@bjoernrochel/sevro 1.0.0 → 1.1.1

package/dist/src/host-diagnostics.js

@@ -0,0 +1,248 @@
+import { diagnosticSecrets, redactDiagnosticText, } from "./host-diagnostic-redaction.js";
+const MAX_TEXT_BYTES = 64 * 1024;
+export class HostDiagnosticPersistenceError extends Error {
+    constructor(persistenceCause, hostCause) {
+        super("host diagnostic persistence failed", {
+            cause: new AggregateError([hostCause, persistenceCause], "host and persistence failures"),
+        });
+    }
+}
+export function rethrowDiagnosticPersistenceError(cause) {
+    if (cause instanceof HostDiagnosticPersistenceError)
+        throw cause;
+}
+/** Drain observers capture only a prefix; completion records actual native termination. */
+export class HostProcessDiagnostics {
+    diagnostics;
+    stdout = new DiagnosticStream();
+    stderr = new DiagnosticStream();
+    started = performance.now();
+    constructor(diagnostics) {
+        this.diagnostics = diagnostics;
+    }
+    recordUnstarted() {
+        if (!this.diagnostics.enabled)
+            return;
+        this.diagnostics.process({
+            code: null,
+            signal: null,
+            durationMs: performance.now() - this.started,
+            out: "",
+            stderr: new Uint8Array(),
+            stderrTruncated: false,
+            reason: "spawn",
+        });
+    }
+    async record(process, reason = "exit") {
+        if (!this.diagnostics.enabled)
+            return;
+        this.diagnostics.process({
+            code: await process.exited,
+            signal: process.signalCode ?? null,
+            durationMs: performance.now() - this.started,
+            out: this.stdout.bytes().toString("utf8"),
+            stdoutTruncated: this.stdout.truncated,
+            stderr: this.stderr.bytes(),
+            stderrTruncated: this.stderr.truncated,
+            reason,
+        });
+    }
+}
+function boundedText(bytes, secrets) {
+    const redacted = Buffer.from(redactDiagnosticText(Buffer.from(bytes.subarray(0, MAX_TEXT_BYTES)).toString("utf8"), secrets));
+    return {
+        text: new TextDecoder().decode(redacted.subarray(0, MAX_TEXT_BYTES), {
+            stream: true,
+        }),
+        truncated: bytes.byteLength > MAX_TEXT_BYTES || redacted.byteLength > MAX_TEXT_BYTES,
+    };
+}
+/** Keep a byte-bounded prefix while the owning transport continues draining. */
+export class DiagnosticStream {
+    chunks = [];
+    size = 0;
+    truncated = false;
+    add(bytes) {
+        const retained = bytes.subarray(0, Math.max(0, MAX_TEXT_BYTES - this.size));
+        if (retained.byteLength)
+            this.chunks.push(Buffer.from(retained));
+        this.size += retained.byteLength;
+        this.truncated ||= retained.byteLength !== bytes.byteLength;
+    }
+    bytes() {
+        return Buffer.concat(this.chunks);
+    }
+}
+function errorCode(cause) {
+    if (!("code" in cause))
+        return {};
+    const code = cause.code;
+    return typeof code === "string" || typeof code === "number" ? { code } : {};
+}
+function errorEvidence(cause, secrets) {
+    return errorChain(cause, secrets, new Set());
+}
+function errorChain(cause, secrets, seen) {
+    if (!(cause instanceof Error))
+        return {
+            name: "NonError",
+            message: redactDiagnosticText(String(cause).slice(0, 8192), secrets),
+        };
+    if (seen.has(cause) || seen.size === 8)
+        return { truncated: true };
+    seen.add(cause);
+    return {
+        ...errorDetails(cause, secrets),
+        ...(cause.cause === undefined
+            ? {}
+            : { cause: errorChain(cause.cause, secrets, seen) }),
+    };
+}
+function errorDetails(cause, secrets) {
+    return {
+        name: redactDiagnosticText(cause.name.slice(0, 200), secrets),
+        message: redactDiagnosticText(cause.message.slice(0, 8192), secrets),
+        stack: redactDiagnosticText(cause.stack?.slice(0, 8192) ?? "", secrets),
+        ...errorCode(cause),
+    };
+}
+/** A cleanup exception must not replace an already captured host/persistence failure. */
+export async function cleanupNativeState(diagnostics, cleanup) {
+    beginNativeCleanup(diagnostics);
+    try {
+        await cleanup();
+    }
+    catch (cause) {
+        if (!diagnostics.failureCaptured)
+            throw cause;
+        console.warn("native state cleanup failed; original host failure preserved");
+    }
+}
+function beginNativeCleanup(diagnostics) {
+    if (!diagnostics.failureCaptured)
+        diagnostics.stage = "cleanup";
+}
+export function diagnosticConfiguration(enabled) {
+    return enabled ? { "sevro.host.retain-diagnostics": true } : {};
+}
+export function createHostDiagnostics(host, enabled, request) {
+    return enabled
+        ? new RetainedHostDiagnostics(host, request.runtimeRole, request.retainHostDiagnostics)
+        : new DisabledHostDiagnostics();
+}
+export async function diagnoseHostRequest(diagnostics, execute) {
+    try {
+        return await execute();
+    }
+    catch (cause) {
+        if (cause instanceof HostDiagnosticPersistenceError)
+            throw cause;
+        if (!diagnostics.enabled)
+            throw cause;
+        const result = {
+            finalMessage: null,
+            complete: false,
+            executionFailed: true,
+            actualCondition: "passive",
+        };
+        await diagnostics.retain(result, cause);
+        return result;
+    }
+}
+class DisabledHostDiagnostics {
+    enabled = false;
+    stage = "preparation";
+    failure;
+    failureCaptured = false;
+    readCredentials() {
+        return Promise.resolve();
+    }
+    registerCredentials() { }
+    process() { }
+    retain() {
+        return Promise.resolve();
+    }
+    retainFailure() {
+        return Promise.resolve();
+    }
+}
+/** Private failure evidence, independent of native sessions and transcript access. */
+class RetainedHostDiagnostics {
+    host;
+    role;
+    persist;
+    enabled = true;
+    stage = "preparation";
+    failure;
+    failureCaptured = false;
+    processes = [];
+    processesDropped = 0;
+    secrets = [];
+    constructor(host, role = "candidate", persist) {
+        this.host = host;
+        this.role = role;
+        this.persist = persist;
+    }
+    async readCredentials(path) {
+        if (path)
+            this.secrets.push(...(await diagnosticSecrets(path)));
+    }
+    registerCredentials(environment, names) {
+        for (const name of names) {
+            const value = environment[name];
+            if (value)
+                this.secrets.push(value);
+        }
+    }
+    process(result) {
+        const stdout = boundedText(Buffer.from(result.out), this.secrets);
+        const stderr = boundedText(result.stderr, this.secrets);
+        this.addProcess({
+            stage: this.stage,
+            code: result.code,
+            signal: result.signal,
+            durationMs: result.durationMs,
+            reason: result.reason,
+            stdout: stdout.text,
+            stdoutTruncated: stdout.truncated || result.stdoutTruncated === true,
+            stderr: stderr.text,
+            stderrTruncated: stderr.truncated || result.stderrTruncated,
+        });
+    }
+    addProcess(receipt) {
+        this.processes.push(receipt);
+        while (this.processes.length > 32 ||
+            Buffer.byteLength(JSON.stringify(this.processes)) > 2 * 1024 * 1024) {
+            this.processes.shift();
+            this.processesDropped++;
+        }
+    }
+    async retainFailure(result, message) {
+        if (result.executionFailed)
+            await this.retain(result, this.failure ?? new Error(message));
+    }
+    async retain(result, cause) {
+        this.failureCaptured = true;
+        const bytes = Buffer.from(JSON.stringify({
+            format: "sevro.host-diagnostics.v1",
+            host: this.host,
+            role: this.role,
+            stage: this.stage,
+            error: errorEvidence(cause, this.secrets),
+            processes: this.processes,
+            processesDropped: this.processesDropped,
+        }));
+        if (this.persist) {
+            try {
+                await this.persist(bytes);
+            }
+            catch (persistenceCause) {
+                throw new HostDiagnosticPersistenceError(persistenceCause, cause);
+            }
+            return;
+        }
+        result.artifacts ??= [];
+        result.artifacts.push({ id: "sevro.host.diagnostics", bytes });
+    }
+}
+//# sourceMappingURL=host-diagnostics.js.map

package/dist/src/host-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-diagnostics.js","sourceRoot":"","sources":["host-diagnostics.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,uCAAoC;AAErC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAcjC,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YAAY,gBAAyB,EAAE,SAAkB;QACvD,KAAK,CAAC,oCAAoC,EAAE;YAC1C,KAAK,EAAE,IAAI,cAAc,CACvB,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAC7B,+BAA+B,CAChC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,IAAI,KAAK,YAAY,8BAA8B;QAAE,MAAM,KAAK,CAAC;AACnE,CAAC;AAED,2FAA2F;AAC3F,MAAM,OAAO,sBAAsB;IAIb;IAHX,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAChC,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACjC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,YAAoB,WAA4B;QAA5B,gBAAW,GAAX,WAAW,CAAiB;IAAG,CAAC;IACpD,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,OAAO;QACtC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;YAC5C,GAAG,EAAE,EAAE;YACP,MAAM,EAAE,IAAI,UAAU,EAAE;YACxB,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CACV,OAAuE,EACvE,SAA+B,MAAM;QAErC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,OAAO;QACtC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM;YAC1B,MAAM,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;YAClC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;YAC5C,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YAC3B,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YACtC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAiB,EAAE,OAAiB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,oBAAoB,CAClB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/D,OAAO,CACR,CACF,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE;YACnE,MAAM,EAAE,IAAI;SACb,CAAC;QACF,SAAS,EACP,KAAK,CAAC,UAAU,GAAG,cAAc,IAAI,QAAQ,CAAC,UAAU,GAAG,cAAc;KAC5E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,OAAO,gBAAgB;IACnB,MAAM,GAAiB,EAAE,CAAC;IAC1B,IAAI,GAAG,CAAC,CAAC;IACjB,SAAS,GAAG,KAAK,CAAC;IAClB,GAAG,CAAC,KAAiB;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,UAAU;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;IAC9D,CAAC;IACD,KAAK;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAY;IAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,IAAI,GAAY,KAAK,CAAC,IAAI,CAAC;IACjC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,OAAiB;IAEjB,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CACjB,KAAc,EACd,OAAiB,EACjB,IAAgB;IAEhB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;SACrE,CAAC;IACJ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,OAAO;QACL,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAY,EAAE,OAAiB;IACnD,OAAO;QACL,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC;QAC7D,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QACpE,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC;QACvE,GAAG,SAAS,CAAC,KAAK,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAA4B,EAC5B,OAA4B;IAE5B,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,WAAW,CAAC,eAAe;YAAE,MAAM,KAAK,CAAC;QAC9C,OAAO,CAAC,IAAI,CACV,8DAA8D,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,WAA4B;IACtD,IAAI,CAAC,WAAW,CAAC,eAAe;QAAE,WAAW,CAAC,KAAK,GAAG,SAAS,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA4B;IAClE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,IAAwB,EACxB,OAA4B,EAC5B,OAGC;IAED,OAAO,OAAO;QACZ,CAAC,CAAC,IAAI,uBAAuB,CACzB,IAAI,EACJ,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,qBAAqB,CAC9B;QACH,CAAC,CAAC,IAAI,uBAAuB,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAA4B,EAC5B,OAAkC;IAElC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,8BAA8B;YAAE,MAAM,KAAK,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC;QACtC,MAAM,MAAM,GAAe;YACzB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,SAAS;SAC3B,CAAC;QACF,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAiBD,MAAM,uBAAuB;IAClB,OAAO,GAAG,KAAK,CAAC;IACzB,KAAK,GAAG,aAAa,CAAC;IACtB,OAAO,CAAU;IACR,eAAe,GAAG,KAAK,CAAC;IAEjC,eAAe;QACb,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,mBAAmB,KAAU,CAAC;IAE9B,OAAO,KAAU,CAAC;IAElB,MAAM;QACJ,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,aAAa;QACX,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,uBAAuB;IASjB;IACA;IACA;IAVD,OAAO,GAAG,IAAI,CAAC;IACxB,KAAK,GAAG,aAAa,CAAC;IACtB,OAAO,CAAU;IACjB,eAAe,GAAG,KAAK,CAAC;IAChB,SAAS,GAA8B,EAAE,CAAC;IAC1C,gBAAgB,GAAG,CAAC,CAAC;IACrB,OAAO,GAAa,EAAE,CAAC;IAC/B,YACU,IAAwB,EACxB,OAAoB,WAAW,EAC/B,OAA8C;QAF9C,SAAI,GAAJ,IAAI,CAAoB;QACxB,SAAI,GAAJ,IAAI,CAA2B;QAC/B,YAAO,GAAP,OAAO,CAAuC;IACrD,CAAC;IAEJ,KAAK,CAAC,eAAe,CAAC,IAAwB;QAC5C,IAAI,IAAI;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,mBAAmB,CACjB,WAAmC,EACnC,KAAwB;QAExB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK;gBAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAyB;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC;YACd,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,eAAe,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI;YACpE,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,eAAe,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,eAAe;SAC5D,CAAC,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,OAAgC;QACjD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,OACE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE;YAC1B,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EACnE,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,OAAe;QACrD,IAAI,MAAM,CAAC,eAAe;YACxB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAkB,EAAE,KAAc;QAC7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,IAAI,CAAC,SAAS,CAAC;YACb,MAAM,EAAE,2BAA2B;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CACH,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,gBAAgB,EAAE,CAAC;gBAC1B,MAAM,IAAI,8BAA8B,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,SAAS,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;CACF","sourcesContent":["import type { HostResult } from \"./evaluation/types\";\nimport type { RuntimeRole } from \"./runtime/state\";\nimport {\n  diagnosticSecrets,\n  redactDiagnosticText,\n} from \"./host-diagnostic-redaction\";\n\nconst MAX_TEXT_BYTES = 64 * 1024;\ninterface ProcessDiagnostic {\n  code: number | null;\n  out: string;\n  stderr: Uint8Array;\n  stderrTruncated: boolean;\n  signal: string | null;\n  durationMs: number;\n  stdoutTruncated?: boolean;\n  reason: \"exit\" | \"timeout\" | \"cancelled\" | \"error\" | \"spawn\";\n}\n\nexport type ProcessFailureReason = ProcessDiagnostic[\"reason\"];\n\nexport class HostDiagnosticPersistenceError extends Error {\n  constructor(persistenceCause: unknown, hostCause: unknown) {\n    super(\"host diagnostic persistence failed\", {\n      cause: new AggregateError(\n        [hostCause, persistenceCause],\n        \"host and persistence failures\",\n      ),\n    });\n  }\n}\n\nexport function rethrowDiagnosticPersistenceError(cause: unknown): void {\n  if (cause instanceof HostDiagnosticPersistenceError) throw cause;\n}\n\n/** Drain observers capture only a prefix; completion records actual native termination. */\nexport class HostProcessDiagnostics {\n  readonly stdout = new DiagnosticStream();\n  readonly stderr = new DiagnosticStream();\n  private started = performance.now();\n  constructor(private diagnostics: HostDiagnostics) {}\n  recordUnstarted(): void {\n    if (!this.diagnostics.enabled) return;\n    this.diagnostics.process({\n      code: null,\n      signal: null,\n      durationMs: performance.now() - this.started,\n      out: \"\",\n      stderr: new Uint8Array(),\n      stderrTruncated: false,\n      reason: \"spawn\",\n    });\n  }\n  async record(\n    process: { exited: Promise<number | null>; signalCode?: string | null },\n    reason: ProcessFailureReason = \"exit\",\n  ): Promise<void> {\n    if (!this.diagnostics.enabled) return;\n    this.diagnostics.process({\n      code: await process.exited,\n      signal: process.signalCode ?? null,\n      durationMs: performance.now() - this.started,\n      out: this.stdout.bytes().toString(\"utf8\"),\n      stdoutTruncated: this.stdout.truncated,\n      stderr: this.stderr.bytes(),\n      stderrTruncated: this.stderr.truncated,\n      reason,\n    });\n  }\n}\n\nfunction boundedText(bytes: Uint8Array, secrets: string[]) {\n  const redacted = Buffer.from(\n    redactDiagnosticText(\n      Buffer.from(bytes.subarray(0, MAX_TEXT_BYTES)).toString(\"utf8\"),\n      secrets,\n    ),\n  );\n  return {\n    text: new TextDecoder().decode(redacted.subarray(0, MAX_TEXT_BYTES), {\n      stream: true,\n    }),\n    truncated:\n      bytes.byteLength > MAX_TEXT_BYTES || redacted.byteLength > MAX_TEXT_BYTES,\n  };\n}\n\n/** Keep a byte-bounded prefix while the owning transport continues draining. */\nexport class DiagnosticStream {\n  private chunks: Uint8Array[] = [];\n  private size = 0;\n  truncated = false;\n  add(bytes: Uint8Array): void {\n    const retained = bytes.subarray(0, Math.max(0, MAX_TEXT_BYTES - this.size));\n    if (retained.byteLength) this.chunks.push(Buffer.from(retained));\n    this.size += retained.byteLength;\n    this.truncated ||= retained.byteLength !== bytes.byteLength;\n  }\n  bytes(): Buffer {\n    return Buffer.concat(this.chunks);\n  }\n}\n\nfunction errorCode(cause: Error): { code?: string | number } {\n  if (!(\"code\" in cause)) return {};\n  const code: unknown = cause.code;\n  return typeof code === \"string\" || typeof code === \"number\" ? { code } : {};\n}\n\nfunction errorEvidence(\n  cause: unknown,\n  secrets: string[],\n): Record<string, unknown> {\n  return errorChain(cause, secrets, new Set());\n}\n\nfunction errorChain(\n  cause: unknown,\n  secrets: string[],\n  seen: Set<Error>,\n): Record<string, unknown> {\n  if (!(cause instanceof Error))\n    return {\n      name: \"NonError\",\n      message: redactDiagnosticText(String(cause).slice(0, 8192), secrets),\n    };\n  if (seen.has(cause) || seen.size === 8) return { truncated: true };\n  seen.add(cause);\n  return {\n    ...errorDetails(cause, secrets),\n    ...(cause.cause === undefined\n      ? {}\n      : { cause: errorChain(cause.cause, secrets, seen) }),\n  };\n}\n\nfunction errorDetails(cause: Error, secrets: string[]) {\n  return {\n    name: redactDiagnosticText(cause.name.slice(0, 200), secrets),\n    message: redactDiagnosticText(cause.message.slice(0, 8192), secrets),\n    stack: redactDiagnosticText(cause.stack?.slice(0, 8192) ?? \"\", secrets),\n    ...errorCode(cause),\n  };\n}\n\n/** A cleanup exception must not replace an already captured host/persistence failure. */\nexport async function cleanupNativeState(\n  diagnostics: HostDiagnostics,\n  cleanup: () => Promise<void>,\n): Promise<void> {\n  beginNativeCleanup(diagnostics);\n  try {\n    await cleanup();\n  } catch (cause) {\n    if (!diagnostics.failureCaptured) throw cause;\n    console.warn(\n      \"native state cleanup failed; original host failure preserved\",\n    );\n  }\n}\n\nfunction beginNativeCleanup(diagnostics: HostDiagnostics): void {\n  if (!diagnostics.failureCaptured) diagnostics.stage = \"cleanup\";\n}\n\nexport function diagnosticConfiguration(enabled: boolean | undefined) {\n  return enabled ? { \"sevro.host.retain-diagnostics\": true } : {};\n}\n\nexport function createHostDiagnostics(\n  host: \"codex\" | \"claude\",\n  enabled: boolean | undefined,\n  request: {\n    runtimeRole?: RuntimeRole;\n    retainHostDiagnostics?: (bytes: Uint8Array) => Promise<void>;\n  },\n): HostDiagnostics {\n  return enabled\n    ? new RetainedHostDiagnostics(\n        host,\n        request.runtimeRole,\n        request.retainHostDiagnostics,\n      )\n    : new DisabledHostDiagnostics();\n}\n\nexport async function diagnoseHostRequest(\n  diagnostics: HostDiagnostics,\n  execute: () => Promise<HostResult>,\n): Promise<HostResult> {\n  try {\n    return await execute();\n  } catch (cause) {\n    if (cause instanceof HostDiagnosticPersistenceError) throw cause;\n    if (!diagnostics.enabled) throw cause;\n    const result: HostResult = {\n      finalMessage: null,\n      complete: false,\n      executionFailed: true,\n      actualCondition: \"passive\",\n    };\n    await diagnostics.retain(result, cause);\n    return result;\n  }\n}\n\nexport interface HostDiagnostics {\n  readonly enabled: boolean;\n  stage: string;\n  failure: unknown;\n  readonly failureCaptured: boolean;\n  readCredentials(path: string | undefined): Promise<void>;\n  registerCredentials(\n    environment: Record<string, string>,\n    names: readonly string[],\n  ): void;\n  process(result: ProcessDiagnostic): void;\n  retain(result: HostResult, cause: unknown): Promise<void>;\n  retainFailure(result: HostResult, message: string): Promise<void>;\n}\n\nclass DisabledHostDiagnostics implements HostDiagnostics {\n  readonly enabled = false;\n  stage = \"preparation\";\n  failure: unknown;\n  readonly failureCaptured = false;\n\n  readCredentials(): Promise<void> {\n    return Promise.resolve();\n  }\n\n  registerCredentials(): void {}\n\n  process(): void {}\n\n  retain(): Promise<void> {\n    return Promise.resolve();\n  }\n\n  retainFailure(): Promise<void> {\n    return Promise.resolve();\n  }\n}\n\n/** Private failure evidence, independent of native sessions and transcript access. */\nclass RetainedHostDiagnostics implements HostDiagnostics {\n  readonly enabled = true;\n  stage = \"preparation\";\n  failure: unknown;\n  failureCaptured = false;\n  private processes: Record<string, unknown>[] = [];\n  private processesDropped = 0;\n  private secrets: string[] = [];\n  constructor(\n    private host: \"codex\" | \"claude\",\n    private role: RuntimeRole = \"candidate\",\n    private persist?: (bytes: Uint8Array) => Promise<void>,\n  ) {}\n\n  async readCredentials(path: string | undefined): Promise<void> {\n    if (path) this.secrets.push(...(await diagnosticSecrets(path)));\n  }\n\n  registerCredentials(\n    environment: Record<string, string>,\n    names: readonly string[],\n  ): void {\n    for (const name of names) {\n      const value = environment[name];\n      if (value) this.secrets.push(value);\n    }\n  }\n\n  process(result: ProcessDiagnostic): void {\n    const stdout = boundedText(Buffer.from(result.out), this.secrets);\n    const stderr = boundedText(result.stderr, this.secrets);\n    this.addProcess({\n      stage: this.stage,\n      code: result.code,\n      signal: result.signal,\n      durationMs: result.durationMs,\n      reason: result.reason,\n      stdout: stdout.text,\n      stdoutTruncated: stdout.truncated || result.stdoutTruncated === true,\n      stderr: stderr.text,\n      stderrTruncated: stderr.truncated || result.stderrTruncated,\n    });\n  }\n\n  private addProcess(receipt: Record<string, unknown>): void {\n    this.processes.push(receipt);\n    while (\n      this.processes.length > 32 ||\n      Buffer.byteLength(JSON.stringify(this.processes)) > 2 * 1024 * 1024\n    ) {\n      this.processes.shift();\n      this.processesDropped++;\n    }\n  }\n\n  async retainFailure(result: HostResult, message: string): Promise<void> {\n    if (result.executionFailed)\n      await this.retain(result, this.failure ?? new Error(message));\n  }\n\n  async retain(result: HostResult, cause: unknown): Promise<void> {\n    this.failureCaptured = true;\n    const bytes = Buffer.from(\n      JSON.stringify({\n        format: \"sevro.host-diagnostics.v1\",\n        host: this.host,\n        role: this.role,\n        stage: this.stage,\n        error: errorEvidence(cause, this.secrets),\n        processes: this.processes,\n        processesDropped: this.processesDropped,\n      }),\n    );\n    if (this.persist) {\n      try {\n        await this.persist(bytes);\n      } catch (persistenceCause) {\n        throw new HostDiagnosticPersistenceError(persistenceCause, cause);\n      }\n      return;\n    }\n    result.artifacts ??= [];\n    result.artifacts.push({ id: \"sevro.host.diagnostics\", bytes });\n  }\n}\n"]}

package/dist/src/hosts/claude-continuation.js

@@ -0,0 +1,89 @@
+import { isRecord } from "../value-guards.js";
+import { randomUUID } from "node:crypto";
+import { summarizeClaudeEvents, parseClaudeEvents, } from "./claude-events.js";
+import { workspaceFingerprint } from "./workspace-fingerprint.js";
+import { MAX_EVENT_BYTES, MAX_STDERR_BYTES } from "./process-lifecycle.js";
+function boundResult(stream, session) {
+    if (stream.lines.some((line) => !line.parsed))
+        return false;
+    const results = stream.lines
+        .filter((line) => line.parsed)
+        .map((line) => line.value)
+        .filter(isRecord)
+        .filter((entry) => entry.type === "result");
+    const [result] = results;
+    return (results.length === 1 &&
+        result !== undefined &&
+        result.session_id === session);
+}
+function parsedTurn(result) {
+    return { ...result, events: parseClaudeEvents(result.out) };
+}
+/** Resume a declared follow-up in the same isolated native Claude session. */
+export async function runClaudeTurns(options) {
+    if (options.followUpPrompt === undefined)
+        return parsedTurn(await options.run(options.prompt));
+    const sessionId = randomUUID();
+    const initialFingerprint = await workspaceFingerprint(options.workspace);
+    const initial = parsedTurn(await options.run(options.prompt, {
+        option: "--session-id",
+        id: sessionId,
+    }));
+    const summary = summarizeClaudeEvents(initial.events, initial.code);
+    const initialBound = boundResult(initial.events, sessionId);
+    if (!summary.complete || !initialBound)
+        return {
+            ...initial,
+            code: summary.complete ? 1 : initial.code,
+            sessionResultsBound: initialBound,
+        };
+    const beforeFollowUp = await workspaceFingerprint(options.workspace);
+    const followUp = parsedTurn(await options.run(options.followUpPrompt, {
+        option: "--resume",
+        id: sessionId,
+    }));
+    return combinedTurns(initial, followUp, sessionId, initialFingerprint, beforeFollowUp);
+}
+function combinedOutput(initial, followUp) {
+    const out = `${initial.out.trimEnd()}\n${followUp.out.trimStart()}`;
+    const stderr = [initial.err.trimEnd(), followUp.err.trimStart()]
+        .filter(Boolean)
+        .join("\n");
+    const err = new TextDecoder("utf-8", { ignoreBOM: true }).decode(Buffer.from(stderr, "utf8").subarray(0, MAX_STDERR_BYTES), { stream: true });
+    if (Buffer.byteLength(out, "utf8") > MAX_EVENT_BYTES)
+        throw new Error("Claude combined process output exceeds its limit");
+    return { out, err };
+}
+function continuationObservation(bound, sessionId, initialFingerprint, beforeFollowUp) {
+    const measured = initialFingerprint !== null && beforeFollowUp !== null;
+    return {
+        id: "sevro.claude.continuation",
+        completeness: bound && measured ? "complete" : "partial",
+        data: {
+            method: "same_session_resume",
+            sessionId,
+            preFollowUpWorktreeUnchanged: measured
+                ? initialFingerprint === beforeFollowUp
+                : null,
+        },
+    };
+}
+function combinedTurns(initial, followUp, sessionId, initialFingerprint, beforeFollowUp) {
+    const followUpSummary = summarizeClaudeEvents(followUp.events, followUp.code);
+    const sessionResultsBound = boundResult(followUp.events, sessionId);
+    const bound = followUpSummary.complete && sessionResultsBound;
+    const { out, err } = combinedOutput(initial, followUp);
+    return {
+        code: bound ? 0 : followUp.code || 1,
+        out,
+        err,
+        initialOut: initial.out,
+        followUpOut: followUp.out,
+        events: { lines: [...initial.events.lines, ...followUp.events.lines] },
+        initialEvents: initial.events,
+        followUpEvents: followUp.events,
+        sessionResultsBound,
+        continuation: continuationObservation(bound, sessionId, initialFingerprint, beforeFollowUp),
+    };
+}
+//# sourceMappingURL=claude-continuation.js.map

package/dist/src/hosts/claude-continuation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-continuation.js","sourceRoot":"","sources":["claude-continuation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,2BAAwB;AAC3C,OAAO,EAAE,UAAU,EAAE,oBAAoB;AACzC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAElB,2BAAwB;AACzB,OAAO,EAAE,oBAAoB,EAAE,mCAAgC;AAC/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,+BAA4B;AAmBxE,SAAS,WAAW,CAAC,MAAoB,EAAE,OAAe;IACxD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;IACzB,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,UAAU,KAAK,OAAO,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAA2B;IAC7C,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAQpC;IACC,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;QACtC,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,kBAAkB,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,UAAU,CACxB,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE;QAChC,MAAM,EAAE,cAAc;QACtB,EAAE,EAAE,SAAS;KACd,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,YAAY;QACpC,OAAO;YACL,GAAG,OAAO;YACV,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;YACzC,mBAAmB,EAAE,YAAY;SAClC,CAAC;IACJ,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,UAAU,CACzB,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE;QACxC,MAAM,EAAE,UAAU;QAClB,EAAE,EAAE,SAAS;KACd,CAAC,CACH,CAAC;IACF,OAAO,aAAa,CAClB,OAAO,EACP,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,cAAc,CACf,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,OAAsC,EACtC,QAAuC;IAEvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;SAC7D,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAC9D,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,EACzD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,eAAe;QAClD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc,EACd,SAAiB,EACjB,kBAAiC,EACjC,cAA6B;IAE7B,MAAM,QAAQ,GAAG,kBAAkB,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI,CAAC;IACxE,OAAO;QACL,EAAE,EAAE,2BAA2B;QAC/B,YAAY,EAAE,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACxD,IAAI,EAAE;YACJ,MAAM,EAAE,qBAAqB;YAC7B,SAAS;YACT,4BAA4B,EAAE,QAAQ;gBACpC,CAAC,CAAC,kBAAkB,KAAK,cAAc;gBACvC,CAAC,CAAC,IAAI;SACT;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAsC,EACtC,QAAuC,EACvC,SAAiB,EACjB,kBAAiC,EACjC,cAA6B;IAE7B,MAAM,eAAe,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,mBAAmB,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IAC9D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACpC,GAAG;QACH,GAAG;QACH,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,WAAW,EAAE,QAAQ,CAAC,GAAG;QACzB,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACtE,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,cAAc,EAAE,QAAQ,CAAC,MAAM;QAC/B,mBAAmB;QACnB,YAAY,EAAE,uBAAuB,CACnC,KAAK,EACL,SAAS,EACT,kBAAkB,EAClB,cAAc,CACf;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { isRecord } from \"../value-guards\";\nimport { randomUUID } from \"node:crypto\";\nimport {\n  summarizeClaudeEvents,\n  parseClaudeEvents,\n  type ClaudeEvents,\n} from \"./claude-events\";\nimport { workspaceFingerprint } from \"./workspace-fingerprint\";\nimport { MAX_EVENT_BYTES, MAX_STDERR_BYTES } from \"./process-lifecycle\";\n\nexport type ClaudeProcessResult = { code: number; out: string; err: string };\nexport type ClaudeSession = { option: \"--session-id\" | \"--resume\"; id: string };\ntype Observation = {\n  id: string;\n  completeness: \"complete\" | \"partial\";\n  data: Record<string, unknown>;\n};\ntype ClaudeTurns = ClaudeProcessResult & {\n  events: ClaudeEvents;\n  initialEvents?: ClaudeEvents;\n  followUpEvents?: ClaudeEvents;\n  initialOut?: string;\n  followUpOut?: string;\n  continuation?: Observation;\n  sessionResultsBound?: boolean;\n};\n\nfunction boundResult(stream: ClaudeEvents, session: string): boolean {\n  if (stream.lines.some((line) => !line.parsed)) return false;\n  const results = stream.lines\n    .filter((line) => line.parsed)\n    .map((line) => line.value)\n    .filter(isRecord)\n    .filter((entry) => entry.type === \"result\");\n  const [result] = results;\n  return (\n    results.length === 1 &&\n    result !== undefined &&\n    result.session_id === session\n  );\n}\n\nfunction parsedTurn(result: ClaudeProcessResult) {\n  return { ...result, events: parseClaudeEvents(result.out) };\n}\n\n/** Resume a declared follow-up in the same isolated native Claude session. */\nexport async function runClaudeTurns(options: {\n  prompt: string;\n  followUpPrompt?: string;\n  workspace: string;\n  run: (\n    prompt: string,\n    session?: ClaudeSession,\n  ) => Promise<ClaudeProcessResult>;\n}): Promise<ClaudeTurns> {\n  if (options.followUpPrompt === undefined)\n    return parsedTurn(await options.run(options.prompt));\n  const sessionId = randomUUID();\n  const initialFingerprint = await workspaceFingerprint(options.workspace);\n  const initial = parsedTurn(\n    await options.run(options.prompt, {\n      option: \"--session-id\",\n      id: sessionId,\n    }),\n  );\n  const summary = summarizeClaudeEvents(initial.events, initial.code);\n  const initialBound = boundResult(initial.events, sessionId);\n  if (!summary.complete || !initialBound)\n    return {\n      ...initial,\n      code: summary.complete ? 1 : initial.code,\n      sessionResultsBound: initialBound,\n    };\n  const beforeFollowUp = await workspaceFingerprint(options.workspace);\n  const followUp = parsedTurn(\n    await options.run(options.followUpPrompt, {\n      option: \"--resume\",\n      id: sessionId,\n    }),\n  );\n  return combinedTurns(\n    initial,\n    followUp,\n    sessionId,\n    initialFingerprint,\n    beforeFollowUp,\n  );\n}\n\nfunction combinedOutput(\n  initial: ReturnType<typeof parsedTurn>,\n  followUp: ReturnType<typeof parsedTurn>,\n) {\n  const out = `${initial.out.trimEnd()}\\n${followUp.out.trimStart()}`;\n  const stderr = [initial.err.trimEnd(), followUp.err.trimStart()]\n    .filter(Boolean)\n    .join(\"\\n\");\n  const err = new TextDecoder(\"utf-8\", { ignoreBOM: true }).decode(\n    Buffer.from(stderr, \"utf8\").subarray(0, MAX_STDERR_BYTES),\n    { stream: true },\n  );\n  if (Buffer.byteLength(out, \"utf8\") > MAX_EVENT_BYTES)\n    throw new Error(\"Claude combined process output exceeds its limit\");\n  return { out, err };\n}\n\nfunction continuationObservation(\n  bound: boolean,\n  sessionId: string,\n  initialFingerprint: string | null,\n  beforeFollowUp: string | null,\n): Observation {\n  const measured = initialFingerprint !== null && beforeFollowUp !== null;\n  return {\n    id: \"sevro.claude.continuation\",\n    completeness: bound && measured ? \"complete\" : \"partial\",\n    data: {\n      method: \"same_session_resume\",\n      sessionId,\n      preFollowUpWorktreeUnchanged: measured\n        ? initialFingerprint === beforeFollowUp\n        : null,\n    },\n  };\n}\n\nfunction combinedTurns(\n  initial: ReturnType<typeof parsedTurn>,\n  followUp: ReturnType<typeof parsedTurn>,\n  sessionId: string,\n  initialFingerprint: string | null,\n  beforeFollowUp: string | null,\n): ClaudeTurns {\n  const followUpSummary = summarizeClaudeEvents(followUp.events, followUp.code);\n  const sessionResultsBound = boundResult(followUp.events, sessionId);\n  const bound = followUpSummary.complete && sessionResultsBound;\n  const { out, err } = combinedOutput(initial, followUp);\n  return {\n    code: bound ? 0 : followUp.code || 1,\n    out,\n    err,\n    initialOut: initial.out,\n    followUpOut: followUp.out,\n    events: { lines: [...initial.events.lines, ...followUp.events.lines] },\n    initialEvents: initial.events,\n    followUpEvents: followUp.events,\n    sessionResultsBound,\n    continuation: continuationObservation(\n      bound,\n      sessionId,\n      initialFingerprint,\n      beforeFollowUp,\n    ),\n  };\n}\n"]}

package/dist/src/hosts/claude-credential.js

@@ -0,0 +1,121 @@
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { nativeStateParent } from "../native-transcript-state.js";
+import { coversLifetime, parseClaudeLogin, rotatedLoginBytes, sameTokens, tokenDigest, } from "./claude-login.js";
+import { claudeLoginRecovery, } from "./claude-login-recovery.js";
+import { refreshClaudeLogin } from "./claude-login-refresh.js";
+import { claudeLoginStore, MAX_CREDENTIAL_BYTES, requireBoundedCredential, } from "./claude-login-store.js";
+import { withClaudeRefreshLock } from "./claude-refresh-lock.js";
+export const CLAUDE_AUTH_VARIABLES = [
+    "ANTHROPIC_API_KEY",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+];
+/** Margin beyond the execution budget, matching Claude's own refresh window. */
+export const CLAUDE_LOGIN_MARGIN_MS = 5 * 60_000;
+/** Keep the CLI's authentication separate from the candidate tool environment. */
+export async function stageClaudeAuthentication(configRoot, sourceFile, requirement) {
+    await mkdir(configRoot, { recursive: true, mode: 0o700 });
+    const environment = authenticationEnvironment(sourceFile);
+    if (!Object.keys(environment).length)
+        environment.CLAUDE_CODE_OAUTH_TOKEN = await claudeAccessToken(sourceFile, requirement);
+    return {
+        // Trials never receive a saved login; the path only anchors private state.
+        credentialFile: join(configRoot, ".credentials.json"),
+        environment,
+    };
+}
+function boundedEnvironmentCredential(value) {
+    if (Buffer.byteLength(value, "utf8") > MAX_CREDENTIAL_BYTES)
+        throw new Error("Claude environment credential exceeds the size limit");
+    return value;
+}
+function authenticationEnvironment(sourceFile) {
+    const environment = {};
+    if (sourceFile === undefined) {
+        for (const name of CLAUDE_AUTH_VARIABLES) {
+            const value = process.env[name];
+            if (value) {
+                environment[name] = boundedEnvironmentCredential(value);
+            }
+        }
+    }
+    return environment;
+}
+async function platformKeychain() {
+    if (process.platform !== "darwin")
+        return undefined;
+    const { claudeKeychain } = await import("./claude-keychain.js");
+    return claudeKeychain;
+}
+/**
+ * Provide an access token from the selected saved login. The parent alone
+ * refreshes it, so a rotating refresh token never enters disposable state.
+ */
+export async function claudeAccessToken(sourceFile, requirement) {
+    const store = await claudeLoginStore(sourceFile, await platformKeychain());
+    const recovery = await claudeLoginRecovery(await nativeStateParent(), store.origin);
+    const login = await storedLogin(store);
+    if (coversLifetime(login, requirement.lifetimeMs) &&
+        !(await recovery.pending()))
+        return login.accessToken;
+    return withClaudeRefreshLock(store.lockRoot, () => lockedAccessToken(store, recovery, requirement));
+}
+async function storedLogin(store) {
+    return parseClaudeLogin(requireBoundedCredential(await store.read()));
+}
+/** Re-read under the lock: another process may already have refreshed. */
+async function lockedAccessToken(store, recovery, requirement) {
+    const current = await recoveredLogin(store, recovery);
+    if (coversLifetime(current, requirement.lifetimeMs))
+        return current.accessToken;
+    const rotated = await refreshClaudeLogin(requirement.binary, refreshableLogin(current), recovery.workRoot);
+    await recovery.retain(current, rotated);
+    await persistRotation(store, recovery, current, rotated);
+    await recovery.discard();
+    return usableAccessToken(rotated, requirement.lifetimeMs);
+}
+function refreshableLogin(login) {
+    const { refreshToken } = login;
+    if (!refreshToken || !login.scopes.length)
+        throw new Error("Claude saved login has expired and cannot be refreshed; run claude and /login");
+    return { ...login, refreshToken };
+}
+function usableAccessToken(login, lifetimeMs) {
+    if (!coversLifetime(login, lifetimeMs))
+        throw new Error(`Claude login lifetime cannot cover the ${String(Math.ceil(lifetimeMs / 60_000))}-minute execution budget`);
+    return login.accessToken;
+}
+/** Complete a rotation left pending when its store could not be updated. */
+async function recoveredLogin(store, recovery) {
+    const current = await storedLogin(store);
+    const pending = await recovery.pending();
+    if (!pending)
+        return current;
+    if (pending.replaces !== tokenDigest(current.refreshToken)) {
+        // The store moved on through another login; never overwrite it.
+        await recovery.discard();
+        return current;
+    }
+    const rotated = parseClaudeLogin(rotatedLoginBytes(current, { ...current, oauth: pending.oauth }));
+    await writeVerified(store, recovery, current, rotated);
+    await recovery.discard();
+    return rotated;
+}
+/** Compare-and-swap against the refresh token the rotation consumed. */
+async function persistRotation(store, recovery, replaced, rotated) {
+    const latest = await storedLogin(store);
+    if (latest.refreshToken !== replaced.refreshToken)
+        return;
+    await writeVerified(store, recovery, latest, rotated);
+}
+async function writeVerified(store, recovery, latest, rotated) {
+    try {
+        await store.write(rotatedLoginBytes(latest, rotated));
+        if (!sameTokens(await storedLogin(store), rotated))
+            throw new Error("the stored login does not match the rotation");
+    }
+    catch (cause) {
+        throw new Error(`Claude refreshed the saved login but could not update ${store.origin}; Sevro retained the refreshed login at ${recovery.path} and restores it on the next run once the store is writable`, { cause });
+    }
+}
+//# sourceMappingURL=claude-credential.js.map

package/dist/src/hosts/claude-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-credential.js","sourceRoot":"","sources":["claude-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,yBAAyB;AACzC,OAAO,EAAE,IAAI,EAAE,kBAAkB;AACjC,OAAO,EAAE,iBAAiB,EAAE,sCAAmC;AAC/D,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,WAAW,GAEZ,0BAAuB;AACxB,OAAO,EACL,mBAAmB,GAEpB,mCAAgC;AACjC,OAAO,EAAE,kBAAkB,EAAE,kCAA+B;AAC5D,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,wBAAwB,GAGzB,gCAA6B;AAC9B,OAAO,EAAE,qBAAqB,EAAE,iCAA8B;AAE9D,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,mBAAmB;IACnB,yBAAyB;CACjB,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AAUjD,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAkB,EAClB,UAA8B,EAC9B,WAAmC;IAEnC,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;QAClC,WAAW,CAAC,uBAAuB,GAAG,MAAM,iBAAiB,CAC3D,UAAU,EACV,WAAW,CACZ,CAAC;IACJ,OAAO;QACL,2EAA2E;QAC3E,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC;QACrD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,oBAAoB;QACzD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,UAA8B;IAC/D,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,WAAW,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,wBAAqB,CAAC;IAC7D,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAA8B,EAC9B,WAAmC;IAEnC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,MAAM,gBAAgB,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,MAAM,iBAAiB,EAAE,EACzB,KAAK,CAAC,MAAM,CACb,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,IACE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC;QAC7C,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QAE3B,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,OAAO,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,CAChD,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAuB;IAChD,OAAO,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,iBAAiB,CAC9B,KAAuB,EACvB,QAA6B,EAC7B,WAAmC;IAEnC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC;QACjD,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,WAAW,CAAC,MAAM,EAClB,gBAAgB,CAAC,OAAO,CAAC,EACzB,QAAQ,CAAC,QAAQ,CAClB,CAAC;IACF,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzB,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAkB;IAElB,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM;QACvC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkB,EAAE,UAAkB;IAC/D,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,0BAA0B,CAC3G,CAAC;IACJ,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,cAAc,CAC3B,KAAuB,EACvB,QAA6B;IAE7B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,gEAAgE;QAChE,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAC9B,iBAAiB,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CACjE,CAAC;IACF,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,eAAe,CAC5B,KAAuB,EACvB,QAA6B,EAC7B,QAAqB,EACrB,OAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAAE,OAAO;IAC1D,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAuB,EACvB,QAA6B,EAC7B,MAAmB,EACnB,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,CAAC,MAAM,2CAA2C,QAAQ,CAAC,IAAI,6DAA6D,EAC1L,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { mkdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { nativeStateParent } from \"../native-transcript-state\";\nimport {\n  coversLifetime,\n  parseClaudeLogin,\n  rotatedLoginBytes,\n  sameTokens,\n  tokenDigest,\n  type ClaudeLogin,\n} from \"./claude-login\";\nimport {\n  claudeLoginRecovery,\n  type ClaudeLoginRecovery,\n} from \"./claude-login-recovery\";\nimport { refreshClaudeLogin } from \"./claude-login-refresh\";\nimport {\n  claudeLoginStore,\n  MAX_CREDENTIAL_BYTES,\n  requireBoundedCredential,\n  type ClaudeKeychain,\n  type ClaudeLoginStore,\n} from \"./claude-login-store\";\nimport { withClaudeRefreshLock } from \"./claude-refresh-lock\";\n\nexport const CLAUDE_AUTH_VARIABLES = [\n  \"ANTHROPIC_API_KEY\",\n  \"CLAUDE_CODE_OAUTH_TOKEN\",\n] as const;\n\n/** Margin beyond the execution budget, matching Claude's own refresh window. */\nexport const CLAUDE_LOGIN_MARGIN_MS = 5 * 60_000;\n\n/** What a saved login must provide before a trial may use it. */\nexport interface ClaudeLoginRequirement {\n  /** Claude binary used for parent-owned refresh. */\n  binary: string;\n  /** Remaining access-token lifetime the complete execution needs. */\n  lifetimeMs: number;\n}\n\n/** Keep the CLI's authentication separate from the candidate tool environment. */\nexport async function stageClaudeAuthentication(\n  configRoot: string,\n  sourceFile: string | undefined,\n  requirement: ClaudeLoginRequirement,\n) {\n  await mkdir(configRoot, { recursive: true, mode: 0o700 });\n  const environment = authenticationEnvironment(sourceFile);\n  if (!Object.keys(environment).length)\n    environment.CLAUDE_CODE_OAUTH_TOKEN = await claudeAccessToken(\n      sourceFile,\n      requirement,\n    );\n  return {\n    // Trials never receive a saved login; the path only anchors private state.\n    credentialFile: join(configRoot, \".credentials.json\"),\n    environment,\n  };\n}\n\nfunction boundedEnvironmentCredential(value: string): string {\n  if (Buffer.byteLength(value, \"utf8\") > MAX_CREDENTIAL_BYTES)\n    throw new Error(\"Claude environment credential exceeds the size limit\");\n  return value;\n}\n\nfunction authenticationEnvironment(sourceFile: string | undefined) {\n  const environment: Record<string, string> = {};\n  if (sourceFile === undefined) {\n    for (const name of CLAUDE_AUTH_VARIABLES) {\n      const value = process.env[name];\n      if (value) {\n        environment[name] = boundedEnvironmentCredential(value);\n      }\n    }\n  }\n  return environment;\n}\n\nasync function platformKeychain(): Promise<ClaudeKeychain | undefined> {\n  if (process.platform !== \"darwin\") return undefined;\n  const { claudeKeychain } = await import(\"./claude-keychain\");\n  return claudeKeychain;\n}\n\n/**\n * Provide an access token from the selected saved login. The parent alone\n * refreshes it, so a rotating refresh token never enters disposable state.\n */\nexport async function claudeAccessToken(\n  sourceFile: string | undefined,\n  requirement: ClaudeLoginRequirement,\n): Promise<string> {\n  const store = await claudeLoginStore(sourceFile, await platformKeychain());\n  const recovery = await claudeLoginRecovery(\n    await nativeStateParent(),\n    store.origin,\n  );\n  const login = await storedLogin(store);\n  if (\n    coversLifetime(login, requirement.lifetimeMs) &&\n    !(await recovery.pending())\n  )\n    return login.accessToken;\n  return withClaudeRefreshLock(store.lockRoot, () =>\n    lockedAccessToken(store, recovery, requirement),\n  );\n}\n\nasync function storedLogin(store: ClaudeLoginStore): Promise<ClaudeLogin> {\n  return parseClaudeLogin(requireBoundedCredential(await store.read()));\n}\n\n/** Re-read under the lock: another process may already have refreshed. */\nasync function lockedAccessToken(\n  store: ClaudeLoginStore,\n  recovery: ClaudeLoginRecovery,\n  requirement: ClaudeLoginRequirement,\n): Promise<string> {\n  const current = await recoveredLogin(store, recovery);\n  if (coversLifetime(current, requirement.lifetimeMs))\n    return current.accessToken;\n  const rotated = await refreshClaudeLogin(\n    requirement.binary,\n    refreshableLogin(current),\n    recovery.workRoot,\n  );\n  await recovery.retain(current, rotated);\n  await persistRotation(store, recovery, current, rotated);\n  await recovery.discard();\n  return usableAccessToken(rotated, requirement.lifetimeMs);\n}\n\nfunction refreshableLogin(\n  login: ClaudeLogin,\n): ClaudeLogin & { refreshToken: string } {\n  const { refreshToken } = login;\n  if (!refreshToken || !login.scopes.length)\n    throw new Error(\n      \"Claude saved login has expired and cannot be refreshed; run claude and /login\",\n    );\n  return { ...login, refreshToken };\n}\n\nfunction usableAccessToken(login: ClaudeLogin, lifetimeMs: number): string {\n  if (!coversLifetime(login, lifetimeMs))\n    throw new Error(\n      `Claude login lifetime cannot cover the ${String(Math.ceil(lifetimeMs / 60_000))}-minute execution budget`,\n    );\n  return login.accessToken;\n}\n\n/** Complete a rotation left pending when its store could not be updated. */\nasync function recoveredLogin(\n  store: ClaudeLoginStore,\n  recovery: ClaudeLoginRecovery,\n): Promise<ClaudeLogin> {\n  const current = await storedLogin(store);\n  const pending = await recovery.pending();\n  if (!pending) return current;\n  if (pending.replaces !== tokenDigest(current.refreshToken)) {\n    // The store moved on through another login; never overwrite it.\n    await recovery.discard();\n    return current;\n  }\n  const rotated = parseClaudeLogin(\n    rotatedLoginBytes(current, { ...current, oauth: pending.oauth }),\n  );\n  await writeVerified(store, recovery, current, rotated);\n  await recovery.discard();\n  return rotated;\n}\n\n/** Compare-and-swap against the refresh token the rotation consumed. */\nasync function persistRotation(\n  store: ClaudeLoginStore,\n  recovery: ClaudeLoginRecovery,\n  replaced: ClaudeLogin,\n  rotated: ClaudeLogin,\n): Promise<void> {\n  const latest = await storedLogin(store);\n  if (latest.refreshToken !== replaced.refreshToken) return;\n  await writeVerified(store, recovery, latest, rotated);\n}\n\nasync function writeVerified(\n  store: ClaudeLoginStore,\n  recovery: ClaudeLoginRecovery,\n  latest: ClaudeLogin,\n  rotated: ClaudeLogin,\n): Promise<void> {\n  try {\n    await store.write(rotatedLoginBytes(latest, rotated));\n    if (!sameTokens(await storedLogin(store), rotated))\n      throw new Error(\"the stored login does not match the rotation\");\n  } catch (cause) {\n    throw new Error(\n      `Claude refreshed the saved login but could not update ${store.origin}; Sevro retained the refreshed login at ${recovery.path} and restores it on the next run once the store is writable`,\n      { cause },\n    );\n  }\n}\n"]}