@deeeed/metamask-harness 0.79.0 → 0.80.0

package/dist/artifact-files.js

@@ -1,92 +0,0 @@
-import { constants as fsConstants } from "node:fs";
-import {
-  lstat,
-  mkdir,
-  open,
-  readFile,
-  realpath,
-  writeFile
-} from "node:fs/promises";
-import path from "node:path";
-async function writeContainedArtifact(artifactsDir, relativePath, value, label) {
-  const file = resolveContainedArtifact(artifactsDir, relativePath, label);
-  await mkdir(path.dirname(file), { recursive: true });
-  await assertContainedParent(artifactsDir, file, label);
-  await assertNotSymlink(file, label);
-  const handle = await open(
-    file,
-    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_TRUNC | fsConstants.O_NOFOLLOW,
-    384
-  );
-  try {
-    await handle.writeFile(value);
-  } finally {
-    await handle.close();
-  }
-}
-async function readContainedJsonArtifact(artifactsDir, relativePath, maxBytes, label) {
-  const file = resolveContainedArtifact(artifactsDir, relativePath, label);
-  await assertContainedParent(artifactsDir, file, label);
-  await assertNotSymlink(file, label);
-  const handle = await open(file, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-  try {
-    const info = await handle.stat();
-    if (!info.isFile() || info.size > maxBytes) {
-      throw new Error(`${label} is not a bounded regular file.`);
-    }
-    return JSON.parse(await handle.readFile("utf8"));
-  } finally {
-    await handle.close();
-  }
-}
-async function indexArtifactManifest(manifestPath, entries) {
-  const parsed = JSON.parse(await readFile(manifestPath, "utf8"));
-  const manifest = asRecord(parsed);
-  const replacementPaths = new Set(entries.map((entry) => entry.path));
-  const current = Array.isArray(manifest.artifacts) ? manifest.artifacts.filter(
-    (artifact) => !replacementPaths.has(String(asRecord(artifact).path ?? ""))
-  ) : [];
-  await writeFile(
-    manifestPath,
-    `${JSON.stringify(
-      { ...manifest, artifacts: [...current, ...entries] },
-      null,
-      2
-    )}
-`
-  );
-}
-function resolveContainedArtifact(artifactsDir, relativePath, label) {
-  const root = path.resolve(artifactsDir);
-  const file = path.resolve(root, relativePath);
-  const relative = path.relative(root, file);
-  if (relative.startsWith("..") || path.isAbsolute(relative)) {
-    throw new Error(`${label} path must stay inside artifactsDir.`);
-  }
-  return file;
-}
-async function assertContainedParent(artifactsDir, file, label) {
-  const root = await realpath(artifactsDir);
-  const parent = await realpath(path.dirname(file));
-  const relative = path.relative(root, parent);
-  if (relative.startsWith("..") || path.isAbsolute(relative)) {
-    throw new Error(`${label} parent must stay inside artifactsDir.`);
-  }
-}
-async function assertNotSymlink(file, label) {
-  try {
-    if ((await lstat(file)).isSymbolicLink()) {
-      throw new Error(`${label} must not be a symbolic link.`);
-    }
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-}
-function asRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-export {
-  indexArtifactManifest,
-  readContainedJsonArtifact,
-  writeContainedArtifact
-};

package/dist/checkout-lock.js

@@ -1,149 +0,0 @@
-import { ensureRuntimeDirectory, processIdentity } from "@farmslot/recipe-runner/runtime/operation";
-import { randomUUID } from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { recipeRuntimeDir } from "./paths.js";
-function acquireCheckoutLock(target, operation) {
-  const repoRoot = fs.realpathSync(target);
-  const lockPath = path.join(repoRoot, recipeRuntimeDir(), "sandbox.lock");
-  ensureRuntimeDirectory(path.dirname(lockPath));
-  const inheritedToken = process.env.MM_HARNESS_CHECKOUT_LOCK_TOKEN;
-  for (let attempt = 0; attempt < 4; attempt += 1) {
-    try {
-      const identity = processIdentity(process.pid);
-      if (!identity) throw new Error("Cannot identify checkout lock owner process");
-      const fd = fs.openSync(lockPath, "wx", 384);
-      fs.fchmodSync(fd, 384);
-      const token = randomUUID();
-      const owner = {
-        schemaVersion: 1,
-        pid: process.pid,
-        processStartedAt: identity,
-        operation,
-        repoRoot,
-        token,
-        startedAt: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      fs.writeFileSync(fd, `${JSON.stringify(owner, null, 2)}
-`);
-      fs.closeSync(fd);
-      process.env.MM_HARNESS_CHECKOUT_LOCK_TOKEN = token;
-      return {
-        path: lockPath,
-        release: () => {
-          const current = readOwner(lockPath);
-          if (current?.pid === process.pid && current.token === token && !childrenAlive(current)) {
-            fs.rmSync(lockPath, { force: true });
-            fs.rmSync(path.join(path.dirname(lockPath), "lock-members", token), { recursive: true, force: true });
-          }
-          if (process.env.MM_HARNESS_CHECKOUT_LOCK_TOKEN === token) {
-            if (inheritedToken) process.env.MM_HARNESS_CHECKOUT_LOCK_TOKEN = inheritedToken;
-            else delete process.env.MM_HARNESS_CHECKOUT_LOCK_TOKEN;
-          }
-        }
-      };
-    } catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      const owner = readOwner(lockPath);
-      if (inheritedToken && owner?.token === inheritedToken && owner.repoRoot === repoRoot && typeof owner.pid === "number" && ownerAlive(owner)) {
-        trackCheckoutChild(repoRoot, process.pid);
-        return { path: lockPath, release: () => void 0 };
-      }
-      if (owner && typeof owner.pid === "number" && ownerAlive(owner)) {
-        return {
-          path: lockPath,
-          owner,
-          message: `checkout sandbox is busy with ${String(owner.operation ?? "another operation")} (pid ${owner.pid}).`
-        };
-      }
-      if (!owner || childrenAlive(owner)) {
-        return { path: lockPath, owner, message: `checkout sandbox owner is unreadable or has surviving child processes. Inspect ${lockPath} and its lock-members directory; remove the lock only after verifying all recorded processes have exited.` };
-      }
-      claimStaleLock(lockPath, owner);
-    }
-  }
-  return { path: lockPath, owner: readOwner(lockPath), message: "checkout sandbox lock could not be acquired." };
-}
-function claimStaleLock(lockPath, expectedOwner) {
-  const claimedPath = `${lockPath}.stale-${process.pid}-${randomUUID()}`;
-  try {
-    fs.renameSync(lockPath, claimedPath);
-  } catch (error) {
-    if (error.code === "ENOENT") return;
-    throw error;
-  }
-  try {
-    const claimedOwner = readOwner(claimedPath);
-    if (!sameOwner(claimedOwner, expectedOwner) || claimedOwner && typeof claimedOwner.pid === "number" && (ownerAlive(claimedOwner) || childrenAlive(claimedOwner))) {
-      try {
-        fs.linkSync(claimedPath, lockPath);
-      } catch (error) {
-        if (error.code !== "EEXIST") throw error;
-      }
-    } else if (typeof claimedOwner?.token === "string" && /^[a-f0-9-]{36}$/.test(claimedOwner.token)) {
-      fs.rmSync(path.join(path.dirname(lockPath), "lock-members", claimedOwner.token), { recursive: true, force: true });
-    }
-  } finally {
-    fs.rmSync(claimedPath, { force: true });
-  }
-}
-function sameOwner(left, right) {
-  if (!left || !right) return left === right;
-  return left.pid === right.pid && left.token === right.token && left.startedAt === right.startedAt && left.repoRoot === right.repoRoot;
-}
-function readOwner(lockPath) {
-  try {
-    const value = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-function ownerAlive(owner) {
-  if (typeof owner.pid !== "number") return true;
-  if (typeof owner.processStartedAt === "string") return processIdentity(owner.pid) === owner.processStartedAt;
-  return processAlive(owner.pid);
-}
-function childrenAlive(owner) {
-  if (typeof owner.repoRoot !== "string" || typeof owner.token !== "string" || !/^[a-f0-9-]{36}$/.test(owner.token)) return false;
-  const directory = path.join(owner.repoRoot, recipeRuntimeDir(), "lock-members", owner.token);
-  if (!fs.existsSync(directory)) return false;
-  return fs.readdirSync(directory).filter((name) => name.endsWith(".json")).some((name) => {
-    const child = readOwner(path.join(directory, name));
-    if (child && typeof child.processGroupId === "number" && child.processGroupId > 0) return processAlive(-child.processGroupId);
-    return !child || typeof child.pid !== "number" || typeof child.processStartedAt !== "string" || child.pid !== owner.pid && processIdentity(child.pid) === child.processStartedAt;
-  });
-}
-function trackCheckoutChild(target, pid, ownsProcessGroup = false) {
-  const repoRoot = fs.realpathSync(target);
-  const lockPath = path.join(repoRoot, recipeRuntimeDir(), "sandbox.lock");
-  const owner = readOwner(lockPath);
-  if (!owner || owner.token !== process.env.MM_HARNESS_CHECKOUT_LOCK_TOKEN || typeof owner.token !== "string" || !/^[a-f0-9-]{36}$/.test(owner.token)) return () => void 0;
-  const identity = processIdentity(pid);
-  if (!identity && !ownsProcessGroup) return () => void 0;
-  const directory = path.join(repoRoot, recipeRuntimeDir(), "lock-members", owner.token);
-  ensureRuntimeDirectory(directory);
-  const file = path.join(directory, `${pid}.json`);
-  const previous = readOwner(file);
-  const group = ownsProcessGroup || previous?.processStartedAt === identity && previous?.processGroupId === pid;
-  const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
-  fs.writeFileSync(temporary, JSON.stringify({ pid, processStartedAt: identity, ...group ? { processGroupId: pid } : {} }), { mode: 384 });
-  fs.chmodSync(temporary, 384);
-  fs.renameSync(temporary, file);
-  return () => {
-    const current = readOwner(file);
-    if (current?.pid === pid && current.processStartedAt === identity) fs.rmSync(file, { force: true });
-  };
-}
-function processAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-}
-export {
-  acquireCheckoutLock,
-  trackCheckoutChild
-};

package/dist/cli-color.js

@@ -1,98 +0,0 @@
-const STYLES = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  label: "\x1B[1;36m",
-  cmd: "\x1B[1m",
-  ok: "\x1B[1;32m",
-  warn: "\x1B[1;33m",
-  err: "\x1B[1;31m",
-  info: "\x1B[0;37m",
-  accent: "\x1B[1;35m",
-  path: "\x1B[2m",
-  comment: "\x1B[2m",
-  active: "\x1B[1m"
-};
-function colorEnabled(stream = process.stderr) {
-  if (process.env.NO_COLOR != null && process.env.NO_COLOR !== "" && process.env.NO_COLOR !== "0") {
-    return false;
-  }
-  if (process.env.RECIPE_NO_COLOR === "1") return false;
-  if (process.env.RECIPE_COLOR === "1" || process.env.FORCE_COLOR === "1") return true;
-  return Boolean(stream?.isTTY);
-}
-function stripAnsi(text) {
-  return String(text).replace(/\x1b\[[0-9;]*m/gu, "");
-}
-function color(style, text, { stream = process.stderr } = {}) {
-  const value = String(text);
-  if (!colorEnabled(stream)) return value;
-  const code = STYLES[style];
-  if (!code) return value;
-  return `${code}${value}${STYLES.reset}`;
-}
-function colorKv(label, value, valueStyle = "info", { stream = process.stderr } = {}) {
-  return `${color("label", `${label}:`, { stream })} ${color(valueStyle, value, { stream })}`;
-}
-function colorStatusWord(word, { stream = process.stderr } = {}) {
-  const normalized = String(word || "").toLowerCase();
-  if (["up", "ready", "yes", "pass", "running", "present", "healthy"].includes(normalized)) {
-    return color("ok", word, { stream });
-  }
-  if (["down", "stopped", "no", "fail", "failed", "missing", "blocked", "unknown"].includes(normalized)) {
-    return color("err", word, { stream });
-  }
-  if (["compiling", "bundling", "starting", "waiting", "warn"].includes(normalized)) {
-    return color("warn", word, { stream });
-  }
-  return color("info", word, { stream });
-}
-function colorHumanMessage(message, { stream = process.stderr } = {}) {
-  return String(message).split("\n").map((line) => {
-    const marker = /^(\s*)(→|✓|✗)\s?(.*)$/u.exec(line);
-    if (marker) {
-      const style = marker[2] === "\u2713" ? "ok" : marker[2] === "\u2717" ? "err" : "accent";
-      return `${marker[1]}${color(style, marker[2], { stream })}${marker[3] ? ` ${marker[3]}` : ""}`;
-    }
-    const next = /^(\s*)Next:\s*(.*)$/u.exec(line);
-    if (next) {
-      return `${next[1]}${color("label", "Next:", { stream })}${next[2] ? ` ${color("cmd", next[2], { stream })}` : ""}`;
-    }
-    const warning = /^(\s*)(WARN(?:ING)?)(:?)[ \t]*(.*)$/iu.exec(line);
-    if (warning) {
-      return `${warning[1]}${color("warn", `${warning[2]}${warning[3]}`, { stream })}${warning[4] ? ` ${warning[4]}` : ""}`;
-    }
-    return line;
-  }).join("\n");
-}
-function classifyLogEvent(event) {
-  const text = String(event || "");
-  if (/Module build failed|^ERROR in |BUILD FAILED|compiled with [1-9][0-9]* error/iu.test(text)) {
-    return "err";
-  }
-  if (/compiled successfully|compiled with [0-9]+ warning|PASS runtime-launch|launch pass|verify pass|build complete/iu.test(text)) {
-    return "ok";
-  }
-  if (/phase [0-9]\/[0-9]|prepare pipeline|snapshot|fixture:|dist-freshness|build-health/iu.test(text)) {
-    return "label";
-  }
-  if (/webpack [0-9]+%|Bundl(ed|ing)|(iOS|Android).*%/iu.test(text)) {
-    return "warn";
-  }
-  return "info";
-}
-function colorLogEvent(event, { latest = false, stream = process.stderr } = {}) {
-  const style = classifyLogEvent(event);
-  const painted = color(style === "label" ? "label" : style, event, { stream });
-  return latest ? color("active", painted, { stream }) : painted;
-}
-export {
-  classifyLogEvent,
-  color,
-  colorEnabled,
-  colorHumanMessage,
-  colorKv,
-  colorLogEvent,
-  colorStatusWord,
-  stripAnsi
-};

package/dist/command-journal.js

@@ -1,308 +0,0 @@
-import { randomUUID } from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { OperationRecord, readOperations, processIdentity, ensureRuntimeDirectory } from "@farmslot/recipe-runner/runtime/operation";
-import { latestTaskDir } from "@farmslot/agent-runtime";
-import { recipeRuntimeDir } from "./paths.js";
-const COMMAND_JOURNAL_FILE = "last-command.json";
-const JOURNALED_COMMANDS = /* @__PURE__ */ new Set([
-  "prepare",
-  "call",
-  "check",
-  "checklist",
-  "cleanup",
-  "doctor",
-  "fixtures",
-  "install",
-  "launch",
-  "runtime-launch",
-  "provision",
-  "recipe-quality",
-  "run",
-  "stop",
-  "verify"
-]);
-const SENSITIVE_KEY = /(?:api[-_]?key|auth|credential|mnemonic|pass(?:word)?|private[-_]?key|secret|seed|srp|token|vault)/iu;
-const EVIDENCE_OPTIONS = /* @__PURE__ */ new Set(["--artifacts-dir", "--out", "--output"]);
-let activeCommandJournal;
-async function withCommandJournal(command, argv, execute) {
-  if (!JOURNALED_COMMANDS.has(command)) return execute();
-  const handle = tryBeginCommandJournal(command, argv);
-  const previous = activeCommandJournal;
-  const parentId = process.env.MM_HARNESS_OPERATION_ID;
-  if (handle) process.env.MM_HARNESS_OPERATION_ID = handle.operation.value.id;
-  activeCommandJournal = handle;
-  try {
-    const exitCode = await execute();
-    tryFinishCommandJournal(handle, exitCode);
-    return exitCode;
-  } catch (error) {
-    tryFinishCommandJournal(handle, 1);
-    throw error;
-  } finally {
-    activeCommandJournal = previous;
-    if (parentId) process.env.MM_HARNESS_OPERATION_ID = parentId;
-    else delete process.env.MM_HARNESS_OPERATION_ID;
-  }
-}
-function recordCommandStage(stage) {
-  activeCommandJournal?.operation.stage(stage);
-}
-function recordCommandOutput(chunk) {
-  activeCommandJournal?.operation.output(chunk);
-}
-function recordCommandEvidence(...evidence) {
-  const handle = activeCommandJournal;
-  if (!handle || evidence.length === 0) return;
-  try {
-    const paths = new Set(handle.record.evidencePaths);
-    for (const entry of evidence) paths.add(path.resolve(entry));
-    handle.record = { ...handle.record, evidencePaths: [...paths] };
-    writeAtomic(handle.file, handle.record);
-  } catch (error) {
-    process.stderr.write(
-      `mm-harness: resumability journal could not record evidence: ${errorMessage(error)}
-`
-    );
-  }
-}
-function commandJournalPath(target, runtimeDir) {
-  const relative = runtimeDir ?? recipeRuntimeDir();
-  assertRelativeRuntimeDir(relative);
-  return path.join(path.resolve(target), relative, COMMAND_JOURNAL_FILE);
-}
-function readCommandJournal(target, runtimeDir) {
-  const legacyFile = commandJournalPath(target, runtimeDir);
-  const operations = readOperations(path.join(path.dirname(legacyFile), "operations"));
-  const live = operations.filter((operation) => operation.status === "running" && processIdentity(operation.pid) === operation.processStartedAt);
-  const roots = operations.filter((operation) => !operation.parentId).sort((a, b) => (a.finishedAt ?? a.startedAt).localeCompare(b.finishedAt ?? b.startedAt));
-  const selected = live.find((operation) => !operation.parentId) ?? live.at(-1) ?? roots.at(-1) ?? operations.at(-1);
-  const file = selected ? path.join(path.dirname(legacyFile), "operations", `${selected.id}.journal.json`) : legacyFile;
-  let descriptor;
-  try {
-    const noFollow = typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0;
-    descriptor = fs.openSync(file, fs.constants.O_RDONLY | noFollow);
-    const descriptorStat = fs.fstatSync(descriptor, { bigint: true });
-    const pathStat = fs.lstatSync(file, { bigint: true });
-    if (!descriptorStat.isFile() || !pathStat.isFile() || pathStat.isSymbolicLink() || pathStat.dev === 0n && pathStat.ino === 0n || descriptorStat.dev !== pathStat.dev || descriptorStat.ino !== pathStat.ino) {
-      return { file, record: null };
-    }
-    const parsed = JSON.parse(
-      fs.readFileSync(descriptor, "utf8")
-    );
-    return isCommandJournalRecord(parsed) ? { file, record: parsed } : { file, record: null };
-  } catch {
-    return { file, record: null };
-  } finally {
-    if (descriptor !== void 0) fs.closeSync(descriptor);
-  }
-}
-function redactCommandArgs(argv) {
-  const redacted = [];
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index] ?? "";
-    const equals = token.indexOf("=");
-    if (token.startsWith("--") && equals !== -1) {
-      const option = token.slice(0, equals);
-      const value = token.slice(equals + 1);
-      redacted.push(
-        `${option}=${option === "--arg" ? redactAssignment(value) : SENSITIVE_KEY.test(option) ? "<redacted>" : redactUrl(value)}`
-      );
-      continue;
-    }
-    if (token.startsWith("--") && SENSITIVE_KEY.test(token)) {
-      redacted.push(token);
-      const value = argv[index + 1];
-      if (value !== void 0 && !value.startsWith("--")) {
-        redacted.push("<redacted>");
-        index += 1;
-      }
-      continue;
-    }
-    if (token === "--arg") {
-      redacted.push(token);
-      const value = argv[index + 1];
-      if (value !== void 0) {
-        redacted.push(redactAssignment(value));
-        index += 1;
-      }
-      continue;
-    }
-    redacted.push(redactAssignment(redactUrl(token)));
-  }
-  return redacted;
-}
-function pruneCompletedJournals(directory, operations) {
-  const completed = operations.filter((operation) => operation.status !== "running");
-  for (const operation of completed.slice(0, -100)) {
-    for (const suffix of [".json", ".journal.json", ".log"]) {
-      fs.rmSync(path.join(directory, `${operation.id}${suffix}`), { force: true });
-    }
-  }
-}
-function tryBeginCommandJournal(command, argv) {
-  try {
-    const target = invocationTarget(argv);
-    if (!fs.existsSync(target)) return void 0;
-    const runtimeDir = optionValue(argv, "--runtime-dir");
-    const legacyFile = commandJournalPath(target, runtimeDir);
-    const taskDir = latestTaskDir(path.join(target, "temp", "tasks"));
-    const signalFile = taskDir && path.join(taskDir, "SIGNAL.json");
-    const liveTask = signalFile && fs.existsSync(signalFile) && JSON.parse(fs.readFileSync(signalFile, "utf8")).status === "running";
-    const directory = path.join(path.dirname(legacyFile), "operations");
-    const operations = readOperations(directory, (error) => process.stderr.write(`mm-harness: ignoring invalid prior operation: ${error.message}
-`));
-    pruneCompletedJournals(directory, operations);
-    const inherited = process.env.MM_HARNESS_OPERATION_ID;
-    const parent = inherited && operations.find((operation2) => operation2.id === inherited && operation2.target === target && operation2.status === "running" && processIdentity(operation2.pid) === operation2.processStartedAt);
-    const operation = new OperationRecord(directory, command, target, {
-      ...parent ? { parentId: parent.id } : {},
-      ...liveTask ? { mirrorDirectory: path.join(taskDir, "artifacts", "operations") } : {}
-    });
-    const file = path.join(directory, `${operation.value.id}.journal.json`);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const record = {
-      schemaVersion: 1,
-      command,
-      args: redactCommandArgs(argv.slice(1)),
-      target,
-      verdict: "running",
-      exitCode: null,
-      evidencePaths: evidencePaths(argv),
-      startedAt: now,
-      finishedAt: null
-    };
-    writeAtomic(file, record);
-    return { file, record, operation };
-  } catch (error) {
-    process.stderr.write(
-      `mm-harness: resumability journal unavailable: ${errorMessage(error)}
-`
-    );
-    return void 0;
-  }
-}
-function tryFinishCommandJournal(handle, exitCode) {
-  if (!handle) return;
-  try {
-    writeAtomic(handle.file, {
-      ...handle.record,
-      verdict: exitCode === 0 ? "pass" : "fail",
-      exitCode,
-      finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  } catch (error) {
-    process.stderr.write(
-      `mm-harness: resumability journal could not finalize: ${errorMessage(error)}
-`
-    );
-  } finally {
-    handle.operation.finish(exitCode);
-  }
-}
-function writeAtomic(file, record) {
-  ensureRuntimeDirectory(path.dirname(file));
-  const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
-  let descriptor;
-  try {
-    descriptor = fs.openSync(temporary, "wx", 384);
-    fs.fchmodSync(descriptor, 384);
-    fs.writeFileSync(descriptor, `${JSON.stringify(record, null, 2)}
-`);
-    fs.fsyncSync(descriptor);
-    fs.closeSync(descriptor);
-    descriptor = void 0;
-    fs.renameSync(temporary, file);
-  } finally {
-    if (descriptor !== void 0) fs.closeSync(descriptor);
-    fs.rmSync(temporary, { force: true });
-  }
-}
-function invocationTarget(argv) {
-  const target = path.resolve(optionValue(argv, "--target") ?? process.cwd());
-  return fs.existsSync(target) ? fs.realpathSync(target) : target;
-}
-function evidencePaths(argv) {
-  const values = /* @__PURE__ */ new Set();
-  for (const option of EVIDENCE_OPTIONS) {
-    const value = optionValue(argv, option);
-    if (value) values.add(path.resolve(value));
-  }
-  return [...values];
-}
-function optionValue(argv, option) {
-  const divider = argv.indexOf("--");
-  const end = divider === -1 ? argv.length : divider;
-  for (let index = 1; index < end; index += 1) {
-    const token = argv[index] ?? "";
-    if (token === option) {
-      const value = argv[index + 1];
-      return value && !value.startsWith("--") ? value : void 0;
-    }
-    if (token.startsWith(`${option}=`)) return token.slice(option.length + 1);
-  }
-  return void 0;
-}
-function redactAssignment(token) {
-  const equals = token.indexOf("=");
-  if (equals <= 0) return redactValue(token);
-  const key = token.slice(0, equals);
-  const value = token.slice(equals + 1);
-  return `${key}=${SENSITIVE_KEY.test(key) ? "<redacted>" : redactValue(value)}`;
-}
-function redactUrl(token) {
-  return token.replace(/(\w+:\/\/)[^/@\s:]+:[^/@\s]+@/gu, "$1<redacted>@");
-}
-function redactValue(value) {
-  try {
-    return JSON.stringify(redactStructuredValue(JSON.parse(value)));
-  } catch {
-    return value.replace(
-      /((?:api[-_]?key|auth|credential|mnemonic|pass(?:word)?|private[-_]?key|secret|seed|srp|token|vault)=)[^\s]+/giu,
-      "$1<redacted>"
-    );
-  }
-}
-function isSensitiveKey(key) {
-  return SENSITIVE_KEY.test(key);
-}
-function redactStructuredValue(value) {
-  if (Array.isArray(value)) return value.map(redactStructuredValue);
-  if (!value || typeof value !== "object") return value;
-  return Object.fromEntries(
-    Object.entries(value).map(([key, entry]) => [
-      key,
-      isSensitiveKey(key) ? "<redacted>" : redactStructuredValue(entry)
-    ])
-  );
-}
-function assertRelativeRuntimeDir(value) {
-  if (!value || path.isAbsolute(value) || !/^[A-Za-z0-9._/-]+$/u.test(value)) {
-    throw new Error(`--runtime-dir must be a safe relative path: ${value}`);
-  }
-  if (value.split("/").some((part) => !part || part === "." || part === "..")) {
-    throw new Error(
-      `--runtime-dir contains an unsafe path component: ${value}`
-    );
-  }
-}
-function isCommandJournalRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const record = value;
-  return record.schemaVersion === 1 && typeof record.command === "string" && Array.isArray(record.args) && record.args.every((entry) => typeof entry === "string") && typeof record.target === "string" && (record.verdict === "running" || record.verdict === "pass" || record.verdict === "fail") && (record.exitCode === null || typeof record.exitCode === "number") && Array.isArray(record.evidencePaths) && record.evidencePaths.every((entry) => typeof entry === "string") && typeof record.startedAt === "string" && (record.finishedAt === null || typeof record.finishedAt === "string");
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-export {
-  COMMAND_JOURNAL_FILE,
-  commandJournalPath,
-  isSensitiveKey,
-  readCommandJournal,
-  recordCommandEvidence,
-  recordCommandOutput,
-  recordCommandStage,
-  redactCommandArgs,
-  redactStructuredValue,
-  withCommandJournal
-};