IAAI,CACL,CAAC;KACH,CAAC;IACF,uBAAuB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACvD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,2BAA2B,CAAC,KAAK,CAAC;QACrC,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC;QACvC,WAAW;QACX,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE;QACjD,SAAS,EAAE,SAAS,CAAC,OAAO;QAC5B,4BAA4B,EAAE,QAAQ,CAAC,OAAO;QAC9C,GAAG,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE;YACxD,GAAG,cAAc;YACjB,GAAG,aAAa;SACjB,CAAC,CAAC;QACH,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA2B,EAC3B,WAAmC,EACnC,IAAY,EACZ,cAAwB;IAExB,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,kBAAkB,CAAC,KAAK,CAAC,EACzB,WAAW,EACX,IAAI,CACL,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,CAAC,OAAO,EAAE,sBAAsB,IAAI,EAAE,EAC3C,WAAW,EACX,IAAI,EACJ,CAAC,GAAG,cAAc,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;IACF,OAAO;QACL,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAA2B;IAC9D,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAA2B;IACnE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;YACxE,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAA2B;IAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAwC;IACrE,MAAM,WAAW,GAAG,OAAO,EAAE,mBAAmB,CAAC;IACjD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC;AAC9C,CAAC;AACD,SAAS,sBAAsB,CAAC,KAA2B;IACzD,OAAO,KAAK,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC;AAC/C,CAAC;AACD,SAAS,kBAAkB,CAAC,KAA2B;IACrD,OAAO,KAAK,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAoC;IACzD,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,KAAK;QACtC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAoB,EAAE,IAAY;IAC7D,IACE,CAAC,cAAc,CAAC,KAAK,CAAC;QACtB,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACpC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,IAAiB;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,QAAQ,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAiC;IAEjC,OAAO;QACL,GAAG,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;KACpD,CAAC;AACJ,CAAC","sourcesContent":["import { lstat, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport type { ErrorObject } from \"ajv\";\nimport {\n  declaredRuntimeRoots,\n  optionalRuntimeRoots,\n  runtimePathDirectories,\n  runtimeInheritedPath,\n  requireRuntimeReadRoots,\n} from \"./paths\";\nimport validate from \"../generated/runtime.cjs\";\nimport {\n  requireArtifactDirectories,\n  type RuntimeArtifactDirectory,\n} from \"../candidate-artifacts\";\nimport { runtimeSeedDigest } from \"./seeds\";\nimport {\n  resolveSharedCaches,\n  requireSharedCachePolicy,\n  type SharedCacheDirectory,\n} from \"./shared-cache\";\nimport {\n  discoverRuntimeSupport,\n  type RuntimeDiscoverySource,\n} from \"./discovery\";\n\n/** Canonical roles; schemas:generate projects this list into the runtime schema. */\nexport const RUNTIME_ROLES = [\n  \"candidate\",\n  \"checks\",\n  \"hooks\",\n  \"semantic\",\n  \"advisory\",\n] as const;\nexport type RuntimeRole = (typeof RUNTIME_ROLES)[number];\nexport interface RuntimeSeed {\n  source: string;\n  target: string;\n  roles?: RuntimeRole[];\n}\nexport interface RuntimeConfiguration {\n  format: \"sevro.runtime.v1\";\n  codexState?: boolean;\n  network?: { localHttp?: boolean };\n  nativeTranscripts?: boolean;\n  environment?: { inherit?: string[]; set?: Record<string, string> };\n  filesystem?: { readOnlyRoots?: string[]; optionalReadOnlyRoots?: string[] };\n  runtime?: {\n    seedDirectories?: RuntimeSeed[];\n    sharedCacheDirectories?: SharedCacheDirectory[];\n    artifactDirectories?: RuntimeArtifactDirectory[];\n  };\n  hooks?: { nativeGoal?: boolean; plugins?: string[] };\n}\n\nexport interface RuntimePolicy {\n  format: \"sevro.runtime.v1\";\n  codexState?: boolean;\n  network?: { localHttp?: boolean };\n  artifactDirectories?: RuntimeArtifactDirectory[];\n  nativeTranscripts?: boolean;\n  environment: Record<string, string>;\n  readOnlyRoots: string[];\n  discovery?: RuntimeDiscoverySource[];\n  skippedOptionalReadOnlyRoots?: string[];\n  /** Original source denials retained when a derived role policy omits seeds. */\n  seedReadDenyRoots?: string[];\n  seeds?: (RuntimeSeed & { sha256: string })[];\n  sharedCacheDirectories?: SharedCacheDirectory[];\n  hooks?: { nativeGoal?: boolean; plugins?: string[] };\n}\n\nexport function runtimeLocalHttpEnabled(\n  policy: RuntimePolicy | undefined,\n  role: RuntimeRole,\n): boolean {\n  const network = policy?.network;\n  return network?.localHttp === true && [\"candidate\", \"checks\"].includes(role);\n}\n\nexport function runtimeNativeGoalEnabled(\n  policy: RuntimePolicy | undefined,\n): boolean {\n  const hooks = policy?.hooks;\n  return hooks?.nativeGoal === true;\n}\n\nconst validatedPolicies = new WeakSet<RuntimePolicy>();\n\nexport function runtimePolicySnapshot(policy: RuntimePolicy): RuntimePolicy;\nexport function runtimePolicySnapshot(\n  policy: RuntimePolicy | undefined,\n): RuntimePolicy | undefined;\nexport function runtimePolicySnapshot(\n  policy: RuntimePolicy | undefined,\n): RuntimePolicy | undefined {\n  if (!policy) return undefined;\n  const snapshot = structuredClone(policy);\n  if (!validatedPolicies.has(policy)) requireRuntimePolicy(snapshot);\n  Object.freeze(snapshot.network);\n  freezeArtifactDirectories(snapshot);\n  Object.freeze(snapshot.environment);\n  Object.freeze(snapshot.readOnlyRoots);\n  freezeDiscovery(snapshot);\n  freezeRuntimeCaches(snapshot);\n  Object.freeze(snapshot.seedReadDenyRoots);\n  const hooks = snapshot.hooks;\n  if (hooks) {\n    Object.freeze(hooks.plugins);\n    Object.freeze(hooks);\n  }\n  Object.freeze(snapshot);\n  validatedPolicies.add(snapshot);\n  return snapshot;\n}\n\n/** Loaded snapshots are already validated; mutable direct API inputs still need validation. */\nexport function requireRuntimePolicy(policy: RuntimePolicy): void {\n  if (validatedPolicies.has(policy)) return;\n  snapshotEnvironment([], policy.environment);\n  requireRuntimeCaches(policy.seeds ?? [], policy.sharedCacheDirectories ?? []);\n  requireSharedCachePolicy(policy);\n  requireArtifactDirectories(policy.artifactDirectories ?? []);\n}\n\nfunction requireRuntimeCaches(\n  seeds: RuntimeSeed[],\n  caches: SharedCacheDirectory[],\n): void {\n  requireRuntimeSeedTargets([...seeds, ...caches]);\n  for (const seed of seeds)\n    if (seed.roles !== undefined) requireRuntimeRoles(seed.roles, \"seed\");\n  for (const cache of caches) requireRuntimeRoles(cache.roles, \"shared cache\");\n}\n\nfunction freezeRuntimeCaches(snapshot: RuntimePolicy): void {\n  for (const seed of [\n    ...(snapshot.seeds ?? []),\n    ...(snapshot.sharedCacheDirectories ?? []),\n  ]) {\n    Object.freeze(seed.roles);\n    Object.freeze(seed);\n  }\n  Object.freeze(snapshot.seeds);\n  Object.freeze(snapshot.sharedCacheDirectories);\n}\n\nfunction freezeDiscovery(snapshot: RuntimePolicy): void {\n  for (const source of snapshot.discovery ?? []) {\n    Object.freeze(source.readOnlyRoots);\n    Object.freeze(source);\n  }\n  Object.freeze(snapshot.discovery);\n  Object.freeze(snapshot.skippedOptionalReadOnlyRoots);\n}\n\nfunction freezeArtifactDirectories(snapshot: RuntimePolicy): void {\n  const directories = snapshot.artifactDirectories ?? [];\n  for (const directory of directories) Object.freeze(directory);\n  Object.freeze(snapshot.artifactDirectories);\n}\n\nfunction assertRuntimeConfiguration(\n  value: unknown,\n): asserts value is RuntimeConfiguration {\n  if (!validate(value)) {\n    // Ajv always populates errors when validation fails.\n    const issue = (validate.errors as [ErrorObject, ...ErrorObject[]])[0];\n    throw new Error(\n      `runtime configuration schema ${runtimeSchemaPath(issue)}: ${issue.message}`,\n    );\n  }\n}\n\nfunction runtimeSchemaPath(issue: ErrorObject): string {\n  const params = issue.params as Record<string, unknown>;\n  const property = params.additionalProperty ?? params.missingProperty;\n  const suffix =\n    typeof property === \"string\"\n      ? \"/\" + property.replaceAll(\"~\", \"~0\").replaceAll(\"/\", \"~1\")\n      : \"\";\n  return safeFilesystemPath(issue.instancePath + suffix || \"/\");\n}\n\nconst RESERVED_ENVIRONMENT =\n  /^(HOME|TMPDIR|TMPPREFIX|TMP|TEMP|CODEX_HOME|CODEX_THREAD_ID|CLAUDE_CONFIG_DIR|CLAUDE_EFFORT|BASH_ENV|ENV|ZDOTDIR|NODE_OPTIONS|BUN_OPTIONS|UV_OFFLINE|GIT_CONFIG.*|LD_.*|DYLD_.*|CLAUDE_CODE_.*|SEVRO_CODEX_.*|SEVRO_NATIVE_.*|SEVRO_CANDIDATE_.*)$/i;\n\nfunction requireEnvironmentName(name: string): void {\n  if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(name))\n    throw new Error(\"invalid runtime environment variable name\");\n  if (\n    RESERVED_ENVIRONMENT.test(name) ||\n    /KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH/i.test(name)\n  )\n    throw new Error(`runtime environment variable is protected: ${name}`);\n}\n\nfunction snapshotEnvironment(\n  names: string[],\n  values: Record<string, string>,\n): Record<string, string> {\n  const inherited = Object.fromEntries(\n    names.map((name) => {\n      requireEnvironmentName(name);\n      const value = process.env[name];\n      if (value === undefined)\n        throw new Error(`runtime environment variable is missing: ${name}`);\n      return [name, value];\n    }),\n  );\n  const environment = { ...inherited, ...values };\n  for (const [name, value] of Object.entries(environment)) {\n    requireEnvironmentName(name);\n    if (value.includes(\"\\0\") || Buffer.byteLength(value) > 8192)\n      throw new Error(\"runtime environment value is invalid or oversized\");\n  }\n  return environment;\n}\n\nfunction requireRuntimeSeedTargets(seeds: RuntimeSeed[]): void {\n  const targets = seeds.map((seed) => seed.target);\n  if (\n    targets.some(\n      (target) =>\n        !/^[a-z][a-z0-9-]{0,63}$/.test(target) ||\n        [\"home\", \"tmp\"].includes(target),\n    )\n  )\n    throw new Error(\"runtime seed target is invalid or reserved\");\n  if (new Set(targets).size !== targets.length)\n    throw new Error(\"runtime seed targets overlap\");\n}\n\n/** Read the operator's repository configuration before any candidate starts. */\nexport async function loadRuntimeConfiguration(\n  projectRoot: string,\n  explicitFile?: string,\n  protectedRoots: string[] = [],\n): Promise<RuntimePolicy | undefined> {\n  const path = await selectedRuntimeFile(projectRoot, explicitFile);\n  if (path === undefined) return undefined;\n  try {\n    const canonical = await realpath(path);\n    const source = await readFile(canonical, \"utf8\");\n    if (Buffer.byteLength(source) > 65536)\n      throw new Error(\"runtime configuration exceeds 64 KiB\");\n    return runtimePolicySnapshot(\n      await resolveRuntimeConfiguration(\n        parseRuntimeConfiguration(source),\n        dirname(canonical),\n        protectedRoots,\n      ),\n    );\n  } catch (cause) {\n    throw new Error(\n      `${runtimeConfigurationDiagnostic(cause)} at ${safeFilesystemPath(path)}`,\n      { cause },\n    );\n  }\n}\n\nfunction parseRuntimeConfiguration(source: string): unknown {\n  try {\n    return JSON.parse(source);\n  } catch (cause) {\n    throw new Error(\n      \"runtime configuration $: invalid JSON; check the JSON syntax\",\n      { cause },\n    );\n  }\n}\n\nfunction runtimeConfigurationDiagnostic(cause: unknown): string {\n  if (\n    cause instanceof Error &&\n    /^(runtime |declared runtime |selected Apple )/.test(cause.message)\n  )\n    return `invalid runtime configuration: ${cause.message}`;\n  const filesystem = runtimeFilesystemDiagnostic(cause);\n  if (filesystem) return filesystem;\n  return \"invalid runtime configuration\";\n}\n\nfunction runtimeFilesystemDiagnostic(cause: unknown): string | undefined {\n  if (!(cause instanceof Error)) return undefined;\n  const error = cause as NodeJS.ErrnoException;\n  if (\n    !validFilesystemCode(error.code) ||\n    !validFilesystemOperation(error.syscall) ||\n    typeof error.path !== \"string\"\n  )\n    return undefined;\n  const path = safeFilesystemPath(error.path);\n  return `invalid runtime configuration: filesystem ${error.syscall} failed (${error.code}) at ${path}`;\n}\n\nfunction validFilesystemCode(code: string | undefined): boolean {\n  return code !== undefined && /^E[A-Z0-9]+$/.test(code);\n}\n\nfunction validFilesystemOperation(operation: string | undefined): boolean {\n  return operation !== undefined && /^[A-Za-z][A-Za-z0-9_]*$/.test(operation);\n}\n\nfunction safeFilesystemPath(path: string): string {\n  return Array.from(path.slice(0, 256), (character) => {\n    const code = character.charCodeAt(0);\n    return code < 0x20 || code === 0x7f ? \"?\" : character;\n  }).join(\"\");\n}\n\nasync function selectedRuntimeFile(\n  projectRoot: string,\n  explicitFile?: string,\n): Promise<string | undefined> {\n  const path = explicitFile ?? join(projectRoot, \"sevro.json\");\n  const info = await selectedRuntimeStat(path, Boolean(explicitFile));\n  if (!info) return undefined;\n  if (!info.isFile() || info.size > 65536)\n    throw new Error(\n      \"invalid runtime configuration: expected a regular file up to 64 KiB\",\n    );\n  return path;\n}\n\nasync function selectedRuntimeStat(path: string, explicit: boolean) {\n  try {\n    return await lstat(path);\n  } catch (cause) {\n    if (!explicit && (cause as NodeJS.ErrnoException).code === \"ENOENT\")\n      return undefined;\n    throw new Error(\n      runtimeFilesystemDiagnostic(cause) ?? \"invalid runtime configuration\",\n      { cause },\n    );\n  }\n}\n\nasync function resolvedSeeds(\n  seeds: RuntimeSeed[],\n  environment: Record<string, string>,\n  base: string,\n) {\n  return Promise.all(\n    seeds.map(async (seed) => {\n      const roots = await declaredRuntimeRoots(\n        [seed.source],\n        environment,\n        base,\n      );\n      requireRuntimeReadRoots(roots, []);\n      const [source] = roots;\n      if (!source) throw new Error(\"runtime seed source is missing\");\n      return {\n        source,\n        target: seed.target,\n        ...(seed.roles ? { roles: seed.roles } : {}),\n        sha256: await runtimeSeedDigest(source),\n      };\n    }),\n  );\n}\n\nasync function resolveRuntimeConfiguration(\n  value: unknown,\n  base: string,\n  protectedRoots: string[],\n): Promise<RuntimePolicy> {\n  assertRuntimeConfiguration(value);\n  const environment = await resolvedRuntimeEnvironment(value);\n  const optional = await optionalRuntimeRoots(\n    value.filesystem?.optionalReadOnlyRoots ?? [],\n    environment,\n    base,\n    protectedRoots,\n  );\n  const pathRoots = await runtimePathDirectories(environment.PATH);\n  requireRuntimeReadRoots(pathRoots, protectedRoots);\n  requireRuntimeReadRoots(optional.roots, protectedRoots);\n  const discovery = await discoverRuntimeSupport(environment, protectedRoots);\n  const readOnlyRoots = [\n    ...optional.roots,\n    ...discovery.sources.flatMap((source) => source.readOnlyRoots),\n    ...pathRoots.filter((root) => !discovery.excludedPrefixes.includes(root)),\n    ...(await declaredRuntimeRoots(\n      configurationReadRoots(value),\n      environment,\n      base,\n    )),\n  ];\n  requireRuntimeReadRoots(readOnlyRoots, protectedRoots);\n  return {\n    format: value.format,\n    ...selectedRuntimeCapabilities(value),\n    ...artifactConfiguration(value.runtime),\n    environment,\n    readOnlyRoots: [...new Set(readOnlyRoots)].sort(),\n    discovery: discovery.sources,\n    skippedOptionalReadOnlyRoots: optional.skipped,\n    ...(await resolvedRuntimeCaches(value, environment, base, [\n      ...protectedRoots,\n      ...readOnlyRoots,\n    ])),\n    hooks: resolvedHooks(value.hooks),\n  };\n}\n\nasync function resolvedRuntimeCaches(\n  value: RuntimeConfiguration,\n  environment: Record<string, string>,\n  base: string,\n  protectedRoots: string[],\n) {\n  const seeds = await resolvedSeeds(\n    configurationSeeds(value),\n    environment,\n    base,\n  );\n  const caches = await resolveSharedCaches(\n    value.runtime?.sharedCacheDirectories ?? [],\n    environment,\n    base,\n    [...protectedRoots, ...seeds.map((seed) => seed.source)],\n  );\n  return {\n    seeds,\n    ...(caches.length ? { sharedCacheDirectories: caches } : {}),\n  };\n}\n\nfunction selectedRuntimeCapabilities(value: RuntimeConfiguration) {\n  return {\n    ...(value.network === undefined ? {} : { network: value.network }),\n    ...(value.codexState === undefined ? {} : { codexState: value.codexState }),\n    ...(value.nativeTranscripts === undefined\n      ? {}\n      : { nativeTranscripts: value.nativeTranscripts }),\n  };\n}\n\nasync function resolvedRuntimeEnvironment(value: RuntimeConfiguration) {\n  const { inherit, set } = configurationEnvironment(value);\n  const environment = snapshotEnvironment(inherit, set);\n  for (const [name, value] of Object.entries(environment)) {\n    if (name === \"PATH\" && inherit.includes(name) && !Object.hasOwn(set, name))\n      environment[name] = await runtimeInheritedPath(value);\n  }\n  return environment;\n}\n\nfunction configurationEnvironment(value: RuntimeConfiguration) {\n  const environment = value.environment;\n  return { inherit: environment?.inherit ?? [], set: environment?.set ?? {} };\n}\n\nfunction artifactConfiguration(runtime: RuntimeConfiguration[\"runtime\"]) {\n  const directories = runtime?.artifactDirectories;\n  if (directories === undefined) return {};\n  return { artifactDirectories: directories };\n}\nfunction configurationReadRoots(value: RuntimeConfiguration): string[] {\n  return value.filesystem?.readOnlyRoots ?? [];\n}\nfunction configurationSeeds(value: RuntimeConfiguration) {\n  return value.runtime?.seedDirectories ?? [];\n}\n\nfunction resolvedHooks(hooks: RuntimeConfiguration[\"hooks\"]) {\n  return {\n    nativeGoal: hooks?.nativeGoal ?? false,\n    plugins: hooks?.plugins ?? [],\n  };\n}\n\nfunction requireRuntimeRoles(roles: RuntimeRole[], kind: string): void {\n  if (\n    !validRoleArray(roles) ||\n    new Set(roles).size !== roles.length ||\n    roles.some((role) => !RUNTIME_ROLES.includes(role))\n  )\n    throw new Error(`runtime ${kind} roles are invalid`);\n}\n\nexport function runtimeRoleSeeds(policy: RuntimePolicy, role: RuntimeRole) {\n  return (policy.seeds ?? []).filter(\n    (seed) => seed.roles?.includes(role) ?? role !== \"checks\",\n  );\n}\n\nfunction validRoleArray(roles: unknown): roles is RuntimeRole[] {\n  return Array.isArray(roles) && roles.length > 0;\n}\n\nexport function runtimeSeedSources(\n  policy: RuntimePolicy | undefined,\n): string[] {\n  return [\n    ...(policy?.seedReadDenyRoots ?? []),\n    ...(policy?.seeds ?? []).map((seed) => seed.source),\n  ];\n}\n"]}

package/dist/src/runtime/discovery-apple.js

@@ -0,0 +1,65 @@
+import { realpath } from "node:fs/promises";
+import { dirname } from "node:path";
+import { RuntimeMetadataQueryError } from "./query.js";
+import { optionalRuntimeRoots, requireRuntimeReadRoots } from "./paths.js";
+import { providerExecutable, query, requireProvider, } from "./discovery-providers.js";
+export async function discoverApple(path, environment, sources, protectedRoots) {
+    const executable = await providerExecutable("xcode-select", path);
+    if (!executable)
+        return;
+    if (!(await selectedAppleShim(executable, path)))
+        return;
+    await requireProvider(executable, protectedRoots);
+    const directory = await selectedAppleDirectory(executable, environment);
+    if (directory === undefined)
+        return;
+    const support = await selectedDeveloperRoots(directory, protectedRoots);
+    requireRuntimeReadRoots(support.roots, []);
+    sources.push({
+        provider: "apple-developer",
+        executable,
+        readOnlyRoots: support.roots,
+    });
+}
+async function selectedDeveloperRoots(directory, protectedRoots) {
+    const support = await optionalRuntimeRoots([directory], {}, "/", protectedRoots);
+    if (support.skipped.length)
+        throw new Error("selected Apple developer directory is missing");
+    return support;
+}
+async function selectedAppleShim(provider, path) {
+    const providerDirectory = dirname(await realpath(provider));
+    for (const name of [
+        "git",
+        "python3",
+        "clang",
+        "clang++",
+        "cc",
+        "c++",
+        "xcrun",
+        "xcodebuild",
+        "swift",
+        "make",
+        "ar",
+        "ranlib",
+    ]) {
+        const executable = await providerExecutable(name, path);
+        if (executable && dirname(await realpath(executable)) === providerDirectory)
+            return true;
+    }
+    return false;
+}
+async function selectedAppleDirectory(executable, environment) {
+    try {
+        return await query(executable, "--print-path", environment);
+    }
+    catch (cause) {
+        const failure = cause.cause;
+        if (environment.DEVELOPER_DIR === undefined &&
+            failure instanceof RuntimeMetadataQueryError &&
+            failure.noActiveDeveloper)
+            return undefined;
+        throw cause;
+    }
+}
+//# sourceMappingURL=discovery-apple.js.map

package/dist/src/runtime/discovery-apple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-apple.js","sourceRoot":"","sources":["discovery-apple.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,yBAAyB;AAC5C,OAAO,EAAE,OAAO,EAAE,kBAAkB;AACpC,OAAO,EAAE,yBAAyB,EAAE,mBAAgB;AACpD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,mBAAgB;AACxE,OAAO,EACL,kBAAkB,EAClB,KAAK,EACL,eAAe,GAEhB,iCAA8B;AAE/B,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmC,EACnC,OAAiC,EACjC,cAAwB;IAExB,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO;IACzD,MAAM,eAAe,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACxE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IACpC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACxE,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC;QACX,QAAQ,EAAE,iBAAiB;QAC3B,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,KAAK;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,SAAiB,EACjB,cAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,CAAC,SAAS,CAAC,EACX,EAAE,EACF,GAAG,EACH,cAAc,CACf,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM;QACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,IAAY;IAEZ,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI;QACjB,KAAK;QACL,SAAS;QACT,OAAO;QACP,SAAS;QACT,IAAI;QACJ,KAAK;QACL,OAAO;QACP,YAAY;QACZ,OAAO;QACP,MAAM;QACN,IAAI;QACJ,QAAQ;KACT,EAAE,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,iBAAiB;YACzE,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,UAAkB,EAClB,WAAmC;IAEnC,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAI,KAAe,CAAC,KAAK,CAAC;QACvC,IACE,WAAW,CAAC,aAAa,KAAK,SAAS;YACvC,OAAO,YAAY,yBAAyB;YAC5C,OAAO,CAAC,iBAAiB;YAEzB,OAAO,SAAS,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { RuntimeMetadataQueryError } from \"./query\";\nimport { optionalRuntimeRoots, requireRuntimeReadRoots } from \"./paths\";\nimport {\n  providerExecutable,\n  query,\n  requireProvider,\n  type RuntimeDiscoverySource,\n} from \"./discovery-providers\";\n\nexport async function discoverApple(\n  path: string,\n  environment: Record<string, string>,\n  sources: RuntimeDiscoverySource[],\n  protectedRoots: string[],\n) {\n  const executable = await providerExecutable(\"xcode-select\", path);\n  if (!executable) return;\n  if (!(await selectedAppleShim(executable, path))) return;\n  await requireProvider(executable, protectedRoots);\n  const directory = await selectedAppleDirectory(executable, environment);\n  if (directory === undefined) return;\n  const support = await selectedDeveloperRoots(directory, protectedRoots);\n  requireRuntimeReadRoots(support.roots, []);\n  sources.push({\n    provider: \"apple-developer\",\n    executable,\n    readOnlyRoots: support.roots,\n  });\n}\n\nasync function selectedDeveloperRoots(\n  directory: string,\n  protectedRoots: string[],\n) {\n  const support = await optionalRuntimeRoots(\n    [directory],\n    {},\n    \"/\",\n    protectedRoots,\n  );\n  if (support.skipped.length)\n    throw new Error(\"selected Apple developer directory is missing\");\n  return support;\n}\n\nasync function selectedAppleShim(\n  provider: string,\n  path: string,\n): Promise<boolean> {\n  const providerDirectory = dirname(await realpath(provider));\n  for (const name of [\n    \"git\",\n    \"python3\",\n    \"clang\",\n    \"clang++\",\n    \"cc\",\n    \"c++\",\n    \"xcrun\",\n    \"xcodebuild\",\n    \"swift\",\n    \"make\",\n    \"ar\",\n    \"ranlib\",\n  ]) {\n    const executable = await providerExecutable(name, path);\n    if (executable && dirname(await realpath(executable)) === providerDirectory)\n      return true;\n  }\n  return false;\n}\n\nasync function selectedAppleDirectory(\n  executable: string,\n  environment: Record<string, string>,\n) {\n  try {\n    return await query(executable, \"--print-path\", environment);\n  } catch (cause) {\n    const failure = (cause as Error).cause;\n    if (\n      environment.DEVELOPER_DIR === undefined &&\n      failure instanceof RuntimeMetadataQueryError &&\n      failure.noActiveDeveloper\n    )\n      return undefined;\n    throw cause;\n  }\n}\n"]}

package/dist/src/runtime/discovery-providers.js

@@ -0,0 +1,37 @@
+import { access, realpath } from "node:fs/promises";
+import { constants } from "node:fs";
+import { delimiter, isAbsolute, join } from "node:path";
+import { runtimeMetadataQuery } from "./query.js";
+import { requireRuntimeReadRoots } from "./paths.js";
+import { containsControl } from "../value-guards.js";
+export async function providerExecutable(name, path) {
+    for (const entry of path.split(delimiter)) {
+        const executable = join(entry, name);
+        try {
+            await access(executable, constants.X_OK);
+            return executable;
+        }
+        catch (cause) {
+            const code = cause.code;
+            if (code !== "ENOENT" && code !== "EACCES")
+                throw cause;
+        }
+    }
+    return undefined;
+}
+export async function query(executable, argument, environment) {
+    try {
+        const value = (await runtimeMetadataQuery(executable, argument, environment)).trim();
+        if (!isAbsolute(value) || containsControl(value))
+            throw new Error("expected one absolute metadata path");
+        return value;
+    }
+    catch (cause) {
+        const reason = cause instanceof Error ? cause.message : "query unavailable";
+        throw new Error(`runtime discovery query failed: ${executable} ${argument}: ${reason} (3 second / 8 KiB bound)`, { cause });
+    }
+}
+export async function requireProvider(executable, protectedRoots) {
+    requireRuntimeReadRoots([executable, await realpath(executable)], protectedRoots);
+}
+//# sourceMappingURL=discovery-providers.js.map

package/dist/src/runtime/discovery-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-providers.js","sourceRoot":"","sources":["discovery-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,yBAAyB;AACpD,OAAO,EAAE,SAAS,EAAE,gBAAgB;AACpC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB;AACxD,OAAO,EAAE,oBAAoB,EAAE,mBAAgB;AAC/C,OAAO,EAAE,uBAAuB,EAAE,mBAAgB;AAClD,OAAO,EAAE,eAAe,EAAE,2BAAwB;AAQlD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY;IACjE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,UAAkB,EAClB,QAAgB,EAChB,WAAmC;IAEnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CACZ,MAAM,oBAAoB,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAC9D,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,IAAI,QAAQ,KAAK,MAAM,2BAA2B,EAC/F,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,cAAwB;IAExB,uBAAuB,CACrB,CAAC,UAAU,EAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,EACxC,cAAc,CACf,CAAC;AACJ,CAAC","sourcesContent":["import { access, realpath } from \"node:fs/promises\";\nimport { constants } from \"node:fs\";\nimport { delimiter, isAbsolute, join } from \"node:path\";\nimport { runtimeMetadataQuery } from \"./query\";\nimport { requireRuntimeReadRoots } from \"./paths\";\nimport { containsControl } from \"../value-guards\";\n\nexport interface RuntimeDiscoverySource {\n  provider: \"homebrew\" | \"apple-developer\";\n  executable: string;\n  readOnlyRoots: string[];\n}\n\nexport async function providerExecutable(name: string, path: string) {\n  for (const entry of path.split(delimiter)) {\n    const executable = join(entry, name);\n    try {\n      await access(executable, constants.X_OK);\n      return executable;\n    } catch (cause) {\n      const code = (cause as NodeJS.ErrnoException).code;\n      if (code !== \"ENOENT\" && code !== \"EACCES\") throw cause;\n    }\n  }\n  return undefined;\n}\n\nexport async function query(\n  executable: string,\n  argument: string,\n  environment: Record<string, string>,\n) {\n  try {\n    const value = (\n      await runtimeMetadataQuery(executable, argument, environment)\n    ).trim();\n    if (!isAbsolute(value) || containsControl(value))\n      throw new Error(\"expected one absolute metadata path\");\n    return value;\n  } catch (cause) {\n    const reason = cause instanceof Error ? cause.message : \"query unavailable\";\n    throw new Error(\n      `runtime discovery query failed: ${executable} ${argument}: ${reason} (3 second / 8 KiB bound)`,\n      { cause },\n    );\n  }\n}\n\nexport async function requireProvider(\n  executable: string,\n  protectedRoots: string[],\n) {\n  requireRuntimeReadRoots(\n    [executable, await realpath(executable)],\n    protectedRoots,\n  );\n}\n"]}

package/dist/src/runtime/discovery.js

@@ -0,0 +1,40 @@
+import { realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { insideRuntimeRoot, optionalRuntimeRoots, requireRuntimeReadRoots, } from "./paths.js";
+import { providerExecutable, query, requireProvider, } from "./discovery-providers.js";
+async function homebrew(executable, environment, protectedRoots) {
+    const prefix = await query(executable, "--prefix", environment);
+    const canonicalPrefix = await realpath(prefix);
+    requireRuntimeReadRoots([prefix, canonicalPrefix], []);
+    const cellar = await query(executable, "--cellar", environment);
+    const support = await optionalRuntimeRoots([cellar, join(prefix, "opt"), join(prefix, "etc")], {}, "/", protectedRoots);
+    requireRuntimeReadRoots(support.roots, []);
+    if (support.roots.some((root) => [prefix, canonicalPrefix].some((installation) => insideRuntimeRoot(root, installation))))
+        throw new Error("runtime Homebrew metadata grants whole installation prefix");
+    return { prefix, roots: support.roots };
+}
+/** Query only providers selected by the operator's declared PATH. */
+export async function discoverRuntimeSupport(environment, protectedRoots) {
+    const path = environment.PATH;
+    const sources = [];
+    const excludedPrefixes = [];
+    if (path === undefined)
+        return { sources, excludedPrefixes };
+    const brew = await providerExecutable("brew", path);
+    if (brew) {
+        await requireProvider(brew, protectedRoots);
+        const support = await homebrew(brew, environment, protectedRoots);
+        excludedPrefixes.push(support.prefix, await realpath(support.prefix));
+        sources.push({
+            provider: "homebrew",
+            executable: brew,
+            readOnlyRoots: support.roots,
+        });
+    }
+    if (process.platform === "darwin") {
+        const { discoverApple } = await import("./discovery-apple.js");
+        await discoverApple(path, environment, sources, protectedRoots);
+    }
+    return { sources, excludedPrefixes };
+}
+//# sourceMappingURL=discovery.js.map

package/dist/src/runtime/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,yBAAyB;AAC5C,OAAO,EAAE,IAAI,EAAE,kBAAkB;AACjC,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,GACxB,mBAAgB;AACjB,OAAO,EACL,kBAAkB,EAClB,KAAK,EACL,eAAe,GAEhB,iCAA8B;AAG/B,KAAK,UAAU,QAAQ,CACrB,UAAkB,EAClB,WAAmC,EACnC,cAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,uBAAuB,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAClD,EAAE,EACF,GAAG,EACH,cAAc,CACf,CAAC;IACF,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,IACE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1B,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAC9C,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,CACtC,CACF;QAED,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmC,EACnC,cAAwB;IAExB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;IAC9B,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;QAClE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,OAAO,CAAC,KAAK;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,wBAAqB,CAAC;QAC5D,MAAM,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AACvC,CAAC","sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  insideRuntimeRoot,\n  optionalRuntimeRoots,\n  requireRuntimeReadRoots,\n} from \"./paths\";\nimport {\n  providerExecutable,\n  query,\n  requireProvider,\n  type RuntimeDiscoverySource,\n} from \"./discovery-providers\";\nexport type { RuntimeDiscoverySource } from \"./discovery-providers\";\n\nasync function homebrew(\n  executable: string,\n  environment: Record<string, string>,\n  protectedRoots: string[],\n) {\n  const prefix = await query(executable, \"--prefix\", environment);\n  const canonicalPrefix = await realpath(prefix);\n  requireRuntimeReadRoots([prefix, canonicalPrefix], []);\n  const cellar = await query(executable, \"--cellar\", environment);\n  const support = await optionalRuntimeRoots(\n    [cellar, join(prefix, \"opt\"), join(prefix, \"etc\")],\n    {},\n    \"/\",\n    protectedRoots,\n  );\n  requireRuntimeReadRoots(support.roots, []);\n  if (\n    support.roots.some((root) =>\n      [prefix, canonicalPrefix].some((installation) =>\n        insideRuntimeRoot(root, installation),\n      ),\n    )\n  )\n    throw new Error(\n      \"runtime Homebrew metadata grants whole installation prefix\",\n    );\n  return { prefix, roots: support.roots };\n}\n\n/** Query only providers selected by the operator's declared PATH. */\nexport async function discoverRuntimeSupport(\n  environment: Record<string, string>,\n  protectedRoots: string[],\n) {\n  const path = environment.PATH;\n  const sources: RuntimeDiscoverySource[] = [];\n  const excludedPrefixes: string[] = [];\n  if (path === undefined) return { sources, excludedPrefixes };\n  const brew = await providerExecutable(\"brew\", path);\n  if (brew) {\n    await requireProvider(brew, protectedRoots);\n    const support = await homebrew(brew, environment, protectedRoots);\n    excludedPrefixes.push(support.prefix, await realpath(support.prefix));\n    sources.push({\n      provider: \"homebrew\",\n      executable: brew,\n      readOnlyRoots: support.roots,\n    });\n  }\n  if (process.platform === \"darwin\") {\n    const { discoverApple } = await import(\"./discovery-apple\");\n    await discoverApple(path, environment, sources, protectedRoots);\n  }\n  return { sources, excludedPrefixes };\n}\n"]}

package/dist/src/runtime/hook-processes.js

@@ -0,0 +1,81 @@
+import { spawn } from "../runtime-process.js";
+import { readFile, readdir, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { isRecord } from "../value-guards.js";
+export async function hookExecutions(receipts) {
+    return Promise.all((await readdir(receipts))
+        .filter((name) => name.startsWith("call."))
+        .map(async (name) => {
+        try {
+            const value = JSON.parse(await readFile(join(receipts, name), "utf8"));
+            return isRecord(value) ? value : { status: "unknown" };
+        }
+        catch {
+            return { status: "unknown" };
+        }
+    }));
+}
+async function processOutput(argv) {
+    const child = spawn(argv, { stdout: "pipe", stderr: "ignore" });
+    const output = await new Response(child.stdout).text();
+    await child.exited;
+    if (Buffer.byteLength(output) > 1024 * 1024)
+        throw new Error("hook process ownership exceeds size limit");
+    return output;
+}
+function ownedWrapper(execution, receipts) {
+    return (validProcessId(execution.pid) &&
+        typeof execution.wrapper === "string" &&
+        dirname(execution.wrapper) === dirname(receipts) &&
+        /^hook-[0-9]+\.sh$/.test(basename(execution.wrapper)));
+}
+function validProcessId(pid) {
+    return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 1;
+}
+function processChildren(table, root) {
+    const pairs = table
+        .trim()
+        .split("\n")
+        .map((line) => line.trim().split(/\s+/).map(Number));
+    const pending = [root], children = [];
+    while (pending.length) {
+        const parent = pending.pop();
+        const found = pairs
+            .filter((pair) => pair[1] === parent)
+            .map((pair) => pair[0])
+            .filter((pid) => pid !== undefined);
+        pending.push(...found);
+        children.push(...found);
+    }
+    return children;
+}
+function stopProcess(pid) {
+    try {
+        process.kill(pid, "SIGKILL");
+    }
+    catch {
+        /* The owned process may already have exited. */
+    }
+}
+/** Stop only processes still bound to a runner-owned private hook wrapper. */
+export async function releaseHookProcesses(receipts) {
+    await writeFile(join(receipts, "stopped"), "stopped\n", { mode: 0o600 });
+    for (const execution of await hookExecutions(receipts)) {
+        if (!ownedWrapper(execution, receipts))
+            continue;
+        const command = await processOutput([
+            "/bin/ps",
+            "-p",
+            String(execution.pid),
+            "-o",
+            "command=",
+        ]);
+        if (!command.includes(execution.wrapper))
+            continue;
+        const children = processChildren(await processOutput(["/bin/ps", "-axo", "pid=,ppid="]), execution.pid);
+        children.reverse().forEach(stopProcess);
+        await new Promise((resolve) => setTimeout(resolve, 50));
+        stopProcess(execution.pid);
+    }
+}
+//# sourceMappingURL=hook-processes.js.map