@crewhaus/tool-desktop 0.7.0 → 0.8.0

package/dist/paths.js

@@ -11,15 +11,45 @@
 import { lstatSync, readlinkSync, realpathSync } from "node:fs";
 import * as path from "node:path";
 import { CrewhausError } from "@crewhaus/errors";
-/** Raised when a caller-supplied path resolves outside the workspace root. */
+/**
+ * The longest path this resolves, in UTF-16 code units; a longer one is
+ * refused before it is walked. Nothing that long can be opened or created:
+ * PATH_MAX is 1,024 bytes on macOS and 4,096 on Linux, Windows stops at
+ * 32,767 UTF-16 units, and a path's UTF-8 form is never shorter than its
+ * UTF-16 one. The limit is twice that because the part of a path that exists
+ * is itself under PATH_MAX, so the part that does not is over PATH_MAX on its
+ * own: no spelling of the place reaches it, not even one through a symlink
+ * that shortens the part that exists.
+ */
+export const MAX_PATH_CHARS = 2 * (process.platform === "darwin" ? 1_024 : process.platform === "win32" ? 32_767 : 4_096);
+/** A path as a refusal quotes it: whole, unless it is past {@link MAX_PATH_CHARS}. */
+function shownPath(given) {
+    return given.length > MAX_PATH_CHARS ? `${given.slice(0, 64)}…` : given;
+}
+/** Why a path past {@link MAX_PATH_CHARS} is refused: its length and the limit. */
+function tooLong(abs) {
+    return `it is ${abs.length} characters once resolved, over the ${MAX_PATH_CHARS}-character limit: no path that long can be opened or created`;
+}
+/**
+ * Raised when a caller-supplied path resolves outside the workspace root, or
+ * is longer than any path can be.
+ */
 export class ToolPermissionError extends CrewhausError {
     name = "ToolPermissionError";
     toolName;
     path;
-    constructor(toolName, attemptedPath) {
-        super("tool", `tool "${toolName}" rejected path "${attemptedPath}": resolved location escapes the workspace root`);
+    /**
+     * Why, when it is not that the location escapes the workspace root: a path
+     * longer than any path can be. A caller that rewords the refusal says this.
+     */
+    reason;
+    constructor(toolName, attemptedPath, reason) {
+        super("tool", reason === undefined
+            ? `tool "${toolName}" rejected path "${attemptedPath}": resolved location escapes the workspace root`
+            : `tool "${toolName}" rejected path "${shownPath(attemptedPath)}": ${reason}`);
         this.toolName = toolName;
         this.path = attemptedPath;
+        this.reason = reason;
     }
 }
 /** The workspace root, resolved. Every path is contained within it. */
@@ -67,15 +97,7 @@ function nameExists(p) {
 function resolveLocation(target, depth = 0) {
     if (depth > 40)
         throw new Error(`symlink chain at "${target}" is too long to resolve`);
-    let probe = target;
-    const tail = [];
-    while (!nameExists(probe)) {
-        tail.unshift(path.basename(probe));
-        const parent = path.dirname(probe);
-        if (parent === probe)
-            break; // reached the filesystem root
-        probe = parent;
-    }
+    const { probe, tail } = deepestName(target);
     let probeReal;
     try {
         probeReal = realpathSync(probe);
@@ -97,7 +119,41 @@ function resolveLocation(target, depth = 0) {
         const base = realpathSync(path.dirname(probe));
         probeReal = resolveLocation(path.resolve(base, link), depth + 1);
     }
-    return tail.length > 0 ? path.join(probeReal, ...tail) : probeReal;
+    // One string, not one argument per name: Bun's `path.join` keeps only
+    // (argument count mod 65,536) of its arguments.
+    return tail.length > 0 ? path.join(probeReal, tail) : probeReal;
+}
+/**
+ * `target`, an absolute path, split where its deepest prefix that exists as
+ * a NAME ends: that prefix, and the names below it, which do not exist, as
+ * one string ("" when `target` itself exists). This is `path.dirname` and
+ * `path.basename` worked by index on `target` itself: handing them each
+ * shorter prefix in turn copied the rest of the path once per missing name,
+ * the square of a count the caller picks.
+ */
+function deepestName(target) {
+    const top = path.parse(target).root.length;
+    const isSep = (i) => target[i] === "/" || target[i] === path.sep;
+    let probe = target;
+    let start = target.length;
+    let stop = -1;
+    while (!nameExists(probe)) {
+        // `path.basename(probe)` is `target.slice(start, end)`, and
+        // `path.dirname(probe)` is `target.slice(0, up)`.
+        let end = probe.length;
+        while (end > top && isSep(end - 1))
+            end--;
+        if (stop < 0)
+            stop = end;
+        start = end;
+        while (start > top && !isSep(start - 1))
+            start--;
+        const up = start > top ? start - 1 : top;
+        if (up === probe.length)
+            break; // reached the filesystem root
+        probe = target.slice(0, up);
+    }
+    return { probe, tail: stop < 0 ? "" : target.slice(start, stop) };
 }
 export function resolveSafe(toolName, rel, root = workspaceRoot()) {
     const rootResolved = path.resolve(root);
@@ -107,6 +163,9 @@ export function resolveSafe(toolName, rel, root = workspaceRoot()) {
     if (abs !== rootResolved && !abs.startsWith(`${rootResolved}${path.sep}`)) {
         throw new ToolPermissionError(toolName, rel);
     }
+    // Longer than any path can be: refused before the walk below reads it.
+    if (abs.length > MAX_PATH_CHARS)
+        throw new ToolPermissionError(toolName, rel, tooLong(abs));
     let real;
     try {
         const rootReal = realpathSync(rootResolved);

package/dist/run.d.ts

@@ -73,6 +73,13 @@ export type RunResult = {
      */
     readonly stdoutTruncated?: boolean;
     readonly stderrTruncated?: boolean;
+    /**
+     * The output could not be read to its end: the child exited but something
+     * it started kept the pipe open past the drain grace. What arrived is
+     * returned, and `stdoutTruncated` is set too. 0.7.0 replaced such output
+     * with "", a definite-looking empty answer built from nothing.
+     */
+    readonly outputIncomplete?: boolean;
     /** Set when no runner was installed and the real host was not allowed. */
     readonly refused?: boolean;
 };

package/dist/run.js

@@ -45,6 +45,8 @@
  * every use is inside a function body, and breaks the first time either file
  * grows a module-scope constant that reads the other.
  */
+import { constants as osConstants } from "node:os";
+import { spawnBounded } from "@crewhaus/tool-safety/streams";
 /** `PATH` for a child, with a floor so a stripped harness env still spawns. */
 export const FALLBACK_PATH = "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
 /** Grace between the deadline's SIGTERM and the SIGKILL that follows it. */
@@ -349,87 +351,65 @@ export async function runHostCommand(request) {
             refused: true,
         };
     }
-    let proc;
-    try {
-        proc = Bun.spawn([...request.argv], {
-            stdin: request.stdin === undefined ? "ignore" : new TextEncoder().encode(request.stdin),
-            stdout: "pipe",
-            stderr: "pipe",
-            env: childEnv(request.env),
-            ...(request.signal !== undefined ? { signal: request.signal } : {}),
-        });
-    }
-    catch (err) {
+    // Output is capped AS IT ARRIVES (tool-safety's spawnBounded): at most
+    // three bytes a character of the cap are kept per stream (no UTF-16 unit
+    // takes more), and the rest is drained unstored, so the child never
+    // blocks on a full pipe and its exit code stays truthful. 0.7.0 read each
+    // pipe to EOF into memory and cut it afterwards, so memory was bounded by
+    // the child's output, not by the cap: 100 MiB of output with a
+    // 1000-character cap grew the process by about 311 MiB (C163).
+    //
+    // The drain bound is unchanged in intent: `xclip -i` and `wl-copy` leave
+    // a holder with the pipe open, and after `DRAIN_GRACE_MS` reading stops.
+    // A holder that exits normally is never killed (it IS the selection);
+    // the group is killed only at the deadline or on abort.
+    const cap = request.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
+    const run = await spawnBounded({
+        cmd: request.argv,
+        env: childEnv(request.env),
+        ...(request.stdin === undefined ? {} : { stdin: request.stdin }),
+        timeoutMs: request.timeoutMs,
+        maxStdoutBytes: cap * 3,
+        maxStderrBytes: cap * 3,
+        killGraceMs: KILL_GRACE_MS,
+        drainGraceMs: DRAIN_GRACE_MS,
+        ...(request.signal !== undefined ? { signal: request.signal } : {}),
+    });
+    if (run.spawnError !== undefined) {
         // ENOENT means the backend is not installed on this host, which is a
         // DIFFERENT answer from "it ran and told us nothing" — and a different
         // answer again from "it is there and would not start". See
         // `classifySpawnError`.
+        const err = new Error(run.spawnError);
+        if (run.spawnErrorCode !== undefined)
+            err.code = run.spawnErrorCode;
         return classifySpawnError(err);
     }
-    let timedOut = false;
-    const term = setTimeout(() => {
-        timedOut = true;
-        try {
-            proc.kill("SIGTERM");
-        }
-        catch {
-            // Already gone between the timer firing and the signal.
-        }
-    }, request.timeoutMs);
-    const hardKill = setTimeout(() => {
-        try {
-            proc.kill("SIGKILL");
-        }
-        catch {
-            // Already gone.
-        }
-    }, request.timeoutMs + KILL_GRACE_MS);
-    try {
-        // `.catch` is attached HERE and not after the race below: the loser of
-        // the race stays pending, and a stream torn down with a killed process
-        // rejects with nobody listening — an unhandled rejection that takes down
-        // the harness rather than the command that caused it.
-        const stdoutText = new Response(proc.stdout)
-            .text()
-            .catch(() => "");
-        const stderrText = new Response(proc.stderr)
-            .text()
-            .catch(() => "");
-        const code = await proc.exited;
-        let drainTimer;
-        const drainFallback = new Promise((resolve) => {
-            drainTimer = setTimeout(() => resolve(""), DRAIN_GRACE_MS);
-        });
-        try {
-            const [rawOut, rawErr] = await Promise.all([
-                Promise.race([stdoutText, drainFallback]),
-                Promise.race([stderrText, drainFallback]),
-            ]);
-            const cap = request.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
-            const out = capText(rawOut, cap);
-            const err = capText(rawErr, cap);
-            return {
-                code,
-                stdout: out.text,
-                stderr: err.text,
-                timedOut,
-                missing: false,
-                ...(out.truncated ? { stdoutTruncated: true } : {}),
-                ...(err.truncated ? { stderrTruncated: true } : {}),
-            };
-        }
-        finally {
-            // One shared timer, cleared as soon as the race settles: a fresh
-            // `setTimeout` per stream that nobody cancels keeps the event loop
-            // awake for the full grace period after every spawn.
-            if (drainTimer !== undefined)
-                clearTimeout(drainTimer);
-        }
-    }
-    finally {
-        clearTimeout(term);
-        clearTimeout(hardKill);
-    }
+    const out = capText(run.stdout, cap);
+    const err = capText(run.stderr, cap);
+    // Output something the child started kept open past the drain grace is
+    // what ARRIVED, not necessarily all of it: it is returned, flagged, and
+    // never presented as a complete answer. 0.7.0 replaced it with "".
+    const incomplete = !run.outputComplete;
+    return {
+        code: exitCodeOf(run.exitCode, run.signal),
+        stdout: out.text,
+        stderr: err.text,
+        timedOut: run.timedOut,
+        missing: false,
+        ...(out.truncated || run.stdoutTruncated || incomplete ? { stdoutTruncated: true } : {}),
+        ...(err.truncated || run.stderrTruncated ? { stderrTruncated: true } : {}),
+        ...(incomplete ? { outputIncomplete: true } : {}),
+    };
+}
+/** The code `Bun.spawn`'s `exited` gave: the exit status, or 128 + the signal's number. */
+function exitCodeOf(exitCode, signal) {
+    if (exitCode !== null)
+        return exitCode;
+    const number = signal === null
+        ? undefined
+        : osConstants.signals[signal];
+    return number === undefined ? -1 : 128 + number;
 }
 /**
  * Start a child and return its pid without waiting for it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/tool-desktop",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "type": "module",
   "description": "Deterministic access to the operator's desktop: clipboard, notifications, opening a document, printing, windows, presence and sleep — failing closed on a headless host",
   "main": "dist/index.js",
@@ -8,17 +8,19 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.7.0",
-    "@crewhaus/tool-builder": "0.7.0",
-    "@crewhaus/tool-catalog": "0.7.0",
-    "@crewhaus/tool-proc": "0.7.0",
+    "@crewhaus/errors": "0.8.0",
+    "@crewhaus/tool-builder": "0.8.0",
+    "@crewhaus/tool-catalog": "0.8.0",
+    "@crewhaus/tool-proc": "0.8.0",
+    "@crewhaus/tool-safety": "0.8.0",
     "zod": "^3.23.8"
   },
   "devDependencies": {
@@ -42,5 +44,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"],
+  "engines": {
+    "bun": ">=1.3.14"
+  }
 }

package/dist/fixtures.d.ts

@@ -1,84 +0,0 @@
-/**
- * Recorded output, and where each line came from.
- *
- * Nothing in this package's suite asks the machine it runs on. CI is a Linux
- * container with no desktop at all, this was written on macOS, and a parser
- * checked against whatever the test host happens to answer is a parser
- * checked against nothing. So every classifier is fed from here.
- *
- * Each constant says whether it was RECORDED (somebody ran the command and
- * pasted the bytes) or DOCUMENTED (written from the program's source or
- * manual because nobody here has that platform). The distinction is kept
- * deliberately: a documented fixture proves the parser handles the shape it
- * was told about, and claims nothing more.
- */
-/** No X server at all. Exit 1, empty stdout. */
-export declare const XCLIP_NO_DISPLAY_STDERR = "Error: Can't open display: (null)\n";
-/**
- * A reachable display with nothing on the selection. Exit 1, empty stdout —
- * the SAME exit code and the SAME empty stdout as the line above, and the
- * opposite meaning. This pair is why `classifyClipboardRead` reads stderr.
- */
-export declare const XCLIP_EMPTY_SELECTION_STDERR = "Error: target STRING not available\n";
-/** The happy path. */
-export declare const XCLIP_TEXT_STDOUT = "ssh-rsa AAAAB3NzaC1yc2EA... deploy@example\n";
-/** `clipboard info` against an EMPTY pasteboard: empty stdout, exit 0. */
-export declare const CLIPBOARD_INFO_EMPTY_STDOUT = "";
-/**
- * `clipboard info` with a screenshot on the pasteboard: flavour names and
- * byte counts, and no content. This is what tells "empty" from "there is
- * something here pbpaste cannot give you".
- */
-export declare const CLIPBOARD_INFO_IMAGE_STDOUT = "\u00ABclass PNGf\u00BB, 284913, \u00ABclass 8BPS\u00BB, 1049928, TIFF picture, 1063968";
-export declare const NOTIFY_SEND_NO_BUS_STDERR = "Cannot autolaunch D-Bus without X11 $DISPLAY\n";
-/**
- * The argument-injection this package's `--` exists to prevent: with the
- * summary passed as a bare positional, `-u` was consumed as the urgency flag
- * and the body became its argument.
- */
-export declare const NOTIFY_SEND_FLAG_INJECTION_STDERR = "Unknown urgency body specified\n";
-export declare const OSASCRIPT_NO_ACCESSIBILITY_STDERR = "44:87: execution error: System Events got an error: osascript is not allowed assistive access. (-25211)\n";
-/** The OTHER grant, in a different System Settings pane. */
-export declare const OSASCRIPT_NO_AUTOMATION_STDERR = "48:52: execution error: Not authorized to send Apple events to System Events. (-1743)\n";
-/**
- * `wmctrl -l -G -p -x`. Nine fixed columns then a title with spaces in it;
- * the second row's title repeats a column's text on purpose, because a parser
- * that re-joins the split fields gets that one wrong.
- */
-export declare const WMCTRL_STDOUT: string;
-/**
- * `ioreg -r -c IOHIDSystem -d 1`. NANOSECONDS: 3_254_341_351_000 ns is 3254
- * seconds. Reading it as milliseconds would report 3254 seconds of idleness
- * as three, and make a locked machine look freshly used.
- *
- * The `-r` matters as much as the unit. `ioreg -c IOHIDSystem -d 1` — the
- * form the survey sketch gave — prints this key NOWHERE on this OS version,
- * because without `-r` the depth is measured from the root.
- */
-export declare const IOREG_HIDIDLE_STDOUT: string;
-/** The same machine, `ioreg -n Root -d1`, with the screen locked. */
-export declare const IOREG_ROOT_LOCKED_STDOUT: string;
-/** An unlocked console, same keys. */
-export declare const IOREG_ROOT_UNLOCKED_STDOUT: string;
-/** A macOS version that reports lock state somewhere this parser cannot see. */
-export declare const IOREG_ROOT_NO_LOCK_KEY_STDOUT = "      \"IORegistryPlanes\" = {\"IOService\"=\"IOService\"}";
-/** DOCUMENTED: `loginctl show-session self -p LockedHint -p Type -p Active`. */
-export declare const LOGINCTL_STDOUT = "LockedHint=no\nType=x11\nActive=yes\n";
-/** DOCUMENTED: the Windows presence script's two lines. */
-export declare const WINDOWS_PRESENCE_STDOUT = "idleMs=42000\nlocked=no\n";
-/**
- * `lpstat -p -d`, verbatim. Two printers in two DIFFERENT sentence shapes,
- * an INDENTED continuation line that belongs to the row above it, and the
- * default-destination line.
- */
-export declare const LPSTAT_STDOUT: string;
-/**
- * A host whose scheduler is down. It lists NOTHING, which reads exactly like
- * a host with no printers — the rule-6 case this fixture exists for.
- */
-export declare const LPSTAT_NO_SCHEDULER_STDERR = "lpstat: Scheduler is not running.\n";
-/** DOCUMENTED: `lp` answers with prose and the job id is inside it. */
-export declare const LP_REQUEST_ID_STDOUT = "request id is Canon_MX490_series-34 (1 file(s))\n";
-export declare const PS_CAFFEINATE_STDOUT = "caffeinate -i -m -t 1800\n";
-/** The same pid, now owned by something else entirely. */
-export declare const PS_REUSED_PID_STDOUT = "/usr/sbin/cupsd -l\n";

package/dist/fixtures.js

@@ -1,130 +0,0 @@
-/**
- * Recorded output, and where each line came from.
- *
- * Nothing in this package's suite asks the machine it runs on. CI is a Linux
- * container with no desktop at all, this was written on macOS, and a parser
- * checked against whatever the test host happens to answer is a parser
- * checked against nothing. So every classifier is fed from here.
- *
- * Each constant says whether it was RECORDED (somebody ran the command and
- * pasted the bytes) or DOCUMENTED (written from the program's source or
- * manual because nobody here has that platform). The distinction is kept
- * deliberately: a documented fixture proves the parser handles the shape it
- * was told about, and claims nothing more.
- */
-// ---------------------------------------------------------------------------
-// clipboard — Linux, RECORDED on Debian 12 / xclip 0.13
-// ---------------------------------------------------------------------------
-/** No X server at all. Exit 1, empty stdout. */
-export const XCLIP_NO_DISPLAY_STDERR = "Error: Can't open display: (null)\n";
-/**
- * A reachable display with nothing on the selection. Exit 1, empty stdout —
- * the SAME exit code and the SAME empty stdout as the line above, and the
- * opposite meaning. This pair is why `classifyClipboardRead` reads stderr.
- */
-export const XCLIP_EMPTY_SELECTION_STDERR = "Error: target STRING not available\n";
-/** The happy path. */
-export const XCLIP_TEXT_STDOUT = "ssh-rsa AAAAB3NzaC1yc2EA... deploy@example\n";
-// ---------------------------------------------------------------------------
-// clipboard — macOS, RECORDED on macOS 26.6.2
-// ---------------------------------------------------------------------------
-/** `clipboard info` against an EMPTY pasteboard: empty stdout, exit 0. */
-export const CLIPBOARD_INFO_EMPTY_STDOUT = "";
-/**
- * `clipboard info` with a screenshot on the pasteboard: flavour names and
- * byte counts, and no content. This is what tells "empty" from "there is
- * something here pbpaste cannot give you".
- */
-export const CLIPBOARD_INFO_IMAGE_STDOUT = "«class PNGf», 284913, «class 8BPS», 1049928, TIFF picture, 1063968";
-// ---------------------------------------------------------------------------
-// notifications — Linux, RECORDED on Debian 12 / libnotify 0.8.1
-// ---------------------------------------------------------------------------
-export const NOTIFY_SEND_NO_BUS_STDERR = "Cannot autolaunch D-Bus without X11 $DISPLAY\n";
-/**
- * The argument-injection this package's `--` exists to prevent: with the
- * summary passed as a bare positional, `-u` was consumed as the urgency flag
- * and the body became its argument.
- */
-export const NOTIFY_SEND_FLAG_INJECTION_STDERR = "Unknown urgency body specified\n";
-// ---------------------------------------------------------------------------
-// AppleScript — RECORDED on macOS 26.6.2 with Accessibility NOT granted
-// ---------------------------------------------------------------------------
-export const OSASCRIPT_NO_ACCESSIBILITY_STDERR = "44:87: execution error: System Events got an error: osascript is not allowed assistive access. (-25211)\n";
-/** The OTHER grant, in a different System Settings pane. */
-export const OSASCRIPT_NO_AUTOMATION_STDERR = "48:52: execution error: Not authorized to send Apple events to System Events. (-1743)\n";
-// ---------------------------------------------------------------------------
-// windows — DOCUMENTED (wmctrl 1.07 output format)
-// ---------------------------------------------------------------------------
-/**
- * `wmctrl -l -G -p -x`. Nine fixed columns then a title with spaces in it;
- * the second row's title repeats a column's text on purpose, because a parser
- * that re-joins the split fields gets that one wrong.
- */
-export const WMCTRL_STDOUT = [
-    "0x03c00003  0 2841   64   27   1280 800  Navigator.firefox     buildbox  Mozilla Firefox",
-    "0x04200005  0 3120   0    0    2560 1440 gnome-terminal-server.Gnome-terminal  buildbox  0x04200005 build log",
-    "0x05000007 -1 4001   200  180  900  600  code.Code             buildbox  index.ts - factory",
-].join("\n");
-// ---------------------------------------------------------------------------
-// presence — RECORDED on macOS 26.6.2, screen locked, ~54 minutes idle
-// ---------------------------------------------------------------------------
-/**
- * `ioreg -r -c IOHIDSystem -d 1`. NANOSECONDS: 3_254_341_351_000 ns is 3254
- * seconds. Reading it as milliseconds would report 3254 seconds of idleness
- * as three, and make a locked machine look freshly used.
- *
- * The `-r` matters as much as the unit. `ioreg -c IOHIDSystem -d 1` — the
- * form the survey sketch gave — prints this key NOWHERE on this OS version,
- * because without `-r` the depth is measured from the root.
- */
-export const IOREG_HIDIDLE_STDOUT = [
-    "+-o IOHIDSystem  <class IOHIDSystem, id 0x1000005b6, registered, matched, active>",
-    "  | {",
-    '  |   "IOClass" = "IOHIDSystem"',
-    '  |   "HIDIdleTime" = 3254341351000',
-    '  |   "IOProviderClass" = "IOResources"',
-    "  | }",
-].join("\n");
-/** The same machine, `ioreg -n Root -d1`, with the screen locked. */
-export const IOREG_ROOT_LOCKED_STDOUT = [
-    '      "IOConsoleLocked" = Yes',
-    '      "IOConsoleUsers" = ({"kCGSSessionOnConsoleKey"=Yes,"kCGSSessionIDKey"=257,"CGSSessionScreenIsLocked"=Yes,"kCGSSessionUserIDKey"=506})',
-].join("\n");
-/** An unlocked console, same keys. */
-export const IOREG_ROOT_UNLOCKED_STDOUT = [
-    '      "IOConsoleLocked" = No',
-    '      "IOConsoleUsers" = ({"kCGSSessionOnConsoleKey"=Yes,"CGSSessionScreenIsLocked"=No})',
-].join("\n");
-/** A macOS version that reports lock state somewhere this parser cannot see. */
-export const IOREG_ROOT_NO_LOCK_KEY_STDOUT = '      "IORegistryPlanes" = {"IOService"="IOService"}';
-/** DOCUMENTED: `loginctl show-session self -p LockedHint -p Type -p Active`. */
-export const LOGINCTL_STDOUT = "LockedHint=no\nType=x11\nActive=yes\n";
-/** DOCUMENTED: the Windows presence script's two lines. */
-export const WINDOWS_PRESENCE_STDOUT = "idleMs=42000\nlocked=no\n";
-// ---------------------------------------------------------------------------
-// printing — RECORDED on macOS 26.6.2, CUPS 2.4
-// ---------------------------------------------------------------------------
-/**
- * `lpstat -p -d`, verbatim. Two printers in two DIFFERENT sentence shapes,
- * an INDENTED continuation line that belongs to the row above it, and the
- * default-destination line.
- */
-export const LPSTAT_STDOUT = [
-    "printer Canon_MX490_series is idle.  enabled since Sun Jul 26 10:59:45 2026",
-    "printer Canon_TS5300_series now printing Canon_TS5300_series-33.  enabled since Sat Sep 12 00:00:20 2026",
-    "\tLooking for printer.",
-    "system default destination: Canon_MX490_series",
-].join("\n");
-/**
- * A host whose scheduler is down. It lists NOTHING, which reads exactly like
- * a host with no printers — the rule-6 case this fixture exists for.
- */
-export const LPSTAT_NO_SCHEDULER_STDERR = "lpstat: Scheduler is not running.\n";
-/** DOCUMENTED: `lp` answers with prose and the job id is inside it. */
-export const LP_REQUEST_ID_STDOUT = "request id is Canon_MX490_series-34 (1 file(s))\n";
-// ---------------------------------------------------------------------------
-// power — DOCUMENTED (`ps -o command= -p <pid>`)
-// ---------------------------------------------------------------------------
-export const PS_CAFFEINATE_STDOUT = "caffeinate -i -m -t 1800\n";
-/** The same pid, now owned by something else entirely. */
-export const PS_REUSED_PID_STDOUT = "/usr/sbin/cupsd -l\n";