@elie-laloum/outpost 11.1.2 → 11.2.0

package/dist/adapters/triggers/github-webhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-webhook.js","sourceRoot":"","sources":["../../../src/adapters/triggers/github-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAKtE,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,aAAa,GACd,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGjE,SAAS,aAAa,CAAC,OAA2B;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,CACtD,mCAAmC,CACpC,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACrE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,OAA2B,EAAE,GAAW;YACnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC;gBACrD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAC;YACd,IACE,CAAC,MAAM;gBACP,CAAC,gBAAgB,CAAC,MAAM,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;gBAE5D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxD,OAAO,YAAY,CAAC;gBAClB,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBACtD,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,OAAO;gBACP,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { payloadString, triggerEvent } from \"../../domain/trigger.ts\";\nimport type {\n  TriggerHttpRequest,\n  TriggerSource,\n} from \"../../domain/trigger.types.ts\";\nimport {\n  header,\n  signatureMatches,\n  webhookSecret,\n} from \"../../infrastructure/webhook-signature.ts\";\nimport { formBody, jsonBody, textBody } from \"./trigger-body.ts\";\nimport type { GithubWebhookOptions } from \"./triggers.types.ts\";\n\nfunction githubPayload(request: TriggerHttpRequest) {\n  const form = request.headers[\"content-type\"]?.startsWith(\n    \"application/x-www-form-urlencoded\",\n  );\n  if (!form) return jsonBody(textBody(request.body));\n  const payload = formBody(request.body).get(\"payload\");\n  if (payload === null) throw new Error(\"Missing GitHub form payload\");\n  return jsonBody(payload);\n}\n\n/** Receive GitHub webhooks signed with `X-Hub-Signature-256`. */\nexport function createGithubWebhook(\n  options: GithubWebhookOptions,\n): TriggerSource {\n  const secrets = webhookSecret(options.secret, \"GitHub webhook\");\n  return Object.freeze({\n    name: \"github\",\n    async verify(request: TriggerHttpRequest, now: number) {\n      const signature = header(request.headers, \"x-hub-signature-256\");\n      const digest = /^sha256=[0-9a-f]{64}$/i.test(signature)\n        ? Buffer.from(signature.slice(7), \"hex\")\n        : undefined;\n      if (\n        !digest ||\n        !signatureMatches(await secrets(), [request.body], [digest])\n      )\n        throw new Error(\"GitHub signature mismatch\");\n      const payload = githubPayload(request);\n      const action = payloadString(payload, \"action\");\n      const login = payloadString(payload, \"sender\", \"login\");\n      return triggerEvent({\n        source: \"github\",\n        delivery: header(request.headers, \"x-github-delivery\"),\n        kind: header(request.headers, \"x-github-event\"),\n        ...(action ? { action } : {}),\n        ...(login ? { actor: `github:${login}` } : {}),\n        payload,\n        receivedAt: new Date(now).toISOString(),\n      });\n    },\n  });\n}\n"]}
+{"version":3,"file":"github-webhook.js","sourceRoot":"","sources":["../../../src/adapters/triggers/github-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAKtE,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,aAAa,GACd,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGjE,SAAS,aAAa,CAAC,OAA2B;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,CACtD,mCAAmC,CACpC,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACrE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,OAA2B,EAAE,GAAW;YACnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC;gBACrD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAC;YACd,IACE,CAAC,MAAM;gBACP,CAAC,gBAAgB,CAAC,MAAM,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;gBAE5D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,OAAO,oBAAoB,CAAC,GAAG,EAAE;gBAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;gBACvC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACxD,OAAO,YAAY,CAAC;oBAClB,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC;oBACtD,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC;oBAC/C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,OAAO;oBACP,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { decodeTriggerPayload } from \"../../domain/trigger-payload.ts\";\nimport { payloadString, triggerEvent } from \"../../domain/trigger.ts\";\nimport type {\n  TriggerHttpRequest,\n  TriggerSource,\n} from \"../../domain/trigger.types.ts\";\nimport {\n  header,\n  signatureMatches,\n  webhookSecret,\n} from \"../../infrastructure/webhook-signature.ts\";\nimport { formBody, jsonBody, textBody } from \"./trigger-body.ts\";\nimport type { GithubWebhookOptions } from \"./triggers.types.ts\";\n\nfunction githubPayload(request: TriggerHttpRequest) {\n  const form = request.headers[\"content-type\"]?.startsWith(\n    \"application/x-www-form-urlencoded\",\n  );\n  if (!form) return jsonBody(textBody(request.body));\n  const payload = formBody(request.body).get(\"payload\");\n  if (payload === null) throw new Error(\"Missing GitHub form payload\");\n  return jsonBody(payload);\n}\n\n/** Receive GitHub webhooks signed with `X-Hub-Signature-256`. */\nexport function createGithubWebhook(\n  options: GithubWebhookOptions,\n): TriggerSource {\n  const secrets = webhookSecret(options.secret, \"GitHub webhook\");\n  return Object.freeze({\n    name: \"github\",\n    async verify(request: TriggerHttpRequest, now: number) {\n      const signature = header(request.headers, \"x-hub-signature-256\");\n      const digest = /^sha256=[0-9a-f]{64}$/i.test(signature)\n        ? Buffer.from(signature.slice(7), \"hex\")\n        : undefined;\n      if (\n        !digest ||\n        !signatureMatches(await secrets(), [request.body], [digest])\n      )\n        throw new Error(\"GitHub signature mismatch\");\n      return decodeTriggerPayload(() => {\n        const payload = githubPayload(request);\n        const action = payloadString(payload, \"action\");\n        const login = payloadString(payload, \"sender\", \"login\");\n        return triggerEvent({\n          source: \"github\",\n          delivery: header(request.headers, \"x-github-delivery\"),\n          kind: header(request.headers, \"x-github-event\"),\n          ...(action ? { action } : {}),\n          ...(login ? { actor: `github:${login}` } : {}),\n          payload,\n          receivedAt: new Date(now).toISOString(),\n        });\n      });\n    },\n  });\n}\n"]}

package/dist/adapters/triggers/gitlab-webhook.js

@@ -1,3 +1,4 @@
+import { decodeTriggerPayload } from "../../domain/trigger-payload.js";
 import { triggerDefaultToleranceMs } from "../../domain/trigger.constants.js";
 import { payloadString, triggerEvent } from "../../domain/trigger.js";
 import { header, sameBytes, webhookSecret, } from "../../infrastructure/webhook-signature.js";
@@ -28,19 +29,21 @@ export function createGitlabWebhook(options) {
         name: "gitlab",
         async verify(request, now) {
             const id = await delivery(request, now);
-            const payload = jsonBody(textBody(request.body));
-            const action = payloadString(payload, "object_attributes", "action");
-            const username = payloadString(payload, "user", "username") ??
-                payloadString(payload, "user_username");
-            return triggerEvent({
-                source: "gitlab",
-                delivery: id,
-                kind: payloadString(payload, "object_kind") ??
-                    header(request.headers, "x-gitlab-event"),
-                ...(action ? { action } : {}),
-                ...(username ? { actor: `gitlab:${username}` } : {}),
-                payload,
-                receivedAt: new Date(now).toISOString(),
+            return decodeTriggerPayload(() => {
+                const payload = jsonBody(textBody(request.body));
+                const action = payloadString(payload, "object_attributes", "action");
+                const username = payloadString(payload, "user", "username") ??
+                    payloadString(payload, "user_username");
+                return triggerEvent({
+                    source: "gitlab",
+                    delivery: id,
+                    kind: payloadString(payload, "object_kind") ??
+                        header(request.headers, "x-gitlab-event"),
+                    ...(action ? { action } : {}),
+                    ...(username ? { actor: `gitlab:${username}` } : {}),
+                    payload,
+                    receivedAt: new Date(now).toISOString(),
+                });
             });
         },
     });

package/dist/adapters/triggers/gitlab-webhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"gitlab-webhook.js","sourceRoot":"","sources":["../../../src/adapters/triggers/gitlab-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAKtE,OAAO,EACL,MAAM,EACN,SAAS,EACT,aAAa,GACd,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQpE,SAAS,cAAc,CAAC,OAA6B;IACnD,OAAO,gBAAgB,CACrB,OAAO,CAAC,YAAY,EACpB,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAA2B;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,EAAE;YACjC,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC;QAC/D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,MAAM,QAAQ,GACZ,cAAc,IAAI,OAAO;QACvB,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,OAA2B,EAAE,GAAW;YACnD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,QAAQ,GACZ,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;gBAC1C,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC1C,OAAO,YAAY,CAAC;gBAClB,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,EAAE;gBACZ,IAAI,EACF,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC;oBACrC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAC3C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,OAAO;gBACP,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { triggerDefaultToleranceMs } from \"../../domain/trigger.constants.ts\";\nimport { payloadString, triggerEvent } from \"../../domain/trigger.ts\";\nimport type {\n  TriggerHttpRequest,\n  TriggerSource,\n} from \"../../domain/trigger.types.ts\";\nimport {\n  header,\n  sameBytes,\n  webhookSecret,\n} from \"../../infrastructure/webhook-signature.ts\";\nimport { standardVerifier } from \"./standard-webhook.ts\";\nimport { jsonBody, textBody, toleranceMs } from \"./trigger-body.ts\";\nimport type {\n  DeliveryVerifier,\n  GitlabSigningOptions,\n  GitlabTokenOptions,\n  GitlabWebhookOptions,\n} from \"./triggers.types.ts\";\n\nfunction signedDelivery(options: GitlabSigningOptions): DeliveryVerifier {\n  return standardVerifier(\n    options.signingToken,\n    toleranceMs(options.toleranceMs, triggerDefaultToleranceMs),\n  );\n}\n\nfunction tokenDelivery(options: GitlabTokenOptions): DeliveryVerifier {\n  const secrets = webhookSecret(options.token, \"GitLab webhook\");\n  return async (request) => {\n    const supplied = Buffer.from(header(request.headers, \"x-gitlab-token\"));\n    let matched = false;\n    for (const token of await secrets())\n      matched = sameBytes(supplied, Buffer.from(token)) || matched;\n    if (!matched) throw new Error(\"GitLab token mismatch\");\n    return (\n      request.headers[\"idempotency-key\"] ??\n      header(request.headers, \"x-gitlab-event-uuid\")\n    );\n  };\n}\n\n/** Receive GitLab webhooks, preferably verified with a signing token. */\nexport function createGitlabWebhook(\n  options: GitlabWebhookOptions,\n): TriggerSource {\n  const delivery =\n    \"signingToken\" in options\n      ? signedDelivery(options)\n      : tokenDelivery(options);\n  return Object.freeze({\n    name: \"gitlab\",\n    async verify(request: TriggerHttpRequest, now: number) {\n      const id = await delivery(request, now);\n      const payload = jsonBody(textBody(request.body));\n      const action = payloadString(payload, \"object_attributes\", \"action\");\n      const username =\n        payloadString(payload, \"user\", \"username\") ??\n        payloadString(payload, \"user_username\");\n      return triggerEvent({\n        source: \"gitlab\",\n        delivery: id,\n        kind:\n          payloadString(payload, \"object_kind\") ??\n          header(request.headers, \"x-gitlab-event\"),\n        ...(action ? { action } : {}),\n        ...(username ? { actor: `gitlab:${username}` } : {}),\n        payload,\n        receivedAt: new Date(now).toISOString(),\n      });\n    },\n  });\n}\n"]}
+{"version":3,"file":"gitlab-webhook.js","sourceRoot":"","sources":["../../../src/adapters/triggers/gitlab-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAKtE,OAAO,EACL,MAAM,EACN,SAAS,EACT,aAAa,GACd,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQpE,SAAS,cAAc,CAAC,OAA6B;IACnD,OAAO,gBAAgB,CACrB,OAAO,CAAC,YAAY,EACpB,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAA2B;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,EAAE;YACjC,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC;QAC/D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,MAAM,QAAQ,GACZ,cAAc,IAAI,OAAO;QACvB,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,OAA2B,EAAE,GAAW;YACnD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO,oBAAoB,CAAC,GAAG,EAAE;gBAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;gBACrE,MAAM,QAAQ,GACZ,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC1C,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;gBAC1C,OAAO,YAAY,CAAC;oBAClB,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,EAAE;oBACZ,IAAI,EACF,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC;wBACrC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC;oBAC3C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,OAAO;oBACP,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { decodeTriggerPayload } from \"../../domain/trigger-payload.ts\";\nimport { triggerDefaultToleranceMs } from \"../../domain/trigger.constants.ts\";\nimport { payloadString, triggerEvent } from \"../../domain/trigger.ts\";\nimport type {\n  TriggerHttpRequest,\n  TriggerSource,\n} from \"../../domain/trigger.types.ts\";\nimport {\n  header,\n  sameBytes,\n  webhookSecret,\n} from \"../../infrastructure/webhook-signature.ts\";\nimport { standardVerifier } from \"./standard-webhook.ts\";\nimport { jsonBody, textBody, toleranceMs } from \"./trigger-body.ts\";\nimport type {\n  DeliveryVerifier,\n  GitlabSigningOptions,\n  GitlabTokenOptions,\n  GitlabWebhookOptions,\n} from \"./triggers.types.ts\";\n\nfunction signedDelivery(options: GitlabSigningOptions): DeliveryVerifier {\n  return standardVerifier(\n    options.signingToken,\n    toleranceMs(options.toleranceMs, triggerDefaultToleranceMs),\n  );\n}\n\nfunction tokenDelivery(options: GitlabTokenOptions): DeliveryVerifier {\n  const secrets = webhookSecret(options.token, \"GitLab webhook\");\n  return async (request) => {\n    const supplied = Buffer.from(header(request.headers, \"x-gitlab-token\"));\n    let matched = false;\n    for (const token of await secrets())\n      matched = sameBytes(supplied, Buffer.from(token)) || matched;\n    if (!matched) throw new Error(\"GitLab token mismatch\");\n    return (\n      request.headers[\"idempotency-key\"] ??\n      header(request.headers, \"x-gitlab-event-uuid\")\n    );\n  };\n}\n\n/** Receive GitLab webhooks, preferably verified with a signing token. */\nexport function createGitlabWebhook(\n  options: GitlabWebhookOptions,\n): TriggerSource {\n  const delivery =\n    \"signingToken\" in options\n      ? signedDelivery(options)\n      : tokenDelivery(options);\n  return Object.freeze({\n    name: \"gitlab\",\n    async verify(request: TriggerHttpRequest, now: number) {\n      const id = await delivery(request, now);\n      return decodeTriggerPayload(() => {\n        const payload = jsonBody(textBody(request.body));\n        const action = payloadString(payload, \"object_attributes\", \"action\");\n        const username =\n          payloadString(payload, \"user\", \"username\") ??\n          payloadString(payload, \"user_username\");\n        return triggerEvent({\n          source: \"gitlab\",\n          delivery: id,\n          kind:\n            payloadString(payload, \"object_kind\") ??\n            header(request.headers, \"x-gitlab-event\"),\n          ...(action ? { action } : {}),\n          ...(username ? { actor: `gitlab:${username}` } : {}),\n          payload,\n          receivedAt: new Date(now).toISOString(),\n        });\n      });\n    },\n  });\n}\n"]}

package/dist/adapters/triggers/slack-request.js

@@ -1,3 +1,4 @@
+import { decodeTriggerPayload } from "../../domain/trigger-payload.js";
 import { triggerDefaultToleranceMs } from "../../domain/trigger.constants.js";
 import { payloadString, triggerEvent } from "../../domain/trigger.js";
 import { header, signatureMatches, timestampWithin, webhookSecret, } from "../../infrastructure/webhook-signature.js";
@@ -39,13 +40,15 @@ export function createSlackSource(options) {
             if (!digest ||
                 !signatureMatches(await secrets(), [`v0:${timestamp}:`, request.body], [digest]))
                 throw new Error("Slack signature mismatch");
-            const { user, delivery, ...event } = slackPayload(request);
-            return triggerEvent({
-                source: "slack",
-                ...event,
-                delivery: delivery ?? "",
-                ...(user ? { actor: `slack:${user}` } : {}),
-                receivedAt: new Date(now).toISOString(),
+            return decodeTriggerPayload(() => {
+                const { user, delivery, ...event } = slackPayload(request);
+                return triggerEvent({
+                    source: "slack",
+                    ...event,
+                    delivery: delivery ?? "",
+                    ...(user ? { actor: `slack:${user}` } : {}),
+                    receivedAt: new Date(now).toISOString(),
+                });
             });
         },
         /** Slack expects HTTP 200 within three seconds; an empty body sends no message. */

package/dist/adapters/triggers/slack-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"slack-request.js","sourceRoot":"","sources":["../../../src/adapters/triggers/slack-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAKtE,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,eAAe,EACf,aAAa,GACd,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGpE,SAAS,YAAY,CAAC,OAA2B;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO;YACL,OAAO;YACP,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,aAAa;YACrD,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC;YAC1C,QAAQ,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC;SAC/C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IACjD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;QACjC,IAAI,EAAE,SAAS;QACf,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS;QACtC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;KAC9C,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,MAAM,CAAC,OAA2B,EAAE,GAAW;YACnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;YACvE,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAC;YACd,IACE,CAAC,MAAM;gBACP,CAAC,gBAAgB,CACf,MAAM,OAAO,EAAE,EACf,CAAC,MAAM,SAAS,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAClC,CAAC,MAAM,CAAC,CACT;gBAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3D,OAAO,YAAY,CAAC;gBAClB,MAAM,EAAE,OAAO;gBACf,GAAG,KAAK;gBACR,QAAQ,EAAE,QAAQ,IAAI,EAAE;gBACxB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QACD,mFAAmF;QACnF,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { triggerDefaultToleranceMs } from \"../../domain/trigger.constants.ts\";\nimport { payloadString, triggerEvent } from \"../../domain/trigger.ts\";\nimport type {\n  TriggerHttpRequest,\n  TriggerSource,\n} from \"../../domain/trigger.types.ts\";\nimport {\n  header,\n  signatureMatches,\n  timestampWithin,\n  webhookSecret,\n} from \"../../infrastructure/webhook-signature.ts\";\nimport { formBody, jsonBody, toleranceMs } from \"./trigger-body.ts\";\nimport type { SlackRequestOptions } from \"./triggers.types.ts\";\n\nfunction slackPayload(request: TriggerHttpRequest) {\n  const form = formBody(request.body);\n  const interaction = form.get(\"payload\");\n  if (interaction !== null) {\n    const payload = jsonBody(interaction);\n    return {\n      payload,\n      kind: payloadString(payload, \"type\") ?? \"interaction\",\n      user: payloadString(payload, \"user\", \"id\"),\n      delivery: payloadString(payload, \"trigger_id\"),\n    };\n  }\n  const command = form.get(\"command\") ?? undefined;\n  return {\n    payload: Object.fromEntries(form),\n    kind: \"command\",\n    ...(command ? { action: command } : {}),\n    user: form.get(\"user_id\") ?? undefined,\n    delivery: form.get(\"trigger_id\") ?? undefined,\n  };\n}\n\n/** Receive Slack slash commands and interactions signed with `X-Slack-Signature`. */\nexport function createSlackSource(options: SlackRequestOptions): TriggerSource {\n  const secrets = webhookSecret(options.signingSecret, \"Slack\");\n  const tolerance = toleranceMs(options.toleranceMs, triggerDefaultToleranceMs);\n  return Object.freeze({\n    name: \"slack\",\n    async verify(request: TriggerHttpRequest, now: number) {\n      const timestamp = header(request.headers, \"x-slack-request-timestamp\");\n      timestampWithin(timestamp, now, tolerance);\n      const signature = header(request.headers, \"x-slack-signature\");\n      const digest = /^v0=[0-9a-f]{64}$/i.test(signature)\n        ? Buffer.from(signature.slice(3), \"hex\")\n        : undefined;\n      if (\n        !digest ||\n        !signatureMatches(\n          await secrets(),\n          [`v0:${timestamp}:`, request.body],\n          [digest],\n        )\n      )\n        throw new Error(\"Slack signature mismatch\");\n      const { user, delivery, ...event } = slackPayload(request);\n      return triggerEvent({\n        source: \"slack\",\n        ...event,\n        delivery: delivery ?? \"\",\n        ...(user ? { actor: `slack:${user}` } : {}),\n        receivedAt: new Date(now).toISOString(),\n      });\n    },\n    /** Slack expects HTTP 200 within three seconds; an empty body sends no message. */\n    reply: () => ({ status: 200 }),\n  });\n}\n"]}
+{"version":3,"file":"slack-request.js","sourceRoot":"","sources":["../../../src/adapters/triggers/slack-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAKtE,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,eAAe,EACf,aAAa,GACd,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGpE,SAAS,YAAY,CAAC,OAA2B;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO;YACL,OAAO;YACP,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,aAAa;YACrD,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC;YAC1C,QAAQ,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC;SAC/C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IACjD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;QACjC,IAAI,EAAE,SAAS;QACf,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS;QACtC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;KAC9C,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,MAAM,CAAC,OAA2B,EAAE,GAAW;YACnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;YACvE,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAC;YACd,IACE,CAAC,MAAM;gBACP,CAAC,gBAAgB,CACf,MAAM,OAAO,EAAE,EACf,CAAC,MAAM,SAAS,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAClC,CAAC,MAAM,CAAC,CACT;gBAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,OAAO,oBAAoB,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;gBAC3D,OAAO,YAAY,CAAC;oBAClB,MAAM,EAAE,OAAO;oBACf,GAAG,KAAK;oBACR,QAAQ,EAAE,QAAQ,IAAI,EAAE;oBACxB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3C,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,mFAAmF;QACnF,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { decodeTriggerPayload } from \"../../domain/trigger-payload.ts\";\nimport { triggerDefaultToleranceMs } from \"../../domain/trigger.constants.ts\";\nimport { payloadString, triggerEvent } from \"../../domain/trigger.ts\";\nimport type {\n  TriggerHttpRequest,\n  TriggerSource,\n} from \"../../domain/trigger.types.ts\";\nimport {\n  header,\n  signatureMatches,\n  timestampWithin,\n  webhookSecret,\n} from \"../../infrastructure/webhook-signature.ts\";\nimport { formBody, jsonBody, toleranceMs } from \"./trigger-body.ts\";\nimport type { SlackRequestOptions } from \"./triggers.types.ts\";\n\nfunction slackPayload(request: TriggerHttpRequest) {\n  const form = formBody(request.body);\n  const interaction = form.get(\"payload\");\n  if (interaction !== null) {\n    const payload = jsonBody(interaction);\n    return {\n      payload,\n      kind: payloadString(payload, \"type\") ?? \"interaction\",\n      user: payloadString(payload, \"user\", \"id\"),\n      delivery: payloadString(payload, \"trigger_id\"),\n    };\n  }\n  const command = form.get(\"command\") ?? undefined;\n  return {\n    payload: Object.fromEntries(form),\n    kind: \"command\",\n    ...(command ? { action: command } : {}),\n    user: form.get(\"user_id\") ?? undefined,\n    delivery: form.get(\"trigger_id\") ?? undefined,\n  };\n}\n\n/** Receive Slack slash commands and interactions signed with `X-Slack-Signature`. */\nexport function createSlackSource(options: SlackRequestOptions): TriggerSource {\n  const secrets = webhookSecret(options.signingSecret, \"Slack\");\n  const tolerance = toleranceMs(options.toleranceMs, triggerDefaultToleranceMs);\n  return Object.freeze({\n    name: \"slack\",\n    async verify(request: TriggerHttpRequest, now: number) {\n      const timestamp = header(request.headers, \"x-slack-request-timestamp\");\n      timestampWithin(timestamp, now, tolerance);\n      const signature = header(request.headers, \"x-slack-signature\");\n      const digest = /^v0=[0-9a-f]{64}$/i.test(signature)\n        ? Buffer.from(signature.slice(3), \"hex\")\n        : undefined;\n      if (\n        !digest ||\n        !signatureMatches(\n          await secrets(),\n          [`v0:${timestamp}:`, request.body],\n          [digest],\n        )\n      )\n        throw new Error(\"Slack signature mismatch\");\n      return decodeTriggerPayload(() => {\n        const { user, delivery, ...event } = slackPayload(request);\n        return triggerEvent({\n          source: \"slack\",\n          ...event,\n          delivery: delivery ?? \"\",\n          ...(user ? { actor: `slack:${user}` } : {}),\n          receivedAt: new Date(now).toISOString(),\n        });\n      });\n    },\n    /** Slack expects HTTP 200 within three seconds; an empty body sends no message. */\n    reply: () => ({ status: 200 }),\n  });\n}\n"]}

package/dist/adapters/triggers/standard-webhook.js

@@ -1,3 +1,4 @@
+import { decodeTriggerPayload } from "../../domain/trigger-payload.js";
 import { triggerDefaultToleranceMs } from "../../domain/trigger.constants.js";
 import { payloadString, triggerDelivery, triggerEvent, } from "../../domain/trigger.js";
 import { header, signatureMatches, timestampWithin, webhookSecret, } from "../../infrastructure/webhook-signature.js";
@@ -36,13 +37,15 @@ export function createStandardWebhook(options) {
         name: source,
         async verify(request, now) {
             const delivery = await verify(request, now);
-            const payload = jsonBody(textBody(request.body));
-            return triggerEvent({
-                source,
-                delivery,
-                kind: payloadString(payload, "type") ?? "webhook",
-                payload,
-                receivedAt: new Date(now).toISOString(),
+            return decodeTriggerPayload(() => {
+                const payload = jsonBody(textBody(request.body));
+                return triggerEvent({
+                    source,
+                    delivery,
+                    kind: payloadString(payload, "type") ?? "webhook",
+                    payload,
+                    receivedAt: new Date(now).toISOString(),
+                });
             });
         },
     });

package/dist/adapters/triggers/standard-webhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"standard-webhook.js","sourceRoot":"","sources":["../../../src/adapters/triggers/standard-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,GACb,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,eAAe,EACf,aAAa,GACd,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGpE,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,MAAM;QACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,SAAiB;IACvE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,OAA2B,EAAE,GAAW,EAAmB,EAAE;QACzE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC/D,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,IACE,CAAC,UAAU,CAAC,MAAM;YAClB,CAAC,gBAAgB,CACf,IAAI,EACJ,CAAC,GAAG,QAAQ,IAAI,SAAS,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAC3C,UAAU,CACX;YAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CACnC,OAA+B;IAE/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,MAAM,GAAG,gBAAgB,CAC7B,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAC5D,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,OAA2B,EAAE,GAAW;YACnD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,YAAY,CAAC;gBAClB,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,SAAS;gBACjD,OAAO;gBACP,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { triggerDefaultToleranceMs } from \"../../domain/trigger.constants.ts\";\nimport {\n  payloadString,\n  triggerDelivery,\n  triggerEvent,\n} from \"../../domain/trigger.ts\";\nimport type {\n  TriggerHttpRequest,\n  TriggerSecret,\n  TriggerSource,\n} from \"../../domain/trigger.types.ts\";\nimport {\n  header,\n  signatureMatches,\n  timestampWithin,\n  webhookSecret,\n} from \"../../infrastructure/webhook-signature.ts\";\nimport { jsonBody, textBody, toleranceMs } from \"./trigger-body.ts\";\nimport type { StandardWebhookOptions } from \"./triggers.types.ts\";\n\nfunction signingKey(secret: string): Buffer {\n  const key = secret.startsWith(\"whsec_\")\n    ? Buffer.from(secret.slice(6), \"base64\")\n    : Buffer.alloc(0);\n  if (!key.length)\n    throw new Error(\"Signing secrets must use the whsec_ format\");\n  return key;\n}\n\n/** Verifies a Standard Webhooks signature and returns the message identifier. */\nexport function standardVerifier(secret: TriggerSecret, tolerance: number) {\n  const secrets = webhookSecret(secret, \"Standard webhook\");\n  return async (request: TriggerHttpRequest, now: number): Promise<string> => {\n    const delivery = triggerDelivery(header(request.headers, \"webhook-id\"));\n    const timestamp = header(request.headers, \"webhook-timestamp\");\n    timestampWithin(timestamp, now, tolerance);\n    const signatures = header(request.headers, \"webhook-signature\")\n      .split(\" \")\n      .filter((value) => value.startsWith(\"v1,\"))\n      .map((value) => Buffer.from(value.slice(3), \"base64\"));\n    const keys = (await secrets()).map(signingKey);\n    if (\n      !signatures.length ||\n      !signatureMatches(\n        keys,\n        [`${delivery}.${timestamp}.`, request.body],\n        signatures,\n      )\n    )\n      throw new Error(\"Webhook signature mismatch\");\n    return delivery;\n  };\n}\n\n/** Receive webhooks signed with the Standard Webhooks scheme. */\nexport function createStandardWebhook(\n  options: StandardWebhookOptions,\n): TriggerSource {\n  const source = options.source ?? \"standard\";\n  const verify = standardVerifier(\n    options.secret,\n    toleranceMs(options.toleranceMs, triggerDefaultToleranceMs),\n  );\n  return Object.freeze({\n    name: source,\n    async verify(request: TriggerHttpRequest, now: number) {\n      const delivery = await verify(request, now);\n      const payload = jsonBody(textBody(request.body));\n      return triggerEvent({\n        source,\n        delivery,\n        kind: payloadString(payload, \"type\") ?? \"webhook\",\n        payload,\n        receivedAt: new Date(now).toISOString(),\n      });\n    },\n  });\n}\n"]}
+{"version":3,"file":"standard-webhook.js","sourceRoot":"","sources":["../../../src/adapters/triggers/standard-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,GACb,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,eAAe,EACf,aAAa,GACd,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGpE,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,MAAM;QACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,SAAiB;IACvE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,OAA2B,EAAE,GAAW,EAAmB,EAAE;QACzE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC/D,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,IACE,CAAC,UAAU,CAAC,MAAM;YAClB,CAAC,gBAAgB,CACf,IAAI,EACJ,CAAC,GAAG,QAAQ,IAAI,SAAS,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAC3C,UAAU,CACX;YAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CACnC,OAA+B;IAE/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,MAAM,GAAG,gBAAgB,CAC7B,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAC5D,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,OAA2B,EAAE,GAAW;YACnD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO,oBAAoB,CAAC,GAAG,EAAE;gBAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjD,OAAO,YAAY,CAAC;oBAClB,MAAM;oBACN,QAAQ;oBACR,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,SAAS;oBACjD,OAAO;oBACP,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { decodeTriggerPayload } from \"../../domain/trigger-payload.ts\";\nimport { triggerDefaultToleranceMs } from \"../../domain/trigger.constants.ts\";\nimport {\n  payloadString,\n  triggerDelivery,\n  triggerEvent,\n} from \"../../domain/trigger.ts\";\nimport type {\n  TriggerHttpRequest,\n  TriggerSecret,\n  TriggerSource,\n} from \"../../domain/trigger.types.ts\";\nimport {\n  header,\n  signatureMatches,\n  timestampWithin,\n  webhookSecret,\n} from \"../../infrastructure/webhook-signature.ts\";\nimport { jsonBody, textBody, toleranceMs } from \"./trigger-body.ts\";\nimport type { StandardWebhookOptions } from \"./triggers.types.ts\";\n\nfunction signingKey(secret: string): Buffer {\n  const key = secret.startsWith(\"whsec_\")\n    ? Buffer.from(secret.slice(6), \"base64\")\n    : Buffer.alloc(0);\n  if (!key.length)\n    throw new Error(\"Signing secrets must use the whsec_ format\");\n  return key;\n}\n\n/** Verifies a Standard Webhooks signature and returns the message identifier. */\nexport function standardVerifier(secret: TriggerSecret, tolerance: number) {\n  const secrets = webhookSecret(secret, \"Standard webhook\");\n  return async (request: TriggerHttpRequest, now: number): Promise<string> => {\n    const delivery = triggerDelivery(header(request.headers, \"webhook-id\"));\n    const timestamp = header(request.headers, \"webhook-timestamp\");\n    timestampWithin(timestamp, now, tolerance);\n    const signatures = header(request.headers, \"webhook-signature\")\n      .split(\" \")\n      .filter((value) => value.startsWith(\"v1,\"))\n      .map((value) => Buffer.from(value.slice(3), \"base64\"));\n    const keys = (await secrets()).map(signingKey);\n    if (\n      !signatures.length ||\n      !signatureMatches(\n        keys,\n        [`${delivery}.${timestamp}.`, request.body],\n        signatures,\n      )\n    )\n      throw new Error(\"Webhook signature mismatch\");\n    return delivery;\n  };\n}\n\n/** Receive webhooks signed with the Standard Webhooks scheme. */\nexport function createStandardWebhook(\n  options: StandardWebhookOptions,\n): TriggerSource {\n  const source = options.source ?? \"standard\";\n  const verify = standardVerifier(\n    options.secret,\n    toleranceMs(options.toleranceMs, triggerDefaultToleranceMs),\n  );\n  return Object.freeze({\n    name: source,\n    async verify(request: TriggerHttpRequest, now: number) {\n      const delivery = await verify(request, now);\n      return decodeTriggerPayload(() => {\n        const payload = jsonBody(textBody(request.body));\n        return triggerEvent({\n          source,\n          delivery,\n          kind: payloadString(payload, \"type\") ?? \"webhook\",\n          payload,\n          receivedAt: new Date(now).toISOString(),\n        });\n      });\n    },\n  });\n}\n"]}

package/dist/application/agent-authentication.js

@@ -1,12 +1,15 @@
 import { readHostCredential } from "../infrastructure/host-credentials.js";
 import { requireSuccess } from "../infrastructure/process.js";
 import { credentialInstaller } from "./credential-installer.constants.js";
+import { invariant } from "../domain/errors.js";
 export async function authenticateAgent(adapter, variables, lease, placement, signal) {
     const plan = adapter.credentials?.(variables);
     if (!plan)
         return {};
-    if (placement === "host")
+    if (placement === "host") {
+        invariant(!plan.requiresSandbox, "This authentication mode requires a private sandbox home; use a sandbox provider or configure an explicit compatible model provider for local execution");
         return plan.variables;
+    }
     const files = [...plan.files];
     const derived = {};
     for (const credential of plan.host) {

package/dist/application/agent-authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-authentication.js","sourceRoot":"","sources":["../../src/application/agent-authentication.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAqB,EACrB,SAAoB,EACpB,KAAmB,EACnB,SAAuC,EACvC,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC;IAChD,MAAM,KAAK,GAA0B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,IAAI,UAAU,CAAC,WAAW;YAClC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;;YACxD,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM;QACd,MAAM,cAAc,CAClB;YACE,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,IAAI,EAAE,mBAAmB,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAClD,MAAM;SACP,EACD,MAAM,CACP,CAAC;IACJ,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACrE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;QACjC,MAAM,cAAc,CAClB,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,WAAW,EAAE,EAAE,MAAM,EAAE,EACnE,MAAM,CACP,CAAC;IACJ,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type {\n  AgentAdapter,\n  GeneratedCredential,\n} from \"../domain/agent.types.ts\";\nimport type { Variables } from \"../domain/command.types.ts\";\nimport type { SandboxLease, SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { readHostCredential } from \"../infrastructure/host-credentials.ts\";\nimport { requireSuccess } from \"../infrastructure/process.ts\";\nimport { credentialInstaller } from \"./credential-installer.constants.ts\";\n\nexport async function authenticateAgent(\n  adapter: AgentAdapter,\n  variables: Variables,\n  lease: SandboxLease,\n  placement: SandboxProvider[\"placement\"],\n  signal: AbortSignal,\n): Promise<Variables> {\n  const plan = adapter.credentials?.(variables);\n  if (!plan) return {};\n  if (placement === \"host\") return plan.variables;\n  const files: GeneratedCredential[] = [...plan.files];\n  const derived: Record<string, string> = {};\n  for (const credential of plan.host) {\n    const content = await readHostCredential(credential);\n    if (\"file\" in credential.destination)\n      files.push({ path: credential.destination.file, content });\n    else derived[credential.destination.variable] = content;\n  }\n  const invoke = lease.invoke.bind(lease);\n  if (files.length)\n    await requireSuccess(\n      {\n        executable: \"node\",\n        arguments: [\"-e\", credentialInstaller],\n        stdin: JSON.stringify({ home: lease.home, files }),\n        signal,\n      },\n      invoke,\n    );\n  const credentials = Object.freeze({ ...plan.variables, ...derived });\n  for (const command of plan.commands)\n    await requireSuccess(\n      { ...command, variables: { ...variables, ...credentials }, signal },\n      invoke,\n    );\n  return credentials;\n}\n"]}
+{"version":3,"file":"agent-authentication.js","sourceRoot":"","sources":["../../src/application/agent-authentication.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAqB,EACrB,SAAoB,EACpB,KAAmB,EACnB,SAAuC,EACvC,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,SAAS,CACP,CAAC,IAAI,CAAC,eAAe,EACrB,yJAAyJ,CAC1J,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,MAAM,KAAK,GAA0B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,IAAI,UAAU,CAAC,WAAW;YAClC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;;YACxD,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM;QACd,MAAM,cAAc,CAClB;YACE,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,IAAI,EAAE,mBAAmB,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAClD,MAAM;SACP,EACD,MAAM,CACP,CAAC;IACJ,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACrE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;QACjC,MAAM,cAAc,CAClB,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,WAAW,EAAE,EAAE,MAAM,EAAE,EACnE,MAAM,CACP,CAAC;IACJ,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type {\n  AgentAdapter,\n  GeneratedCredential,\n} from \"../domain/agent.types.ts\";\nimport type { Variables } from \"../domain/command.types.ts\";\nimport type { SandboxLease, SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { readHostCredential } from \"../infrastructure/host-credentials.ts\";\nimport { requireSuccess } from \"../infrastructure/process.ts\";\nimport { credentialInstaller } from \"./credential-installer.constants.ts\";\nimport { invariant } from \"../domain/errors.ts\";\n\nexport async function authenticateAgent(\n  adapter: AgentAdapter,\n  variables: Variables,\n  lease: SandboxLease,\n  placement: SandboxProvider[\"placement\"],\n  signal: AbortSignal,\n): Promise<Variables> {\n  const plan = adapter.credentials?.(variables);\n  if (!plan) return {};\n  if (placement === \"host\") {\n    invariant(\n      !plan.requiresSandbox,\n      \"This authentication mode requires a private sandbox home; use a sandbox provider or configure an explicit compatible model provider for local execution\",\n    );\n    return plan.variables;\n  }\n  const files: GeneratedCredential[] = [...plan.files];\n  const derived: Record<string, string> = {};\n  for (const credential of plan.host) {\n    const content = await readHostCredential(credential);\n    if (\"file\" in credential.destination)\n      files.push({ path: credential.destination.file, content });\n    else derived[credential.destination.variable] = content;\n  }\n  const invoke = lease.invoke.bind(lease);\n  if (files.length)\n    await requireSuccess(\n      {\n        executable: \"node\",\n        arguments: [\"-e\", credentialInstaller],\n        stdin: JSON.stringify({ home: lease.home, files }),\n        signal,\n      },\n      invoke,\n    );\n  const credentials = Object.freeze({ ...plan.variables, ...derived });\n  for (const command of plan.commands)\n    await requireSuccess(\n      { ...command, variables: { ...variables, ...credentials }, signal },\n      invoke,\n    );\n  return credentials;\n}\n"]}

package/dist/application/agent-turn.js

@@ -5,7 +5,7 @@ import { stopReason } from "./stop-reason.js";
 import { customTurn } from "./custom-turn.js";
 import { replayTurn } from "./replay-turn.js";
 import { cliSteering } from "./cli-steering.js";
-import { OutpostError } from "../domain/errors.js";
+import { OutpostError, recordRecovery } from "../domain/errors.js";
 import { activityWatchdog } from "./activity-watchdog.js";
 import { agentOutput } from "./agent-output.js";
 import { agentFailure } from "./agent-failure.js";
@@ -13,6 +13,7 @@ import { agentConnectionFailurePattern, executionDefaults, } from "./execution.c
 import { steeringInterruption } from "./execution.constants.js";
 import { modelUsage } from "../domain/usage.js";
 import { notify } from "./observation.js";
+import { openCliHooks } from "./cli-hooks.js";
 export async function turn(lease, agent, prompt, options, continuation, markers, pass, context) {
     if (agent.kind === "custom")
         return customTurn(lease, agent, prompt, options, pass, {
@@ -59,7 +60,12 @@ export async function turn(lease, agent, prompt, options, continuation, markers,
     let status = 0;
     let interrupted = false;
     let commandCompleted = false;
+    let hooks;
+    let hookCleanupFailure;
+    let executionFailure;
     try {
+        if (agent.hooks?.handlers.length)
+            hooks = await openCliHooks(agent.hooks, lease, signal, (error) => controller.abort(error));
         if (agent.usage === "session")
             warnUsage(options, pass, `${agent.name}: token usage is collected after the command exits; use budget.attempts and time limits to bound execution before the final counters arrive`);
         if (agent.usage === "unavailable") {
@@ -88,7 +94,7 @@ export async function turn(lease, agent, prompt, options, continuation, markers,
         });
         steering.start(request);
         const result = await lease.invoke({
-            ...steering.command(command),
+            ...steering.command(hooks ? hooks.command(command) : command),
             signal,
             deadlineMs: options.deadlineMs ?? executionDefaults.deadlineMs,
             observe(channel, chunk) {
@@ -108,9 +114,7 @@ export async function turn(lease, agent, prompt, options, continuation, markers,
         commandCompleted = true;
         status = result.status;
         output.flush();
-        if (controller.signal.reason instanceof OutpostError &&
-            controller.signal.reason.code === "stuck")
-            throw controller.signal.reason;
+        signal.throwIfAborted();
         if (status !== 0)
             throw new OutpostError("process", `Agent exited with status ${status}`, {
                 ...result,
@@ -118,6 +122,7 @@ export async function turn(lease, agent, prompt, options, continuation, markers,
             });
     }
     catch (cause) {
+        executionFailure = cause;
         const reason = stopReason(options.signal, controller.signal.reason, cause);
         if (reason)
             notify(options.observe, {
@@ -144,6 +149,14 @@ export async function turn(lease, agent, prompt, options, continuation, markers,
             notify(options.warn, "Agent remained active after completion; its command was stopped and trailing output retained");
     }
     finally {
+        try {
+            await hooks?.close();
+        }
+        catch (error) {
+            hookCleanupFailure = error;
+            if (executionFailure)
+                recordRecovery(executionFailure, { hookCleanupError: error });
+        }
         steering.close();
         stderr.flush();
         watchdog.close();
@@ -156,6 +169,8 @@ export async function turn(lease, agent, prompt, options, continuation, markers,
         await collectAgentUsage(lease, agent, output, options, pass, commandCompleted);
     }
     options.signal?.throwIfAborted();
+    if (hookCleanupFailure)
+        throw hookCleanupFailure;
     let outcome;
     try {
         outcome = interrupted ? output.partial() : output.result();

package/dist/application/agent-turn.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-turn.js","sourceRoot":"","sources":["../../src/application/agent-turn.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,KAAmB,EACnB,KAAY,EACZ,MAAc,EACd,OAAiC,EACjC,YAA6C,EAC7C,OAA0B,EAC1B,IAAY,EACZ,OAAoB;IAEpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QACzB,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;YACrD,GAAG,OAAO;YACV,YAAY;SACb,CAAC,CAAC;IACL,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QACzB,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;QAC3B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;IACtB,IAAI,oBAAwC,CAAC;IAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;QACxD,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,IAAI,oBAAoB;QAC/D,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS;QACjC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,UAAU,EACV,OAAO,EACP,IAAI,EACJ,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,KAAuB,EAAE,EAAE;QAC1C,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CACJ,OAAO,CAAC,OAAO,EACf,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM;YACtC,CAAC,CAAC;gBACE,GAAG,KAAK;gBACR,MAAM,EAAE,UAAU,CAChB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,EAAE,IAAI,EACjB,KAAK,CAAC,UAAU,KAAK,UAAU,CAChC;aACF;YACH,CAAC,CAAC,KAAK,CACV,CAAC;QACF,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAC9C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,SAAS;YACT,IAAI;YACJ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAC3B,SAAS,CACP,OAAO,EACP,IAAI,EACJ,GAAG,KAAK,CAAC,IAAI,6IAA6I,CAC3J,CAAC;QACJ,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YAClC,SAAS,CACP,OAAO,EACP,IAAI,EACJ,GAAG,KAAK,CAAC,IAAI,mEAAmE,CACjF,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,MAAM;YACZ,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,KAAK,EACL,OAAO,EACP,CAAC,OAAO,EAAE,EAAE,CACV,KAAK,CAAC,MAAM,CAAC;YACX,GAAG,OAAO;YACV,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,UAAU;SAC/D,CAAC,EACJ,CAAC,EAAE,EAAE,EAAE;YACL,oBAAoB,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC;gBACN,IAAI,EAAE,cAAc;gBACpB,EAAE;gBACF,IAAI;gBACJ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YAChC,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;YAC5B,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,UAAU;YAC9D,OAAO,CAAC,OAAO,EAAE,KAAK;gBACpB,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACvB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO,KAAK,QAAQ;oBAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC/C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC;SACF,CAAC,CAAC;QACH,gBAAgB,GAAG,IAAI,CAAC;QACxB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IACE,UAAU,CAAC,MAAM,CAAC,MAAM,YAAY,YAAY;YAChD,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;YAEzC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QACjC,IAAI,MAAM,KAAK,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,4BAA4B,MAAM,EAAE,EAAE;gBACtE,GAAG,MAAM;gBACT,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,oBAAoB;aAC1D,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM;YACR,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;gBACtB,IAAI,EAAE,SAAS;gBACf,MAAM;gBACN,IAAI;gBACJ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B,CAAC,CAAC;QACL,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,oBAAoB,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,GACT,UAAU,CAAC,MAAM,CAAC,MAAM,YAAY,YAAY;gBAC9C,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM;gBAC1B,CAAC,CAAC,KAAK,CAAC;YACZ,IACE,KAAK,YAAY,YAAY;gBAC7B,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,MAAM,CAAC,OAAO;gBACd,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBAElD,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,WAAW;YACd,MAAM,CACJ,OAAO,CAAC,IAAI,EACZ,8FAA8F,CAC/F,CAAC;IACN,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,MAAM,iBAAiB,CACrB,KAAK,EACL,KAAK,EACL,MAAM,EACN,OAAO,EACP,IAAI,EACJ,gBAAgB,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,IAAI,OAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO;QACL,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,OAAO;QACV,GAAG,CAAC,OAAO,CAAC,MAAM;YAChB,CAAC,CAAC;gBACE,KAAK,EAAE,UAAU,CACf,OAAO,CAAC,KAAK,EACb,KAAK,CAAC,KAAK,EAAE,IAAI,EACjB,KAAK,CAAC,UAAU,KAAK,UAAU,CAChC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM;QACN,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC","sourcesContent":["import {\n  collectAgentUsage,\n  prepareAgentUsage,\n  warnUsage,\n} from \"./agent-usage.ts\";\nimport { agentRequest } from \"./agent-request.ts\";\nimport { boundedLines } from \"./output-lines.ts\";\nimport { stopReason } from \"./stop-reason.ts\";\nimport { customTurn } from \"./custom-turn.ts\";\nimport { replayTurn } from \"./replay-turn.ts\";\nimport type { Agent, AgentObservation } from \"../domain/agent.types.ts\";\nimport { cliSteering } from \"./cli-steering.ts\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport { activityWatchdog } from \"./activity-watchdog.ts\";\nimport { agentOutput } from \"./agent-output.ts\";\nimport { agentFailure } from \"./agent-failure.ts\";\nimport {\n  agentConnectionFailurePattern,\n  executionDefaults,\n} from \"./execution.constants.ts\";\nimport type { DispatchOptions, Turn, TurnContext } from \"./execution.types.ts\";\nimport { steeringInterruption } from \"./execution.constants.ts\";\nimport { modelUsage } from \"../domain/usage.ts\";\nimport { notify } from \"./observation.ts\";\n\nexport async function turn(\n  lease: SandboxLease,\n  agent: Agent,\n  prompt: string,\n  options: DispatchOptions<unknown>,\n  continuation: DispatchOptions[\"continuation\"],\n  markers: readonly string[],\n  pass: number,\n  context: TurnContext,\n): Promise<Turn> {\n  if (agent.kind === \"custom\")\n    return customTurn(lease, agent, prompt, options, pass, {\n      ...context,\n      continuation,\n    });\n  if (agent.kind === \"replay\")\n    return replayTurn(lease, agent, prompt, options, pass);\n  const start = Date.now();\n  const controller = new AbortController();\n  const signal = options.signal\n    ? AbortSignal.any([options.signal, controller.signal])\n    : controller.signal;\n  let preparedConversation: string | undefined;\n  const steering = cliSteering(agent, lease, options, pass, {\n    conversation: () => output.conversation ?? preparedConversation,\n    completed: () => output.completed,\n    interrupt: () => controller.abort(steeringInterruption),\n  });\n  const watchdog = activityWatchdog(\n    controller,\n    options,\n    pass,\n    context.repetition,\n  );\n  const observe = (event: AgentObservation) => {\n    steering.observe(event);\n    notify(\n      options.observe,\n      event.kind === \"usage\" && options.prices\n        ? {\n            ...event,\n            tokens: modelUsage(\n              event.tokens,\n              agent.model?.name,\n              agent.usageInput !== \"uncached\",\n            ),\n          }\n        : event,\n    );\n    watchdog.observe(event);\n  };\n  const output = agentOutput(agent, { ...options, observe }, markers, pass);\n  const failure = agentFailure(agent, output);\n  watchdog.refresh(false);\n  const stderr = boundedLines((text, truncated) => {\n    failure.observe(text);\n    notify(options.observe, {\n      kind: \"stderr\",\n      text,\n      truncated,\n      pass,\n      at: new Date().toISOString(),\n    });\n  });\n  let status = 0;\n  let interrupted = false;\n  let commandCompleted = false;\n  try {\n    if (agent.usage === \"session\")\n      warnUsage(\n        options,\n        pass,\n        `${agent.name}: token usage is collected after the command exits; use budget.attempts and time limits to bound execution before the final counters arrive`,\n      );\n    if (agent.usage === \"unavailable\") {\n      warnUsage(\n        options,\n        pass,\n        `${agent.name}: token usage is unavailable; use budget.attempts and time limits`,\n      );\n      output.recordUsage({ input: 0, cached: 0, output: 0, complete: false });\n    }\n    await prepareAgentUsage(lease, agent, output, continuation, signal);\n    signal.throwIfAborted();\n    const request = {\n      text: prompt,\n      ...(steering.liveInput ? { liveInput: true } : {}),\n      ...(continuation ? { continuation } : {}),\n    };\n    const command = await agentRequest(\n      agent,\n      request,\n      (command) =>\n        lease.invoke({\n          ...command,\n          signal,\n          deadlineMs: options.deadlineMs ?? executionDefaults.deadlineMs,\n        }),\n      (id) => {\n        preparedConversation = id;\n        observe({\n          kind: \"conversation\",\n          id,\n          pass,\n          at: new Date().toISOString(),\n        });\n      },\n    );\n    steering.start(request);\n    const result = await lease.invoke({\n      ...steering.command(command),\n      signal,\n      deadlineMs: options.deadlineMs ?? executionDefaults.deadlineMs,\n      observe(channel, chunk) {\n        if (channel === \"stdout\") {\n          try {\n            output.append(chunk);\n          } catch (cause) {\n            controller.abort(cause);\n          }\n        }\n        if (channel === \"stderr\") stderr.append(chunk);\n        watchdog.refresh(output.completed);\n      },\n    });\n    commandCompleted = true;\n    status = result.status;\n    output.flush();\n    if (\n      controller.signal.reason instanceof OutpostError &&\n      controller.signal.reason.code === \"stuck\"\n    )\n      throw controller.signal.reason;\n    if (status !== 0)\n      throw new OutpostError(\"process\", `Agent exited with status ${status}`, {\n        ...result,\n        conversation: output.conversation ?? preparedConversation,\n      });\n  } catch (cause) {\n    const reason = stopReason(options.signal, controller.signal.reason, cause);\n    if (reason)\n      notify(options.observe, {\n        kind: \"stopped\",\n        reason,\n        pass,\n        at: new Date().toISOString(),\n      });\n    options.signal?.throwIfAborted();\n    interrupted = controller.signal.reason === steeringInterruption;\n    if (controller.signal.reason !== \"completion\" && !interrupted) {\n      const error =\n        controller.signal.reason instanceof OutpostError\n          ? controller.signal.reason\n          : cause;\n      if (\n        error instanceof OutpostError &&\n        error.code === \"timeout\" &&\n        output.failure &&\n        agentConnectionFailurePattern.test(output.failure)\n      )\n        throw failure.connection(error);\n      stderr.flush();\n      throw failure.classify(error);\n    }\n    if (!interrupted)\n      notify(\n        options.warn,\n        \"Agent remained active after completion; its command was stopped and trailing output retained\",\n      );\n  } finally {\n    steering.close();\n    stderr.flush();\n    watchdog.close();\n    try {\n      output.flush();\n    } catch {\n      commandCompleted = false;\n    }\n    await collectAgentUsage(\n      lease,\n      agent,\n      output,\n      options,\n      pass,\n      commandCompleted,\n    );\n  }\n  options.signal?.throwIfAborted();\n  let outcome: ReturnType<typeof output.result>;\n  try {\n    outcome = interrupted ? output.partial() : output.result();\n  } catch (error) {\n    throw failure.classify(error);\n  }\n  return {\n    ...(preparedConversation ? { conversation: preparedConversation } : {}),\n    ...outcome,\n    ...(options.prices\n      ? {\n          usage: modelUsage(\n            outcome.usage,\n            agent.model?.name,\n            agent.usageInput !== \"uncached\",\n          ),\n        }\n      : {}),\n    status,\n    ...(interrupted ? { interrupted: \"steering\" as const } : {}),\n    durationMs: Date.now() - start,\n  };\n}\n"]}
+{"version":3,"file":"agent-turn.js","sourceRoot":"","sources":["../../src/application/agent-turn.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,KAAmB,EACnB,KAAY,EACZ,MAAc,EACd,OAAiC,EACjC,YAA6C,EAC7C,OAA0B,EAC1B,IAAY,EACZ,OAAoB;IAEpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QACzB,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;YACrD,GAAG,OAAO;YACV,YAAY;SACb,CAAC,CAAC;IACL,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QACzB,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;QAC3B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;IACtB,IAAI,oBAAwC,CAAC;IAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;QACxD,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,IAAI,oBAAoB;QAC/D,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS;QACjC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,UAAU,EACV,OAAO,EACP,IAAI,EACJ,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,KAAuB,EAAE,EAAE;QAC1C,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CACJ,OAAO,CAAC,OAAO,EACf,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM;YACtC,CAAC,CAAC;gBACE,GAAG,KAAK;gBACR,MAAM,EAAE,UAAU,CAChB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,EAAE,IAAI,EACjB,KAAK,CAAC,UAAU,KAAK,UAAU,CAChC;aACF;YACH,CAAC,CAAC,KAAK,CACV,CAAC;QACF,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAC9C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,SAAS;YACT,IAAI;YACJ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,KAAwC,CAAC;IAC7C,IAAI,kBAA2B,CAAC;IAChC,IAAI,gBAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM;YAC9B,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/D,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CACxB,CAAC;QACJ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAC3B,SAAS,CACP,OAAO,EACP,IAAI,EACJ,GAAG,KAAK,CAAC,IAAI,6IAA6I,CAC3J,CAAC;QACJ,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YAClC,SAAS,CACP,OAAO,EACP,IAAI,EACJ,GAAG,KAAK,CAAC,IAAI,mEAAmE,CACjF,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,MAAM;YACZ,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,KAAK,EACL,OAAO,EACP,CAAC,OAAO,EAAE,EAAE,CACV,KAAK,CAAC,MAAM,CAAC;YACX,GAAG,OAAO;YACV,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,UAAU;SAC/D,CAAC,EACJ,CAAC,EAAE,EAAE,EAAE;YACL,oBAAoB,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC;gBACN,IAAI,EAAE,cAAc;gBACpB,EAAE;gBACF,IAAI;gBACJ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YAChC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7D,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,UAAU;YAC9D,OAAO,CAAC,OAAO,EAAE,KAAK;gBACpB,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACvB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO,KAAK,QAAQ;oBAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC/C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC;SACF,CAAC,CAAC;QACH,gBAAgB,GAAG,IAAI,CAAC;QACxB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,MAAM,KAAK,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,4BAA4B,MAAM,EAAE,EAAE;gBACtE,GAAG,MAAM;gBACT,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,oBAAoB;aAC1D,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,GAAG,KAAK,CAAC;QACzB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM;YACR,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;gBACtB,IAAI,EAAE,SAAS;gBACf,MAAM;gBACN,IAAI;gBACJ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B,CAAC,CAAC;QACL,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,oBAAoB,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,GACT,UAAU,CAAC,MAAM,CAAC,MAAM,YAAY,YAAY;gBAC9C,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM;gBAC1B,CAAC,CAAC,KAAK,CAAC;YACZ,IACE,KAAK,YAAY,YAAY;gBAC7B,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,MAAM,CAAC,OAAO;gBACd,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBAElD,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,WAAW;YACd,MAAM,CACJ,OAAO,CAAC,IAAI,EACZ,8FAA8F,CAC/F,CAAC;IACN,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,GAAG,KAAK,CAAC;YAC3B,IAAI,gBAAgB;gBAClB,cAAc,CAAC,gBAAgB,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,MAAM,iBAAiB,CACrB,KAAK,EACL,KAAK,EACL,MAAM,EACN,OAAO,EACP,IAAI,EACJ,gBAAgB,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,IAAI,kBAAkB;QAAE,MAAM,kBAAkB,CAAC;IACjD,IAAI,OAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO;QACL,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,OAAO;QACV,GAAG,CAAC,OAAO,CAAC,MAAM;YAChB,CAAC,CAAC;gBACE,KAAK,EAAE,UAAU,CACf,OAAO,CAAC,KAAK,EACb,KAAK,CAAC,KAAK,EAAE,IAAI,EACjB,KAAK,CAAC,UAAU,KAAK,UAAU,CAChC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM;QACN,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC","sourcesContent":["import {\n  collectAgentUsage,\n  prepareAgentUsage,\n  warnUsage,\n} from \"./agent-usage.ts\";\nimport { agentRequest } from \"./agent-request.ts\";\nimport { boundedLines } from \"./output-lines.ts\";\nimport { stopReason } from \"./stop-reason.ts\";\nimport { customTurn } from \"./custom-turn.ts\";\nimport { replayTurn } from \"./replay-turn.ts\";\nimport type { Agent, AgentObservation } from \"../domain/agent.types.ts\";\nimport { cliSteering } from \"./cli-steering.ts\";\nimport { OutpostError, recordRecovery } from \"../domain/errors.ts\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport { activityWatchdog } from \"./activity-watchdog.ts\";\nimport { agentOutput } from \"./agent-output.ts\";\nimport { agentFailure } from \"./agent-failure.ts\";\nimport {\n  agentConnectionFailurePattern,\n  executionDefaults,\n} from \"./execution.constants.ts\";\nimport type { DispatchOptions, Turn, TurnContext } from \"./execution.types.ts\";\nimport { steeringInterruption } from \"./execution.constants.ts\";\nimport { modelUsage } from \"../domain/usage.ts\";\nimport { notify } from \"./observation.ts\";\nimport { openCliHooks } from \"./cli-hooks.ts\";\nimport type { AgentHookInstallation } from \"../domain/agent-hook.types.ts\";\n\nexport async function turn(\n  lease: SandboxLease,\n  agent: Agent,\n  prompt: string,\n  options: DispatchOptions<unknown>,\n  continuation: DispatchOptions[\"continuation\"],\n  markers: readonly string[],\n  pass: number,\n  context: TurnContext,\n): Promise<Turn> {\n  if (agent.kind === \"custom\")\n    return customTurn(lease, agent, prompt, options, pass, {\n      ...context,\n      continuation,\n    });\n  if (agent.kind === \"replay\")\n    return replayTurn(lease, agent, prompt, options, pass);\n  const start = Date.now();\n  const controller = new AbortController();\n  const signal = options.signal\n    ? AbortSignal.any([options.signal, controller.signal])\n    : controller.signal;\n  let preparedConversation: string | undefined;\n  const steering = cliSteering(agent, lease, options, pass, {\n    conversation: () => output.conversation ?? preparedConversation,\n    completed: () => output.completed,\n    interrupt: () => controller.abort(steeringInterruption),\n  });\n  const watchdog = activityWatchdog(\n    controller,\n    options,\n    pass,\n    context.repetition,\n  );\n  const observe = (event: AgentObservation) => {\n    steering.observe(event);\n    notify(\n      options.observe,\n      event.kind === \"usage\" && options.prices\n        ? {\n            ...event,\n            tokens: modelUsage(\n              event.tokens,\n              agent.model?.name,\n              agent.usageInput !== \"uncached\",\n            ),\n          }\n        : event,\n    );\n    watchdog.observe(event);\n  };\n  const output = agentOutput(agent, { ...options, observe }, markers, pass);\n  const failure = agentFailure(agent, output);\n  watchdog.refresh(false);\n  const stderr = boundedLines((text, truncated) => {\n    failure.observe(text);\n    notify(options.observe, {\n      kind: \"stderr\",\n      text,\n      truncated,\n      pass,\n      at: new Date().toISOString(),\n    });\n  });\n  let status = 0;\n  let interrupted = false;\n  let commandCompleted = false;\n  let hooks: AgentHookInstallation | undefined;\n  let hookCleanupFailure: unknown;\n  let executionFailure: unknown;\n  try {\n    if (agent.hooks?.handlers.length)\n      hooks = await openCliHooks(agent.hooks, lease, signal, (error) =>\n        controller.abort(error),\n      );\n    if (agent.usage === \"session\")\n      warnUsage(\n        options,\n        pass,\n        `${agent.name}: token usage is collected after the command exits; use budget.attempts and time limits to bound execution before the final counters arrive`,\n      );\n    if (agent.usage === \"unavailable\") {\n      warnUsage(\n        options,\n        pass,\n        `${agent.name}: token usage is unavailable; use budget.attempts and time limits`,\n      );\n      output.recordUsage({ input: 0, cached: 0, output: 0, complete: false });\n    }\n    await prepareAgentUsage(lease, agent, output, continuation, signal);\n    signal.throwIfAborted();\n    const request = {\n      text: prompt,\n      ...(steering.liveInput ? { liveInput: true } : {}),\n      ...(continuation ? { continuation } : {}),\n    };\n    const command = await agentRequest(\n      agent,\n      request,\n      (command) =>\n        lease.invoke({\n          ...command,\n          signal,\n          deadlineMs: options.deadlineMs ?? executionDefaults.deadlineMs,\n        }),\n      (id) => {\n        preparedConversation = id;\n        observe({\n          kind: \"conversation\",\n          id,\n          pass,\n          at: new Date().toISOString(),\n        });\n      },\n    );\n    steering.start(request);\n    const result = await lease.invoke({\n      ...steering.command(hooks ? hooks.command(command) : command),\n      signal,\n      deadlineMs: options.deadlineMs ?? executionDefaults.deadlineMs,\n      observe(channel, chunk) {\n        if (channel === \"stdout\") {\n          try {\n            output.append(chunk);\n          } catch (cause) {\n            controller.abort(cause);\n          }\n        }\n        if (channel === \"stderr\") stderr.append(chunk);\n        watchdog.refresh(output.completed);\n      },\n    });\n    commandCompleted = true;\n    status = result.status;\n    output.flush();\n    signal.throwIfAborted();\n    if (status !== 0)\n      throw new OutpostError(\"process\", `Agent exited with status ${status}`, {\n        ...result,\n        conversation: output.conversation ?? preparedConversation,\n      });\n  } catch (cause) {\n    executionFailure = cause;\n    const reason = stopReason(options.signal, controller.signal.reason, cause);\n    if (reason)\n      notify(options.observe, {\n        kind: \"stopped\",\n        reason,\n        pass,\n        at: new Date().toISOString(),\n      });\n    options.signal?.throwIfAborted();\n    interrupted = controller.signal.reason === steeringInterruption;\n    if (controller.signal.reason !== \"completion\" && !interrupted) {\n      const error =\n        controller.signal.reason instanceof OutpostError\n          ? controller.signal.reason\n          : cause;\n      if (\n        error instanceof OutpostError &&\n        error.code === \"timeout\" &&\n        output.failure &&\n        agentConnectionFailurePattern.test(output.failure)\n      )\n        throw failure.connection(error);\n      stderr.flush();\n      throw failure.classify(error);\n    }\n    if (!interrupted)\n      notify(\n        options.warn,\n        \"Agent remained active after completion; its command was stopped and trailing output retained\",\n      );\n  } finally {\n    try {\n      await hooks?.close();\n    } catch (error) {\n      hookCleanupFailure = error;\n      if (executionFailure)\n        recordRecovery(executionFailure, { hookCleanupError: error });\n    }\n    steering.close();\n    stderr.flush();\n    watchdog.close();\n    try {\n      output.flush();\n    } catch {\n      commandCompleted = false;\n    }\n    await collectAgentUsage(\n      lease,\n      agent,\n      output,\n      options,\n      pass,\n      commandCompleted,\n    );\n  }\n  options.signal?.throwIfAborted();\n  if (hookCleanupFailure) throw hookCleanupFailure;\n  let outcome: ReturnType<typeof output.result>;\n  try {\n    outcome = interrupted ? output.partial() : output.result();\n  } catch (error) {\n    throw failure.classify(error);\n  }\n  return {\n    ...(preparedConversation ? { conversation: preparedConversation } : {}),\n    ...outcome,\n    ...(options.prices\n      ? {\n          usage: modelUsage(\n            outcome.usage,\n            agent.model?.name,\n            agent.usageInput !== \"uncached\",\n          ),\n        }\n      : {}),\n    status,\n    ...(interrupted ? { interrupted: \"steering\" as const } : {}),\n    durationMs: Date.now() - start,\n  };\n}\n"]}

package/dist/application/cli-hooks.constants.d.ts

@@ -0,0 +1,2 @@
+export declare const hookBridgeScript: string;
+export declare const hookClientScript: string;

package/dist/application/cli-hooks.constants.js

@@ -0,0 +1,69 @@
+export const hookBridgeScript = String.raw `
+const http = require('node:http');
+const readline = require('node:readline');
+const max = 1048576;
+const pending = new Map();
+let sequence = 0;
+const server = http.createServer((request, response) => {
+  if (request.method !== 'POST' || request.headers.authorization !== process.env.OUTPOST_HOOK_BRIDGE_TOKEN) { response.writeHead(403); response.end(); return; }
+  if (pending.size >= 32) { response.writeHead(429); response.end(); return; }
+  let body = ''; let oversized = false;
+  request.setEncoding('utf8');
+  request.on('data', chunk => { body += chunk; if (Buffer.byteLength(body) > max) { oversized = true; request.destroy(); } });
+  request.on('end', () => {
+    if (oversized) return;
+    try {
+      const value = JSON.parse(body);
+      const id = ++sequence;
+      pending.set(id, response);
+      response.on('close', () => pending.delete(id));
+      process.stdout.write(JSON.stringify({ id, hook: value.hook, event: value.event }) + '\n');
+    } catch { response.writeHead(400); response.end(); }
+  });
+});
+const lines = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
+lines.on('line', line => {
+  try { const value = JSON.parse(line); const response = pending.get(value.id); if (response) { pending.delete(value.id); response.end(JSON.stringify(value)); } }
+  catch { process.exitCode = 1; lines.close(); }
+});
+lines.on('close', () => {
+  for (const response of pending.values()) { response.writeHead(503); response.end(); }
+  server.close(); server.closeAllConnections();
+});
+server.listen(0, '127.0.0.1', () => process.stdout.write(JSON.stringify({ port: server.address().port }) + '\n'));
+`;
+export const hookClientScript = String.raw `
+const http = require('node:http');
+const { spawn } = require('node:child_process');
+const config = JSON.parse(Buffer.from(process.argv[1], 'base64').toString());
+const connection = process.env[config.variable];
+if (!connection) process.exit(0);
+let input = ''; const max = 1048576;
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => { input += chunk; if (Buffer.byteLength(input) > max) { console.error('Hook input exceeds its size limit'); process.exit(2); } });
+process.stdin.on('end', () => {
+  if (config.command) {
+    const command = config.command;
+    const child = spawn(command.executable, command.arguments || [], { cwd: command.directory || process.cwd(), env: { ...process.env, ...command.variables }, stdio: ['pipe', 'inherit', 'inherit'] });
+    child.on('error', () => { console.error('Cannot start hook command'); process.exitCode = 2; });
+    child.stdin.on('error', () => {}); child.stdin.end(input);
+    child.on('exit', (code, signal) => { process.exitCode = code === null ? 2 : code; });
+    return;
+  }
+  let event;
+  try { event = JSON.parse(input); } catch { console.error('Invalid hook input'); process.exitCode = 2; return; }
+  const { port, token } = JSON.parse(connection);
+  const request = http.request({ host: '127.0.0.1', port, method: 'POST', headers: { authorization: token, 'content-type': 'application/json' } }, response => {
+    let output = ''; response.setEncoding('utf8');
+    response.on('data', chunk => { output += chunk; if (Buffer.byteLength(output) > max * 2) request.destroy(new Error('Hook response too large')); });
+    response.on('end', () => {
+      try { if (response.statusCode !== 200) throw new Error('Hook bridge unavailable'); const value = JSON.parse(output); if (value.error) throw new Error(value.error); process.stdout.write(value.output || ''); }
+      catch (error) { console.error(error.message); process.exitCode = 2; }
+    });
+  });
+  request.setTimeout(config.timeoutMs, () => request.destroy(new Error('Hook bridge timed out')));
+  request.on('error', error => { console.error(error.message); process.exitCode = 2; });
+  request.end(JSON.stringify({ hook: config.index, event }));
+});
+`;
+//# sourceMappingURL=cli-hooks.constants.js.map

package/dist/application/cli-hooks.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-hooks.constants.js","sourceRoot":"","sources":["../../src/application/cli-hooks.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCzC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCzC,CAAC","sourcesContent":["export const hookBridgeScript = String.raw`\nconst http = require('node:http');\nconst readline = require('node:readline');\nconst max = 1048576;\nconst pending = new Map();\nlet sequence = 0;\nconst server = http.createServer((request, response) => {\n  if (request.method !== 'POST' || request.headers.authorization !== process.env.OUTPOST_HOOK_BRIDGE_TOKEN) { response.writeHead(403); response.end(); return; }\n  if (pending.size >= 32) { response.writeHead(429); response.end(); return; }\n  let body = ''; let oversized = false;\n  request.setEncoding('utf8');\n  request.on('data', chunk => { body += chunk; if (Buffer.byteLength(body) > max) { oversized = true; request.destroy(); } });\n  request.on('end', () => {\n    if (oversized) return;\n    try {\n      const value = JSON.parse(body);\n      const id = ++sequence;\n      pending.set(id, response);\n      response.on('close', () => pending.delete(id));\n      process.stdout.write(JSON.stringify({ id, hook: value.hook, event: value.event }) + '\\n');\n    } catch { response.writeHead(400); response.end(); }\n  });\n});\nconst lines = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });\nlines.on('line', line => {\n  try { const value = JSON.parse(line); const response = pending.get(value.id); if (response) { pending.delete(value.id); response.end(JSON.stringify(value)); } }\n  catch { process.exitCode = 1; lines.close(); }\n});\nlines.on('close', () => {\n  for (const response of pending.values()) { response.writeHead(503); response.end(); }\n  server.close(); server.closeAllConnections();\n});\nserver.listen(0, '127.0.0.1', () => process.stdout.write(JSON.stringify({ port: server.address().port }) + '\\n'));\n`;\n\nexport const hookClientScript = String.raw`\nconst http = require('node:http');\nconst { spawn } = require('node:child_process');\nconst config = JSON.parse(Buffer.from(process.argv[1], 'base64').toString());\nconst connection = process.env[config.variable];\nif (!connection) process.exit(0);\nlet input = ''; const max = 1048576;\nprocess.stdin.setEncoding('utf8');\nprocess.stdin.on('data', chunk => { input += chunk; if (Buffer.byteLength(input) > max) { console.error('Hook input exceeds its size limit'); process.exit(2); } });\nprocess.stdin.on('end', () => {\n  if (config.command) {\n    const command = config.command;\n    const child = spawn(command.executable, command.arguments || [], { cwd: command.directory || process.cwd(), env: { ...process.env, ...command.variables }, stdio: ['pipe', 'inherit', 'inherit'] });\n    child.on('error', () => { console.error('Cannot start hook command'); process.exitCode = 2; });\n    child.stdin.on('error', () => {}); child.stdin.end(input);\n    child.on('exit', (code, signal) => { process.exitCode = code === null ? 2 : code; });\n    return;\n  }\n  let event;\n  try { event = JSON.parse(input); } catch { console.error('Invalid hook input'); process.exitCode = 2; return; }\n  const { port, token } = JSON.parse(connection);\n  const request = http.request({ host: '127.0.0.1', port, method: 'POST', headers: { authorization: token, 'content-type': 'application/json' } }, response => {\n    let output = ''; response.setEncoding('utf8');\n    response.on('data', chunk => { output += chunk; if (Buffer.byteLength(output) > max * 2) request.destroy(new Error('Hook response too large')); });\n    response.on('end', () => {\n      try { if (response.statusCode !== 200) throw new Error('Hook bridge unavailable'); const value = JSON.parse(output); if (value.error) throw new Error(value.error); process.stdout.write(value.output || ''); }\n      catch (error) { console.error(error.message); process.exitCode = 2; }\n    });\n  });\n  request.setTimeout(config.timeoutMs, () => request.destroy(new Error('Hook bridge timed out')));\n  request.on('error', error => { console.error(error.message); process.exitCode = 2; });\n  request.end(JSON.stringify({ hook: config.index, event }));\n});\n`;\n"]}

package/dist/application/cli-hooks.d.ts

@@ -0,0 +1,3 @@
+import type { AgentHookInstallation, AgentHookPlan } from "../domain/agent-hook.types.ts";
+import type { SandboxLease } from "../domain/sandbox.types.ts";
+export declare function openCliHooks(plan: AgentHookPlan, sandbox: SandboxLease, signal: AbortSignal, fail: (error: unknown) => void): Promise<AgentHookInstallation>;