@gaia-ai/gaia 0.1.4

package/dist/plugins.js

@@ -0,0 +1,1557 @@
+// src/plugins/auth/basic.ts
+function basicAuthProvider(tokenBase64) {
+  const authProvider = {
+    id: "basic_auth",
+    displayName: "HTTP Basic (inline)",
+    capabilities: { login: false, logout: false, status: true },
+    async login() {
+      throw new Error("GAIA uses static inline HTTP Basic auth.");
+    },
+    async logout() {
+    },
+    async status() {
+      return { loggedIn: true, provider: "basic_auth" };
+    },
+    createAdapter() {
+      return {
+        async apply(req) {
+          return {
+            ...req,
+            headers: {
+              ...req.headers ?? {},
+              Authorization: `Basic ${tokenBase64}`
+            }
+          };
+        }
+      };
+    }
+  };
+  return { id: "gaia-basic-auth", authProvider };
+}
+
+// src/plugins/plugins.ts
+async function selectRemote(config) {
+  return config.remote.createRemote(config);
+}
+async function selectExecutor(config) {
+  return config.executor.createExecutor(config);
+}
+async function selectWorkspace(config) {
+  return config.workspace.createWorkspace(config);
+}
+async function selectAgent(config) {
+  return config.agent.createAgent(config);
+}
+
+// src/plugins/remote/drupal.ts
+import { resolveAuth } from "dropsh";
+import { createHttpClient, createJsonApiClient } from "dropsh/plugin";
+var ACTIVE = ["claimed", "running"];
+function parseTicketComments(included) {
+  if (!Array.isArray(included)) {
+    return [];
+  }
+  const comments = [];
+  for (const res of included) {
+    if (res?.type !== "gaia_comment--gaia_comment") {
+      continue;
+    }
+    const attrs = res.attributes ?? {};
+    const body = attrs.body;
+    const value = typeof body === "string" ? body : typeof body?.value === "string" ? body.value : "";
+    comments.push({
+      type: typeof attrs.gaia_comment_type === "string" ? attrs.gaia_comment_type : "comment",
+      body: value,
+      created: typeof attrs.created === "string" ? attrs.created : ""
+    });
+  }
+  return comments;
+}
+var DrupalGaiaRemote = class {
+  constructor(api) {
+    this.api = api;
+  }
+  api;
+  async fetchActiveRuns(id) {
+    const rows = await this.api.collection("gaia_run").where("conductor_id.machine_id", "=", id).whereIn("state", ACTIVE).fields(["state", "state_at_start", "worktree_path"]).page(100).list();
+    return Promise.all(
+      rows.map(async (r) => ({
+        runUuid: r.id,
+        ticketUuid: r.rel("ticket_id") ?? "",
+        ticketIdentifier: await this.getRunTicketIdentifier(r.id),
+        branchName: await this.getRunTicketBranchName(r.id),
+        state: r.attr("state") ?? "",
+        stateAtStart: r.attr("state_at_start") ?? "",
+        worktreePath: r.attr("worktree_path") ?? ""
+      }))
+    );
+  }
+  async activeRunCount(id) {
+    return this.api.collection("gaia_run").where("conductor_id.machine_id", "=", id).whereIn("state", ACTIVE).fields(["drupal_internal__id"]).page(100).count();
+  }
+  async claimNext(c) {
+    const res = await this.api.post("gaia/claim-next", {
+      data: {
+        attributes: {
+          lease_seconds: c.leaseSeconds,
+          // Server (`ConductorResolverTrait`) narrows to the caller's conductor
+          // by the `machine_id` attribute; `c.conductorId` IS the machine_id.
+          machine_id: c.conductorId
+        }
+      }
+    });
+    if (!res?.data) {
+      return null;
+    }
+    const d = res.data;
+    const rawId = d.attributes?.drupal_internal__id;
+    if (rawId === void 0 || rawId === null) {
+      throw new Error(`claimNext: missing drupal_internal__id on run ${d.id}`);
+    }
+    return {
+      runUuid: d.id,
+      runId: Number(rawId),
+      ticketUuid: d.relationships?.ticket_id?.data?.id ?? "",
+      stateAtStart: String(d.attributes?.state_at_start ?? ""),
+      // handler_id was dropped; the handler is the work the run does, i.e. the
+      // ticket state the run started in.
+      handler: String(d.attributes?.state_at_start ?? "")
+    };
+  }
+  async getTicket(uuid) {
+    const doc = await this.api.get(
+      `gaia_ticket/gaia_ticket/${uuid}?include=comments`
+    );
+    const attrs = doc.data?.attributes ?? {};
+    const issueUrl = typeof attrs.origin === "string" ? attrs.origin : void 0;
+    return {
+      uuid: doc.data?.id ?? uuid,
+      identifier: typeof attrs.identifier === "string" ? attrs.identifier : uuid,
+      title: typeof attrs.title === "string" ? attrs.title : "",
+      state: typeof attrs.state === "string" ? attrs.state : "",
+      branchName: typeof attrs.branch_name === "string" ? attrs.branch_name : "",
+      ...typeof attrs.base_branch === "string" && attrs.base_branch !== "" ? { baseBranch: attrs.base_branch } : {},
+      comments: parseTicketComments(doc.included),
+      ...issueUrl ? { issueUrl } : {}
+    };
+  }
+  async getRunWorktree(uuid) {
+    const r = await this.api.resource("gaia_run", uuid);
+    return r.attr("worktree_path") ?? "";
+  }
+  async getRunTicketIdentifier(uuid) {
+    const run = await this.api.resource("gaia_run", uuid);
+    const ticketUuid = run.rel("ticket_id");
+    if (!ticketUuid) {
+      return "";
+    }
+    const ticket = await this.api.resource("gaia_ticket", ticketUuid);
+    return ticket.attr("identifier") ?? "";
+  }
+  async getRunTicketBranchName(uuid) {
+    const run = await this.api.resource("gaia_run", uuid);
+    const ticketUuid = run.rel("ticket_id");
+    if (!ticketUuid) {
+      return "";
+    }
+    const ticket = await this.api.resource("gaia_ticket", ticketUuid);
+    return ticket.attr("branch_name") ?? "";
+  }
+  async registerConductor(reg) {
+    const r = await this.api.upsert(
+      "gaia_conductor",
+      { path: "machine_id", value: reg.id },
+      {
+        attributes: {
+          machine_id: reg.id,
+          status: "online",
+          workspace_root: reg.workspace,
+          label: reg.label,
+          states: reg.states,
+          max_parallel: reg.max_parallel
+        },
+        relationships: {
+          owner_user_id: {
+            data: { type: "user--user", id: await this.api.me() }
+          },
+          project_id: {
+            data: {
+              type: "gaia_project--gaia_project",
+              id: await this.projectUuid(reg.project)
+            }
+          }
+        }
+      }
+    );
+    return r.id;
+  }
+  async heartbeat(reg, load, lease = 300) {
+    const res = await this.api.post("gaia/heartbeat", {
+      data: {
+        attributes: {
+          machine_id: reg.id,
+          project: reg.project,
+          states: reg.states,
+          workspace_root: reg.workspace,
+          label: reg.label,
+          max_parallel: reg.max_parallel,
+          current_load: load,
+          lease_seconds: lease
+        }
+      }
+    });
+    const status = res?.data?.attributes?.status;
+    return typeof status === "string" ? status : "online";
+  }
+  async getConductorStatus(id) {
+    const c = await this.api.collection("gaia_conductor").where("machine_id", "=", id).fields(["status"]).first();
+    return c ? c.attr("status") ?? null : null;
+  }
+  async setConductorStatus(id, status) {
+    const c = await this.api.collection("gaia_conductor").where("machine_id", "=", id).first();
+    if (c) {
+      await this.api.update("gaia_conductor", c.id, { attributes: { status } });
+    }
+  }
+  async listConductors(owner) {
+    let col = this.api.collection("gaia_conductor");
+    if (owner === "me") {
+      col = col.where("owner_user_id.id", "=", await this.api.me());
+    }
+    const rows = await col.page(200).list();
+    return rows.map((r) => ({
+      id: r.attr("machine_id") ?? r.id,
+      project: "",
+      label: r.attr("label") ?? "",
+      status: r.attr("status") ?? "",
+      lastSeen: r.attr("last_seen") ?? 0,
+      load: r.attr("current_load") ?? 0
+    }));
+  }
+  async markRunning(uuid, attrs) {
+    const t = Math.floor(Date.now() / 1e3);
+    await this.api.update("gaia_run", uuid, {
+      attributes: {
+        state: "running",
+        heartbeat: t,
+        ...attrs?.worktree_path ? { worktree_path: attrs.worktree_path } : {}
+      }
+    });
+  }
+  async fetchFinalizableRuns(id) {
+    const rows = await this.api.collection("gaia_run").where("conductor_id.machine_id", "=", id).where("state", "=", "done").where("closed", "=", "0").fields(["worktree_path"]).page(100).list();
+    return rows.map((r) => ({
+      runUuid: r.id,
+      worktreePath: r.attr("worktree_path") ?? ""
+    }));
+  }
+  async finalizeRun(uuid, log) {
+    const t = Math.floor(Date.now() / 1e3);
+    await this.api.update("gaia_run", uuid, {
+      attributes: {
+        closed: true,
+        closed_date: t,
+        ...log ? { log } : {}
+      }
+    });
+  }
+  async fetchFinalizableTickets(id) {
+    const rows = await this.api.collection("gaia_ticket").where("conductor_id.machine_id", "=", id).where("state", "=", "done").where("closed", "=", "0").fields(["branch_name"]).page(100).list();
+    return Promise.all(
+      rows.map(async (r) => ({
+        ticketUuid: r.id,
+        branchName: r.attr("branch_name") ?? "",
+        worktreePath: await this.latestRunWorktree(r.id)
+      }))
+    );
+  }
+  async closeTicket(uuid) {
+    const t = Math.floor(Date.now() / 1e3);
+    await this.api.update("gaia_ticket", uuid, {
+      attributes: { closed: true, closed_date: t }
+    });
+  }
+  /**
+   * Absolute worktree path of the ticket's latest run (highest run id with a
+   * non-empty worktree_path), or '' when none — the cwd the cleanup command
+   * runs in. The conductor persists worktree_path on markRunning, so a done
+   * ticket's run carries the path even after the run closed.
+   */
+  async latestRunWorktree(ticketUuid) {
+    const rows = await this.api.collection("gaia_run").where("ticket_id.id", "=", ticketUuid).fields(["worktree_path", "drupal_internal__id"]).sort("-drupal_internal__id").page(100).list();
+    for (const r of rows) {
+      const path = r.attr("worktree_path");
+      if (path) {
+        return path;
+      }
+    }
+    return "";
+  }
+  async projectUuid(name) {
+    const p = await this.api.collection("gaia_project").where("name", "=", name).first();
+    if (!p) {
+      throw new Error(`gaia project "${name}" not found`);
+    }
+    return p.id;
+  }
+};
+function drupalRemote() {
+  return {
+    kind: "remote",
+    id: "drupal",
+    requiredModules: [],
+    async createRemote(config) {
+      const http = createHttpClient();
+      const auth = await resolveAuth({
+        baseUrl: config.site.base_url,
+        plugins: config.plugins ?? [],
+        http,
+        now: Date.now
+        // stateDir omitted → dropsh defaultStateDir() (~/.config/dropsh)
+      });
+      return new DrupalGaiaRemote(
+        createJsonApiClient({
+          baseUrl: config.site.base_url,
+          prefix: config.site.jsonapi_prefix,
+          http,
+          auth
+        })
+      );
+    }
+  };
+}
+
+// src/plugins/remote/fake.ts
+var ACTIVE2 = ["claimed", "running"];
+var FakeGaiaRemote = class {
+  calls = {
+    markRunning: [],
+    finalizeRun: [],
+    closeTicket: []
+  };
+  /**
+   * Override for reconcile tests: when set, `fetchActiveRuns` returns this
+   * list verbatim instead of deriving it from the internal runs map.
+   */
+  activeRuns = null;
+  runs = /* @__PURE__ */ new Map();
+  queue = [];
+  tickets;
+  conductorStatus = "online";
+  /** Stable counter for assigning numeric ids to unseeded runs. */
+  runIdCounter = 0;
+  constructor(seed = {}) {
+    this.tickets = seed.tickets ?? {};
+    for (const r of seed.runs ?? []) {
+      const handler = r.handler ?? "code";
+      const runId = r.id ?? ++this.runIdCounter;
+      this.runs.set(r.runUuid, {
+        runUuid: r.runUuid,
+        runId,
+        ticketUuid: r.ticketUuid,
+        handler,
+        state: r.state ?? r.stateAtStart,
+        stateAtStart: r.stateAtStart,
+        ...r.worktreePath !== void 0 ? { worktreePath: r.worktreePath } : {},
+        ...r.closed !== void 0 ? { closed: r.closed } : {}
+      });
+      this.queue.push({
+        runUuid: r.runUuid,
+        runId,
+        ticketUuid: r.ticketUuid,
+        stateAtStart: r.stateAtStart,
+        handler
+      });
+    }
+  }
+  async registerConductor(_reg) {
+    this.conductorStatus = "online";
+    return "fake-conductor-uuid";
+  }
+  async heartbeat() {
+    this.conductorStatus = "online";
+    return this.conductorStatus;
+  }
+  async getConductorStatus(_conductorId) {
+    return this.conductorStatus;
+  }
+  async setConductorStatus(_conductorId, status) {
+    this.conductorStatus = status;
+  }
+  async listConductors(_owner) {
+    return [];
+  }
+  async activeRunCount(_conductorId) {
+    return this.internalActiveRuns().length;
+  }
+  async fetchActiveRuns(_conductorId) {
+    if (this.activeRuns !== null) {
+      return this.activeRuns;
+    }
+    return this.internalActiveRuns().map((r) => {
+      const ticket = this.tickets[r.ticketUuid];
+      const identifier = ticket?.identifier ?? "";
+      const branchName = ticket?.branchName ?? (identifier ? `gaia/${identifier.toLowerCase()}` : "");
+      return {
+        runUuid: r.runUuid,
+        ticketUuid: r.ticketUuid,
+        ticketIdentifier: identifier,
+        branchName,
+        state: r.state,
+        stateAtStart: r.stateAtStart,
+        worktreePath: r.worktreePath ?? ""
+      };
+    });
+  }
+  async claimNext(_claim) {
+    return this.queue.shift() ?? null;
+  }
+  async getTicket(ticketUuid) {
+    const t = this.tickets[ticketUuid];
+    if (!t) {
+      throw new Error(`fake remote: ticket ${ticketUuid} not seeded`);
+    }
+    const branchName = t.branchName ?? `gaia/${t.identifier.toLowerCase()}`;
+    return {
+      uuid: ticketUuid,
+      identifier: t.identifier,
+      title: t.title,
+      state: t.state,
+      branchName,
+      ...t.baseBranch ? { baseBranch: t.baseBranch } : {},
+      comments: t.comments ?? [],
+      ...t.url ? { issueUrl: t.url } : {}
+    };
+  }
+  async getRunWorktree(runUuid) {
+    return this.runs.get(runUuid)?.worktreePath ?? "";
+  }
+  async getRunTicketIdentifier(runUuid) {
+    const ticketUuid = this.runs.get(runUuid)?.ticketUuid;
+    if (!ticketUuid) {
+      return "";
+    }
+    return this.tickets[ticketUuid]?.identifier ?? "";
+  }
+  async getRunTicketBranchName(runUuid) {
+    const ticketUuid = this.runs.get(runUuid)?.ticketUuid;
+    if (!ticketUuid) {
+      return "";
+    }
+    const ticket = this.tickets[ticketUuid];
+    if (!ticket) {
+      return "";
+    }
+    return ticket.branchName ?? `gaia/${ticket.identifier.toLowerCase()}`;
+  }
+  async markRunning(runUuid, attrs) {
+    this.calls.markRunning.push({
+      runUuid,
+      ...attrs ? {
+        attrs: {
+          ...attrs.worktree_path ? { worktree_path: attrs.worktree_path } : {}
+        }
+      } : {}
+    });
+    const run = this.runs.get(runUuid);
+    if (run) {
+      run.state = "running";
+      if (attrs?.worktree_path) {
+        run.worktreePath = attrs.worktree_path;
+      }
+    }
+  }
+  async fetchFinalizableRuns(_conductorId) {
+    return [...this.runs.values()].filter((r) => r.state === "done" && !r.closed).map((r) => ({ runUuid: r.runUuid, worktreePath: r.worktreePath ?? "" }));
+  }
+  async finalizeRun(runUuid, log) {
+    this.calls.finalizeRun.push({ runUuid, log });
+    const run = this.runs.get(runUuid);
+    if (run) {
+      run.closed = true;
+      if (log) run.log = log;
+    }
+  }
+  async fetchFinalizableTickets(_conductorId) {
+    return Object.entries(this.tickets).filter(([, t]) => t.state === "done" && !t.closed).map(([ticketUuid, t]) => ({
+      ticketUuid,
+      branchName: t.branchName ?? `gaia/${t.identifier.toLowerCase()}`,
+      worktreePath: this.latestRunWorktree(ticketUuid)
+    }));
+  }
+  async closeTicket(uuid) {
+    this.calls.closeTicket.push(uuid);
+    const t = this.tickets[uuid];
+    if (t) {
+      t.closed = true;
+    }
+  }
+  /** Worktree path of the ticket's most recently seeded run, or '' when none. */
+  latestRunWorktree(ticketUuid) {
+    let worktree = "";
+    for (const r of this.runs.values()) {
+      if (r.ticketUuid === ticketUuid && r.worktreePath) {
+        worktree = r.worktreePath;
+      }
+    }
+    return worktree;
+  }
+  internalActiveRuns() {
+    return [...this.runs.values()].filter((r) => ACTIVE2.includes(r.state));
+  }
+};
+function fakeRemote(seed = {}) {
+  const remote = new FakeGaiaRemote(seed);
+  return {
+    kind: "remote",
+    id: "fake",
+    requiredModules: [],
+    async createRemote(_config) {
+      return remote;
+    }
+  };
+}
+
+// src/plugins/workspace/fake.ts
+var FakeWorkspace = class {
+  async ensure(identifier, _title) {
+    return { path: `/fake/${identifier}`, instructions: null };
+  }
+  async beforeRun(_path) {
+  }
+  async afterRun(_path) {
+  }
+  async afterDone(_path) {
+  }
+};
+function fakeWorkspace() {
+  const workspace = new FakeWorkspace();
+  return {
+    kind: "workspace",
+    id: "fake",
+    requiredModules: [],
+    async createWorkspace(_config) {
+      return workspace;
+    }
+  };
+}
+
+// src/plugins/workspace/git.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { dirname, join, resolve as resolve2 } from "node:path";
+
+// src/core/exec.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var ExecError = class extends Error {
+  constructor(file, args, exitCode, stderr, options) {
+    super(`exec failed: ${file}`, options);
+    this.file = file;
+    this.args = args;
+    this.exitCode = exitCode;
+    this.stderr = stderr;
+    this.name = "ExecError";
+  }
+  file;
+  args;
+  exitCode;
+  stderr;
+};
+var CommandRunner = class {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  logger;
+  async run(file, args, opts = {}) {
+    try {
+      const { stdout } = await execFileAsync(file, args, {
+        encoding: "utf8",
+        ...opts
+      });
+      this.logger.debug({ file, args, cwd: opts.cwd }, "exec ok");
+      return stdout;
+    } catch (err) {
+      const e = err;
+      const exitCode = typeof e.code === "number" ? e.code : null;
+      const stderr = e.stderr ?? "";
+      this.logger.error(
+        { file, args, cwd: opts.cwd, exitCode, stderr },
+        "exec failed"
+      );
+      throw new ExecError(file, args, exitCode, stderr, { cause: err });
+    }
+  }
+};
+var noopLogger = {
+  debug() {
+  },
+  info() {
+  },
+  warn() {
+  },
+  error() {
+  }
+};
+var defaultRunner = new CommandRunner(noopLogger);
+function exec(file, args, opts = {}) {
+  return defaultRunner.run(file, args, opts);
+}
+
+// src/core/slug.ts
+var DEFAULT_SLUG_MAX_LENGTH = 40;
+function slugify(text, maxLength = DEFAULT_SLUG_MAX_LENGTH) {
+  const slug = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (slug.length <= maxLength) {
+    return slug;
+  }
+  return slug.slice(0, maxLength).replace(/-+$/g, "");
+}
+
+// src/plugins/workspace/instructions.ts
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+function loadInstructions(workspacePath) {
+  const path = resolve(workspacePath, "WORKFLOW.md");
+  if (!existsSync(path)) {
+    return null;
+  }
+  const text = readFileSync(path, "utf8");
+  return {
+    path,
+    sha256: createHash("sha256").update(text).digest("hex"),
+    text
+  };
+}
+
+// src/plugins/workspace/git.ts
+var DEFAULT_BRANCH_TEMPLATE = "{branchPrefix}{key}-{titleSlug}";
+function renderBranchTemplate(template, vars) {
+  const rendered = template.replace(/\{(\w+)\}/g, (whole, key) => {
+    const value = vars[key];
+    return value === void 0 ? whole : value;
+  });
+  return rendered.replace(/[-_./]+$/g, "");
+}
+var defaultHookRunner = async (command, cwd) => {
+  await exec("sh", ["-c", command], { cwd });
+};
+var defaultGitRunner = async (args, cwd) => {
+  await exec("git", args, { cwd });
+};
+var GitWorkspace = class {
+  constructor(options) {
+    this.options = options;
+    this.runHook = options.runHook ?? defaultHookRunner;
+    this.runGit = options.runGit ?? defaultGitRunner;
+    this.root = resolve2(options.root);
+    this.worktreesRoot = options.worktreesRoot ? resolve2(options.worktreesRoot) : `${this.root}-worktrees`;
+    this.branchPrefix = options.branchPrefix ?? "gaia/";
+    this.branchTemplate = options.branchTemplate ?? DEFAULT_BRANCH_TEMPLATE;
+  }
+  options;
+  runHook;
+  runGit;
+  root;
+  worktreesRoot;
+  branchPrefix;
+  branchTemplate;
+  /** Render the branch name for a ticket from the configured template. */
+  branchFor(identifier, title) {
+    return renderBranchTemplate(this.branchTemplate, {
+      branchPrefix: this.branchPrefix,
+      key: this.keyFor(identifier),
+      identifier,
+      titleSlug: slugify(title ?? "")
+    });
+  }
+  keyFor(identifier) {
+    return identifier.replace(/[^A-Za-z0-9._-]/g, "_");
+  }
+  pathFor(key) {
+    return resolve2(join(this.worktreesRoot, key));
+  }
+  async ensure(identifier, title, _baseRef) {
+    const key = this.keyFor(identifier);
+    if (key === "" || key.startsWith(".")) {
+      throw new Error(`invalid workspace identifier: ${identifier}`);
+    }
+    const path = this.pathFor(key);
+    if (existsSync2(path)) {
+      return { path, instructions: loadInstructions(path) };
+    }
+    const branch = this.branchFor(identifier, title);
+    await this.runGit(
+      ["-C", this.root, "worktree", "add", "--force", "-B", branch, path],
+      this.root
+    );
+    if (this.options.hooks?.after_create) {
+      await this.runHook(this.options.hooks.after_create, path);
+    }
+    return { path, instructions: loadInstructions(path) };
+  }
+  async remove(identifier) {
+    const key = this.keyFor(identifier);
+    const path = this.pathFor(key);
+    await this.runGit(
+      ["-C", this.root, "worktree", "remove", "--force", path],
+      this.root
+    );
+  }
+  async beforeRun(path) {
+    if (this.options.hooks?.before_run) {
+      await this.runHook(this.options.hooks.before_run, path);
+    }
+  }
+  async afterRun(path) {
+    if (this.options.hooks?.after_run) {
+      await this.runHook(this.options.hooks.after_run, path);
+    }
+  }
+  async afterDone(path) {
+    if (this.options.hooks?.after_done) {
+      await this.runHook(this.options.hooks.after_done, path);
+    }
+  }
+};
+function gitWorkspace(opts = {}) {
+  return {
+    kind: "workspace",
+    id: "git",
+    requiredModules: [],
+    async createWorkspace(config) {
+      const root = config.config_path ? dirname(config.config_path) : process.cwd();
+      return new GitWorkspace({
+        root,
+        ...opts.hooks ? { hooks: opts.hooks } : {},
+        ...opts.branchPrefix ? { branchPrefix: opts.branchPrefix } : {},
+        ...opts.branchTemplate ? { branchTemplate: opts.branchTemplate } : {}
+      });
+    }
+  };
+}
+
+// src/plugins/workspace/herdr.ts
+import { dirname as dirname2, join as join2, resolve as resolve3 } from "node:path";
+var defaultExec = (args) => exec("herdr", args);
+var defaultGitExec = (args) => exec("git", args);
+var defaultHookRunner2 = async (command, cwd) => {
+  await exec("sh", ["-c", command], { cwd });
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJson(output, command) {
+  try {
+    return JSON.parse(output);
+  } catch {
+    throw new Error(`herdr ${command} returned invalid JSON`);
+  }
+}
+function parseWorktreeList(output) {
+  const parsed = parseJson(output, "worktree list");
+  const worktrees = isRecord(parsed) ? parsed.result?.worktrees : void 0;
+  if (!Array.isArray(worktrees)) {
+    throw new Error("herdr worktree list returned invalid schema");
+  }
+  return worktrees.filter(isRecord).filter((w) => typeof w.branch === "string" && typeof w.path === "string").map((w) => ({
+    branch: w.branch,
+    path: w.path,
+    ...typeof w.open_workspace_id === "string" ? { open_workspace_id: w.open_workspace_id } : {}
+  }));
+}
+function parseWorktreePath(output, command) {
+  const parsed = parseJson(output, command);
+  const path = isRecord(parsed) ? parsed.result?.worktree?.path : void 0;
+  if (typeof path !== "string") {
+    throw new Error(`herdr ${command} returned invalid schema`);
+  }
+  return path;
+}
+function validateBranch(branch) {
+  if (!/^[A-Za-z0-9._/-]+$/.test(branch) || branch.startsWith(".") || branch.includes("..")) {
+    throw new Error(`invalid workspace branch: ${branch}`);
+  }
+}
+var HerdrWorkspace = class {
+  constructor(options) {
+    this.options = options;
+    this.execHerdr = options.execHerdr ?? defaultExec;
+    this.execGit = options.execGit ?? defaultGitExec;
+    this.runHook = options.runHook ?? defaultHookRunner2;
+    this.root = resolve3(options.root);
+    this.worktreeDir = options.worktreeDir ?? ".gaia-worktrees";
+  }
+  options;
+  execHerdr;
+  execGit;
+  runHook;
+  root;
+  worktreeDir;
+  /**
+   * Resolve the base ref for a new worktree branch. Prefers the configured
+   * `baseBranch`; otherwise the remote tracking branch of the repo's HEAD
+   * (e.g. `origin/develop`). Best-effort: a repo with no upstream returns
+   * `undefined`, leaving herdr to fall back to the parent workspace HEAD.
+   */
+  async resolveBaseRef() {
+    if (this.options.baseBranch) {
+      return this.options.baseBranch;
+    }
+    try {
+      const ref = (await this.execGit([
+        "-C",
+        this.root,
+        "rev-parse",
+        "--abbrev-ref",
+        "--symbolic-full-name",
+        "@{u}"
+      ])).trim();
+      return ref || void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Fetch the base ref's remote branch so the new worktree starts from the
+   * latest pushed state. Best-effort: offline / unknown remote is non-fatal.
+   */
+  async fetchBaseRef(baseRef) {
+    const slash = baseRef.indexOf("/");
+    if (slash <= 0) {
+      return;
+    }
+    const remote = baseRef.slice(0, slash);
+    const branch = baseRef.slice(slash + 1);
+    try {
+      await this.execGit(["-C", this.root, "fetch", remote, branch]);
+    } catch {
+    }
+  }
+  /**
+   * Verify a base-ref candidate resolves on the remote (after fetching it).
+   * Returns the ref when it exists, else undefined so the caller falls back.
+   */
+  async verifyRemoteRef(ref) {
+    await this.fetchBaseRef(ref);
+    try {
+      await this.execGit([
+        "-C",
+        this.root,
+        "rev-parse",
+        "--verify",
+        "--quiet",
+        `${ref}^{commit}`
+      ]);
+      return ref;
+    } catch {
+      return void 0;
+    }
+  }
+  async ensure(_identifier, branch, baseRefOverride) {
+    if (branch === void 0) {
+      throw new Error("herdr workspace requires a branch name");
+    }
+    validateBranch(branch);
+    const worktrees = parseWorktreeList(
+      await this.execHerdr(["worktree", "list", "--cwd", this.root, "--json"])
+    );
+    const existing = worktrees.find((w) => w.branch === branch);
+    if (existing) {
+      let path2 = existing.path;
+      if (!existing.open_workspace_id) {
+        path2 = parseWorktreePath(
+          await this.execHerdr([
+            "worktree",
+            "open",
+            "--cwd",
+            this.root,
+            "--branch",
+            branch,
+            "--no-focus",
+            "--json"
+          ]),
+          "worktree open"
+        );
+      }
+      return { path: path2, instructions: loadInstructions(path2) };
+    }
+    let baseRef;
+    if (baseRefOverride !== void 0) {
+      baseRef = await this.verifyRemoteRef(baseRefOverride);
+    }
+    if (baseRef === void 0) {
+      baseRef = await this.resolveBaseRef();
+      if (baseRef !== void 0) {
+        await this.fetchBaseRef(baseRef);
+      }
+    }
+    const path = parseWorktreePath(
+      await this.execHerdr([
+        "worktree",
+        "create",
+        "--cwd",
+        this.root,
+        "--branch",
+        branch,
+        ...baseRef !== void 0 ? ["--base", baseRef] : [],
+        "--label",
+        branch,
+        "--path",
+        join2(this.worktreeDir, branch),
+        "--no-focus",
+        "--json"
+      ]),
+      "worktree create"
+    );
+    if (this.options.hooks?.after_create) {
+      await this.runHook(this.options.hooks.after_create, path);
+    }
+    return { path, instructions: loadInstructions(path) };
+  }
+  async beforeRun(path) {
+    if (this.options.hooks?.before_run) {
+      await this.runHook(this.options.hooks.before_run, path);
+    }
+  }
+  async afterRun(path) {
+    if (this.options.hooks?.after_run) {
+      await this.runHook(this.options.hooks.after_run, path);
+    }
+  }
+  async afterDone(path) {
+    if (this.options.hooks?.after_done) {
+      await this.runHook(this.options.hooks.after_done, path);
+    }
+  }
+};
+function herdrWorkspace(opts = {}) {
+  return {
+    kind: "workspace",
+    id: "herdr",
+    requiredModules: [],
+    async createWorkspace(config) {
+      const root = config.config_path ? dirname2(config.config_path) : process.cwd();
+      return new HerdrWorkspace({
+        root,
+        ...opts.hooks ? { hooks: opts.hooks } : {},
+        ...opts.worktreeDir ? { worktreeDir: opts.worktreeDir } : {},
+        ...opts.baseBranch ? { baseBranch: opts.baseBranch } : {}
+      });
+    }
+  };
+}
+
+// plugins/claude/src/index.ts
+import { readdir, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join as join3 } from "node:path";
+function shellSingleQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function encodeClaudeProjectDir(cwd) {
+  return cwd.replace(/[^a-zA-Z0-9]/g, "-");
+}
+var ClaudeAgent = class {
+  constructor(options, home = homedir()) {
+    this.options = options;
+    this.home = home;
+  }
+  options;
+  home;
+  id = "claude";
+  launchCommand(prompt) {
+    if (prompt === "") {
+      return "claude";
+    }
+    const parts = ["claude", shellSingleQuote(prompt)];
+    if (this.options.model) {
+      parts.push("--model", this.options.model);
+    }
+    parts.push("--dangerously-skip-permissions");
+    return parts.join(" ");
+  }
+  async getRunLog(worktreePath) {
+    const dir = join3(
+      this.home,
+      ".claude",
+      "projects",
+      encodeClaudeProjectDir(worktreePath)
+    );
+    let entries;
+    try {
+      entries = await readdir(dir);
+    } catch {
+      return "";
+    }
+    let latest = null;
+    for (const name of entries) {
+      if (!name.endsWith(".jsonl")) {
+        continue;
+      }
+      const full = join3(dir, name);
+      try {
+        const s = await stat(full);
+        if (!latest || s.mtimeMs > latest.mtimeMs) {
+          latest = { path: full, mtimeMs: s.mtimeMs };
+        }
+      } catch {
+      }
+    }
+    if (!latest) {
+      return "";
+    }
+    try {
+      return await readFile(latest.path, "utf8");
+    } catch {
+      return "";
+    }
+  }
+};
+function claudeAgent(options = {}) {
+  const agent = new ClaudeAgent(options);
+  return {
+    kind: "agent",
+    id: "claude",
+    requiredModules: [],
+    async createAgent() {
+      return agent;
+    }
+  };
+}
+
+// plugins/codex/src/index.ts
+function shellSingleQuote2(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+var CodexAgent = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  id = "codex";
+  launchCommand(prompt) {
+    const parts = [
+      "codex",
+      "--sandbox danger-full-access",
+      "--dangerously-bypass-approvals-and-sandbox",
+      "--dangerously-bypass-hook-trust"
+    ];
+    if (this.options.model) {
+      parts.push("--model", this.options.model);
+    }
+    if (prompt !== "") {
+      parts.push(shellSingleQuote2(prompt));
+    }
+    return parts.join(" ");
+  }
+  async getRunLog() {
+    return "";
+  }
+};
+function codexAgent(options = {}) {
+  const agent = new CodexAgent(options);
+  return {
+    kind: "agent",
+    id: "codex",
+    requiredModules: [],
+    async createAgent() {
+      return agent;
+    }
+  };
+}
+
+// plugins/fake/src/index.ts
+import { writeFileSync } from "node:fs";
+import { isAbsolute, join as join4, relative, resolve as resolve4, sep } from "node:path";
+var FakeExecutor = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  id = "fake";
+  capabilities() {
+    return { persistent: false };
+  }
+  async startRun(input) {
+    const branch = input.ticket.branchName;
+    if (this.options.markerFile) {
+      writeFileSync(
+        this.markerPath(input.workspacePath, this.options.markerFile),
+        JSON.stringify({
+          run_uuid: input.run.uuid,
+          ticket_uuid: input.ticket.uuid,
+          handler: input.run.handler,
+          instructions_sha256: input.instructions?.sha256 ?? null
+        })
+      );
+    }
+    return { sessionRef: branch };
+  }
+  markerPath(workspacePath, markerFile) {
+    const workspace = resolve4(workspacePath);
+    const marker = resolve4(join4(workspace, markerFile));
+    const markerRelativePath = relative(workspace, marker);
+    if (isAbsolute(markerFile) || markerRelativePath === ".." || markerRelativePath.startsWith(`..${sep}`)) {
+      throw new Error(
+        `markerFile must stay inside the workspace: ${markerFile}`
+      );
+    }
+    return marker;
+  }
+  async retire(_branch) {
+  }
+  async stopAgent(_branch) {
+  }
+  async removeWorktree(_branch, _worktreePath) {
+  }
+};
+function fakeExecutor(options = {}) {
+  const executor = new FakeExecutor({
+    outcome: options.outcome ?? "exited",
+    ...options.markerFile !== void 0 ? { markerFile: options.markerFile } : {}
+  });
+  return {
+    kind: "executor",
+    id: "fake",
+    requiredModules: [],
+    async createExecutor() {
+      return executor;
+    }
+  };
+}
+
+// plugins/herdr/src/index.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+
+// plugins/herdr/src/config.ts
+var BUILTIN_DEFAULTS = {
+  tabLabel: "{identifier} \xB7 {titleSlug}",
+  workspaceLabel: "{repoName}",
+  panes: []
+};
+function resolveStateConfig(options, state) {
+  const base = options.default ?? {};
+  const stateCfg = options.states?.[state] ?? {};
+  return {
+    tabLabel: stateCfg.tabLabel ?? base.tabLabel ?? BUILTIN_DEFAULTS.tabLabel,
+    workspaceLabel: stateCfg.workspaceLabel ?? base.workspaceLabel ?? BUILTIN_DEFAULTS.workspaceLabel,
+    panes: stateCfg.panes ?? base.panes ?? BUILTIN_DEFAULTS.panes
+  };
+}
+function renderTemplate(tpl, vars) {
+  return tpl.replace(/\{(\w+)\}/g, (whole, key) => {
+    const value = vars[key];
+    return value === void 0 ? whole : value;
+  });
+}
+
+// plugins/herdr/src/fs.ts
+import { chmodSync, lstatSync, readdirSync, rmSync } from "node:fs";
+import { join as join5 } from "node:path";
+function restoreWritable(path) {
+  let stat2;
+  try {
+    stat2 = lstatSync(path);
+  } catch {
+    return;
+  }
+  if (stat2.isSymbolicLink()) {
+    return;
+  }
+  try {
+    chmodSync(path, stat2.mode | 128);
+  } catch {
+  }
+  if (stat2.isDirectory()) {
+    let entries;
+    try {
+      entries = readdirSync(path);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      restoreWritable(join5(path, entry));
+    }
+  }
+}
+function forceRemoveDir(path) {
+  restoreWritable(path);
+  rmSync(path, { recursive: true, force: true });
+}
+
+// plugins/herdr/src/index.ts
+async function defaultExec2(args) {
+  return exec("herdr", args);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJson2(output, command) {
+  try {
+    return JSON.parse(output);
+  } catch {
+    throw new Error(`herdr ${command} returned invalid JSON`);
+  }
+}
+function parseWorktreeList2(output) {
+  const parsed = parseJson2(output, "worktree list");
+  const worktrees = isRecord2(parsed) ? parsed.result?.worktrees : void 0;
+  if (!Array.isArray(worktrees)) {
+    return [];
+  }
+  return worktrees.filter(isRecord2).filter((w) => typeof w.branch === "string" && typeof w.path === "string").map((w) => ({
+    branch: w.branch,
+    path: w.path,
+    ...typeof w.open_workspace_id === "string" && w.open_workspace_id ? { open_workspace_id: w.open_workspace_id } : {}
+  }));
+}
+function parseTabList(output) {
+  const parsed = parseJson2(output, "tab list");
+  const tabs = isRecord2(parsed) ? parsed.result?.tabs : void 0;
+  if (!Array.isArray(tabs)) {
+    return [];
+  }
+  return tabs.filter(isRecord2).filter((t) => typeof t.tab_id === "string" && typeof t.label === "string").map((t) => ({
+    tabId: t.tab_id,
+    label: t.label
+  }));
+}
+function parsePaneList(output) {
+  const parsed = parseJson2(output, "pane list");
+  const panes = isRecord2(parsed) ? parsed.result?.panes : void 0;
+  if (!Array.isArray(panes)) {
+    return [];
+  }
+  return panes.filter(isRecord2).filter(
+    (p) => typeof p.pane_id === "string" && typeof p.tab_id === "string"
+  ).map((p) => ({
+    paneId: p.pane_id,
+    tabId: p.tab_id
+  }));
+}
+function parseTabCreate(output) {
+  const parsed = parseJson2(output, "tab create");
+  const result = isRecord2(parsed) ? parsed.result : void 0;
+  const paneId = result?.root_pane?.pane_id;
+  const tabId = result?.tab?.tab_id;
+  if (typeof paneId !== "string" || typeof tabId !== "string") {
+    throw new Error("herdr tab create returned invalid schema");
+  }
+  return { paneId, tabId };
+}
+function parsePaneSplit(output) {
+  const parsed = parseJson2(output, "pane split");
+  const paneId = isRecord2(parsed) ? parsed.result?.pane?.pane_id : void 0;
+  if (typeof paneId !== "string") {
+    throw new Error("herdr pane split returned invalid schema");
+  }
+  return paneId;
+}
+function shellSingleQuote3(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function normPath(path) {
+  return path.replace(/\/+$/, "");
+}
+function resolveWorktreeEntry(entries, branch, worktreePath) {
+  if (worktreePath) {
+    const want = normPath(worktreePath);
+    const byPath = entries.find((e) => normPath(e.path) === want);
+    if (byPath) {
+      return byPath;
+    }
+  }
+  return entries.find((e) => e.branch === branch) ?? null;
+}
+var HerdrExecutor = class {
+  constructor(options, execHerdr = defaultExec2) {
+    this.options = options;
+    this.execHerdr = execHerdr;
+  }
+  options;
+  execHerdr;
+  id = "herdr";
+  capabilities() {
+    return { persistent: true };
+  }
+  /**
+   * Find the worktree entry (path + open_workspace_id) for a branch via
+   * worktree list. Returns null if the branch has no worktree.
+   */
+  async findWorktreeByBranch(branch) {
+    const output = await this.execHerdr(["worktree", "list", "--json"]);
+    const entries = parseWorktreeList2(output);
+    return entries.find((e) => e.branch === branch) ?? null;
+  }
+  /**
+   * Find the open_workspace_id for a branch via worktree list.
+   * Returns null if no workspace is open for that branch.
+   */
+  async findWorkspaceByBranch(branch) {
+    const entry = await this.findWorktreeByBranch(branch);
+    return entry?.open_workspace_id ?? null;
+  }
+  /**
+   * Tear down a ticket's entire worktree (git worktree + hosted workspace).
+   * `herdr worktree remove` is keyed by an open workspace id, so resolve the
+   * worktree first — by its stable `worktreePath`, falling back to `branch`
+   * (see {@link resolveWorktreeEntry}): if its workspace is already open use
+   * that id; otherwise open the on-disk worktree to obtain one (mirrors
+   * startRun's open-if-needed).
+   *
+   * `herdr worktree list` is machine-global — it enumerates every repo's
+   * worktrees on the host, most of which are not ours. So a no-match does NOT
+   * mean "error"; it means herdr no longer tracks this ticket's worktree.
+   * Teardown is idempotent, keyed off the stable on-disk `worktreePath`:
+   *   - path gone from disk  → already torn down; quiet success.
+   *   - path still on disk    → herdr lost track but the dir survives (an
+   *     orphan we own); reclaim it directly with {@link forceRemoveDir} so it
+   *     can't pile up — the concern the old throw was meant to surface.
+   * Either way we never touch, list-dump, or fail over foreign worktrees.
+   */
+  async removeWorktree(branch, worktreePath) {
+    const entries = parseWorktreeList2(
+      await this.execHerdr(["worktree", "list", "--json"])
+    );
+    const entry = resolveWorktreeEntry(entries, branch, worktreePath);
+    if (!entry) {
+      if (worktreePath && existsSync3(worktreePath)) {
+        forceRemoveDir(worktreePath);
+      }
+      return;
+    }
+    let workspaceId = entry.open_workspace_id ?? null;
+    if (!workspaceId) {
+      await this.execHerdr([
+        "worktree",
+        "open",
+        "--cwd",
+        this.options.root ?? entry.path,
+        "--branch",
+        entry.branch,
+        "--no-focus",
+        "--json"
+      ]);
+      const reopened = resolveWorktreeEntry(
+        parseWorktreeList2(await this.execHerdr(["worktree", "list", "--json"])),
+        branch,
+        worktreePath
+      );
+      workspaceId = reopened?.open_workspace_id ?? null;
+      if (!workspaceId) {
+        throw new Error(
+          `herdr worktree open did not yield a workspace id for path ${entry.path} (branch ${entry.branch})`
+        );
+      }
+    }
+    restoreWritable(entry.path);
+    await this.execHerdr([
+      "worktree",
+      "remove",
+      "--workspace",
+      workspaceId,
+      "--force",
+      "--json"
+    ]);
+  }
+  async startRun(input) {
+    const branchName = input.ticket.branchName;
+    const cfg = resolveStateConfig(
+      this.options,
+      input.ticket.state
+    );
+    let workspaceId = await this.findWorkspaceByBranch(branchName);
+    if (!workspaceId) {
+      await this.execHerdr([
+        "worktree",
+        "open",
+        "--cwd",
+        this.options.root ?? input.workspacePath,
+        "--branch",
+        branchName,
+        "--no-focus",
+        "--json"
+      ]);
+      workspaceId = await this.findWorkspaceByBranch(branchName);
+      if (!workspaceId) {
+        throw new Error(
+          `herdr worktree open did not produce an open_workspace_id for branch ${branchName}`
+        );
+      }
+    }
+    const vars = {
+      identifier: input.ticket.identifier,
+      title: input.ticket.title,
+      titleSlug: slugify(input.ticket.title),
+      runUuid: input.run.uuid,
+      workspacePath: input.workspacePath
+    };
+    const { paneId: rootPaneId, tabId } = parseTabCreate(
+      await this.execHerdr([
+        "tab",
+        "create",
+        "--workspace",
+        workspaceId,
+        "--label",
+        `${input.ticket.identifier} \xB7 ${input.ticket.state} #${input.run.id}`,
+        "--no-focus"
+      ])
+    );
+    try {
+      await this.execHerdr(["pane", "run", rootPaneId, this.commandFor(input)]);
+      for (const spec of cfg.panes) {
+        const splitPaneId = parsePaneSplit(
+          await this.execHerdr([
+            "pane",
+            "split",
+            rootPaneId,
+            "--direction",
+            spec.direction,
+            "--cwd",
+            input.workspacePath,
+            spec.focus ? "--focus" : "--no-focus"
+          ])
+        );
+        await this.execHerdr([
+          "pane",
+          "run",
+          splitPaneId,
+          renderTemplate(spec.command, vars)
+        ]);
+      }
+      return { sessionRef: branchName };
+    } catch (err) {
+      await this.rollback(tabId);
+      throw err;
+    }
+  }
+  /** Best-effort cleanup: close only the just-created tab. Swallows errors. */
+  async rollback(tabId) {
+    try {
+      await this.execHerdr(["tab", "close", tabId]);
+    } catch {
+    }
+  }
+  async retire(branch) {
+    const workspaceId = await this.findWorkspaceByBranch(branch);
+    if (!workspaceId) {
+      return;
+    }
+    const tabs = parseTabList(
+      await this.execHerdr(["tab", "list", "--workspace", workspaceId])
+    );
+    const panes = parsePaneList(
+      await this.execHerdr(["pane", "list", "--workspace", workspaceId])
+    );
+    for (const tab of tabs) {
+      try {
+        if (tab.label.endsWith(" (done)")) {
+          continue;
+        }
+        const pane = panes.find((p) => p.tabId === tab.tabId);
+        if (pane) {
+          await this.execHerdr(["pane", "send-keys", pane.paneId, "C-c"]);
+        }
+        await this.execHerdr([
+          "tab",
+          "rename",
+          tab.tabId,
+          `${tab.label} (done)`
+        ]);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Ask the agent in each open tab of the branch workspace to exit gracefully:
+   * type `/exit` then send Enter into its pane. Unlike {@link retire} (C-c
+   * SIGINT), this is the clean shutdown claude expects. Best-effort: no open
+   * workspace, a `(done)` tab, or a tab with no matching pane are skipped, and
+   * one failing tab never aborts the others.
+   */
+  async stopAgent(branch) {
+    const workspaceId = await this.findWorkspaceByBranch(branch);
+    if (!workspaceId) {
+      return;
+    }
+    const tabs = parseTabList(
+      await this.execHerdr(["tab", "list", "--workspace", workspaceId])
+    );
+    const panes = parsePaneList(
+      await this.execHerdr(["pane", "list", "--workspace", workspaceId])
+    );
+    for (const tab of tabs) {
+      if (tab.label.endsWith(" (done)")) {
+        continue;
+      }
+      const pane = panes.find((p) => p.tabId === tab.tabId);
+      if (!pane) {
+        continue;
+      }
+      try {
+        await this.execHerdr(["pane", "send-text", pane.paneId, "/exit"]);
+        await this.execHerdr(["pane", "send-keys", pane.paneId, "Enter"]);
+      } catch {
+      }
+    }
+  }
+  commandFor(input) {
+    const env = Object.entries(input.env ?? {}).map(([key, value]) => {
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+        throw new Error(`invalid environment variable name for herdr: ${key}`);
+      }
+      return `${key}=${shellSingleQuote3(value)}`;
+    });
+    const command = input.command ?? this.options.command ?? "claude";
+    return [...env, command].join(" ");
+  }
+};
+function herdrExecutor(options = {}) {
+  return {
+    kind: "executor",
+    id: "herdr",
+    requiredModules: [],
+    async createExecutor(config) {
+      const root = options.root ?? dirname3(config.config_path);
+      return new HerdrExecutor({
+        command: options.command ?? "claude",
+        root,
+        ...options.default ? { default: options.default } : {},
+        ...options.states ? { states: options.states } : {}
+      });
+    }
+  };
+}
+
+// scripts/plugins-entry.ts
+import { oauth2Plugin } from "@dropsh/plugin-oauth2";
+export {
+  ClaudeAgent,
+  CodexAgent,
+  DrupalGaiaRemote,
+  FakeExecutor,
+  FakeGaiaRemote,
+  FakeWorkspace,
+  GitWorkspace,
+  HerdrExecutor,
+  HerdrWorkspace,
+  basicAuthProvider,
+  claudeAgent,
+  codexAgent,
+  drupalRemote,
+  encodeClaudeProjectDir,
+  fakeExecutor,
+  fakeRemote,
+  fakeWorkspace,
+  gitWorkspace,
+  herdrExecutor,
+  herdrWorkspace,
+  oauth2Plugin,
+  selectAgent,
+  selectExecutor,
+  selectRemote,
+  selectWorkspace
+};