@claudexor/harness-agy 3.6.0 → 3.8.1

package/dist/keychain.js

@@ -0,0 +1,354 @@
+import { execFileSync } from "node:child_process";
+import { closeSync, constants, fchmodSync, fstatSync, linkSync, lstatSync, openSync, realpathSync, unlinkSync, } from "node:fs";
+import { join, resolve } from "node:path";
+import { canonicalIsolationLocator } from "@claudexor/core";
+import { ensureCanonicalPrivateDirectory, redactSecrets } from "@claudexor/util";
+const SECURITY_BINARY = "/usr/bin/security";
+const SECURITY_TIMEOUT_MS = 5_000;
+const configuredKeychains = new Set();
+/**
+ * Typed, bounded setup result. `unsafe` means the profile path or target
+ * identity is not proven and callers must refuse the vendor child; a false
+ * value is a recoverable security-tool miss where agy's file fallback may
+ * still keep authentication working.
+ */
+export class AgyProfileKeychainError extends Error {
+    code = "agy_profile_keychain_unavailable";
+    unsafe;
+    constructor(detail, options = {}) {
+        super(`agy profile keychain setup failed: ${redactSecrets(detail).slice(0, 300)}`);
+        this.name = "AgyProfileKeychainError";
+        this.unsafe = options.unsafe === true;
+    }
+}
+export function isAgyProfileKeychainUnsafe(error) {
+    return error instanceof AgyProfileKeychainError && error.unsafe;
+}
+/** The only keychain path agy may use for one named profile. */
+export function agyProfileKeychainPath(profileHome) {
+    const home = canonicalIsolationLocator(profileHome, "credential profile Antigravity HOME");
+    return join(home, "Library", "Keychains", "login.keychain-db");
+}
+/**
+ * Prepare the private Darwin keychain declared by the agy capability profile.
+ * Other platforms deliberately do nothing: Linux and Windows retain their
+ * vendor-owned credential behavior. The helper never reads, copies, or
+ * removes credential items; agy itself remains the only item owner. Creation
+ * uses a neutral bootstrap filename before adopting login.keychain-db because
+ * Apple's create operation treats the latter name as a user-list entry on the
+ * supported Darwin path.
+ */
+export function prepareAgyProfileKeychain(profileHome, options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "darwin")
+        return;
+    ensureAgyProfileKeychain(profileHome, { ...options, platform });
+}
+/**
+ * Low-level Darwin ensure used by the adapter's production seams and tests.
+ * The caller has already established that this is the private agy route.
+ */
+export function ensureAgyProfileKeychain(profileHome, options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "darwin")
+        return;
+    let home;
+    let keychain;
+    try {
+        home = canonicalIsolationLocator(profileHome, "credential profile Antigravity HOME");
+        keychain = agyProfileKeychainPath(home);
+    }
+    catch (error) {
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+    try {
+        try {
+            ensureOwnedDirectory(home, platform);
+            ensureOwnedDirectory(join(home, "Library"), platform);
+            ensureOwnedDirectory(join(home, "Library", "Keychains"), platform);
+        }
+        catch (error) {
+            throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+                unsafe: true,
+            });
+        }
+        let exists = validateKeychainFile(keychain, home, false);
+        const runSecurity = options.runSecurity ?? defaultSecurityRunner;
+        const env = securityEnv(home);
+        if (!exists) {
+            const bootstrap = temporaryKeychainPath(join(home, "Library", "Keychains"));
+            if (bootstrap.includes("/login.keychain")) {
+                throw new AgyProfileKeychainError("profile keychain path would match Apple's login-keychain search-list heuristic", { unsafe: true });
+            }
+            const bootstrapExists = validateKeychainFile(bootstrap, home, false);
+            const created = bootstrapExists
+                ? { status: 48, detail: "bootstrap keychain already exists" }
+                : runSecurity(["create-keychain", "-p", "", bootstrap], env);
+            const canonicalAfterCreate = validateKeychainFile(keychain, home, false);
+            if (!canonicalAfterCreate) {
+                let bootstrapReady = false;
+                if (created.status !== 0) {
+                    // A concurrent process may have won creation with a
+                    // platform-specific already-exists status. Revalidation, not a
+                    // numeric status guess, is the idempotence authority.
+                    try {
+                        validateKeychainFile(bootstrap, home, true);
+                        bootstrapReady = true;
+                    }
+                    catch (error) {
+                        // A peer can adopt and remove the bootstrap file between our
+                        // status check and this validation. Recheck the canonical winner
+                        // only for that missing-file race; identity failures remain hard
+                        // refusals.
+                        if (pathIsMissing(bootstrap) && validateKeychainFile(keychain, home, false)) {
+                            exists = true;
+                        }
+                        else {
+                            // A failed create with no usable target is unsafe: spawning agy
+                            // would return to the missing-keychain prompt. Explicit security
+                            // errors remain recoverable only when a valid file exists.
+                            if (error instanceof AgyProfileKeychainError)
+                                throw error;
+                            throw new AgyProfileKeychainError(created.detail ?? "create-keychain failed", {
+                                unsafe: true,
+                            });
+                        }
+                    }
+                }
+                else {
+                    validateKeychainFile(bootstrap, home, true);
+                    bootstrapReady = true;
+                }
+                if (bootstrapReady) {
+                    adoptBootstrapKeychain(bootstrap, keychain, home);
+                    exists = true;
+                }
+            }
+            else {
+                // Another process completed the canonical rename while this process
+                // was creating its neutral bootstrap file. The neutral file is ours;
+                // remove it only after the canonical target is identity-checked.
+                removeBootstrapKeychain(bootstrap, home);
+                exists = true;
+            }
+            configuredKeychains.delete(keychain);
+        }
+        let unlockedBeforeSettings = false;
+        if (!configuredKeychains.has(keychain)) {
+            const unlocked = runSecurity(["unlock-keychain", "-p", "", keychain], env);
+            if (unlocked.status !== 0) {
+                throw new AgyProfileKeychainError(unlocked.detail ?? "unlock-keychain failed");
+            }
+            unlockedBeforeSettings = true;
+            const settings = runSecurity(["set-keychain-settings", keychain], env);
+            if (settings.status !== 0) {
+                throw new AgyProfileKeychainError(settings.detail ?? "set-keychain-settings failed");
+            }
+            configuredKeychains.add(keychain);
+        }
+        // A login keychain can still be locked by sleep, logout, or an explicit
+        // user action. Re-open it at every vendor-spawn boundary; the first-call
+        // unlock above also makes set-keychain-settings safe on a locked file.
+        if (!unlockedBeforeSettings) {
+            const unlocked = runSecurity(["unlock-keychain", "-p", "", keychain], env);
+            if (unlocked.status !== 0) {
+                throw new AgyProfileKeychainError(unlocked.detail ?? "unlock-keychain failed");
+            }
+        }
+        validateKeychainFile(keychain, home, true);
+    }
+    catch (error) {
+        configuredKeychains.delete(keychain);
+        if (error instanceof AgyProfileKeychainError)
+            throw error;
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+}
+function securityEnv(home) {
+    return {
+        HOME: home,
+        USERPROFILE: home,
+        PATH: "/usr/bin:/bin",
+        ...(process.env.TMPDIR ? { TMPDIR: process.env.TMPDIR } : {}),
+        ...(process.env.LANG ? { LANG: process.env.LANG } : {}),
+        ...(process.env.LC_ALL ? { LC_ALL: process.env.LC_ALL } : {}),
+    };
+}
+function defaultSecurityRunner(args, env) {
+    try {
+        execFileSync(SECURITY_BINARY, [...args], {
+            env,
+            stdio: "ignore",
+            timeout: SECURITY_TIMEOUT_MS,
+            windowsHide: true,
+        });
+        return { status: 0 };
+    }
+    catch (error) {
+        const status = typeof error === "object" && error !== null && "status" in error
+            ? error.status
+            : null;
+        return {
+            status: typeof status === "number" ? status : null,
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+function ensureOwnedDirectory(path, platform) {
+    try {
+        ensureCanonicalPrivateDirectory(path, platform);
+    }
+    catch (error) {
+        if (!(error instanceof Error) || !/EEXIST|already exists/i.test(error.message))
+            throw error;
+        // Another process won the mkdir race. Re-run the full identity proof.
+        ensureCanonicalPrivateDirectory(path, platform);
+    }
+}
+function temporaryKeychainPath(directory) {
+    // Keep one deterministic neutral name so a crash between create and adopt
+    // is recoverable on the next preparation rather than accumulating orphan
+    // keychain databases. It deliberately does not contain "login.keychain",
+    // the Apple Security heuristic that updates the user search list.
+    return join(directory, ".agy-profile-bootstrap.keychain-db");
+}
+/**
+ * Install the neutral-name keychain without calling a user-domain list
+ * mutation. A hard link gives us an atomic no-replace destination on the
+ * same APFS directory; the source is then removed, so the vendor sees one
+ * canonical login.keychain-db path and no bootstrap alias remains.
+ */
+function adoptBootstrapKeychain(source, destination, home) {
+    try {
+        linkSync(source, destination);
+    }
+    catch (error) {
+        if (isAlreadyExists(error)) {
+            validateKeychainFile(destination, home, true);
+            removeBootstrapKeychain(source, home);
+            return;
+        }
+        if (isMissing(error) && validateKeychainFile(destination, home, false)) {
+            // A peer may have adopted and removed the bootstrap between our
+            // identity check and this no-replace link. The canonical winner is
+            // authoritative; do not turn that benign race into a profile refusal.
+            return;
+        }
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+    try {
+        unlinkSync(source);
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            validateKeychainFile(destination, home, true);
+            return;
+        }
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+    validateKeychainFile(destination, home, true);
+}
+function removeBootstrapKeychain(path, home) {
+    let exists = false;
+    try {
+        exists = validateKeychainFile(path, home, false);
+    }
+    catch (error) {
+        if (error instanceof AgyProfileKeychainError)
+            throw error;
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+    if (!exists)
+        return;
+    try {
+        unlinkSync(path);
+    }
+    catch (error) {
+        if (isMissing(error))
+            return;
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+}
+function validateKeychainFile(path, home, required) {
+    const absolute = resolve(path);
+    let named;
+    try {
+        named = lstatSync(absolute);
+    }
+    catch (error) {
+        if (!required && isMissing(error))
+            return false;
+        throw new AgyProfileKeychainError("private keychain path is missing or unreadable", {
+            unsafe: true,
+        });
+    }
+    if (named.isSymbolicLink() || !named.isFile()) {
+        throw new AgyProfileKeychainError("private keychain path is not a regular file", {
+            unsafe: true,
+        });
+    }
+    let fd;
+    try {
+        fd = openSync(absolute, constants.O_RDWR | constants.O_NOFOLLOW);
+    }
+    catch {
+        throw new AgyProfileKeychainError("private keychain path cannot be opened safely", {
+            unsafe: true,
+        });
+    }
+    try {
+        const opened = fstatSync(fd);
+        const current = lstatSync(absolute);
+        if (!opened.isFile() ||
+            current.isSymbolicLink() ||
+            !current.isFile() ||
+            opened.dev !== current.dev ||
+            opened.ino !== current.ino ||
+            realpathSync.native(absolute) !== absolute ||
+            (typeof process.getuid === "function" && opened.uid !== process.getuid()) ||
+            !absolute.startsWith(resolve(home) + "/")) {
+            throw new AgyProfileKeychainError("private keychain identity is not canonical", {
+                unsafe: true,
+            });
+        }
+        fchmodSync(fd, 0o600);
+    }
+    finally {
+        closeSync(fd);
+    }
+    return true;
+}
+function isMissing(error) {
+    return typeof error === "object" && error !== null && "code" in error
+        ? error.code === "ENOENT"
+        : false;
+}
+function pathIsMissing(path) {
+    try {
+        lstatSync(path);
+        return false;
+    }
+    catch (error) {
+        if (isMissing(error))
+            return true;
+        throw error;
+    }
+}
+function isAlreadyExists(error) {
+    return typeof error === "object" && error !== null && "code" in error
+        ? error.code === "EEXIST"
+        : false;
+}
+//# sourceMappingURL=keychain.js.map

package/dist/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,+BAA+B,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEjF,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAiB9C;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,kCAA2C,CAAC;IACnD,MAAM,CAAU;IAEzB,YAAY,MAAc,EAAE,OAAO,GAAyB,EAAE;QAC5D,KAAK,CAAC,sCAAsC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IACxC,CAAC;CACF;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,OAAO,KAAK,YAAY,uBAAuB,IAAI,KAAK,CAAC,MAAM,CAAC;AAClE,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,MAAM,IAAI,GAAG,yBAAyB,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAmB,EACnB,OAAO,GAAuB,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAClC,wBAAwB,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,OAAO,GAAuB,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAElC,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,yBAAyB,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;QACrF,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACrC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;YACtD,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACxF,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;QACjE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5E,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,uBAAuB,CAC/B,gFAAgF,EAChF,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;YACJ,CAAC;YACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,eAAe;gBAC7B,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE;gBAC7D,CAAC,CAAC,WAAW,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACzE,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;gBAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,oDAAoD;oBACpD,+DAA+D;oBAC/D,sDAAsD;oBACtD,IAAI,CAAC;wBACH,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;wBAC5C,cAAc,GAAG,IAAI,CAAC;oBACxB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,6DAA6D;wBAC7D,iEAAiE;wBACjE,iEAAiE;wBACjE,YAAY;wBACZ,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;4BAC5E,MAAM,GAAG,IAAI,CAAC;wBAChB,CAAC;6BAAM,CAAC;4BACN,gEAAgE;4BAChE,iEAAiE;4BACjE,2DAA2D;4BAC3D,IAAI,KAAK,YAAY,uBAAuB;gCAAE,MAAM,KAAK,CAAC;4BAC1D,MAAM,IAAI,uBAAuB,CAAC,OAAO,CAAC,MAAM,IAAI,wBAAwB,EAAE;gCAC5E,MAAM,EAAE,IAAI;6BACb,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC5C,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;gBACD,IAAI,cAAc,EAAE,CAAC;oBACnB,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAClD,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,oEAAoE;gBACpE,qEAAqE;gBACrE,iEAAiE;gBACjE,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACzC,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YACD,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,sBAAsB,GAAG,KAAK,CAAC;QACnC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAC;YACjF,CAAC;YACD,sBAAsB,GAAG,IAAI,CAAC;YAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,uBAAuB,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,IAAI,8BAA8B,CAAC,CAAC;YACvF,CAAC;YACD,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO;QACL,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI;QACjB,IAAI,EAAE,eAAe;QACrB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB,EAAE,GAAsB;IAC5E,IAAI,CAAC;QACH,YAAY,CAAC,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACvC,GAAG;YACH,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK;YAC9D,CAAC,CAAE,KAA8B,CAAC,MAAM;YACxC,CAAC,CAAC,IAAI,CAAC;QACX,OAAO;YACL,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAClD,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAAyB;IACnE,IAAI,CAAC;QACH,+BAA+B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5F,sEAAsE;QACtE,+BAA+B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,kEAAkE;IAClE,OAAO,IAAI,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAY;IAC/E,IAAI,CAAC;QACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACvE,gEAAgE;YAChE,mEAAmE;YACnE,sEAAsE;YACtE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,IAAY;IACzD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO;QAC7B,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,IAAY,EAAE,QAAiB;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,EAAE;YAClF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,EAAE;YAC/E,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,+CAA+C,EAAE;YACjF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;YAChB,OAAO,CAAC,cAAc,EAAE;YACxB,CAAC,OAAO,CAAC,MAAM,EAAE;YACjB,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;YAC1B,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;YAC1B,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;YAC1C,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACzE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACzC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,EAAE;gBAC9E,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QACD,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAE,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACjD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAE,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACjD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC"}

package/dist/print-command.d.ts

@@ -0,0 +1,64 @@
+import { spawn, type SpawnOptionsWithoutStdio } from "node:child_process";
+import { reapProcessTree } from "@claudexor/core";
+export declare const AGY_PRINT_TIMEOUT_MS = 30000;
+export declare const AGY_PRINT_STREAM_LIMIT_BYTES: number;
+type EnvMap = Record<string, string | null | undefined>;
+export type AgyPrintFailureReason = "spawn_failed" | "timed_out" | "aborted" | "output_overflow" | "termination_unconfirmed";
+export type AgyPrintCommandResult = {
+    kind: "completed";
+    code: number | null;
+    signal: NodeJS.Signals | null;
+    stdout: string;
+    stderr: string;
+} | {
+    kind: "failed";
+    reason: AgyPrintFailureReason;
+    detail: string;
+    stdout: string;
+    stderr: string;
+};
+export interface AgyPrintCommandOptions {
+    timeoutMs?: number;
+    maxStdoutBytes?: number;
+    maxStderrBytes?: number;
+    abortSignal?: AbortSignal;
+    platform?: NodeJS.Platform;
+    /** Bounded cancellation proof seam; production default is 5 seconds. */
+    cancelDeadlineMs?: number;
+    /** Bounded post-exit pipe drain seam; production default is 200 ms. */
+    drainMs?: number;
+    /** Deterministic binary-resolution seam; production uses the shared exact resolver. */
+    resolveBinary?: (bin: string, env: NodeJS.ProcessEnv, platform: NodeJS.Platform) => string | null;
+    /** Deterministic lifecycle seams. */
+    spawnProcess?: typeof spawn;
+    reap?: typeof reapProcessTree;
+    /** Deterministic passive-registry seam; production uses the shared registry. */
+    processRegistry?: {
+        register(pid: number, command: string): void;
+        unregister(pid: number): void;
+    };
+}
+/** Spawn policy is exported so Windows fixtures can assert no inherited console/stdio. */
+export declare function agyPrintSpawnOptions(platform: NodeJS.Platform, env: NodeJS.ProcessEnv): SpawnOptionsWithoutStdio;
+/**
+ * Bounded print-mode owner for `/model` and `/quota`. The child has no stdin
+ * and no controlling terminal: POSIX starts a new session; Windows uses
+ * DETACHED_PROCESS because CREATE_NO_WINDOW still exposes a windowless
+ * CONIN$. Child exit is completion authority; descendant-held pipes receive
+ * only a bounded drain.
+ */
+export declare function runAgyPrintCommand(bin: string, command: "/model" | "/quota", envPatch: EnvMap, options?: AgyPrintCommandOptions): Promise<AgyPrintCommandResult>;
+export type AgyPrintClassification = {
+    kind: "success";
+    envelope: Record<string, unknown>;
+} | {
+    kind: "unauthenticated";
+    detail: string;
+} | {
+    kind: "probe_failed";
+    detail: string;
+};
+/** Shared exit/envelope/auth classifier for doctor and quota. */
+export declare function classifyAgyPrintResult(result: AgyPrintCommandResult): AgyPrintClassification;
+export {};
+//# sourceMappingURL=print-command.d.ts.map

package/dist/print-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"print-command.d.ts","sourceRoot":"","sources":["../src/print-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAA4B,KAAK,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAGpG,OAAO,EAIL,eAAe,EAMhB,MAAM,iBAAiB,CAAC;AAGzB,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,eAAO,MAAM,4BAA4B,QAAa,CAAC;AAIvD,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAExD,MAAM,MAAM,qBAAqB,GAC/B,cAAc,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,yBAAyB,CAAC;AAE3F,MAAM,MAAM,qBAAqB,GAC7B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,MAAM,GAAG,IAAI,CAAC;IAClG,qCAAqC;IACrC,YAAY,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,CAAC,EAAE,OAAO,eAAe,CAAC;IAC9B,gFAAgF;IAChF,eAAe,CAAC,EAAE;QAChB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,CAAC;CACH;AAED,0FAA0F;AAC1F,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,wBAAwB,CAU1B;AAqED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,QAAQ,GAAG,QAAQ,EAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAgPhC;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAkC7C,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,sBAAsB,CAyC5F"}