@ccdd/project 2.0.2 → 3.1.0

package/dist/src/review/client.js

@@ -0,0 +1,191 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { materializeWorkspace, validateWorkspaceManifest } from '../workspaces/transfer.js';
+import { reopenWorkspace } from '../workspaces/index.js';
+import { prepareHumanReview } from '../executors/human-preparation.js';
+import { createReviewTools, describeReviewTools } from '../tools/runner.js';
+import { packageVersion } from '../runtime-paths.js';
+const requestId = (id) => { if (!/^[A-Za-z0-9_-]{1,128}$/.test(id))
+    throw new Error('Invalid review request identifier.'); return id; };
+function transport(options) {
+    const server = new URL(options.server);
+    if (!['http:', 'https:'].includes(server.protocol) || server.username || server.password || server.search || server.hash || !['', '/'].includes(server.pathname)) {
+        throw new Error('Use the HTTP(S) origin of the review server without credentials or a path.');
+    }
+    if (!/^[A-Za-z0-9_-]{32,256}$/.test(options.token))
+        throw new Error('Invalid reviewer token format.');
+    const timeoutMs = options.timeoutMs ?? 900_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 86_400_000)
+        throw new Error('Review request timeout must be between 1 and 86400000 ms.');
+    const send = async (route, input, signal = options.signal) => {
+        signal?.throwIfAborted();
+        const response = await fetch(new URL(route, server), { method: input === undefined ? 'GET' : 'POST',
+            headers: { authorization: `Bearer ${options.token}`, ...(input === undefined ? {} : { 'content-type': 'application/json' }) },
+            ...(input === undefined ? {} : { body: JSON.stringify(input) }),
+            signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs), redirect: 'error' });
+        if (!response.ok) {
+            const message = await response.json().catch(() => ({}));
+            throw new Error(message.error ?? `Review server returned HTTP ${response.status}.`);
+        }
+        return response;
+    };
+    return { server: server.origin, send,
+        async json(route, input, signal) { return await (await send(route, input, signal)).json(); },
+    };
+}
+async function connect(options) {
+    const api = transport(options);
+    const identity = await api.json('/session');
+    if (identity.packageVersion !== packageVersion)
+        throw new Error(`Use @ccdd/project ${identity.packageVersion} to match the review server (this client is ${packageVersion}).`);
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(identity.reviewerId))
+        throw new Error('Invalid reviewer identity from server.');
+    const root = resolve(options.stateDir);
+    const sessionPath = (id) => join(root, 'review-sessions', createHash('sha256').update(JSON.stringify([api.server, identity.reviewerId, requestId(id)])).digest('hex') + '.json');
+    const readSession = async (id) => {
+        const stored = JSON.parse(await readFile(sessionPath(id), 'utf8'));
+        if (stored.version !== 1 || stored.server !== api.server || stored.reviewerId !== identity.reviewerId || stored.request?.id !== id || stored.request.packageVersion !== packageVersion || stored.workspace?.hash !== stored.request.snapshotHash || stored.workspace.stateDir !== root)
+            throw new Error('Prepared review session does not match this client. Claim this review again.');
+        requestId(stored.request.runId);
+        requestId(stored.attemptId);
+        return stored;
+    };
+    const saveSession = async (session) => {
+        const directory = join(root, 'review-sessions');
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        const temporary = join(directory, `.${randomUUID()}.json`);
+        await writeFile(temporary, JSON.stringify(session), { mode: 0o600, flag: 'wx' });
+        await rename(temporary, sessionPath(session.request.id));
+    };
+    return { ...api, root, reviewerId: identity.reviewerId, readSession, saveSession };
+}
+export async function listRemoteReviews(options, { limit = 100, offset = 0 } = {}) {
+    const api = await connect(options);
+    return api.json(`/requests?limit=${limit}&offset=${offset}`);
+}
+export async function showRemoteReview(id, options) {
+    const api = await connect(options);
+    const { request, status } = await api.json(`/requests/${requestId(id)}`);
+    return { id: request.id, title: request.title, status, claimedBy: request.claimedBy,
+        instruction: request.payload.instruction, artifacts: request.artifacts,
+        ...(request.artifactGroups ? { artifactGroups: request.artifactGroups } : {}),
+        environmentRequirements: request.configManifest?.envRequirements ?? {},
+        tools: request.configManifest ? describeReviewTools({ artifacts: request.artifacts, configManifest: request.configManifest, audience: 'human' }) : [],
+    };
+}
+export async function claimRemoteReview(id, options) {
+    requestId(id);
+    const api = await connect(options);
+    const route = `/requests/${id}`;
+    const current = await api.json(route);
+    if (current.status !== 'WAITING_HUMAN')
+        throw new Error('Request is not waiting for a Human review.');
+    if (current.request.claimedBy) {
+        if (current.request.claimedBy !== api.reviewerId)
+            throw new Error('This review is already claimed by another reviewer.');
+        const session = await api.readSession(id);
+        if (session.attemptId !== current.request.claimAttemptId)
+            throw new Error('This Claim was prepared by another local session.');
+        const handle = await reopenWorkspace(session.workspace, { signal: options.signal });
+        try {
+            await handle.assertUnchanged();
+        }
+        finally {
+            await handle.close();
+        }
+        return { requestId: id, reviewerId: api.reviewerId, snapshotHash: session.request.snapshotHash, workspacePath: session.workspace.path, downloadedFiles: 0, downloadedBytes: 0, reusedFiles: 0 };
+    }
+    const { attempt, request } = await api.json(`${route}/try-claim`, {});
+    const controller = new AbortController();
+    const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+    const renewalController = new AbortController();
+    let renewal;
+    const heartbeat = setInterval(() => {
+        if (renewal)
+            return;
+        renewal = api.json(`${route}/renew`, { attemptId: attempt.id }, AbortSignal.any([signal, renewalController.signal, AbortSignal.timeout(15_000)]))
+            .catch(error => { if (!renewalController.signal.aborted)
+            controller.abort(error); }).finally(() => { renewal = undefined; });
+    }, 20_000);
+    try {
+        if (request.id !== id || request.packageVersion !== packageVersion || attempt.reviewerId !== api.reviewerId)
+            throw new Error('Invalid Try Claim response.');
+        requestId(request.runId);
+        requestId(attempt.id);
+        const manifest = validateWorkspaceManifest(await api.json(`${route}/snapshot`, undefined, signal));
+        if (manifest.hash !== request.snapshotHash)
+            throw new Error('Downloaded manifest does not match this review.');
+        options.onProgress?.({ phase: 'download' });
+        const imported = await materializeWorkspace({ manifest, stateDir: api.root, signal,
+            fetchBlob: async (hash, downloadSignal) => {
+                const response = await api.send(`${route}/blobs/${hash}`, undefined, downloadSignal);
+                if (!response.body)
+                    throw new Error('Missing snapshot file body.');
+                return response.body;
+            }, onProgress: transfer => options.onProgress?.({ phase: 'download', transfer }),
+        });
+        options.onProgress?.({ phase: 'environment' });
+        const preparation = await prepareHumanReview(request, imported.descriptor, join(api.root, 'runs', request.runId, id, 'preparation', attempt.id), signal);
+        const session = { version: 1, server: api.server, reviewerId: api.reviewerId, attemptId: attempt.id, request, workspace: imported.descriptor };
+        // Keep the prepared session before confirmation, so a lost confirmation response
+        // can be recovered by checking the authoritative Claim with the same attempt ID.
+        await api.saveSession(session);
+        signal.throwIfAborted();
+        await api.json(`${route}/confirm`, { attemptId: attempt.id, preparation }, signal);
+        options.onProgress?.({ phase: 'claimed' });
+        return { requestId: id, reviewerId: api.reviewerId, snapshotHash: request.snapshotHash, workspacePath: imported.descriptor.path,
+            downloadedFiles: imported.downloadedFiles, downloadedBytes: imported.downloadedBytes, reusedFiles: imported.reusedFiles };
+    }
+    catch (error) {
+        // Best-effort release is conditional on the attempt; loss of network is covered
+        // by lease expiry, and cannot release another reviewer's newer reservation.
+        await api.json(`${route}/release`, { attemptId: attempt.id }, AbortSignal.timeout(5_000)).catch(() => { });
+        throw error;
+    }
+    finally {
+        clearInterval(heartbeat);
+        renewalController.abort();
+        await renewal;
+    }
+}
+export async function executeRemoteHumanTool(id, toolName, args, options) {
+    const api = await connect(options), session = await api.readSession(requestId(id));
+    const action = { attemptId: session.attemptId, toolName, arguments: args };
+    await api.json(`/requests/${id}/authorize-tool`, action);
+    const handle = await reopenWorkspace(session.workspace, { signal: options.signal });
+    try {
+        await handle.assertUnchanged();
+        const request = session.request;
+        const registry = await createReviewTools({ worktreePath: session.workspace.path, artifacts: request.artifacts,
+            artifactGroups: request.artifactGroups, artifactTypes: request.artifactTypes, configManifest: request.configManifest,
+            criticId: request.criticId, audience: 'human', runDir: join(api.root, 'runs', request.runId, id, 'human-tools'), signal: handle.signal });
+        try {
+            registry.validateArguments(toolName, args);
+            const result = await registry.call(toolName, args);
+            await handle.assertUnchanged();
+            handle.signal.throwIfAborted();
+            await api.json(`/requests/${id}/tool-receipt`, action);
+            return result;
+        }
+        finally {
+            await registry.close();
+        }
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function submitRemoteHumanReview(id, result, options) {
+    const api = await connect(options), session = await api.readSession(requestId(id));
+    const handle = await reopenWorkspace(session.workspace, { signal: options.signal });
+    try {
+        await handle.assertUnchanged();
+        handle.signal.throwIfAborted();
+        return await api.json(`/requests/${id}/submit`, { attemptId: session.attemptId, result });
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/src/review/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/review/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAkC,MAAM,2BAA2B,CAAC;AAC5H,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4BrD,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEhJ,SAAS,SAAS,CAAC,OAA4B;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjK,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9J,MAAM,IAAI,GAAG,KAAK,EAAE,KAAa,EAAE,KAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAqB,EAAE;QAChG,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YACjG,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;YAC7H,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACpI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAuB,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI;QAClC,KAAK,CAAC,IAAI,CAAI,KAAa,EAAE,KAAe,EAAE,MAAoB,IAAgB,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAO,CAAC,CAAC,CAAC;KACjJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAA4B;IACjD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAiD,UAAU,CAAC,CAAC;IAC5F,IAAI,QAAQ,CAAC,cAAc,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,cAAc,+CAA+C,cAAc,IAAI,CAAC,CAAC;IAC/K,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACnH,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC;IACzL,MAAM,WAAW,GAAG,KAAK,EAAE,EAAU,EAA+B,EAAE;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAuB,CAAC;QACzF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,cAAc,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QACxX,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,KAAK,EAAE,OAA2B,EAAE,EAAE;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA4B,EAAE,EAAE,KAAK,GAAG,GAAG,EAAE,MAAM,GAAG,CAAC,EAAE,GAAwC,EAAE;IACzI,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,WAAW,MAAM,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU,EAAE,OAA4B;IAC7E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAA8C,aAAa,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtH,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;QACjF,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;QACtE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,uBAAuB,EAAE,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,EAAE;QACtE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;KACtJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU,EAAE,OAA4B;IAC9E,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,aAAa,EAAE,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAA8C,KAAK,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACtG,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC/H,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QACzE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAClM,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAsD,GAAG,KAAK,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3H,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;IACzG,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;IAChD,IAAI,OAAqC,CAAC;IAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aAC9I,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACjI,CAAC,EAAE,MAAM,CAAC,CAAC;IACX,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,cAAc,KAAK,cAAc,IAAI,OAAO,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC5J,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACnG,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC/G,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YAChF,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE;gBACxC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;gBACrF,IAAI,CAAC,QAAQ,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBACnE,OAAO,QAAQ,CAAC,IAAI,CAAC;YACvB,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;SACjF,CAAC,CAAC;QACH,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACzJ,MAAM,OAAO,GAAuB,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnK,iFAAiF;QACjF,iFAAiF;QACjF,MAAM,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QACnF,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;YAC7H,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC9H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gFAAgF;QAChF,4EAA4E;QAC5E,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1G,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,OAAO,CAAC;IAAC,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAU,EAAE,QAAgB,EAAE,IAA6B,EAAE,OAA4B;IACpI,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;YAC3G,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc;YACpH,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5I,IAAI,CAAC;YACH,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnD,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC/D,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;YACvD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAU,EAAE,MAA8D,EAAE,OAA4B;IACpJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/D,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC"}

package/dist/src/review/local-claim.d.ts

@@ -0,0 +1,5 @@
+import type { Broker } from '../broker/index.js';
+/** Keep the local CLI alive long enough to release Try Claim and stop its checks. */
+export declare function claimHumanFromCli(broker: Broker, requestId: string, reviewerId: string, stderr: {
+    write(value: string): unknown;
+}): Promise<import("../contracts.js").ReviewRequest>;

package/dist/src/review/local-claim.js

@@ -0,0 +1,16 @@
+/** Keep the local CLI alive long enough to release Try Claim and stop its checks. */
+export async function claimHumanFromCli(broker, requestId, reviewerId, stderr) {
+    const controller = new AbortController();
+    const cancel = () => controller.abort(new Error('Human claim preparation cancelled.'));
+    process.once('SIGINT', cancel);
+    process.once('SIGTERM', cancel);
+    try {
+        stderr.write('Try Claim: preparing the review input and checking the local environment.\n');
+        return await broker.claimHuman(requestId, reviewerId, { signal: controller.signal });
+    }
+    finally {
+        process.off('SIGINT', cancel);
+        process.off('SIGTERM', cancel);
+    }
+}
+//# sourceMappingURL=local-claim.js.map

package/dist/src/review/local-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-claim.js","sourceRoot":"","sources":["../../../src/review/local-claim.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,SAAiB,EAAE,UAAkB,EAAE,MAAyC;IACtI,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC5F,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;YAAS,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;AAC9E,CAAC"}

package/dist/src/review/server.d.ts

@@ -0,0 +1,11 @@
+export interface ReviewServerOptions {
+    stateDir: string;
+    reviewers: Record<string, string>;
+    host?: string;
+    port?: number;
+}
+/** A download/action transport. Only explicit POST actions open the Broker. */
+export declare function startReviewServer(options: ReviewServerOptions): Promise<{
+    url: string;
+    close(): Promise<void>;
+}>;

package/dist/src/review/server.js

@@ -0,0 +1,248 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { pipeline } from 'node:stream/promises';
+import { createBroker, readStateContext } from '../broker/index.js';
+import { activeTryClaim } from '../broker/human-claims.js';
+import { withProjectStore } from '../project/store.js';
+import { createWorkspaceManifest, openWorkspaceBlob } from '../workspaces/transfer.js';
+import { ensureRunWorker } from '../worker-client.js';
+import { packageVersion } from '../runtime-paths.js';
+import { portableReview } from './types.js';
+class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const digest = (value) => createHash('sha256').update(value).digest();
+const identifier = (value) => { if (!/^[A-Za-z0-9_-]{1,128}$/.test(value))
+    throw new HttpError(400, 'Invalid request identifier.'); return value; };
+function json(response, value, status = 200) {
+    response.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    response.end(JSON.stringify(value));
+}
+function shape(value, keys) {
+    if (!object(value) || Object.keys(value).some(key => !keys.includes(key)))
+        throw new HttpError(400, 'Invalid request body.');
+}
+function string(value) {
+    if (typeof value !== 'string' || !value || value.length > 256)
+        throw new HttpError(400, 'Missing or invalid action identifier.');
+    return value;
+}
+async function readBody(request) {
+    if (!/^application\/json(?:;\s*charset=utf-8)?$/i.test(request.headers['content-type'] ?? ''))
+        throw new HttpError(415, 'Send an application/json body.');
+    let size = 0;
+    const chunks = [];
+    for await (const chunk of request) {
+        size += chunk.length;
+        if (size > 128 * 1024)
+            throw new HttpError(413, 'Action body exceeds 128 KiB.');
+        chunks.push(chunk);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new HttpError(400, 'Invalid JSON body.');
+    }
+}
+/** A download/action transport. Only explicit POST actions open the Broker. */
+export async function startReviewServer(options) {
+    const context = readStateContext(options.stateDir);
+    if (!object(options.reviewers) || !Object.keys(options.reviewers).length)
+        throw new Error('At least one reviewer credential is required.');
+    const credentials = Object.entries(options.reviewers).map(([id, token]) => {
+        if (!/^[A-Za-z0-9_-]{1,128}$/.test(id) || typeof token !== 'string' || !/^[A-Za-z0-9_-]{32,256}$/.test(token))
+            throw new Error('Reviewer credentials require an ID and a random base64url token of at least 32 characters.');
+        return { id, hash: digest(token) };
+    });
+    if (new Set(credentials.map(entry => entry.hash.toString('hex'))).size !== credentials.length)
+        throw new Error('Each reviewer needs a distinct credential.');
+    const requestedPort = options.port ?? 4320;
+    if (!Number.isInteger(requestedPort) || requestedPort < 0 || requestedPort > 65535)
+        throw new Error('Invalid review server port.');
+    const host = options.host ?? '127.0.0.1';
+    const jobs = new Set(), active = new Set();
+    const manifests = new Map();
+    let closing = false;
+    const readRequest = (id) => withProjectStore(context.stateDir, db => {
+        const row = db.prepare('SELECT data FROM requests WHERE id=?').get(id);
+        return row ? JSON.parse(String(row.data)) : null;
+    }, null);
+    const authenticate = (request) => {
+        if (request.headers.origin || request.headers['sec-fetch-site'])
+            throw new HttpError(403, 'Use the CCDD review client for authenticated remote actions.');
+        const authorization = request.headers.authorization;
+        if (!authorization?.startsWith('Bearer ') || authorization.length > 264)
+            throw new HttpError(401, 'A reviewer credential is required.');
+        const hash = digest(authorization.slice(7));
+        const credential = credentials.find(entry => timingSafeEqual(entry.hash, hash));
+        if (!credential)
+            throw new HttpError(401, 'Invalid reviewer credential.');
+        return credential.id;
+    };
+    const manifestFor = (request) => {
+        let pending = manifests.get(request.snapshotHash);
+        if (!pending) {
+            // This reads immutable snapshot files and verifies their identity; it never
+            // evaluates configuration or modifies review state.
+            pending = createWorkspaceManifest(request.workspace);
+            manifests.set(request.snapshotHash, pending);
+            pending.catch(() => { manifests.delete(request.snapshotHash); });
+            if (manifests.size > 16)
+                manifests.delete(manifests.keys().next().value);
+        }
+        return pending;
+    };
+    const server = createServer({ maxHeaderSize: 16_384 }, (request, response) => {
+        response.setHeader('Cache-Control', 'no-store');
+        response.setHeader('X-Content-Type-Options', 'nosniff');
+        response.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'");
+        const controller = new AbortController();
+        active.add(controller);
+        const disconnect = () => { if (!response.writableEnded)
+            controller.abort(new Error('Review client disconnected.')); };
+        response.once('close', disconnect);
+        const job = (async () => {
+            if (closing)
+                throw new HttpError(503, 'Review server is stopping.');
+            if (active.size > 32)
+                throw new HttpError(429, 'Too many concurrent review transfers.');
+            const reviewerId = authenticate(request);
+            if (!request.url?.startsWith('/') || request.url.startsWith('//'))
+                throw new HttpError(400, 'Invalid review route.');
+            const url = new URL(request.url, 'http://review.local');
+            if (request.method === 'GET' && url.pathname === '/session') {
+                json(response, { reviewerId, packageVersion });
+                return;
+            }
+            if (request.method === 'GET' && url.pathname === '/requests') {
+                if ([...url.searchParams.keys()].some(key => !['limit', 'offset'].includes(key)))
+                    throw new HttpError(400, 'Unknown query parameter.');
+                const limit = Number(url.searchParams.get('limit') ?? 100), offset = Number(url.searchParams.get('offset') ?? 0);
+                if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200 || !Number.isSafeInteger(offset) || offset < 0)
+                    throw new HttpError(400, 'Invalid pagination.');
+                const result = withProjectStore(context.stateDir, db => db.prepare("SELECT data FROM requests WHERE json_extract(data,'$.profile.kind')='human' ORDER BY json_extract(data,'$.createdAt') DESC, rowid DESC LIMIT ? OFFSET ?").all(limit, offset).map(row => {
+                    const stored = JSON.parse(String(row.data));
+                    const preparation = activeTryClaim(stored);
+                    return { id: stored.id, runId: stored.runId, title: stored.title, status: stored.status,
+                        claimedBy: stored.claimedBy ?? null, preparation: preparation ? { reviewerId: preparation.reviewerId, expiresAt: preparation.expiresAt } : null,
+                        remoteSupported: stored.workspace.mode === 'copy' && Boolean(stored.configManifest) };
+                }), []);
+                json(response, result);
+                return;
+            }
+            const match = /^\/requests\/([^/]+)(?:\/(snapshot|blobs\/([a-f0-9]{64})|try-claim|renew|release|confirm|authorize-tool|tool-receipt|submit))?$/.exec(url.pathname);
+            if (!match || url.search)
+                throw new HttpError(404, 'Unknown review route.');
+            const id = identifier(match[1]), action = match[2];
+            const stored = readRequest(id);
+            if (!stored)
+                throw new HttpError(404, 'Unknown review request.');
+            const portable = portableReview(stored);
+            if (request.method === 'GET') {
+                if (!action) {
+                    json(response, { request: portable, status: stored.status });
+                    return;
+                }
+                const reservation = activeTryClaim(stored);
+                if (stored.status !== 'WAITING_HUMAN' || (stored.claimedBy !== reviewerId && reservation?.reviewerId !== reviewerId))
+                    throw new HttpError(403, 'Reserve this review before downloading its input.');
+                if (action === 'snapshot') {
+                    json(response, await manifestFor(stored));
+                    return;
+                }
+                if (match[3]) {
+                    const manifest = await manifestFor(stored);
+                    const blob = await openWorkspaceBlob(stored.workspace, manifest, match[3], { signal: controller.signal });
+                    response.writeHead(200, { 'content-type': 'application/octet-stream', 'content-length': blob.size });
+                    await pipeline(blob.stream, response, { signal: controller.signal });
+                    return;
+                }
+                throw new HttpError(405, 'This route requires POST.');
+            }
+            if (request.method !== 'POST')
+                throw new HttpError(405, 'Use GET or POST.');
+            const input = await readBody(request);
+            const broker = createBroker(context);
+            try {
+                if (action === 'try-claim') {
+                    shape(input, []);
+                    const attempt = broker.tryClaimHuman(id, reviewerId);
+                    json(response, { attempt, request: portable });
+                }
+                else if (action === 'renew' || action === 'release') {
+                    shape(input, ['attemptId']);
+                    const attemptId = string(input.attemptId);
+                    json(response, action === 'renew' ? broker.renewHumanTryClaim(id, reviewerId, attemptId) : { released: broker.releaseHumanTryClaim(id, reviewerId, attemptId) });
+                }
+                else if (action === 'confirm') {
+                    shape(input, ['attemptId', 'preparation']);
+                    const confirmed = broker.confirmHumanClaim(id, reviewerId, string(input.attemptId), input.preparation);
+                    json(response, { request: portableReview(confirmed) });
+                }
+                else if (action === 'authorize-tool' || action === 'tool-receipt') {
+                    shape(input, ['attemptId', 'toolName', 'arguments']);
+                    const args = { reviewerId, attemptId: string(input.attemptId), toolName: string(input.toolName), arguments: input.arguments ?? {} };
+                    if (action === 'authorize-tool')
+                        json(response, { tool: broker.authorizeRemoteHumanTool(id, args) });
+                    else {
+                        broker.recordRemoteHumanTool(id, args);
+                        json(response, { ok: true });
+                    }
+                }
+                else if (action === 'submit') {
+                    shape(input, ['attemptId', 'result']);
+                    const current = broker.getRequest(id);
+                    if (!current || current.claimedBy !== reviewerId || current.claimAttemptId !== string(input.attemptId))
+                        throw new HttpError(409, 'This Claim no longer belongs to this attempt.');
+                    const completed = await broker.completeHuman(id, { reviewerId, result: input.result });
+                    if (!completed)
+                        throw new HttpError(404, 'The completed request is unavailable.');
+                    const run = broker.getRun(completed.runId);
+                    if (run.status === 'QUEUED')
+                        await ensureRunWorker({ broker, context, run });
+                    json(response, { id, status: completed.status, result: completed.result });
+                }
+                else
+                    throw new HttpError(404, 'Unknown review action.');
+            }
+            finally {
+                await broker.close();
+            }
+        })().catch(error => {
+            if (response.headersSent) {
+                response.destroy();
+                return;
+            }
+            json(response, { error: error instanceof Error ? error.message : 'Review action failed.' }, error instanceof HttpError ? error.status : 409);
+        }).finally(() => { active.delete(controller); response.off('close', disconnect); jobs.delete(job); });
+        jobs.add(job);
+    });
+    server.requestTimeout = 30_000;
+    server.headersTimeout = 10_000;
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(requestedPort, host, () => { server.off('error', reject); resolve(); });
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string')
+        throw new Error('Cannot determine review server address.');
+    let closePromise;
+    return { url: `http://${host.includes(':') ? `[${host}]` : host}:${address.port}`,
+        close() {
+            return closePromise ??= (async () => {
+                closing = true;
+                for (const controller of active)
+                    controller.abort(new Error('Review server stopped.'));
+                await new Promise((resolve, reject) => { server.close(error => error ? reject(error) : resolve()); server.closeAllConnections(); });
+                await Promise.allSettled([...jobs]);
+            })();
+        },
+    };
+}
+//# sourceMappingURL=server.js.map

package/dist/src/review/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/review/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAA0B,MAAM,2BAA2B,CAAC;AAC/G,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQ5C,MAAM,SAAU,SAAQ,KAAK;IAAwB,MAAM;IAA3B,YAAqB,MAAc,EAAE,OAAe;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;sBAAlD,MAAM;IAA6C,CAAC;CAAE;AAC3G,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC1I,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9E,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;IAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5J,SAAS,IAAI,CAAC,QAAwB,EAAE,KAAc,EAAE,MAAM,GAAG,GAAG;IAClE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACzH,CAAC;AACD,SAAS,KAAK,CAAC,KAAc,EAAE,IAAc;IAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;AAC/H,CAAC;AACD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACjI,OAAO,KAAK,CAAC;AACf,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,OAAwB;IAC9C,IAAI,CAAC,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAC1J,IAAI,IAAI,GAAG,CAAC,CAAC;IAAC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,GAAG,GAAG,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAClE,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAAC,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA4B;IAClE,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC3I,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;QACxE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;QAC7N,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC7J,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsC,CAAC;IAChE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE;QAC1E,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC,EAAE,IAAI,CAAC,CAAC;IACT,MAAM,YAAY,GAAG,CAAC,OAAwB,EAAE,EAAE;QAChD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8DAA8D,CAAC,CAAC;QAC1J,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;QACxI,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QAC1E,OAAO,UAAU,CAAC,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,OAAsB,EAAE,EAAE;QAC7C,IAAI,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,4EAA4E;YAC5E,oDAAoD;YACpD,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrD,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,SAAS,CAAC,IAAI,GAAG,EAAE;gBAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3E,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACxD,QAAQ,CAAC,SAAS,CAAC,yBAAyB,EAAE,4CAA4C,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa;YAAE,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;YACtB,IAAI,OAAO;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,IAAI,GAAG,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;YACxF,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;YACrH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACxD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;gBAAC,OAAO;YACzD,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC7D,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;gBACvI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;oBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;gBAC7J,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,yJAAyJ,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;oBACzP,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAkB,CAAC;oBAC7D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;oBAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrF,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI;wBAC/I,eAAe,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC1F,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACR,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAAC,OAAO;YACjC,CAAC;YACD,MAAM,KAAK,GAAG,iIAAiI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnK,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;YAC5E,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;oBAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACtF,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,WAAW,EAAE,UAAU,KAAK,UAAU,CAAC;oBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;gBACpM,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;oBAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACjF,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACb,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;oBAC3C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC1G,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;oBACrG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAC/E,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC3B,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACjB,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;oBACrD,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjD,CAAC;qBAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACtD,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;oBAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACvE,IAAI,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;gBACnK,CAAC;qBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAChC,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;oBAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,WAA+B,CAAC,CAAC;oBAC3H,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACzD,CAAC;qBAAM,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;oBACpE,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;oBACrD,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;oBACpI,IAAI,MAAM,KAAK,gBAAgB;wBAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;yBAChG,CAAC;wBAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;wBAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;oBAAC,CAAC;gBAChF,CAAC;qBAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;oBACtC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,IAAI,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;wBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;oBAClL,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;oBACvF,IAAI,CAAC,SAAS;wBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;oBAClF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAE,CAAC;oBAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;wBAAE,MAAM,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC7E,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC7E,CAAC;;oBAAM,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;YAC5D,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QACrC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACjB,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACzD,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/I,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACxG,IAAI,YAAuC,CAAC;IAC5C,OAAO,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE;QAC/E,KAAK;YACH,OAAO,YAAY,KAAK,CAAC,KAAK,IAAI,EAAE;gBAClC,OAAO,GAAG,IAAI,CAAC;gBAAC,KAAK,MAAM,UAAU,IAAI,MAAM;oBAAE,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBACvG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1I,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/review/types.d.ts

@@ -0,0 +1,10 @@
+import type { ReviewEnvelope, ReviewRequest } from '../contracts.js';
+/** Portable review data contains no publisher paths, credentials or worker state. */
+export interface PortableReview extends ReviewEnvelope {
+    id: string;
+    runId: string;
+    packageVersion: string;
+    claimedBy: string | null;
+    claimAttemptId?: string;
+}
+export declare function portableReview(request: ReviewRequest): PortableReview;

package/dist/src/review/types.js

@@ -0,0 +1,17 @@
+import { packageVersion } from '../runtime-paths.js';
+export function portableReview(request) {
+    if (request.profile.kind !== 'human' || request.workspace.mode !== 'copy' || !request.configManifest) {
+        throw new Error('Remote review requires a copy-mode Human request with a TypeScript tool manifest.');
+    }
+    return {
+        id: request.id, runId: request.runId, repoId: request.repoId,
+        snapshotHash: request.snapshotHash, criticId: request.criticId, title: request.title,
+        target: request.target, deps: request.deps, artifacts: request.artifacts,
+        ...(request.artifactGroups ? { artifactGroups: request.artifactGroups } : {}),
+        artifactTypes: request.artifactTypes, configManifest: request.configManifest,
+        payload: { instruction: request.payload.instruction }, profile: { kind: 'human' },
+        packageVersion, claimedBy: request.claimedBy ?? null,
+        ...(request.claimAttemptId ? { claimAttemptId: request.claimAttemptId } : {}),
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/src/review/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/review/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAWrD,MAAM,UAAU,cAAc,CAAC,OAAsB;IACnD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;QAC5D,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpF,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;QACxE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc;QAC5E,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACjF,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/src/tools/contracts.d.ts

@@ -11,6 +11,8 @@ export interface ToolMetadata {
     observation: 'content' | 'none';
     artifactKind?: 'file' | 'directory' | 'any';
     timeoutMs?: number;
+    /** Project-relative runtime files or directories whose bytes affect this tool. */
+    executionPaths?: string[];
 }
 export interface ToolContext {
     artifactId: string;
@@ -20,6 +22,8 @@ export interface ToolContext {
     tmpDir: string;
     signal: AbortSignal;
     resolvePath(path?: string): Promise<string>;
+    /** Resolve only paths explicitly registered in metadata.executionPaths. */
+    resolveExecutionPath?(path: string): Promise<string>;
 }
 export type ToolContent = {
     type: 'text';
@@ -61,10 +65,19 @@ export interface ArtifactToolsConfig {
     agentTools?: Record<string, ToolDefinition<any>>;
     humanTools?: Record<string, ToolDefinition<any>>;
 }
+export interface EnvironmentRequirement {
+    description: string;
+    /** Project-relative Node script; a zero exit status confirms readiness. */
+    script: string;
+    timeoutMs?: number;
+    /** Additional project files or directories used by the check. */
+    inputs?: string[];
+}
 export interface Config {
     artifacts: Record<string, ArtifactEntryDefinition>;
     artifactTypes: Record<string, ArtifactToolsConfig>;
     critics: CriticDefinition[];
+    envRequirements?: Record<string, EnvironmentRequirement>;
 }
 export type ConfigFactory = () => Config | Promise<Config>;
 export interface ConfigManifest {
@@ -78,6 +91,15 @@ export interface ConfigManifest {
         agentTools: Record<string, ToolMetadata>;
         humanTools: Record<string, ToolMetadata>;
     }>;
+    envRequirements?: Record<string, EnvironmentRequirement>;
+    environmentInputs?: {
+        path: string;
+        hash: string;
+    }[];
+    executionInputs?: {
+        path: string;
+        hash: string;
+    }[];
 }
 type Properties<S> = S extends {
     properties: infer P;

package/dist/src/tools/environment-host.d.ts

@@ -0,0 +1 @@
+export {};