@claudexor/core 3.2.1 → 3.3.7-rc.0

package/dist/auth-capability-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-capability-verifier.d.ts","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAgBA,OAAO,EAML,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,WAAW,EAChB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMpE,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,aAAa,EAAE,eAAe,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,yBAAyB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IAM/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACmB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,EACpE,IAAI,GAAE,0BAA+B,EAOtC;IAED,MAAM,CAAC,YAAY,CACjB,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,0BAA+B,GACpC,sBAAsB,CAExB;IAED,UAAU,CACR,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,eAAe,EAC9B,cAAc,EAAE,cAAc,GAC7B,uBAAuB,CAczB;IAED,OAAO,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAiB5E;IAEK,MAAM,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA0P3F;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAgB/B;IAED,OAAO,CAAC,aAAa;CAYtB"}
+{"version":3,"file":"auth-capability-verifier.d.ts","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAgBA,OAAO,EAML,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,WAAW,EAChB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMpE,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,aAAa,EAAE,eAAe,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,yBAAyB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IAM/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACmB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,EACpE,IAAI,GAAE,0BAA+B,EAOtC;IAED,MAAM,CAAC,YAAY,CACjB,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,0BAA+B,GACpC,sBAAsB,CAExB;IAED,UAAU,CACR,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,eAAe,EAC9B,cAAc,EAAE,cAAc,GAC7B,uBAAuB,CAczB;IAED,OAAO,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAiB5E;IAEK,MAAM,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA6P3F;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAgB/B;IAED,OAAO,CAAC,aAAa;CAYtB"}

package/dist/auth-capability-verifier.js

@@ -132,6 +132,9 @@ export class AuthCapabilityVerifier {
                     env: {},
                     attachments: [],
                     browser: null,
+                    // The auth smoke is not a delegated run and gets no boundary; stated
+                    // rather than defaulted, so a new spec site cannot omit it silently.
+                    confinement: null,
                     extra_mcp_servers: [],
                     stream_deltas: false,
                     extra: request.abortSignal ? { abortSignal: request.abortSignal } : {},

package/dist/auth-capability-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-capability-verifier.js","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,cAAc,IAAI,oBAAoB,GAQvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA0BrC;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAMd,OAAO;IALT,GAAG,CAAa;IAChB,SAAS,CAAe;IACxB,WAAW,CAAS;IAErC,YACmB,OAAmD,EACpE,IAAI,GAA+B,EAAE;uBADpB,OAAO;QAGxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,UAAU,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,OAAO,CACxB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,QAAyB,EACzB,IAAI,GAA+B,EAAE;QAErC,OAAO,IAAI,sBAAsB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,UAAU,CACR,OAAe,EACf,SAAsB,EACtB,aAA8B,EAC9B,cAA8B;QAE9B,OAAO,mBAAmB,CAAC,KAAK,CAAC;YAC/B,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,OAAO;YACP,SAAS;YACT,aAAa;YACb,cAAc;YACd,YAAY,EAAE,uBAAuB;YACrC,gBAAgB,EAAE,SAAS;YAC3B,wBAAwB,EAAE,SAAS;YACnC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,OAAyC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAChC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe;gBACf,aAAa,EAAE,uBAAuB,CAAC,UAAU,EAAE,eAAe,CAAC;gBACnE,UAAU;aACX,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA0C;QACrD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC;YAC5C,OAAO,CAAC,aAAa,KAAK,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,SAAS,GAA2B,IAAI,CAAC;QAC7C,IAAI,eAAe,GAA0B,IAAI,CAAC;QAClD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;QACtD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,eAAe,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,mBAAmB,GAAG,eAAe,CAAC;QAC1C,IAAI,kBAAkB,GAAG,eAAe,CAAC;QACzC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,GAAG,IAAI,CAAC;gBACrB,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa;gBAAE,cAAc,GAAG,IAAI,CAAC;YACtD,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACjD,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,uBAAuB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpD,mBAAmB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC;oBACtC,UAAU,EAAE,cAAc,OAAO,CAAC,SAAS,EAAE;oBAC7C,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,kBAAkB,QAAQ,wCAAwC;oBAC1E,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,UAAU;oBAClB,uBAAuB,EAAE,KAAK;oBAC9B,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC3D,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,UAAU,CAAC,SAAS;oBACrC,qEAAqE;oBACrE,gEAAgE;oBAChE,kBAAkB,EAAE,IAAI;oBACxB,iBAAiB,EAAE,IAAI;oBACvB,eAAe,EAAE,OAAO;oBACxB,eAAe,EAAE,aAAa;oBAC9B,GAAG,EAAE,EAAE;oBACP,WAAW,EAAE,EAAE;oBACf,OAAO,EAAE,IAAI;oBACb,iBAAiB,EAAE,EAAE;oBACrB,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;iBAC9C,CAAC,CAAC;gBAC5B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACtC,UAAU,CAAC,MAAM,CACf,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,UAAU;wBACzB,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;wBACrC,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;wBACvC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;wBAC/B,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;qBACjE,CAAC,CACH,CAAC;oBACF,IAAI,YAAY;wBAAE,oBAAoB,IAAI,CAAC,CAAC;oBAC5C,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;wBACzC,qBAAqB,IAAI,CAAC,CAAC;wBAC3B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;wBACvC,SAAS;oBACX,CAAC;oBACD,IAAI,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;wBAAE,iBAAiB,GAAG,IAAI,CAAC;oBAC9E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;wBACnB,KAAK,SAAS;4BACZ,aAAa,IAAI,CAAC,CAAC;4BACnB,IAAI,aAAa,KAAK,CAAC,IAAI,YAAY;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BAClE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;4BAC9B,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gCAC3B,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,gBAAgB;oCAAE,aAAa,GAAG,IAAI,CAAC;gCAC5E,SAAS,KAAK,KAAK,CAAC,gBAAgB,CAAC;gCACrC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;4BAC7D,CAAC;4BACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gCAC5B,IAAI,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,iBAAiB;oCAChE,cAAc,GAAG,IAAI,CAAC;gCACxB,eAAe,KAAK,KAAK,CAAC,iBAAiB,CAAC;gCAC5C,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;4BAC/D,CAAC;4BACD,MAAM;wBACR,KAAK,SAAS,EAAE,CAAC;4BACf,+DAA+D;4BAC/D,8DAA8D;4BAC9D,gDAAgD;4BAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;4BAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gCACzB,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;oCACtD,kBAAkB,GAAG,IAAI,CAAC;oCAC1B,MAAM;gCACR,CAAC;gCACD,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC;4BAChC,CAAC;4BACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BACtB,MAAM;wBACR,CAAC;wBACD,KAAK,OAAO;4BACV,WAAW,IAAI,CAAC,CAAC;4BACjB,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;4BAC5B,MAAM;wBACR,KAAK,uBAAuB;4BAC1B,iBAAiB,IAAI,CAAC,CAAC;4BACvB,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;4BAC7C,MAAM;wBACR,KAAK,WAAW,CAAC;wBACjB,KAAK,aAAa,CAAC;wBACnB,KAAK,aAAa;4BAChB,oBAAoB,IAAI,CAAC,CAAC;4BAC1B,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;4BAC/C,MAAM;wBACR,KAAK,WAAW;4BACd,eAAe,IAAI,CAAC,CAAC;4BACrB,YAAY,GAAG,IAAI,CAAC;4BACpB,IAAI,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BACrE,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;4BACrC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;4BAChC,MAAM;wBACR;4BACE,MAAM;oBACV,CAAC;gBACH,CAAC;gBACD,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;gBACpD,aAAa,GAAG,CAAC,SAAS,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,kBAAkB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;oBACpD,CAAC;oBAAC,MAAM,CAAC;wBACP,kBAAkB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,kBAAkB,CAAC;QAClE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,YAAY,EAAE,CAAC,CAAC;QAC9C,IAAI,eAA6D,CAAC;QAClE,IAAI,eAAe;YAAE,eAAe,GAAG,kBAAkB,CAAC;aACrD,IAAI,uBAAuB;YAAE,eAAe,GAAG,2BAA2B,CAAC;aAC3E,IAAI,cAAc;YAAE,eAAe,GAAG,qBAAqB,CAAC;aAC5D,IAAI,SAAS;YAAE,eAAe,GAAG,WAAW,CAAC;aAC7C,IAAI,aAAa;YAAE,eAAe,GAAG,eAAe,CAAC;aACrD,IAAI,aAAa,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI;YAAE,eAAe,GAAG,eAAe,CAAC;aACjF,IAAI,aAAa,IAAI,SAAS,KAAK,UAAU,CAAC,aAAa;YAC9D,eAAe,GAAG,gBAAgB,CAAC;aAChC,IAAI,eAAe,KAAK,IAAI;YAAE,eAAe,GAAG,gBAAgB,CAAC;aACjE,IAAI,cAAc,IAAI,eAAe,KAAK,UAAU,CAAC,cAAc;YACtE,eAAe,GAAG,iBAAiB,CAAC;aACjC,IACH,iBAAiB;YACjB,aAAa,KAAK,CAAC;YACnB,eAAe,GAAG,CAAC;YACnB,oBAAoB,GAAG,CAAC;YAExB,eAAe,GAAG,oBAAoB,CAAC;aACpC,IACH,WAAW,GAAG,CAAC;YACf,oBAAoB,GAAG,CAAC;YACxB,iBAAiB,GAAG,CAAC;YACrB,qBAAqB,GAAG,CAAC;YAEzB,eAAe,GAAG,eAAe,CAAC;aAC/B,IAAI,eAAe,KAAK,CAAC;YAAE,eAAe,GAAG,oBAAoB,CAAC;aAClE,IAAI,mBAAmB,KAAK,kBAAkB;YAAE,eAAe,GAAG,iBAAiB,CAAC;aACpF,IAAI,gBAAgB,IAAI,QAAQ,KAAK,QAAQ;YAAE,eAAe,GAAG,mBAAmB,CAAC;;YACrF,eAAe,GAAG,uBAAuB,CAAC;QAE/C,MAAM,MAAM,GAAG,eAAe,KAAK,uBAAuB,CAAC;QAC3D,OAAO,qBAAqB,CAAC,KAAK,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,SAAS;YACT,eAAe;YACf,eAAe;YACf,YAAY,EACV,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzF,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC1C,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACrC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,YAAY;YACZ,mBAAmB;YACnB,kBAAkB;YAClB,MAAM,EAAE;gBACN,aAAa;gBACb,eAAe;gBACf,WAAW;gBACX,oBAAoB;gBACpB,iBAAiB;gBACjB,qBAAqB;gBACrB,oBAAoB;gBACpB,OAAO,EAAE,SAAS;aACnB;YACD,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IACE,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,aAAa,CAAC,SAAiB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChF,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,gCAAgC,MAAM,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAmC,EACnC,eAAuB;IAEvB,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU;QAClB,qBAAqB,EAAE,KAAK;QAC5B,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,OAAO;QACvB,cAAc,EAAE,aAAa;QAC7B,eAAe;KAChB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACvC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE;gBAC7B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACb,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;wBACrB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC3D,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAmC;IACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"auth-capability-verifier.js","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,cAAc,IAAI,oBAAoB,GAQvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA0BrC;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAMd,OAAO;IALT,GAAG,CAAa;IAChB,SAAS,CAAe;IACxB,WAAW,CAAS;IAErC,YACmB,OAAmD,EACpE,IAAI,GAA+B,EAAE;uBADpB,OAAO;QAGxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,UAAU,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,OAAO,CACxB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,QAAyB,EACzB,IAAI,GAA+B,EAAE;QAErC,OAAO,IAAI,sBAAsB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,UAAU,CACR,OAAe,EACf,SAAsB,EACtB,aAA8B,EAC9B,cAA8B;QAE9B,OAAO,mBAAmB,CAAC,KAAK,CAAC;YAC/B,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,OAAO;YACP,SAAS;YACT,aAAa;YACb,cAAc;YACd,YAAY,EAAE,uBAAuB;YACrC,gBAAgB,EAAE,SAAS;YAC3B,wBAAwB,EAAE,SAAS;YACnC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,OAAyC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAChC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe;gBACf,aAAa,EAAE,uBAAuB,CAAC,UAAU,EAAE,eAAe,CAAC;gBACnE,UAAU;aACX,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA0C;QACrD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC;YAC5C,OAAO,CAAC,aAAa,KAAK,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,SAAS,GAA2B,IAAI,CAAC;QAC7C,IAAI,eAAe,GAA0B,IAAI,CAAC;QAClD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;QACtD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,eAAe,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,mBAAmB,GAAG,eAAe,CAAC;QAC1C,IAAI,kBAAkB,GAAG,eAAe,CAAC;QACzC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,GAAG,IAAI,CAAC;gBACrB,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa;gBAAE,cAAc,GAAG,IAAI,CAAC;YACtD,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACjD,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,uBAAuB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpD,mBAAmB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC;oBACtC,UAAU,EAAE,cAAc,OAAO,CAAC,SAAS,EAAE;oBAC7C,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,kBAAkB,QAAQ,wCAAwC;oBAC1E,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,UAAU;oBAClB,uBAAuB,EAAE,KAAK;oBAC9B,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC3D,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,UAAU,CAAC,SAAS;oBACrC,qEAAqE;oBACrE,gEAAgE;oBAChE,kBAAkB,EAAE,IAAI;oBACxB,iBAAiB,EAAE,IAAI;oBACvB,eAAe,EAAE,OAAO;oBACxB,eAAe,EAAE,aAAa;oBAC9B,GAAG,EAAE,EAAE;oBACP,WAAW,EAAE,EAAE;oBACf,OAAO,EAAE,IAAI;oBACb,qEAAqE;oBACrE,qEAAqE;oBACrE,WAAW,EAAE,IAAI;oBACjB,iBAAiB,EAAE,EAAE;oBACrB,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;iBAC9C,CAAC,CAAC;gBAC5B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACtC,UAAU,CAAC,MAAM,CACf,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,UAAU;wBACzB,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;wBACrC,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;wBACvC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;wBAC/B,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;qBACjE,CAAC,CACH,CAAC;oBACF,IAAI,YAAY;wBAAE,oBAAoB,IAAI,CAAC,CAAC;oBAC5C,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;wBACzC,qBAAqB,IAAI,CAAC,CAAC;wBAC3B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;wBACvC,SAAS;oBACX,CAAC;oBACD,IAAI,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;wBAAE,iBAAiB,GAAG,IAAI,CAAC;oBAC9E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;wBACnB,KAAK,SAAS;4BACZ,aAAa,IAAI,CAAC,CAAC;4BACnB,IAAI,aAAa,KAAK,CAAC,IAAI,YAAY;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BAClE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;4BAC9B,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gCAC3B,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,gBAAgB;oCAAE,aAAa,GAAG,IAAI,CAAC;gCAC5E,SAAS,KAAK,KAAK,CAAC,gBAAgB,CAAC;gCACrC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;4BAC7D,CAAC;4BACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gCAC5B,IAAI,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,iBAAiB;oCAChE,cAAc,GAAG,IAAI,CAAC;gCACxB,eAAe,KAAK,KAAK,CAAC,iBAAiB,CAAC;gCAC5C,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;4BAC/D,CAAC;4BACD,MAAM;wBACR,KAAK,SAAS,EAAE,CAAC;4BACf,+DAA+D;4BAC/D,8DAA8D;4BAC9D,gDAAgD;4BAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;4BAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gCACzB,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;oCACtD,kBAAkB,GAAG,IAAI,CAAC;oCAC1B,MAAM;gCACR,CAAC;gCACD,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC;4BAChC,CAAC;4BACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BACtB,MAAM;wBACR,CAAC;wBACD,KAAK,OAAO;4BACV,WAAW,IAAI,CAAC,CAAC;4BACjB,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;4BAC5B,MAAM;wBACR,KAAK,uBAAuB;4BAC1B,iBAAiB,IAAI,CAAC,CAAC;4BACvB,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;4BAC7C,MAAM;wBACR,KAAK,WAAW,CAAC;wBACjB,KAAK,aAAa,CAAC;wBACnB,KAAK,aAAa;4BAChB,oBAAoB,IAAI,CAAC,CAAC;4BAC1B,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;4BAC/C,MAAM;wBACR,KAAK,WAAW;4BACd,eAAe,IAAI,CAAC,CAAC;4BACrB,YAAY,GAAG,IAAI,CAAC;4BACpB,IAAI,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BACrE,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;4BACrC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;4BAChC,MAAM;wBACR;4BACE,MAAM;oBACV,CAAC;gBACH,CAAC;gBACD,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;gBACpD,aAAa,GAAG,CAAC,SAAS,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,kBAAkB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;oBACpD,CAAC;oBAAC,MAAM,CAAC;wBACP,kBAAkB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,kBAAkB,CAAC;QAClE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,YAAY,EAAE,CAAC,CAAC;QAC9C,IAAI,eAA6D,CAAC;QAClE,IAAI,eAAe;YAAE,eAAe,GAAG,kBAAkB,CAAC;aACrD,IAAI,uBAAuB;YAAE,eAAe,GAAG,2BAA2B,CAAC;aAC3E,IAAI,cAAc;YAAE,eAAe,GAAG,qBAAqB,CAAC;aAC5D,IAAI,SAAS;YAAE,eAAe,GAAG,WAAW,CAAC;aAC7C,IAAI,aAAa;YAAE,eAAe,GAAG,eAAe,CAAC;aACrD,IAAI,aAAa,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI;YAAE,eAAe,GAAG,eAAe,CAAC;aACjF,IAAI,aAAa,IAAI,SAAS,KAAK,UAAU,CAAC,aAAa;YAC9D,eAAe,GAAG,gBAAgB,CAAC;aAChC,IAAI,eAAe,KAAK,IAAI;YAAE,eAAe,GAAG,gBAAgB,CAAC;aACjE,IAAI,cAAc,IAAI,eAAe,KAAK,UAAU,CAAC,cAAc;YACtE,eAAe,GAAG,iBAAiB,CAAC;aACjC,IACH,iBAAiB;YACjB,aAAa,KAAK,CAAC;YACnB,eAAe,GAAG,CAAC;YACnB,oBAAoB,GAAG,CAAC;YAExB,eAAe,GAAG,oBAAoB,CAAC;aACpC,IACH,WAAW,GAAG,CAAC;YACf,oBAAoB,GAAG,CAAC;YACxB,iBAAiB,GAAG,CAAC;YACrB,qBAAqB,GAAG,CAAC;YAEzB,eAAe,GAAG,eAAe,CAAC;aAC/B,IAAI,eAAe,KAAK,CAAC;YAAE,eAAe,GAAG,oBAAoB,CAAC;aAClE,IAAI,mBAAmB,KAAK,kBAAkB;YAAE,eAAe,GAAG,iBAAiB,CAAC;aACpF,IAAI,gBAAgB,IAAI,QAAQ,KAAK,QAAQ;YAAE,eAAe,GAAG,mBAAmB,CAAC;;YACrF,eAAe,GAAG,uBAAuB,CAAC;QAE/C,MAAM,MAAM,GAAG,eAAe,KAAK,uBAAuB,CAAC;QAC3D,OAAO,qBAAqB,CAAC,KAAK,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,SAAS;YACT,eAAe;YACf,eAAe;YACf,YAAY,EACV,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzF,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC1C,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACrC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,YAAY;YACZ,mBAAmB;YACnB,kBAAkB;YAClB,MAAM,EAAE;gBACN,aAAa;gBACb,eAAe;gBACf,WAAW;gBACX,oBAAoB;gBACpB,iBAAiB;gBACjB,qBAAqB;gBACrB,oBAAoB;gBACpB,OAAO,EAAE,SAAS;aACnB;YACD,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IACE,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,aAAa,CAAC,SAAiB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChF,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,gCAAgC,MAAM,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAmC,EACnC,eAAuB;IAEvB,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU;QAClB,qBAAqB,EAAE,KAAK;QAC5B,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,OAAO;QACvB,cAAc,EAAE,aAAa;QAC7B,eAAe;KAChB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACvC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE;gBAC7B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACb,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;wBACrB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC3D,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAmC;IACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}

package/dist/confinement.d.ts

@@ -0,0 +1,73 @@
+import type { HarnessConfinement } from "@claudexor/schema";
+export interface ConfinementInput {
+    /** The operator's REAL home — the thing the child must not be able to mine. */
+    operatorHome: string;
+    /** Claudexor's runtime tree: daemon token/socket, trust, every project's state. */
+    runtimeRoot: string;
+    /** Vendor credential state the harness itself authenticates out of (§8 carve-out). */
+    nativeStateRoot: string;
+    /** This attempt's scoped HOME. */
+    scopedHome: string;
+    /** This attempt's worktree (its cwd). */
+    worktree: string;
+    /** Scratch root the toolchain writes to; defaults to the process TMPDIR. */
+    tmpDir?: string;
+}
+/**
+ * The host the boundary is being applied ON. Injectable so the platform
+ * branches are TESTABLE without booting that platform: the availability probe
+ * and every exec go through here.
+ */
+export interface ConfinementHost {
+    platform: NodeJS.Platform;
+    exists(path: string): boolean;
+    run(bin: string, args: readonly string[]): {
+        status: number | null;
+        stderr?: string;
+    };
+}
+/**
+ * The paths this profile must make unreadable. Also the probe surface: the
+ * boundary is verified by trying to read the FIRST of them.
+ */
+export declare function confinementDeniedReadPaths(input: ConfinementInput): string[];
+/** Kept for the seam tests and the docs: the macOS policy text for one attempt. */
+export declare function buildConfinementProfile(input: ConfinementInput): string;
+/**
+ * The one question a caller outside this file may ask about the host.
+ *
+ * Deliberately NOT "which mechanism": the routing decision that depends on this
+ * — whether to tell the adapter to stand its own sandbox down — turns on
+ * whether Claudexor will actually provide a boundary, never on which one or on
+ * the platform's name.
+ */
+export declare function confinementBoundaryAvailable(host?: ConfinementHost): {
+    available: boolean;
+    reason: string | null;
+};
+/** What one attempt's boundary turned out to be: applied, or absent and why. */
+export interface ConfinementOutcome {
+    /** The APPLIED boundary, or null when this host has none. */
+    confinement: HarnessConfinement | null;
+    /** Why no boundary was applied; null exactly when one was. */
+    unavailableReason: string | null;
+}
+/**
+ * Build, verify and describe the boundary for one attempt.
+ *
+ * Degrades HONESTLY where the platform offers nothing — the run proceeds and
+ * the outcome carries the reason, which the caller writes onto the attempt,
+ * into the child's prompt and into its own result. It never degrades SILENTLY,
+ * and it never names a mechanism it did not just prove on this host.
+ *
+ * Still refuses for the two conditions that are Claudexor's own fault rather
+ * than the platform's: an allowed root that swallows a denied one, and a policy
+ * that a working mechanism failed to enforce for this attempt.
+ */
+export declare function applyConfinement(input: ConfinementInput, host?: ConfinementHost): ConfinementOutcome;
+/** Rewrite an argv so the child (and every descendant) starts inside the boundary. */
+export declare function confinedInvocation(confinement: HarnessConfinement | null | undefined, bin: string, args: readonly string[]): {
+    bin: string;
+    args: string[];
+};
+//# sourceMappingURL=confinement.d.ts.map

package/dist/confinement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confinement.d.ts","sourceRoot":"","sources":["../src/confinement.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AA+C5D,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,eAAe,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvF;AAuDD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQ5E;AAiDD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAEvE;AAyED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,eAA8B,GAAG;IAClF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAGA;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,gBAAgB,EACvB,IAAI,GAAE,eAA8B,GACnC,kBAAkB,CAkCpB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAClD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWjC"}

package/dist/confinement.js

@@ -0,0 +1,255 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { sensitiveResourcePolicy, sha256 } from "@claudexor/util";
+import { ConfinementUnavailableError } from "./errors.js";
+/**
+ * OS-enforced filesystem confinement for a delegated harness process.
+ *
+ * WHY THIS IS NOT AN ENV VAR. A scoped `HOME` redirects `~`-relative lookups
+ * and nothing else; `/Users/<op>/.claudexor/v3/daemon/token` — a bearer for the
+ * whole control API — stays one absolute path away. The threat model, the
+ * live reproduction and the list of what this does NOT cover are in
+ * docs/DELEGATED_CONFINEMENT.md; keep them in step with this file.
+ *
+ * WHY THE HARNESS SANDBOX STANDS DOWN. macOS refuses `sandbox_apply` inside an
+ * already-restricted process (measured: any deny clause in the outer profile is
+ * enough), and codex shells out to `/usr/bin/sandbox-exec` for its own
+ * workspace-write sandbox. An outer boundary and the harness's own are
+ * mutually exclusive, so the engine states `external_sandbox_full` — the
+ * access profile that already means "I am providing the sandbox" — and each
+ * adapter maps that onto its own switch. No harness name is branched on. That
+ * stand-down is spent ONLY where a boundary was actually proven available: a
+ * host with none keeps whatever enforcement the harness brings itself.
+ *
+ * WHERE THERE IS NO BOUNDARY — every platform but macOS, by owner decision, and
+ * a macOS host missing `sandbox-exec`. The run still runs, on the scoped `HOME`
+ * alone. It does not pretend: the absence and its reason are recorded on the
+ * attempt, told to the child, and returned to the caller. Refusing instead would
+ * make "delegated" a macOS-only feature; claiming a boundary we did not prove
+ * would be worse than having none, so the type below cannot express a mechanism
+ * name without the path it was proven to deny.
+ */
+const SEATBELT_BIN = "/usr/bin/sandbox-exec";
+/** System prefixes a workspace-scoped run has no business writing to. */
+const SYSTEM_WRITE_DENY = [
+    "/usr",
+    "/opt",
+    "/Library",
+    "/Applications",
+    "/System",
+    "/bin",
+    "/sbin",
+    "/etc",
+    "/var",
+];
+const DEFAULT_HOST = {
+    platform: process.platform,
+    exists: existsSync,
+    run: (bin, args) => spawnSync(bin, [...args], { encoding: "utf8", timeout: 15_000 }),
+};
+/**
+ * Seatbelt matches RESOLVED paths (`/tmp` is `/private/tmp`), so a profile
+ * written against the symlinked spelling silently allows what it names.
+ * Resolution falls back to the literal for a path that does not exist yet —
+ * a deny on a not-yet-created path is still worth emitting.
+ */
+function resolved(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch {
+        return path;
+    }
+}
+/** Whether `root` is `path` or an ancestor of it, after resolution. */
+function contains(root, path) {
+    const rel = relative(resolved(root), resolved(path));
+    return rel === "" || (!rel.startsWith("..") && !rel.startsWith(sep) && !/^[A-Za-z]:/.test(rel));
+}
+function subpath(paths) {
+    return paths.map((path) => `(subpath ${JSON.stringify(resolved(path))})`).join(" ");
+}
+/**
+ * The paths this profile must make unreadable. Also the probe surface: the
+ * boundary is verified by trying to read the FIRST of them.
+ */
+export function confinementDeniedReadPaths(input) {
+    return [
+        join(input.runtimeRoot, "daemon"),
+        input.runtimeRoot,
+        ...sensitiveResourcePolicy
+            .homeRelativeCredentialEntries()
+            .map((entry) => join(input.operatorHome, entry)),
+    ];
+}
+/** The run's own roots: allowed, and the reason the deny set needs carve-outs. */
+function ownRoots(input) {
+    return [input.scopedHome, input.worktree, input.nativeStateRoot];
+}
+/** macOS: kernel-enforced per-path denial for the process and every descendant. */
+const SEATBELT = {
+    id: "seatbelt",
+    platform: "darwin",
+    bins: [SEATBELT_BIN],
+    /** SBPL text. Last match wins, so the carve-outs follow the denies. */
+    buildProfile(input) {
+        const scratch = input.tmpDir ?? process.env.TMPDIR ?? "/tmp";
+        // SBPL is last-match-wins, and the order below is the policy. The scratch
+        // allow sits ABOVE the operator-home deny on purpose: a `TMPDIR` configured
+        // inside `$HOME` would otherwise re-open the whole home for writing. The run's
+        // own roots come last because they outrank every deny above them, including
+        // the case where the worktree lives inside the operator's home (isolation:
+        // live, which is exactly the delegated shape).
+        return [
+            "(version 1)",
+            "(allow default)",
+            `(deny file-read* ${subpath(confinementDeniedReadPaths(input))})`,
+            `(deny file-write* ${subpath([...SYSTEM_WRITE_DENY])})`,
+            `(allow file-write* ${subpath([scratch, "/tmp"])})`,
+            `(deny file-write* ${subpath([input.operatorHome])})`,
+            `(allow file-read* file-write* ${subpath(ownRoots(input))})`,
+            "",
+        ].join("\n");
+    },
+    invocation(profile, bin, args) {
+        return { bin: SEATBELT_BIN, args: ["-p", profile, bin, ...args] };
+    },
+};
+/**
+ * The registry. ONE mechanism today, by owner decision: Seatbelt on macOS, and
+ * NO kernel boundary anywhere else. Linux bubblewrap/Landlock and a Windows
+ * equivalent were considered and declined — see docs/DELEGATED_CONFINEMENT.md §6.
+ * Non-macOS is served by the scoped HOME plus a disclosed, typed absence, which
+ * is what the rest of this file and the delegated terminal are shaped around.
+ *
+ * The list stays a list because the mechanism id is OPAQUE end to end: the only
+ * place a name selects behaviour is the lookup in `confinedInvocation`.
+ */
+const MECHANISMS = [SEATBELT];
+/** Kept for the seam tests and the docs: the macOS policy text for one attempt. */
+export function buildConfinementProfile(input) {
+    return SEATBELT.buildProfile(input, SEATBELT_BIN);
+}
+/** Read `probePath` from inside the policy, the way the harness child would. */
+function readUnder(mechanism, profile, probePath, host) {
+    const invocation = mechanism.invocation(profile, "/bin/ls", [probePath]);
+    return host.run(invocation.bin, invocation.args);
+}
+/**
+ * Prove the policy denies, on THIS host, before anything runs under it.
+ *
+ * Returns the reason it could NOT be proven, or null when it was. A policy that
+ * fails to compile, or that a future OS quietly stops enforcing, would
+ * otherwise produce a run that reports `confined` and is not.
+ */
+function proveConfinementDenial(mechanism, profile, probePath, host) {
+    // CONTROL first. A probe path that is simply absent fails the confined read
+    // for the wrong reason, and the policy would be "proven" by an ENOENT.
+    if (host.run("/bin/ls", [probePath]).status !== 0) {
+        return `the probe path ${probePath} is not readable even unconfined, so a denial there proves nothing`;
+    }
+    const probe = readUnder(mechanism, profile, probePath, host);
+    if (probe.status === 0)
+        return `${probePath} stayed readable under the ${mechanism.id} policy`;
+    if (probe.status === null) {
+        const detail = probe.stderr ? ` (${probe.stderr.trim().slice(0, 200)})` : "";
+        return `the ${mechanism.id} probe did not complete${detail}`;
+    }
+    return null;
+}
+/**
+ * Whether an OS-enforced boundary exists on this host, and which one.
+ *
+ * A platform with no mechanism is a DECISION, not a gap to be discovered at
+ * spawn time, so the answer is a stated reason rather than a throw. Nothing here
+ * hunts for a boundary the owner declined to build: the question is only whether
+ * THIS platform's declared mechanism is present.
+ */
+function confinementMechanism(host) {
+    const mechanism = MECHANISMS.find((candidate) => candidate.platform === host.platform);
+    if (!mechanism) {
+        return {
+            mechanism: null,
+            bin: null,
+            reason: `Claudexor applies no OS-enforced filesystem boundary on ${host.platform}; only macOS has one`,
+        };
+    }
+    const bin = mechanism.bins.find((candidate) => host.exists(candidate));
+    if (!bin) {
+        return {
+            mechanism: null,
+            bin: null,
+            reason: `${host.platform} enforces a boundary with ${mechanism.id}, which is not installed here (looked for ${mechanism.bins.join(", ")})`,
+        };
+    }
+    return { mechanism, bin, reason: null };
+}
+/**
+ * The one question a caller outside this file may ask about the host.
+ *
+ * Deliberately NOT "which mechanism": the routing decision that depends on this
+ * — whether to tell the adapter to stand its own sandbox down — turns on
+ * whether Claudexor will actually provide a boundary, never on which one or on
+ * the platform's name.
+ */
+export function confinementBoundaryAvailable(host = DEFAULT_HOST) {
+    const availability = confinementMechanism(host);
+    return { available: availability.mechanism !== null, reason: availability.reason };
+}
+/**
+ * Build, verify and describe the boundary for one attempt.
+ *
+ * Degrades HONESTLY where the platform offers nothing — the run proceeds and
+ * the outcome carries the reason, which the caller writes onto the attempt,
+ * into the child's prompt and into its own result. It never degrades SILENTLY,
+ * and it never names a mechanism it did not just prove on this host.
+ *
+ * Still refuses for the two conditions that are Claudexor's own fault rather
+ * than the platform's: an allowed root that swallows a denied one, and a policy
+ * that a working mechanism failed to enforce for this attempt.
+ */
+export function applyConfinement(input, host = DEFAULT_HOST) {
+    const available = confinementMechanism(host);
+    if (!available.mechanism)
+        return { confinement: null, unavailableReason: available.reason };
+    const denied = confinementDeniedReadPaths(input);
+    // The carve-outs re-open whatever they contain, so an "own root" that CONTAINS
+    // a denied path silently defeats the policy. Refuse rather than emit one that
+    // reads like a boundary and is not.
+    const swallowed = ownRoots(input).find((root) => denied.some((path) => path !== root && contains(root, path)));
+    if (swallowed) {
+        throw new ConfinementUnavailableError(`filesystem confinement would be self-defeating: the allowed root ${swallowed} contains a path the policy must deny`);
+    }
+    const profile = available.mechanism.buildProfile(input, available.bin);
+    const probeCandidate = denied.find((path) => host.exists(path));
+    if (!probeCandidate) {
+        throw new ConfinementUnavailableError("filesystem confinement could not be verified: none of the denied paths exists on this host, so the policy cannot be proven to deny anything");
+    }
+    const probePath = resolved(probeCandidate);
+    const why = proveConfinementDenial(available.mechanism, profile, probePath, host);
+    if (why)
+        throw new ConfinementUnavailableError(`filesystem confinement failed: ${why}`);
+    return {
+        confinement: {
+            mechanism: available.mechanism.id,
+            profile,
+            profile_digest: sha256(profile),
+            verified_denied_path: probePath,
+        },
+        unavailableReason: null,
+    };
+}
+/** Rewrite an argv so the child (and every descendant) starts inside the boundary. */
+export function confinedInvocation(confinement, bin, args) {
+    if (!confinement)
+        return { bin, args: [...args] };
+    const mechanism = MECHANISMS.find((candidate) => candidate.id === confinement.mechanism);
+    if (!mechanism) {
+        // The record names a boundary this engine cannot apply. Spawning unwrapped
+        // would run the child outside the boundary its own record claims.
+        throw new ConfinementUnavailableError(`the attempt records confinement mechanism '${confinement.mechanism}', which this engine cannot apply`);
+    }
+    return mechanism.invocation(confinement.profile, bin, args);
+}
+//# sourceMappingURL=confinement.js.map

package/dist/confinement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confinement.js","sourceRoot":"","sources":["../src/confinement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,yEAAyE;AACzE,MAAM,iBAAiB,GAAG;IACxB,MAAM;IACN,MAAM;IACN,UAAU;IACV,eAAe;IACf,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;CACE,CAAC;AA4BX,MAAM,YAAY,GAAoB;IACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;CACrF,CAAC;AAyBF;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB;IACvC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAuB;IAChE,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC;QACjC,KAAK,CAAC,WAAW;QACjB,GAAG,uBAAuB;aACvB,6BAA6B,EAAE;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,KAAuB;IACvC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;AACnE,CAAC;AAED,mFAAmF;AACnF,MAAM,QAAQ,GAAyB;IACrC,EAAE,EAAE,UAAU;IACd,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,CAAC,YAAY,CAAC;IACpB,uEAAuE;IACvE,YAAY,CAAC,KAAK;QAChB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;QAC7D,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,+CAA+C;QAC/C,OAAO;YACL,aAAa;YACb,iBAAiB;YACjB,oBAAoB,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,GAAG;YACjE,qBAAqB,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,GAAG;YACvD,sBAAsB,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG;YACnD,qBAAqB,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG;YACrD,iCAAiC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG;YAC5D,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI;QAC3B,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAoC,CAAC,QAAQ,CAAC,CAAC;AAE/D,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,KAAuB;IAC7D,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAChB,SAA+B,EAC/B,OAAe,EACf,SAAiB,EACjB,IAAqB;IAErB,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,SAA+B,EAC/B,OAAe,EACf,SAAiB,EACjB,IAAqB;IAErB,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,kBAAkB,SAAS,oEAAoE,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,SAAS,8BAA8B,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,OAAO,SAAS,CAAC,EAAE,0BAA0B,MAAM,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAqB;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,2DAA2D,IAAI,CAAC,QAAQ,sBAAsB;SACvG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,6BAA6B,SAAS,CAAC,EAAE,6CAA6C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC3I,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAI,GAAoB,YAAY;IAI/E,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,KAAK,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAuB,EACvB,IAAI,GAAoB,YAAY;IAEpC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC5F,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACjD,+EAA+E;IAC/E,8EAA8E;IAC9E,oCAAoC;IACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC7D,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,2BAA2B,CACnC,oEAAoE,SAAS,uCAAuC,CACrH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,2BAA2B,CACnC,6IAA6I,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,sBAAsB,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,GAAG;QAAE,MAAM,IAAI,2BAA2B,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IACxF,OAAO;QACL,WAAW,EAAE;YACX,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE;YACjC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;YAC/B,oBAAoB,EAAE,SAAS;SAChC;QACD,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAChC,WAAkD,EAClD,GAAW,EACX,IAAuB;IAEvB,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,WAAW,CAAC,SAAS,CAAC,CAAC;IACzF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,IAAI,2BAA2B,CACnC,8CAA8C,WAAW,CAAC,SAAS,mCAAmC,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC"}

package/dist/errors.d.ts

@@ -23,4 +23,35 @@ export declare class DelegationBeltUnavailableError extends ClaudexorError {
     readonly code = "delegation_belt_unavailable";
     readonly status = 503;
 }
+/**
+ * A run marked `execution.delegated` could not be confined to a scoped harness
+ * HOME. Its caller cannot audit a confinement that silently did not happen, so
+ * the attempt refuses instead of degrading onto the operator's real home (which
+ * holds the daemon control token and the caller's own provider settings).
+ */
+export declare class DelegatedHomeUnavailableError extends ClaudexorError {
+    readonly code = "delegated_home_unavailable";
+    readonly category: "internal";
+}
+/**
+ * A run marked `execution.delegated` could not be given an OS-ENFORCED
+ * filesystem boundary — the host does not offer one, or the profile did not
+ * take effect when probed. The scoped HOME beside it is a convention that an
+ * absolute path defeats, so there is nothing to degrade onto: the attempt
+ * refuses. See docs/DELEGATED_CONFINEMENT.md.
+ */
+export declare class ConfinementUnavailableError extends ClaudexorError {
+    readonly code = "delegated_confinement_unavailable";
+    readonly category: "config_error";
+}
+/**
+ * A terminal MUTATING delegated run whose attempts do not all carry the applied
+ * HOME/access/profile/confinement facts. Asking for confinement is not evidence
+ * that it happened, so an unauditable mutating terminal is an infrastructure
+ * refusal rather than a pass.
+ */
+export declare class DelegatedEvidenceIncompleteError extends ClaudexorError {
+    readonly code = "delegated_evidence_incomplete";
+    readonly category: "internal";
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,qBAAa,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,qBAAa,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,qBAAa,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,MAAM,OAAO;CACvB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,qBAAa,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,qBAAa,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,qBAAa,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,MAAM,OAAO;CACvB;AAED;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,cAAc;IAC/D,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;CACzC;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,cAAc;IAC7D,QAAQ,CAAC,IAAI,uCAAuC;IACpD,QAAQ,CAAC,QAAQ,EAAG,cAAc,CAAU;CAC7C;AAED;;;;;GAKG;AACH,qBAAa,gCAAiC,SAAQ,cAAc;IAClE,QAAQ,CAAC,IAAI,mCAAmC;IAChD,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;CACzC"}

package/dist/errors.js

@@ -24,4 +24,35 @@ export class DelegationBeltUnavailableError extends ClaudexorError {
     code = "delegation_belt_unavailable";
     status = 503;
 }
+/**
+ * A run marked `execution.delegated` could not be confined to a scoped harness
+ * HOME. Its caller cannot audit a confinement that silently did not happen, so
+ * the attempt refuses instead of degrading onto the operator's real home (which
+ * holds the daemon control token and the caller's own provider settings).
+ */
+export class DelegatedHomeUnavailableError extends ClaudexorError {
+    code = "delegated_home_unavailable";
+    category = "internal";
+}
+/**
+ * A run marked `execution.delegated` could not be given an OS-ENFORCED
+ * filesystem boundary — the host does not offer one, or the profile did not
+ * take effect when probed. The scoped HOME beside it is a convention that an
+ * absolute path defeats, so there is nothing to degrade onto: the attempt
+ * refuses. See docs/DELEGATED_CONFINEMENT.md.
+ */
+export class ConfinementUnavailableError extends ClaudexorError {
+    code = "delegated_confinement_unavailable";
+    category = "config_error";
+}
+/**
+ * A terminal MUTATING delegated run whose attempts do not all carry the applied
+ * HOME/access/profile/confinement facts. Asking for confinement is not evidence
+ * that it happened, so an unauditable mutating terminal is an infrastructure
+ * refusal rather than a pass.
+ */
+export class DelegatedEvidenceIncompleteError extends ClaudexorError {
+    code = "delegated_evidence_incomplete";
+    category = "internal";
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,MAAM,OAAO,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,MAAM,OAAO,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IACvD,IAAI,GAAG,6BAA6B,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC;CACvB"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,MAAM,OAAO,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,MAAM,OAAO,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IACvD,IAAI,GAAG,6BAA6B,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,OAAO,6BAA8B,SAAQ,cAAc;IACtD,IAAI,GAAG,4BAA4B,CAAC;IACpC,QAAQ,GAAG,UAAmB,CAAC;CACzC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA4B,SAAQ,cAAc;IACpD,IAAI,GAAG,mCAAmC,CAAC;IAC3C,QAAQ,GAAG,cAAuB,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,OAAO,gCAAiC,SAAQ,cAAc;IACzD,IAAI,GAAG,+BAA+B,CAAC;IACvC,QAAQ,GAAG,UAAmB,CAAC;CACzC"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./errors.js";
 export * from "./adapter.js";
+export * from "./confinement.js";
 export * from "./attachment-integrity.js";
 export * from "./effort.js";
 export * from "./model.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 export * from "./errors.js";
 export * from "./adapter.js";
+export * from "./confinement.js";
 export * from "./attachment-integrity.js";
 export * from "./effort.js";
 export * from "./model.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC"}

package/dist/runloop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runloop.d.ts","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAwB/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,GAAG,SAAS,CAOjF;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;IAChF,4EAA4E;IAC5E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;QACnC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,KAAK,cAAc,CAAC,YAAY,CAAC,CAAC;QACvE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;KAC1C,CAAC;IACF;;iCAE6B;IAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;CACjF;AAED,wBAAuB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAAC,YAAY,CAAC,CA4K1F"}
+{"version":3,"file":"runloop.d.ts","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAwB/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,GAAG,SAAS,CAOjF;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;IAChF,4EAA4E;IAC5E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;QACnC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,KAAK,cAAc,CAAC,YAAY,CAAC,CAAC;QACvE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;KAC1C,CAAC;IACF;;iCAE6B;IAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;CACjF;AAED,wBAAuB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAAC,YAAY,CAAC,CAiL1F"}

package/dist/runloop.js

@@ -1,3 +1,4 @@
+import { confinedInvocation } from "./confinement.js";
 import { spawnProcess } from "./proc.js";
 /**
  * Shared CLI adapter run loop.
@@ -48,8 +49,13 @@ export async function* runCliHarness(opts) {
     // Box the stdin handle: it is assigned inside the onSpawn callback, which
     // TypeScript's control-flow narrowing cannot see through a plain let.
     const session = { io: null };
+    // The OS boundary is applied HERE, at the one seam every local-CLI adapter
+    // already funnels through, rather than in each adapter's argv builder: an
+    // adapter that forgot to opt in would run a delegated child unconfined while
+    // the run record still said it asked for confinement.
+    const invocation = confinedInvocation(spec.confinement, opts.bin, opts.args);
     try {
-        for await (const ev of spawnProcess(opts.bin, opts.args, {
+        for await (const ev of spawnProcess(invocation.bin, invocation.args, {
             cwd: spec.cwd,
             env: opts.env,
             inheritEnv: spec.env_inheritance,

package/dist/runloop.js.map

@@ -1 +1 @@
-{"version":3,"file":"runloop.js","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAmB,MAAM,WAAW,CAAC;AAG1D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,SAAS,GAAG,MAA8B,CAAC;IACjD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,gBAAgB,KAAK,UAAU;QAC/F,CAAC,CAAE,MAAsB;QACzB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAyCD,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,aAAa,CAAC,IAAuB;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,yBAAyB,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,iFAAiF;IACjF,IAAI,sBAAsB,GAGf,IAAI,CAAC;IAChB,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhG,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAA8B,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,wBAAwB,EAAE,CAAC,IAAI,EAAE,EAAE;gBACjC,sBAAsB,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpF,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC;oBACE,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE,CAAC,EAAc,EAAE,EAAE;wBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;wBAChB,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY;4BAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBACtE,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,EAAE,CAAC;YACH,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;gBACnB,UAAU,GAAG,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBAC1C,yEAAyE;gBACzE,oEAAoE;gBACpE,sBAAsB,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;gBAChF,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;wBAAE,QAAQ,GAAG,IAAI,CAAC;oBAC1C,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,kEAAkE;gBAClE,gEAAgE;gBAChE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,yBAAyB,IAAI,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;oBAAE,QAAQ,GAAG,IAAI,CAAC;gBAC1C,MAAM,GAAG,CAAC;gBACV,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,IAAI;gBAAE,MAAM;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,IAAI,CAAC;QAChB,WAAW,GAAG,IAAI,CAAC;QACnB,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAClB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,kFAAkF;IAClF,iFAAiF;IACjF,0EAA0E;IAC1E,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,kDAAkD,sBAAsB,CAAC,SAAS,CAAC,MAAM,sBACtG,sBAAsB,CAAC,UAAU,CAAC,MAAM;gBACtC,CAAC,CAAC,KAAK,sBAAsB,CAAC,UAAU,CAAC,MAAM,oCAAoC;gBACnF,CAAC,CAAC,EACN,EAAE;SACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;YACxE,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;SACzE,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,yBAAyB,UAAU,EAAE;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,oBAAoB,GAAG,CAAC;QAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,oBAAoB,CAAC;IACvF,IAAI,yBAAyB,GAAG,CAAC;QAC/B,OAAO,CAAC,6BAA6B,CAAC,GAAG,yBAAyB,CAAC;IACrE,IAAI,OAAO;QAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;IACvD,iFAAiF;IACjF,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,CAAC,yBAAyB,CAAC,GAAG;YACnC,SAAS,EAAE,sBAAsB,CAAC,SAAS;YAC3C,UAAU,EAAE,sBAAsB,CAAC,UAAU;SAC9C,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,qEAAqE;IACrE,IAAI,CAAC,OAAO,IAAI,UAAU;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC;IAChE,IAAI,WAAW;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;IAChD,MAAM;QACJ,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,EAAE,EAAE,EAAE,EAAE;QACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runloop.js","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAmB,MAAM,WAAW,CAAC;AAG1D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,SAAS,GAAG,MAA8B,CAAC;IACjD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,gBAAgB,KAAK,UAAU;QAC/F,CAAC,CAAE,MAAsB;QACzB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAyCD,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,aAAa,CAAC,IAAuB;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,yBAAyB,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,iFAAiF;IACjF,IAAI,sBAAsB,GAGf,IAAI,CAAC;IAChB,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhG,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAA8B,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE;YACnE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,wBAAwB,EAAE,CAAC,IAAI,EAAE,EAAE;gBACjC,sBAAsB,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpF,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC;oBACE,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE,CAAC,EAAc,EAAE,EAAE;wBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;wBAChB,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY;4BAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBACtE,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,EAAE,CAAC;YACH,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;gBACnB,UAAU,GAAG,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBAC1C,yEAAyE;gBACzE,oEAAoE;gBACpE,sBAAsB,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;gBAChF,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;wBAAE,QAAQ,GAAG,IAAI,CAAC;oBAC1C,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,kEAAkE;gBAClE,gEAAgE;gBAChE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,yBAAyB,IAAI,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;oBAAE,QAAQ,GAAG,IAAI,CAAC;gBAC1C,MAAM,GAAG,CAAC;gBACV,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,IAAI;gBAAE,MAAM;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,IAAI,CAAC;QAChB,WAAW,GAAG,IAAI,CAAC;QACnB,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAClB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,kFAAkF;IAClF,iFAAiF;IACjF,0EAA0E;IAC1E,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,kDAAkD,sBAAsB,CAAC,SAAS,CAAC,MAAM,sBACtG,sBAAsB,CAAC,UAAU,CAAC,MAAM;gBACtC,CAAC,CAAC,KAAK,sBAAsB,CAAC,UAAU,CAAC,MAAM,oCAAoC;gBACnF,CAAC,CAAC,EACN,EAAE;SACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;YACxE,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;SACzE,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,yBAAyB,UAAU,EAAE;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,oBAAoB,GAAG,CAAC;QAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,oBAAoB,CAAC;IACvF,IAAI,yBAAyB,GAAG,CAAC;QAC/B,OAAO,CAAC,6BAA6B,CAAC,GAAG,yBAAyB,CAAC;IACrE,IAAI,OAAO;QAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;IACvD,iFAAiF;IACjF,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,CAAC,yBAAyB,CAAC,GAAG;YACnC,SAAS,EAAE,sBAAsB,CAAC,SAAS;YAC3C,UAAU,EAAE,sBAAsB,CAAC,UAAU;SAC9C,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,qEAAqE;IACrE,IAAI,CAAC,OAAO,IAAI,UAAU;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC;IAChE,IAAI,WAAW;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;IAChD,MAAM;QACJ,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,EAAE,EAAE,EAAE,EAAE;QACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudexor/core",
-  "version": "3.2.1",
+  "version": "3.3.7-rc.0",
   "license": "MIT",
   "description": "HarnessAdapter contract, process helpers, typed errors, and low-level execution utilities.",
   "type": "module",
@@ -20,8 +20,8 @@
   ],
   "dependencies": {
     "@playwright/mcp": "0.0.78",
-    "@claudexor/util": "3.2.1",
-    "@claudexor/schema": "3.2.1"
+    "@claudexor/schema": "3.3.7-rc.0",
+    "@claudexor/util": "3.3.7-rc.0"
   },
   "repository": {
     "type": "git",