@claudexor/cli 1.0.1 → 2.1.3

package/dist/setup-job-store.js

@@ -0,0 +1,359 @@
+import { chmodSync, existsSync, lstatSync, mkdirSync, realpathSync } from "node:fs";
+import { join, sep } from "node:path";
+import { DurableJournal, JournalRecoveryRequiredError, } from "@claudexor/journal";
+import { ControlSetupJob as ControlSetupJobSchema, ControlSetupJobEvent, TERMINAL_CONTROL_SETUP_JOB_STATES, } from "@claudexor/schema";
+import { ensureCanonicalPrivateDirectory, hashJson, redactSecrets } from "@claudexor/util";
+import { initialSetupJob, reduceSetupJob } from "./setup-job-reducer.js";
+export const ACTIVE_SETUP_STATES = new Set([
+    "queued",
+    "running",
+    "waiting_for_input",
+]);
+export const TERMINAL_SETUP_STATES = new Set([
+    ...TERMINAL_CONTROL_SETUP_JOB_STATES,
+]);
+const MAX_LOG_RECORD_BYTES = 16 * 1024;
+/**
+ * Setup lifecycle projection over the daemon's global durable journal.
+ *
+ * Per-job directories contain only operational artifacts (runner handshake
+ * and command launcher). They never contain a job snapshot,
+ * event ledger or sequence metadata and cannot become a second authority.
+ */
+export class SetupJobStore {
+    rootDir;
+    artifactsDir;
+    journal;
+    jobs = new Map();
+    createByKey = new Map();
+    now;
+    semanticRecovery = null;
+    constructor(rootDir, opts = {}) {
+        this.rootDir = rootDir;
+        this.now = opts.now ?? (() => new Date());
+        ensurePrivateRealDirectory(rootDir, "daemon data root");
+        this.artifactsDir = join(rootDir, "setup-artifacts");
+        ensurePrivateRealDirectory(this.artifactsDir, "setup artifacts root");
+        if (realpathSync(this.artifactsDir).startsWith(realpathSync(rootDir) + sep) === false) {
+            throw new Error("setup artifacts root escapes daemon data root");
+        }
+        this.journal =
+            opts.journal ??
+                new DurableJournal({
+                    rootDir: join(rootDir, "journal"),
+                    partition: "global",
+                    now: this.now,
+                });
+        if (this.journal.options.partition !== "global") {
+            throw new Error(`setup lifecycle requires the global journal, received '${this.journal.options.partition}'`);
+        }
+        this.rebuild();
+    }
+    paths(jobId) {
+        if (!/^setup-[A-Za-z0-9-]+$/.test(jobId)) {
+            throw new Error(`unsafe setup job id: ${jobId}`);
+        }
+        const dir = join(this.artifactsDir, jobId);
+        if (!dir.startsWith(this.artifactsDir + sep)) {
+            throw new Error(`setup job path escapes store: ${jobId}`);
+        }
+        return {
+            dir,
+            manifest: join(dir, "runner-manifest.json"),
+            runnerState: join(dir, "runner-state.json"),
+            runnerResult: join(dir, "runner-result.json"),
+            runnerPermit: join(dir, "runner-permit.json"),
+            command: join(dir, "login.command"),
+        };
+    }
+    recoveryState() {
+        if (!this.semanticRecovery)
+            return this.journal.state();
+        return {
+            ...this.semanticRecovery,
+            location: { ...this.semanticRecovery.location },
+        };
+    }
+    validateProjection() {
+        this.assertAvailable();
+    }
+    create(job, idempotency) {
+        this.assertAvailable();
+        if (this.jobs.has(job.jobId))
+            throw new Error(`setup job already exists: ${job.jobId}`);
+        return this.persist(initialSetupJob(job), idempotency ? this.newBinding(job.jobId, idempotency) : undefined);
+    }
+    resolveCreate(idempotency) {
+        this.assertAvailable();
+        const binding = this.newBinding("pending", idempotency);
+        const prior = this.createByKey.get(binding.keyDigest);
+        if (!prior)
+            return null;
+        if (prior.requestDigest !== binding.requestDigest)
+            throw idempotencyConflict();
+        return this.status(prior.jobId);
+    }
+    bindCreate(jobId, idempotency) {
+        this.assertAvailable();
+        const job = this.status(jobId);
+        const binding = this.newBinding(jobId, idempotency);
+        const prior = this.createByKey.get(binding.keyDigest);
+        if (prior) {
+            if (prior.requestDigest !== binding.requestDigest)
+                throw idempotencyConflict();
+            return this.status(prior.jobId);
+        }
+        this.journal.append("setup.job.create_bound", { binding });
+        this.rememberBinding(binding);
+        return job;
+    }
+    persist(job, binding) {
+        this.assertAvailable();
+        this.ensureJobDir(this.paths(job.jobId).dir);
+        this.journal.append("setup.job.saved", { job, binding });
+        const stored = cloneJob(job);
+        this.jobs.set(job.jobId, stored);
+        if (binding)
+            this.rememberBinding(binding);
+        return cloneJob(stored);
+    }
+    update(jobId, patch) {
+        const current = this.jobs.get(jobId);
+        if (!current)
+            throw Object.assign(new Error("setup job not found"), { status: 404 });
+        return this.persist(reduceSetupJob(current, { ...current, ...patch }));
+    }
+    status(jobId) {
+        this.assertAvailable();
+        const job = this.jobs.get(jobId);
+        if (!job)
+            throw Object.assign(new Error("setup job not found"), { status: 404 });
+        return cloneJob(job);
+    }
+    list(filter) {
+        this.assertAvailable();
+        let rows = [...this.jobs.values()];
+        if (filter?.harness)
+            rows = rows.filter((job) => job.harness === filter.harness);
+        if (filter?.action)
+            rows = rows.filter((job) => job.action === filter.action);
+        if (filter?.active !== undefined) {
+            rows = rows.filter((job) => filter.active === (job.phase !== undefined && ACTIVE_SETUP_STATES.has(job.state)));
+        }
+        rows.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+        if (filter?.limit !== undefined && rows.length > filter.limit) {
+            rows = rows.slice(-filter.limit);
+        }
+        return rows.map(cloneJob);
+    }
+    snapshot(jobId) {
+        this.assertAvailable();
+        return {
+            job: this.status(jobId),
+            cursor: this.journal.currentCursor(),
+            sequence: this.journal.currentSequence(),
+        };
+    }
+    events(jobId, afterCursor) {
+        this.assertAvailable();
+        this.status(jobId);
+        const afterSeq = this.journal.sequenceAfter(afterCursor);
+        let previousCursor = afterCursor ?? null;
+        const events = [];
+        for (const record of this.journal.records(afterSeq)) {
+            if (record.type !== "setup.job.saved")
+                continue;
+            const parsed = ControlSetupJobSchema.safeParse(record.payload?.job);
+            if (!parsed.success || parsed.data.jobId !== jobId)
+                continue;
+            const cursor = this.journal.cursorFor(record);
+            events.push(ControlSetupJobEvent.parse({
+                jobId,
+                cursor,
+                previousCursor,
+                sequence: record.seq,
+                time: record.time,
+                kind: "status",
+                state: parsed.data.state,
+                message: parsed.data.message,
+                job: parsed.data,
+            }));
+            previousCursor = cursor;
+        }
+        return events;
+    }
+    appendLog(jobId, line) {
+        this.assertAvailable();
+        if (!this.jobs.has(jobId))
+            return;
+        const redacted = `[${this.now().toISOString()}] ${redactSecrets(line)}`;
+        const bytes = Buffer.from(redacted, "utf8");
+        const bounded = bytes.length <= MAX_LOG_RECORD_BYTES
+            ? redacted
+            : `${bytes.subarray(0, MAX_LOG_RECORD_BYTES).toString("utf8")}\n[output truncated at ${MAX_LOG_RECORD_BYTES} bytes]`;
+        this.journal.append("setup.job.log", { jobId, line: bounded });
+    }
+    rebuild() {
+        if (this.journal.state().status === "recovery_required")
+            return;
+        for (const record of this.journal.records()) {
+            if (record.type === "setup.job.log") {
+                if (typeof record.payload?.jobId !== "string" ||
+                    !/^setup-[A-Za-z0-9-]+$/.test(record.payload.jobId) ||
+                    typeof record.payload.line !== "string" ||
+                    Buffer.byteLength(record.payload.line, "utf8") > MAX_LOG_RECORD_BYTES + 128) {
+                    this.semanticRecovery = {
+                        status: "recovery_required",
+                        location: { kind: "cursor", epoch: record.epoch, seq: record.seq },
+                        reason: `invalid setup.job.log payload at journal seq ${record.seq}`,
+                        discardedTailBytes: 0,
+                    };
+                    return;
+                }
+                continue;
+            }
+            if (record.type === "setup.job.create_bound") {
+                const binding = parseBinding(record.payload?.binding);
+                if (!binding || !this.jobs.has(binding.jobId)) {
+                    this.failSemantic(record, "invalid setup.job.create_bound payload");
+                    return;
+                }
+                this.rememberBinding(binding);
+                continue;
+            }
+            if (record.type !== "setup.job.saved")
+                continue;
+            const parsed = ControlSetupJobSchema.safeParse(record.payload?.job);
+            if (!parsed.success) {
+                this.semanticRecovery = {
+                    status: "recovery_required",
+                    location: { kind: "cursor", epoch: record.epoch, seq: record.seq },
+                    reason: `invalid setup.job.saved payload at journal seq ${record.seq}`,
+                    discardedTailBytes: 0,
+                };
+                return;
+            }
+            try {
+                const current = this.jobs.get(parsed.data.jobId);
+                const next = current ? reduceSetupJob(current, parsed.data) : initialSetupJob(parsed.data);
+                this.jobs.set(next.jobId, cloneJob(next));
+                if (record.payload?.binding !== undefined) {
+                    const binding = parseBinding(record.payload.binding);
+                    if (!binding || binding.jobId !== next.jobId) {
+                        this.failSemantic(record, "invalid setup create binding");
+                        return;
+                    }
+                    this.rememberBinding(binding);
+                }
+            }
+            catch (error) {
+                this.semanticRecovery = {
+                    status: "recovery_required",
+                    location: { kind: "cursor", epoch: record.epoch, seq: record.seq },
+                    reason: `invalid setup lifecycle transition at journal seq ${record.seq}: ${error instanceof Error ? error.message : String(error)}`,
+                    discardedTailBytes: 0,
+                };
+                return;
+            }
+        }
+        // Partition-level recovery is acknowledged only by the global recovery
+        // coordinator after every registered projection has validated the prefix.
+    }
+    newBinding(jobId, input) {
+        if (!input.key.trim() || input.key.length > 256) {
+            throw Object.assign(new Error("invalid Idempotency-Key"), { status: 400 });
+        }
+        return {
+            keyDigest: hashJson({
+                client: input.client,
+                partition: "global",
+                operation: "setup.job.create",
+                key: input.key,
+            }),
+            requestDigest: hashJson(input.request),
+            jobId,
+        };
+    }
+    rememberBinding(binding) {
+        const prior = this.createByKey.get(binding.keyDigest);
+        if (prior && (prior.requestDigest !== binding.requestDigest || prior.jobId !== binding.jobId)) {
+            throw idempotencyConflict();
+        }
+        this.createByKey.set(binding.keyDigest, {
+            requestDigest: binding.requestDigest,
+            jobId: binding.jobId,
+        });
+    }
+    failSemantic(record, reason) {
+        this.semanticRecovery = {
+            status: "recovery_required",
+            location: { kind: "cursor", epoch: record.epoch, seq: record.seq },
+            reason: `${reason} at journal seq ${record.seq}`,
+            discardedTailBytes: 0,
+        };
+    }
+    assertAvailable() {
+        const recovery = this.recoveryState();
+        if (recovery.status === "recovery_required") {
+            throw new JournalRecoveryRequiredError(recovery);
+        }
+    }
+    ensureJobDir(dir) {
+        if (existsSync(dir)) {
+            if (!this.validExistingJobDir(dir)) {
+                throw new Error(`refusing unsafe setup job directory: ${dir}`);
+            }
+        }
+        else {
+            mkdirSync(dir, { recursive: false, mode: 0o700 });
+        }
+        chmodSync(dir, 0o700);
+    }
+    validExistingJobDir(dir) {
+        try {
+            const stat = lstatSync(dir);
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                return false;
+            const root = realpathSync(this.artifactsDir);
+            return realpathSync(dir).startsWith(root + sep);
+        }
+        catch {
+            return false;
+        }
+    }
+}
+function parseBinding(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const row = value;
+    if (typeof row["keyDigest"] !== "string" ||
+        !/^sha256:[a-f0-9]{64}$/.test(row["keyDigest"]) ||
+        typeof row["requestDigest"] !== "string" ||
+        !/^sha256:[a-f0-9]{64}$/.test(row["requestDigest"]) ||
+        typeof row["jobId"] !== "string" ||
+        !/^setup-[A-Za-z0-9-]+$/.test(row["jobId"]))
+        return null;
+    return {
+        keyDigest: row["keyDigest"],
+        requestDigest: row["requestDigest"],
+        jobId: row["jobId"],
+    };
+}
+function idempotencyConflict() {
+    return Object.assign(new Error("Idempotency-Key was already used with a different request"), {
+        code: "idempotency_conflict",
+        status: 409,
+    });
+}
+function ensurePrivateRealDirectory(path, label) {
+    try {
+        ensureCanonicalPrivateDirectory(path);
+    }
+    catch (error) {
+        throw new Error(`${label} is unsafe: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function cloneJob(job) {
+    return ControlSetupJobSchema.parse(JSON.parse(JSON.stringify(job)));
+}
+//# sourceMappingURL=setup-job-store.js.map

package/dist/setup-job-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-job-store.js","sourceRoot":"","sources":["../src/setup-job-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,cAAc,EACd,4BAA4B,GAE7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,IAAI,qBAAqB,EACxC,oBAAoB,EACpB,iCAAiC,GAIlC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAA2B;IACnE,QAAQ;IACR,SAAS;IACT,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAA2B;IACrE,GAAG,iCAAiC;CACrC,CAAC,CAAC;AAkCH,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IAUb;IATF,YAAY,CAAS;IACrB,OAAO,CAAiB;IAChB,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC1C,WAAW,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC1E,GAAG,CAAa;IACzB,gBAAgB,GACtB,IAAI,CAAC;IAEP,YACW,OAAe,EACxB,OAA6B,EAAE;QADtB,YAAO,GAAP,OAAO,CAAQ;QAGxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,0BAA0B,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACrD,0BAA0B,CAAC,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;QACtE,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,OAAO;YACV,IAAI,CAAC,OAAO;gBACZ,IAAI,cAAc,CAAC;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;oBACjC,SAAS,EAAE,QAAQ;oBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;QACL,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,0DAA0D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAC5F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAa;QACjB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO;YACL,GAAG;YACH,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC;YAC3C,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC;YAC3C,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC;YAC7C,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC;YAC7C,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;SACpC,CAAC;IACJ,CAAC;IAED,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO;YACL,GAAG,IAAI,CAAC,gBAAgB;YACxB,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE;SAChD,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,GAAoB,EAAE,WAAoC;QAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,OAAO,CACjB,eAAe,CAAC,GAAG,CAAC,EACpB,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAClE,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,WAAmC;QAC/C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;YAAE,MAAM,mBAAmB,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,WAAmC;QAC3D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAsB,wBAAwB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,OAAO,CAAC,GAAoB,EAAE,OAA4B;QAChE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAsB,iBAAiB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,OAAO;YAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,KAA+B;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,MAAkC;QACrC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,MAAM,EAAE,OAAO;YAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC;QACjF,IAAI,MAAM,EAAE,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9E,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC,MAAM,CAChB,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9D,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;YACpC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,WAA2B;QAC/C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,cAAc,GAAG,WAAW,IAAI,IAAI,CAAC;QACzC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAsB,QAAQ,CAAC,EAAE,CAAC;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;gBAAE,SAAS;YAChD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK;gBAAE,SAAS;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CACT,oBAAoB,CAAC,KAAK,CAAC;gBACzB,KAAK;gBACL,MAAM;gBACN,cAAc;gBACd,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;gBAC5B,GAAG,EAAE,MAAM,CAAC,IAAI;aACjB,CAAC,CACH,CAAC;YACF,cAAc,GAAG,MAAM,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,KAAa,EAAE,IAAY;QACnC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QAClC,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GACX,KAAK,CAAC,MAAM,IAAI,oBAAoB;YAClC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,0BAA0B,oBAAoB,SAAS,CAAC;QACzH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAsB,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,KAAK,mBAAmB;YAAE,OAAO;QAChE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAuB,EAAE,CAAC;YACjE,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACpC,IACE,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,KAAK,QAAQ;oBACzC,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;oBACnD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;oBACvC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,oBAAoB,GAAG,GAAG,EAC3E,CAAC;oBACD,IAAI,CAAC,gBAAgB,GAAG;wBACtB,MAAM,EAAE,mBAAmB;wBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;wBAClE,MAAM,EAAE,gDAAgD,MAAM,CAAC,GAAG,EAAE;wBACpE,kBAAkB,EAAE,CAAC;qBACtB,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtD,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9C,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;gBAAE,SAAS;YAChD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,gBAAgB,GAAG;oBACtB,MAAM,EAAE,mBAAmB;oBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;oBAClE,MAAM,EAAE,kDAAkD,MAAM,CAAC,GAAG,EAAE;oBACtE,kBAAkB,EAAE,CAAC;iBACtB,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBACrD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;wBAC7C,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;wBAC1D,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,gBAAgB,GAAG;oBACtB,MAAM,EAAE,mBAAmB;oBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;oBAClE,MAAM,EAAE,qDAAqD,MAAM,CAAC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACpI,kBAAkB,EAAE,CAAC;iBACtB,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;QACD,uEAAuE;QACvE,0EAA0E;IAC5E,CAAC;IAEO,UAAU,CAAC,KAAa,EAAE,KAA6B;QAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAChD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,kBAAkB;gBAC7B,GAAG,EAAE,KAAK,CAAC,GAAG;aACf,CAAC;YACF,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;YACtC,KAAK;SACN,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,OAA2B;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9F,MAAM,mBAAmB,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,MAAsC,EAAE,MAAc;QACzE,IAAI,CAAC,gBAAgB,GAAG;YACtB,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;YAClE,MAAM,EAAE,GAAG,MAAM,mBAAmB,MAAM,CAAC,GAAG,EAAE;YAChD,kBAAkB,EAAE,CAAC;SACtB,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC5C,MAAM,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAEO,mBAAmB,CAAC,GAAW;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC7C,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IACE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ;QACpC,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,QAAQ;QACxC,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;QAChC,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE3C,OAAO,IAAI,CAAC;IACd,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;QAC3B,aAAa,EAAE,GAAG,CAAC,eAAe,CAAC;QACnC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE;QAC3F,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY,EAAE,KAAa;IAC7D,IAAI,CAAC;QACH,+BAA+B,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,eAAe,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/setup-job-support.d.ts

@@ -0,0 +1,27 @@
+import { type HarnessAdapter, type ProcessGroupHandle } from "@claudexor/core";
+import type { ControlHarnessSetupHarness, ControlSetupJob, CredentialProfileStatus } from "@claudexor/schema";
+import type { SetupLoginRunnerState } from "./setup-login-protocol.js";
+export type SetupProfile = {
+    guideUrl: string;
+    note: string;
+};
+export declare const SETUP_PROFILES: Record<ControlHarnessSetupHarness, SetupProfile>;
+/**
+ * Resolve an INV-135 profile-targeted login request to its canonical scoped
+ * config dir. Typed 400s: an unknown/disabled/secret-ref profile must refuse
+ * at create time, never open a Terminal login into the wrong store.
+ */
+export declare function resolveProfileBinding(harness: ControlHarnessSetupHarness, profileId: string | undefined): {
+    profileId: string;
+    configDir: string;
+} | null;
+/** INV-135 profile verification: the registry adapter's doctor probe against
+ * the durable registry entry — the SAME truth `claudexor profiles login` uses. */
+export declare function profileDoctorProbe(getAdapter: (harness: string) => HarnessAdapter | undefined): (harness: string, profileId: string, abortSignal: AbortSignal) => Promise<CredentialProfileStatus | null>;
+export declare function resolveSetupLoginRunnerPath(moduleUrl?: string, pathExists?: (path: string) => boolean): string;
+export declare function waitWithAbort(ms: number, controller: AbortController, sleep: (ms: number) => Promise<void>): Promise<void>;
+export declare function withAbortAndTimeout<T>(operation: () => Promise<T>, controller: AbortController, timeoutMs: number, label: string): Promise<T>;
+export declare function processGroupFromJob(job: ControlSetupJob): ProcessGroupHandle | null;
+export declare function stateMatchesDurableExecution(job: ControlSetupJob, state: SetupLoginRunnerState): boolean;
+export declare function shellQuote(value: string): string;
+//# sourceMappingURL=setup-job-support.d.ts.map

package/dist/setup-job-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-job-support.d.ts","sourceRoot":"","sources":["../src/setup-job-support.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,0BAA0B,EAAE,YAAY,CAa3E,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,0BAA0B,EACnC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuCjD;AAED;kFACkF;AAClF,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,GAC1D,CACD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,KACrB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAU3C;AAED,wBAAgB,2BAA2B,CACzC,SAAS,GAAE,MAAwB,EACnC,UAAU,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GACjD,MAAM,CAIR;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,eAAe,EAC3B,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,eAAe,EAC3B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CAgCZ;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,GAAG,IAAI,CAOnF;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAQT;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD"}

package/dist/setup-job-support.js

@@ -0,0 +1,141 @@
+/**
+ * Closure-free support owners for the setup-job manager (complexity split:
+ * setup-jobs.ts is at its ratchet cap). Everything here is a pure function or
+ * a parameterized factory — no store, supervisor, or journal access.
+ */
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseProcessGroupHandle, } from "@claudexor/core";
+import { loadConfig } from "@claudexor/config";
+import { canonicalProfileConfigDir } from "@claudexor/harness-claude";
+import { canonicalCodexProfileHome } from "@claudexor/harness-codex";
+import { noProjectRepoRoot } from "@claudexor/util";
+const NO_PROJECT_ROOT = noProjectRepoRoot();
+export const SETUP_PROFILES = {
+    codex: {
+        guideUrl: "https://developers.openai.com/codex/auth/",
+        note: "Codex native login updates the official vendor-owned CLI session. Exact subscription setup never falls back to a managed API key.",
+    },
+    claude: {
+        guideUrl: "https://code.claude.com/docs/en/authentication",
+        note: "Claude Code native login updates the official vendor-owned CLI session. Exact subscription setup never falls back to a managed API key.",
+    },
+    cursor: {
+        guideUrl: "https://docs.cursor.com/en/cli/reference/authentication",
+        note: "Cursor native CLI login is reused when available.",
+    },
+};
+/**
+ * Resolve an INV-135 profile-targeted login request to its canonical scoped
+ * config dir. Typed 400s: an unknown/disabled/secret-ref profile must refuse
+ * at create time, never open a Terminal login into the wrong store.
+ */
+export function resolveProfileBinding(harness, profileId) {
+    if (!profileId)
+        return null;
+    if (harness !== "claude" && harness !== "codex") {
+        throw Object.assign(new Error(`harness "${harness}" has no isolated config-dir login; only claude and codex support profile logins`), { status: 400 });
+    }
+    const profile = loadConfig(NO_PROJECT_ROOT).global.credential_profiles.find((entry) => entry.harness_id === harness && entry.profile_id === profileId);
+    if (!profile) {
+        throw Object.assign(new Error(`no credential profile "${profileId}" for harness "${harness}" — register it first (POST /v2/credential-profiles or \`claudexor profiles add\`)`), { status: 400 });
+    }
+    if (!profile.enabled) {
+        throw Object.assign(new Error(`credential profile "${profileId}" is disabled`), {
+            status: 400,
+        });
+    }
+    if (profile.credential_kind !== "config_dir_login") {
+        throw Object.assign(new Error(`credential profile "${profileId}" is ${profile.credential_kind}; only config_dir_login profiles use the native login flow (store its secret instead)`), { status: 400 });
+    }
+    const configDir = harness === "claude"
+        ? canonicalProfileConfigDir(profile.isolation_locator ?? "")
+        : canonicalCodexProfileHome(profile.isolation_locator ?? "");
+    return { profileId, configDir };
+}
+/** INV-135 profile verification: the registry adapter's doctor probe against
+ * the durable registry entry — the SAME truth `claudexor profiles login` uses. */
+export function profileDoctorProbe(getAdapter) {
+    return async (harness, profileId, abortSignal) => {
+        const profile = loadConfig(NO_PROJECT_ROOT).global.credential_profiles.find((entry) => entry.harness_id === harness && entry.profile_id === profileId);
+        if (!profile)
+            return null;
+        const adapter = getAdapter(harness);
+        if (!adapter?.probeCredentialProfile)
+            return null;
+        return adapter.probeCredentialProfile(profile, abortSignal);
+    };
+}
+export function resolveSetupLoginRunnerPath(moduleUrl = import.meta.url, pathExists = existsSync) {
+    const directory = dirname(fileURLToPath(moduleUrl));
+    const bundled = resolve(directory, "setup-login-runner.cjs");
+    return pathExists(bundled) ? bundled : resolve(directory, "setup-login-runner.js");
+}
+export function waitWithAbort(ms, controller, sleep) {
+    if (controller.signal.aborted)
+        return Promise.reject(controller.signal.reason);
+    return new Promise((resolveWait, rejectWait) => {
+        let settled = false;
+        const settle = (task) => {
+            if (settled)
+                return;
+            settled = true;
+            controller.signal.removeEventListener("abort", onAbort);
+            task();
+        };
+        const onAbort = () => settle(() => rejectWait(controller.signal.reason instanceof Error
+            ? controller.signal.reason
+            : new Error("setup operation aborted")));
+        controller.signal.addEventListener("abort", onAbort, { once: true });
+        sleep(ms).then(() => settle(resolveWait), (error) => settle(() => rejectWait(error)));
+    });
+}
+export function withAbortAndTimeout(operation, controller, timeoutMs, label) {
+    if (controller.signal.aborted)
+        return Promise.reject(controller.signal.reason);
+    return new Promise((resolveOperation, rejectOperation) => {
+        let settled = false;
+        const settle = (task) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            controller.signal.removeEventListener("abort", onAbort);
+            task();
+        };
+        const onAbort = () => settle(() => rejectOperation(controller.signal.reason instanceof Error
+            ? controller.signal.reason
+            : new Error(`${label} aborted`)));
+        const timer = setTimeout(() => {
+            const error = Object.assign(new Error(`${label} timed out after ${timeoutMs / 1000}s`), {
+                code: "setup_timeout",
+            });
+            controller.abort(error);
+        }, timeoutMs);
+        timer.unref();
+        controller.signal.addEventListener("abort", onAbort, { once: true });
+        operation().then((value) => settle(() => resolveOperation(value)), (error) => settle(() => rejectOperation(error)));
+    });
+}
+export function processGroupFromJob(job) {
+    if (!job.execution)
+        return null;
+    try {
+        return parseProcessGroupHandle(job.execution.processGroup);
+    }
+    catch {
+        return null;
+    }
+}
+export function stateMatchesDurableExecution(job, state) {
+    return (job.execution?.executionId === state.executionId &&
+        job.execution.commandDigest === state.commandDigest &&
+        job.execution.manifestDigest === state.manifestDigest &&
+        job.execution.observedAt === state.observedAt &&
+        JSON.stringify(job.execution.processGroup) === JSON.stringify(state.processGroup));
+}
+export function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+//# sourceMappingURL=setup-job-support.js.map

package/dist/setup-job-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-job-support.js","sourceRoot":"","sources":["../src/setup-job-support.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,uBAAuB,GAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAMrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC;AAO5C,MAAM,CAAC,MAAM,cAAc,GAAqD;IAC9E,KAAK,EAAE;QACL,QAAQ,EAAE,2CAA2C;QACrD,IAAI,EAAE,mIAAmI;KAC1I;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,gDAAgD;QAC1D,IAAI,EAAE,yIAAyI;KAChJ;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,yDAAyD;QACnE,IAAI,EAAE,mDAAmD;KAC1D;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAmC,EACnC,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,YAAY,OAAO,kFAAkF,CACtG,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACzE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAC1E,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0BAA0B,SAAS,kBAAkB,OAAO,oFAAoF,CACjJ,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,SAAS,eAAe,CAAC,EAAE;YAC9E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACnD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,uBAAuB,SAAS,QAAQ,OAAO,CAAC,eAAe,uFAAuF,CACvJ,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GACb,OAAO,KAAK,QAAQ;QAClB,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC5D,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,kBAAkB,CAChC,UAA2D;IAM3D,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACzE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAC1E,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,sBAAsB;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO,OAAO,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,YAAoB,MAAM,CAAC,IAAI,CAAC,GAAG,EACnC,aAAwC,UAAU;IAElD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAU,EACV,UAA2B,EAC3B,KAAoC;IAEpC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,GAAG,EAAE,CACV,UAAU,CACR,UAAU,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK;YACvC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM;YAC1B,CAAC,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CACzC,CACF,CAAC;QACJ,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CACZ,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACzB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAA2B,EAC3B,UAA2B,EAC3B,SAAiB,EACjB,KAAa;IAEb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,EAAE;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,GAAG,EAAE,CACV,eAAe,CACb,UAAU,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK;YACvC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM;YAC1B,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,CAAC,CAClC,CACF,CAAC;QACJ,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,SAAS,GAAG,IAAI,GAAG,CAAC,EAAE;gBACtF,IAAI,EAAE,eAAe;aACtB,CAAC,CAAC;YACH,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC,IAAI,CACd,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAChD,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,GAAoB,EACpB,KAA4B;IAE5B,OAAO,CACL,GAAG,CAAC,SAAS,EAAE,WAAW,KAAK,KAAK,CAAC,WAAW;QAChD,GAAG,CAAC,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QACnD,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACrD,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAC7C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC"}