@dev-mainsequence/codex-plugin 0.0.0-stage → 0.4.2

package/dist/runner.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// The plugin's own entry point: `--codex-hook` serves the UserPromptSubmit hook from
+// stdin; any other invocation is the plain ms-devtools terminal CLI, so this package's
+// bin keeps working in a shell.
+const devtools_1 = require("./vendor/devtools/index.js");
+const codex_1 = require("./hosts/codex.js");
+async function main() {
+    const argv = process.argv.slice(2);
+    const hook = argv.length === 1 && argv[0] === '--codex-hook';
+    const controller = new AbortController();
+    const stop = () => controller.abort();
+    process.once('SIGINT', stop);
+    process.once('SIGTERM', stop);
+    // Finish a handled prompt before Codex's 600-second hook limit.
+    const timer = hook ? setTimeout(stop, 550_000) : undefined;
+    // The Codex hook reports only its final blocking result. Sync is local and needs no backend preflight.
+    const tooling = (0, devtools_1.createDevTools)({ host: (0, devtools_1.createNodeHost)(hook || argv.includes('--json') ? undefined : message => process.stderr.write(message + '\n')), signal: controller.signal });
+    try {
+        if (hook) {
+            let stdin = '';
+            for await (const chunk of process.stdin) {
+                stdin += chunk;
+                if (stdin.length > 1_000_000)
+                    throw new devtools_1.ToolingError('INVALID_REQUEST', 'Hook input is too large.');
+            }
+            let input;
+            try {
+                input = JSON.parse(stdin);
+            }
+            catch {
+                return;
+            }
+            const output = await (0, codex_1.handleCodexPrompt)(input, tooling.dispatch);
+            if (output)
+                process.stdout.write(JSON.stringify(output) + '\n');
+            return;
+        }
+        let result;
+        try {
+            const parsed = (0, devtools_1.parseArguments)(argv);
+            if (parsed.help) {
+                process.stdout.write(devtools_1.HELP);
+                return;
+            }
+            result = await tooling.dispatch(parsed.request);
+        }
+        catch (error) {
+            const message = error instanceof devtools_1.ToolingError ? error.message : 'The command could not be parsed.';
+            result = { schemaVersion: 1, action: 'invalid', status: 'failure', summary: message, error: { code: 'INVALID_REQUEST', message } };
+        }
+        process.stdout.write(argv.includes('--json') ? JSON.stringify(result) + '\n' : result.summary + '\n' + (result.data === undefined ? '' : JSON.stringify(result.data, null, 2) + '\n'));
+        process.exitCode = result.status === 'success' ? 0 : result.status === 'cancelled' ? 130 : 1;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        process.removeListener('SIGINT', stop);
+        process.removeListener('SIGTERM', stop);
+    }
+}
+void main().catch(() => {
+    // A handled-hook failure must block, never pass through to model inference.
+    if (process.argv.includes('--codex-hook'))
+        process.stdout.write(JSON.stringify({ decision: 'block', reason: 'Developer action runner failed.' }) + '\n');
+    else {
+        process.stderr.write('Developer action runner failed.\n');
+        process.exitCode = 1;
+    }
+});

package/dist/vendor/devtools/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 MainSequence SDK
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/vendor/devtools/NOTICE

@@ -0,0 +1,12 @@
+The native machine-session store, backend normalization, browser authorization flow,
+repository identity/layout, response models, and project CLI contracts derive from
+ms-vscode-extension 0.1.45 (4bb107e), Copyright (c) 2024 MainSequence SDK, MIT license.
+
+Adaptations remove VS Code APIs and legacy project-token projection, add explicit host
+interfaces, cancellation, safe results, and deterministic command dispatch.
+The SDK repositories remain independent and are not bundled.
+
+MainSequence brand icons are copied unchanged from the public website:
+https://www.main-sequence.io/favicon.svg
+https://www.main-sequence.io/favicon-192.png
+Retrieved 2026-10-01. The branding belongs to MainSequence.

package/dist/vendor/devtools/index.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HELP = exports.tokenizeCommand = exports.parseArguments = exports.readOrganizationProjectWorkspace = exports.OrganizationProjectClient = exports.updateDevcontainerJsonc = exports.validateDockerPlatform = exports.validateDockerImage = exports.PROJECT_OPERATION_ACTIONS = exports.createProjectOperations = exports.AgentClient = exports.bindSessionAccount = exports.listEnvironments = exports.PYTHON_SDK_PROJECT_URL = exports.readPythonProjectSdkStatus = exports.projectVersion = exports.hasPythonProject = exports.pythonExecutable = exports.sanitizeCommitMessage = exports.codeRepositoryActionPreview = exports.buildCodeRepositoryCliInvocations = exports.resolveCodeRepositoryCli = exports.repositorySshKeyPaths = exports.repositorySshKeyName = exports.repositorySshKeyIdentity = exports.RepositoryClient = exports.safeSlug = exports.canonicalRepositoryDir = exports.detectProjectType = exports.projectContext = exports.readWorkspacePreferences = exports.normalizeBackendUrl = exports.ForeignEntryError = exports.CredentialStoreError = exports.SESSION_SERVICE = exports.saveSession = exports.readSession = exports.clearSession = exports.authSecretKey = exports.HostAuthSession = exports.createSessionService = exports.ToolingError = exports.openCredentialStore = exports.sessionAccount = exports.requireBackend = exports.createNodeHost = exports.createDevTools = void 0;
+var actions_1 = require("./shared/actions.js");
+Object.defineProperty(exports, "createDevTools", { enumerable: true, get: function () { return actions_1.createDevTools; } });
+var process_1 = require("./shared/process.js");
+Object.defineProperty(exports, "createNodeHost", { enumerable: true, get: function () { return process_1.createNodeHost; } });
+var session_1 = require("./shared/session.js");
+Object.defineProperty(exports, "requireBackend", { enumerable: true, get: function () { return session_1.requireBackend; } });
+var machineSession_1 = require("./shared/machineSession.js");
+Object.defineProperty(exports, "sessionAccount", { enumerable: true, get: function () { return machineSession_1.sessionAccount; } });
+Object.defineProperty(exports, "openCredentialStore", { enumerable: true, get: function () { return machineSession_1.openCredentialStore; } });
+var models_1 = require("./shared/models.js");
+Object.defineProperty(exports, "ToolingError", { enumerable: true, get: function () { return models_1.ToolingError; } });
+var session_2 = require("./shared/session.js");
+Object.defineProperty(exports, "createSessionService", { enumerable: true, get: function () { return session_2.createSessionService; } });
+var hostSession_1 = require("./shared/hostSession.js");
+Object.defineProperty(exports, "HostAuthSession", { enumerable: true, get: function () { return hostSession_1.HostAuthSession; } });
+Object.defineProperty(exports, "authSecretKey", { enumerable: true, get: function () { return hostSession_1.authSecretKey; } });
+var machineSession_2 = require("./shared/machineSession.js");
+Object.defineProperty(exports, "clearSession", { enumerable: true, get: function () { return machineSession_2.clearSession; } });
+Object.defineProperty(exports, "readSession", { enumerable: true, get: function () { return machineSession_2.readSession; } });
+Object.defineProperty(exports, "saveSession", { enumerable: true, get: function () { return machineSession_2.saveSession; } });
+Object.defineProperty(exports, "SESSION_SERVICE", { enumerable: true, get: function () { return machineSession_2.SESSION_SERVICE; } });
+Object.defineProperty(exports, "CredentialStoreError", { enumerable: true, get: function () { return machineSession_2.CredentialStoreError; } });
+Object.defineProperty(exports, "ForeignEntryError", { enumerable: true, get: function () { return machineSession_2.ForeignEntryError; } });
+var config_1 = require("./shared/config.js");
+Object.defineProperty(exports, "normalizeBackendUrl", { enumerable: true, get: function () { return config_1.normalizeBackendUrl; } });
+var repositories_1 = require("./shared/repositories.js");
+Object.defineProperty(exports, "readWorkspacePreferences", { enumerable: true, get: function () { return repositories_1.readWorkspacePreferences; } });
+Object.defineProperty(exports, "projectContext", { enumerable: true, get: function () { return repositories_1.projectContext; } });
+Object.defineProperty(exports, "detectProjectType", { enumerable: true, get: function () { return repositories_1.detectProjectType; } });
+Object.defineProperty(exports, "canonicalRepositoryDir", { enumerable: true, get: function () { return repositories_1.canonicalRepositoryDir; } });
+Object.defineProperty(exports, "safeSlug", { enumerable: true, get: function () { return repositories_1.safeSlug; } });
+var repositoryClient_1 = require("./shared/repositoryClient.js");
+Object.defineProperty(exports, "RepositoryClient", { enumerable: true, get: function () { return repositoryClient_1.RepositoryClient; } });
+var repositoryIdentity_1 = require("./shared/repositoryIdentity.js");
+Object.defineProperty(exports, "repositorySshKeyIdentity", { enumerable: true, get: function () { return repositoryIdentity_1.repositorySshKeyIdentity; } });
+Object.defineProperty(exports, "repositorySshKeyName", { enumerable: true, get: function () { return repositoryIdentity_1.repositorySshKeyName; } });
+Object.defineProperty(exports, "repositorySshKeyPaths", { enumerable: true, get: function () { return repositoryIdentity_1.repositorySshKeyPaths; } });
+var cli_1 = require("./shared/cli.js");
+Object.defineProperty(exports, "resolveCodeRepositoryCli", { enumerable: true, get: function () { return cli_1.resolveCodeRepositoryCli; } });
+Object.defineProperty(exports, "buildCodeRepositoryCliInvocations", { enumerable: true, get: function () { return cli_1.buildCodeRepositoryCliInvocations; } });
+Object.defineProperty(exports, "codeRepositoryActionPreview", { enumerable: true, get: function () { return cli_1.codeRepositoryActionPreview; } });
+Object.defineProperty(exports, "sanitizeCommitMessage", { enumerable: true, get: function () { return cli_1.sanitizeCommitMessage; } });
+var pythonProjectStatus_1 = require("./shared/pythonProjectStatus.js");
+Object.defineProperty(exports, "pythonExecutable", { enumerable: true, get: function () { return pythonProjectStatus_1.pythonExecutable; } });
+Object.defineProperty(exports, "hasPythonProject", { enumerable: true, get: function () { return pythonProjectStatus_1.hasPythonProject; } });
+Object.defineProperty(exports, "projectVersion", { enumerable: true, get: function () { return pythonProjectStatus_1.projectVersion; } });
+Object.defineProperty(exports, "readPythonProjectSdkStatus", { enumerable: true, get: function () { return pythonProjectStatus_1.readPythonSdkStatus; } });
+Object.defineProperty(exports, "PYTHON_SDK_PROJECT_URL", { enumerable: true, get: function () { return pythonProjectStatus_1.PYTHON_SDK_PROJECT_URL; } });
+var environments_1 = require("./shared/environments.js");
+Object.defineProperty(exports, "listEnvironments", { enumerable: true, get: function () { return environments_1.listEnvironments; } });
+var accountScope_1 = require("./shared/accountScope.js");
+Object.defineProperty(exports, "bindSessionAccount", { enumerable: true, get: function () { return accountScope_1.bindSessionAccount; } });
+var agents_1 = require("./shared/agents.js");
+Object.defineProperty(exports, "AgentClient", { enumerable: true, get: function () { return agents_1.AgentClient; } });
+var projectOperations_1 = require("./shared/projectOperations.js");
+Object.defineProperty(exports, "createProjectOperations", { enumerable: true, get: function () { return projectOperations_1.createProjectOperations; } });
+Object.defineProperty(exports, "PROJECT_OPERATION_ACTIONS", { enumerable: true, get: function () { return projectOperations_1.PROJECT_OPERATION_ACTIONS; } });
+Object.defineProperty(exports, "validateDockerImage", { enumerable: true, get: function () { return projectOperations_1.validateDockerImage; } });
+Object.defineProperty(exports, "validateDockerPlatform", { enumerable: true, get: function () { return projectOperations_1.validateDockerPlatform; } });
+var devcontainerJsonc_1 = require("./shared/devcontainerJsonc.js");
+Object.defineProperty(exports, "updateDevcontainerJsonc", { enumerable: true, get: function () { return devcontainerJsonc_1.updateDevcontainerJsonc; } });
+var organizationProjects_1 = require("./shared/organizationProjects.js");
+Object.defineProperty(exports, "OrganizationProjectClient", { enumerable: true, get: function () { return organizationProjects_1.OrganizationProjectClient; } });
+var organizationProjectWorkspace_1 = require("./shared/organizationProjectWorkspace.js");
+Object.defineProperty(exports, "readOrganizationProjectWorkspace", { enumerable: true, get: function () { return organizationProjectWorkspace_1.readOrganizationProjectWorkspace; } });
+var arguments_1 = require("./shared/arguments.js");
+Object.defineProperty(exports, "parseArguments", { enumerable: true, get: function () { return arguments_1.parseArguments; } });
+Object.defineProperty(exports, "tokenizeCommand", { enumerable: true, get: function () { return arguments_1.tokenizeCommand; } });
+Object.defineProperty(exports, "HELP", { enumerable: true, get: function () { return arguments_1.HELP; } });

package/dist/vendor/devtools/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "@dev-mainsequence/devtools",
+  "version": "0.3.2",
+  "main": "./index.js"
+}

package/dist/vendor/devtools/shared/accountScope.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateExpectedAccount = validateExpectedAccount;
+exports.bindSessionAccount = bindSessionAccount;
+const models_1 = require("./models.js");
+function validateExpectedAccount(value) {
+    if (typeof value !== 'string' || !value.trim() || value.length > 300 || /[\r\n\0]/.test(value)) {
+        throw new models_1.ToolingError('INVALID_REQUEST', 'Use the account returned by verified session status.');
+    }
+}
+/** Opt-in account scope for domain operations; never silently weaken a custom transport. */
+async function bindSessionAccount(session, backend, expectedAccount) {
+    if (expectedAccount === undefined)
+        return session;
+    validateExpectedAccount(expectedAccount);
+    if (!session.withAccount)
+        throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'This session transport does not support account-bound operations. Upgrade its session implementation.');
+    return session.withAccount(backend, expectedAccount);
+}

package/dist/vendor/devtools/shared/actions.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDevTools = createDevTools;
+exports.validateRequest = validateRequest;
+const mcp_1 = require("./mcp.js");
+const agents_1 = require("./agents.js");
+const models_1 = require("./models.js");
+const session_1 = require("./session.js");
+const repositories_1 = require("./repositories.js");
+const projects_1 = require("./projects.js");
+const organizationProjects_1 = require("./organizationProjects.js");
+const organizationProjectWorkspace_1 = require("./organizationProjectWorkspace.js");
+const accountScope_1 = require("./accountScope.js");
+function createDevTools(options) {
+    const { host, session: suppliedSession, allowMcpSkills, allowLegacyProjectCredentials, mcpConnectionsPath, ...sessionOptions } = options;
+    const session = suppliedSession ?? new session_1.MachineSessionService(host, sessionOptions);
+    const env = { ...(options.env ?? process.env) };
+    async function dispatch(request) {
+        const state = { mutationStarted: false };
+        const action = request?.action || 'unknown';
+        try {
+            validateRequest(request);
+            options.signal?.throwIfAborted();
+            if (action.startsWith('organization-')) {
+                const input = request;
+                const backend = await (0, repositories_1.resolveBackend)(request.backend, undefined, env);
+                const scoped = await (0, accountScope_1.bindSessionAccount)(session, backend, input.expectedAccount);
+                const client = new organizationProjects_1.OrganizationProjectClient(scoped, backend, options.signal);
+                let data;
+                if (input.action === 'organization-environments')
+                    data = await client.environments();
+                else if (input.action === 'organization-projects')
+                    data = await client.list(input.environmentUid, input);
+                else if (input.action === 'organization-project')
+                    data = await client.getProject(input.environmentUid, input.projectUid);
+                else if (input.action === 'organization-project-link') {
+                    const url = await client.link(input);
+                    if (input.expectedAccount !== undefined)
+                        await scoped.status(backend, true);
+                    if (!await host.openBrowser(url))
+                        throw new models_1.ToolingError('BROWSER_FAILED', 'The resource link could not open.');
+                    data = { url };
+                }
+                else if (input.action === 'organization-project-setup')
+                    data = await (0, organizationProjectWorkspace_1.setupOrganizationProject)({ ...input, backend }, { host, session: scoped, env, signal: options.signal, state });
+                else
+                    throw new models_1.ToolingError('INVALID_REQUEST', 'Unknown organization project action.');
+                if (input.expectedAccount !== undefined)
+                    await scoped.status(backend, true);
+                return safeResult({ schemaVersion: 1, action, status: 'success', summary: input.action === 'organization-project-setup' ? 'Project checkouts are prepared on their assigned branches. Claude must attach them when its workspace session starts.' : 'Projects loaded.', data });
+            }
+            if ((0, agents_1.isAgentAction)(action)) {
+                const backend = await (0, repositories_1.resolveBackend)(request.backend, undefined, env);
+                return safeResult(await new agents_1.AgentClient(session, { signal: options.signal, progress: host.progress?.bind(host) }).dispatch(request, backend));
+            }
+            if (action.startsWith('mcp-')) {
+                const backend = await (0, repositories_1.resolveBackend)(request.backend, process.cwd(), env);
+                const input = request, scoped = await (0, accountScope_1.bindSessionAccount)(session, backend, input.expectedAccount);
+                return safeResult(await new mcp_1.McpConnections(scoped, { connectionsPath: mcpConnectionsPath, env, fetch: options.fetch, signal: options.signal, requestTimeoutMs: options.requestTimeoutMs,
+                    checkAccount: input.expectedAccount === undefined ? undefined : () => scoped.status(backend, true).then(() => { }) }).dispatch(input, backend));
+            }
+            let data;
+            if (['login', 'logout', 'refresh-token', 'auth-status', 'repositories'].includes(action)) {
+                const backend = await (0, repositories_1.resolveBackend)(request.backend, undefined, env);
+                if (request.action === 'login')
+                    data = await session.login(backend);
+                else if (request.action === 'logout')
+                    data = await session.logout(backend);
+                else if (request.action === 'refresh-token')
+                    data = await session.refresh(backend);
+                else if (request.action === 'auth-status')
+                    data = await session.status(backend, request.check);
+                else
+                    data = await (0, repositories_1.listRepositories)(session, backend);
+            }
+            else if (request.action === 'setup') {
+                data = await (0, projects_1.setupRepository)(host, session, { ...request, backend: await (0, repositories_1.resolveBackend)(request.backend, undefined, env) }, { env, signal: options.signal, state });
+            }
+            else if ('root' in request) {
+                const context = await (0, repositories_1.projectContext)(host, request.root, request.backend, request.projectType, env, options.signal);
+                if (request.action === 'status')
+                    data = { project: context, capabilities: await (0, projects_1.projectCapabilities)(host, context, env, options.signal, allowMcpSkills), session: await session.status(context.backend) };
+                else if (request.action === 'resolve')
+                    data = { project: context, resolution: await (0, repositories_1.resolveRepository)(session, context) };
+                else {
+                    const operation = () => (0, projects_1.runProjectAction)(host, session, context, request.action, { ...request, env, signal: options.signal, state, fetch: options.fetch, allowMcpSkills, allowLegacyProjectCredentials });
+                    data = ['sdk-status', 'open-folder', 'signed-terminal'].includes(action) || ('dryRun' in request && request.dryRun)
+                        ? await operation() : await (0, projects_1.withProjectLock)(context.gitCommonDir, operation);
+                }
+            }
+            const summary = action === 'auth-status' ? (data.authenticated ? 'The selected session is usable.' : 'No usable session is selected.')
+                : action === 'login' ? 'Signed in; the machine session was saved and verified.'
+                    : action === 'refresh-token' ? 'The saved machine session was renewed.'
+                        : action === 'logout' ? (data.revoked ? 'The machine session was revoked and removed.' : 'The local machine session was removed; remote revocation was not confirmed.')
+                            : action === 'sync' ? 'Dependency files were refreshed. Nothing was committed or pushed: review the changes, then commit and push them yourself.'
+                                : `${action} completed.`;
+            return safeResult({ schemaVersion: 1, action, status: 'success', summary, data });
+        }
+        catch (error) {
+            const failure = options.signal?.aborted ? new models_1.ToolingError('CANCELLED', 'The action was cancelled.')
+                : error instanceof models_1.ToolingError ? error : new models_1.ToolingError('INTERNAL_ERROR', 'The action could not complete. Check the required local tools and project permissions.');
+            return safeResult({ schemaVersion: 1, action, status: failure.code === 'CANCELLED' ? 'cancelled' : 'failure', summary: failure.message,
+                error: { code: failure.code, message: failure.message },
+                ...(state.mutationStarted ? { effects: { state: 'partial-or-uncertain', message: 'Files, dependencies, keys, or remote state may have changed. Inspect the result before retrying; no automatic rollback was attempted.' } } : {})
+            });
+        }
+    }
+    function safeResult(result) {
+        // The dispatcher is the one public output boundary for every host.
+        const sanitize = (value) => {
+            if (typeof value === 'string')
+                return session.sanitize?.(value) ?? value;
+            if (Array.isArray(value))
+                return value.map(sanitize);
+            if (value && typeof value === 'object')
+                return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitize(item)]));
+            return value;
+        };
+        return sanitize(result);
+    }
+    return { dispatch };
+}
+const ACTIONS = new Set(['login', 'logout', 'refresh-token', 'auth-status', 'repositories', 'status', 'resolve', 'setup', 'sync', 'sdk-status', 'update-sdk', 'update-agents', 'install-skills', 'skills-sync', 'install', 'env-cleanup', 'open-folder', 'signed-terminal']);
+// Removed actions keep a specific answer, so that an older host learns what replaced them.
+const RETIRED_ACTIONS = {
+    'freeze-env': 'freeze-env was removed: sync now refreshes the lock file, the environment and requirements.txt. Run sync instead.',
+};
+function validateRequest(request) {
+    if (request && ['organization-environments', 'organization-projects', 'organization-project', 'organization-project-link', 'organization-project-setup'].includes(request.action)) {
+        if (request.backend !== undefined && typeof request.backend !== 'string')
+            throw new models_1.ToolingError('INVALID_REQUEST', 'Backend must be a URL string.');
+        return;
+    }
+    if (request && (0, agents_1.isAgentAction)(request.action)) {
+        if (request.backend !== undefined && typeof request.backend !== 'string')
+            throw new models_1.ToolingError('INVALID_REQUEST', 'Backend must be a URL string.');
+        return;
+    }
+    if (request && ['mcp-environments', 'mcp-discover', 'mcp-add', 'mcp-list', 'mcp-remove', 'mcp-tools', 'mcp-call'].includes(request.action)) {
+        if (request.backend !== undefined && typeof request.backend !== 'string')
+            throw new models_1.ToolingError('INVALID_REQUEST', 'Backend must be a URL string.');
+        return;
+    }
+    if (request && typeof request.action === 'string' && Object.hasOwn(RETIRED_ACTIONS, request.action))
+        throw new models_1.ToolingError('UNSUPPORTED_ACTION', RETIRED_ACTIONS[request.action]);
+    if (!request || !ACTIONS.has(request.action))
+        throw new models_1.ToolingError('INVALID_REQUEST', 'Unknown developer action. Run --help for supported commands.');
+    if (!['login', 'logout', 'refresh-token', 'auth-status', 'repositories', 'setup'].includes(request.action) && !('root' in request))
+        throw new models_1.ToolingError('INVALID_REQUEST', 'A project root is required.');
+    if ('root' in request && (typeof request.root !== 'string' || !request.root.trim() || request.root.includes('\0')))
+        throw new models_1.ToolingError('INVALID_REQUEST', 'A project root is required.');
+    if (request.backend !== undefined && typeof request.backend !== 'string')
+        throw new models_1.ToolingError('INVALID_REQUEST', 'Backend must be a URL string.');
+    if ('projectType' in request && request.projectType && !['python', 'vite_react'].includes(request.projectType))
+        throw new models_1.ToolingError('INVALID_REQUEST', 'Project type must be python or vite_react.');
+    // A sync request from an older host may still carry a commit message. Sync ignores it.
+    if ('dryRun' in request && request.dryRun && !projects_1.DRY_RUN_ACTIONS.includes(request.action))
+        throw new models_1.ToolingError('INVALID_REQUEST', 'This action has no dry-run mode.');
+    if (request.action === 'setup') {
+        for (const value of [request.repositoryUid, request.branch, request.baseDir])
+            if (typeof value !== 'string' || !value.trim() || /[\r\n\0]/.test(value))
+                throw new models_1.ToolingError('INVALID_REQUEST', 'Setup requires --uid, --branch, and --base-dir.');
+    }
+}

package/dist/vendor/devtools/shared/agentReadiness.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.waitForAgentReadiness = waitForAgentReadiness;
+const models_1 = require("./models.js");
+/** All runtime-access responses remain private. Only fixed, credential-free copy escapes. */
+async function waitForAgentReadiness(options) {
+    const budget = options.timeoutMs ?? 630000;
+    if (!Number.isFinite(budget) || budget < 1 || budget > 630000) {
+        throw new models_1.ToolingError('INVALID_REQUEST', 'Agent readiness timeout must be between 1 and 630000 milliseconds.');
+    }
+    let deadline = performance.now() + budget;
+    let lastProgress = '';
+    const progress = (message) => {
+        if (message !== lastProgress) {
+            lastProgress = message;
+            options.progress?.(message);
+        }
+    };
+    const timedOut = () => new models_1.ToolingError('PROCESS_TIMEOUT', 'The agent did not become ready in time. No message was sent. Try again.');
+    progress('Checking agent…');
+    while (true) {
+        options.signal?.throwIfAborted();
+        if (performance.now() >= deadline)
+            throw timedOut();
+        const access = await options.resolve(deadline);
+        options.signal?.throwIfAborted();
+        if (performance.now() >= deadline)
+            throw timedOut();
+        const interaction = access?.runtime_interaction;
+        if (!interaction || typeof interaction.can_submit !== 'boolean' || typeof interaction.state !== 'string') {
+            throw new models_1.ToolingError('API_ERROR', 'The platform did not provide a valid agent readiness decision. No message was sent.');
+        }
+        if (interaction.can_submit) {
+            if (!['ready', 'warning'].includes(interaction.state) || access.mode !== 'token'
+                || typeof access.token !== 'string' || !access.token || typeof access.rpc_url !== 'string' || !access.rpc_url) {
+                throw new models_1.ToolingError('API_ERROR', 'The platform returned an incomplete agent readiness decision. No message was sent.');
+            }
+            progress('Agent ready');
+            return;
+        }
+        if (!['checking', 'starting', 'waking', 'updating'].includes(interaction.state)) {
+            const message = { update_required: 'The agent needs an update before it can accept messages.',
+                update_failed: 'The agent update failed.', unavailable: 'The agent is unavailable.' }[interaction.state]
+                ?? 'The agent cannot accept messages right now.';
+            throw new models_1.ToolingError('API_ERROR', `${message} No message was sent. Try again when it is available.`);
+        }
+        const retry = interaction.retry_after_ms;
+        if (typeof retry !== 'number' || !Number.isFinite(retry) || retry < 0) {
+            throw new models_1.ToolingError('API_ERROR', 'The platform did not provide a valid readiness retry interval. No message was sent.');
+        }
+        const wakeDeadline = access.runtime_presence?.wake?.deadline_at;
+        if (typeof wakeDeadline === 'string' && Number.isFinite(Date.parse(wakeDeadline))) {
+            deadline = Math.min(deadline, performance.now() + Math.max(0, Date.parse(wakeDeadline) + 30000 - Date.now()));
+        }
+        progress(interaction.state === 'updating' ? 'Agent update in progress…'
+            : interaction.state === 'checking' ? 'Checking agent…' : 'Starting agent…');
+        const delay = Math.max(100, retry), remaining = deadline - performance.now();
+        if (remaining <= 0)
+            throw timedOut();
+        await new Promise((resolve, reject) => {
+            const finish = () => { options.signal?.removeEventListener('abort', abort); resolve(); };
+            const timer = setTimeout(finish, Math.min(delay, remaining));
+            const abort = () => { clearTimeout(timer); options.signal?.removeEventListener('abort', abort); reject(new models_1.ToolingError('CANCELLED', 'Agent preparation cancelled. No message was sent.')); };
+            options.signal?.addEventListener('abort', abort, { once: true });
+            if (options.signal?.aborted)
+                abort();
+        });
+        if (delay >= remaining)
+            throw timedOut();
+    }
+}