@geminixiang/mikan 0.2.0

package/dist/execution-resolver.js

@@ -0,0 +1,167 @@
+import { existsSync } from "fs";
+import { join } from "path";
+import { loadAgentConfig, loadAgentConfigForConversation } from "./config.js";
+import { ensureDirExists, isRecord, readJsonFileIfExists } from "./file-guards.js";
+import { DockerContainerManager } from "./provisioner.js";
+import { createExecutor } from "./sandbox/index.js";
+import { reportUserFacingError } from "./sentry.js";
+import { normalizeSharedVaultName } from "./vault.js";
+import { resolveActorVaultKey } from "./vault-routing.js";
+export function readConversationWorkspaceMountMode(workspaceDir, conversationId) {
+    const globalDefault = readGlobalWorkspaceMountMode();
+    if (!workspaceDir) {
+        return globalDefault;
+    }
+    const conversationDir = join(workspaceDir, conversationId);
+    try {
+        return (loadAgentConfigForConversation(conversationDir).sandboxImageWorkspaceMount ?? globalDefault);
+    }
+    catch {
+        const conversationSettingsPath = join(conversationDir, "settings.json");
+        const raw = readConversationSettingsFallback(conversationSettingsPath);
+        return raw?.sandbox?.image?.workspaceMount ?? globalDefault;
+    }
+}
+function readGlobalWorkspaceMountMode() {
+    try {
+        return loadAgentConfig().sandboxImageWorkspaceMount ?? "private";
+    }
+    catch {
+        return "private";
+    }
+}
+function readConversationSettingsFallback(settingsPath) {
+    try {
+        return readJsonFileIfExists(settingsPath, (value) => isRecord(value), () => "Ignoring malformed conversation settings file while resolving workspace mount");
+    }
+    catch {
+        return undefined;
+    }
+}
+export class ActorExecutionResolver {
+    constructor(baseConfig, vaultManager, provisioner, workspaceDir) {
+        this.baseConfig = baseConfig;
+        this.vaultManager = vaultManager;
+        this.provisioner = provisioner;
+        this.workspaceDir = workspaceDir;
+        this.ensuredConversationDirs = new Set();
+    }
+    async resolve(context) {
+        const vaultKey = resolveActorVaultKey(this.baseConfig, context.userId, context.conversationId);
+        this.ensureDefaultSharedVault(vaultKey);
+        const vault = this.vaultManager.resolve(vaultKey);
+        const config = this.resolveSandboxConfig(vaultKey);
+        const env = config.type !== "host" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
+        return createExecutor(config, env, this.buildEnsureReadyCallback(vaultKey, context.conversationId, config, vault));
+    }
+    ensureDefaultSharedVault(vaultKey) {
+        if (this.baseConfig.type !== "image" && this.baseConfig.type !== "cloudflare")
+            return;
+        if (this.vaultManager.hasEntry(vaultKey))
+            return;
+        let profile;
+        try {
+            profile = loadAgentConfig().defaultSharedVault;
+        }
+        catch {
+            return;
+        }
+        if (!profile || normalizeSharedVaultName(profile) !== profile)
+            return;
+        this.vaultManager.copySharedVaultTo(profile, vaultKey);
+    }
+    resolveSandboxConfig(vaultKey) {
+        const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);
+        if (this.baseConfig.type !== "image") {
+            return config;
+        }
+        if (config.type === "container") {
+            return config;
+        }
+        return {
+            type: "container",
+            container: DockerContainerManager.containerName(vaultKey),
+        };
+    }
+    buildEnsureReadyCallback(vaultKey, conversationId, config, vault) {
+        if (this.baseConfig.type !== "image" || config.type !== "container") {
+            return undefined;
+        }
+        return async () => {
+            const expected = config.container || DockerContainerManager.containerName(vaultKey);
+            let actual;
+            try {
+                actual = await this.provisioner?.provision(vaultKey, {
+                    containerName: expected,
+                    mounts: this.resolveMounts(conversationId, vault),
+                    conversationId,
+                });
+            }
+            catch (err) {
+                reportUserFacingError(err, {
+                    domain: "sandbox",
+                    surface: "sandbox_provision",
+                    operation: "ensure_image_container_ready",
+                    severity: "error",
+                    context: {
+                        sandboxType: "image",
+                        resolvedSandboxType: config.type,
+                        conversationId,
+                        vaultKey,
+                        expectedContainer: expected,
+                        hasVault: Boolean(vault),
+                    },
+                });
+                throw err;
+            }
+            if (actual && actual !== expected) {
+                throw new Error(`Provisioner returned container "${actual}" for container key "${vaultKey}", expected "${expected}"`);
+            }
+        };
+    }
+    resolveMounts(conversationId, vault) {
+        const mountsByTarget = new Map();
+        for (const mount of this.buildImageSandboxMounts(conversationId)) {
+            mountsByTarget.set(mount.target, mount);
+        }
+        for (const mount of vault?.mounts ?? []) {
+            if (!existsSync(mount.source)) {
+                reportUserFacingError(new Error("Vault mount source is missing"), {
+                    domain: "sandbox",
+                    surface: "vault_injection",
+                    operation: "resolve_mounts",
+                    severity: "warning",
+                    context: {
+                        sandboxType: "image",
+                        conversationId,
+                        target: mount.target,
+                        hasVault: Boolean(vault),
+                    },
+                });
+                continue;
+            }
+            mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });
+        }
+        return [...mountsByTarget.values()];
+    }
+    buildImageSandboxMounts(conversationId) {
+        if (!this.workspaceDir) {
+            return [];
+        }
+        if (readConversationWorkspaceMountMode(this.workspaceDir, conversationId) === "full") {
+            return [{ source: this.workspaceDir, target: "/workspace" }];
+        }
+        const conversationDir = join(this.workspaceDir, conversationId);
+        if (!this.ensuredConversationDirs.has(conversationId)) {
+            ensureDirExists(conversationDir);
+            this.ensuredConversationDirs.add(conversationId);
+        }
+        return [
+            { source: join(this.workspaceDir, "MEMORY.md"), target: "/workspace/MEMORY.md" },
+            { source: join(this.workspaceDir, "skills"), target: "/workspace/skills" },
+            { source: join(this.workspaceDir, "events"), target: "/workspace/events" },
+            { source: conversationDir, target: `/workspace/${conversationId}` },
+        ];
+    }
+}
+//# sourceMappingURL=execution-resolver.js.map

package/dist/execution-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAyC,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,kCAAkC,CAChD,YAAgC,EAChC,cAAsB;IAEtB,MAAM,aAAa,GAAG,4BAA4B,EAAE,CAAC;IACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,CACL,8BAA8B,CAAC,eAAe,CAAC,CAAC,0BAA0B,IAAI,aAAa,CAC5F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,wBAAwB,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,IAAI,aAAa,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,IAAI,CAAC;QACH,OAAO,eAAe,EAAE,CAAC,0BAA0B,IAAI,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACvC,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,oBAAoB,CACzB,YAAY,EACZ,CAAC,KAAK,EAAmF,EAAE,CACzF,QAAQ,CAAC,KAAK,CAAC,EACjB,GAAG,EAAE,CAAC,+EAA+E,CACtF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,sBAAsB;IAGjC,YACU,UAAyB,EACzB,YAA0B,EAC1B,WAAoC,EACpC,YAAqB;QAHrB,eAAU,GAAV,UAAU,CAAe;QACzB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAyB;QACpC,iBAAY,GAAZ,YAAY,CAAS;QANd,4BAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAO1D,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/F,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,GAAG,GACP,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,OAAO,cAAc,CACnB,MAAM,EACN,GAAG,EACH,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAC/E,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,QAAgB;QAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO;QACtF,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QAEjD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,eAAe,EAAE,CAAC,kBAAkB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QAEtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC;SAC1D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,QAAgB,EAChB,cAAsB,EACtB,MAAqB,EACrB,KAAqB;QAErB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpF,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;oBACnD,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC;oBACjD,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,mBAAmB,EAAE,MAAM,CAAC,IAAI;wBAChC,cAAc;wBACd,QAAQ;wBACR,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACzB;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,wBAAwB,QAAQ,gBAAgB,QAAQ,GAAG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,cAAsB,EAAE,KAAqB;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAAE,CAAC;YACjE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;oBAChE,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,iBAAiB;oBAC1B,SAAS,EAAE,gBAAgB;oBAC3B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,cAAc;wBACd,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACzB;iBACF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,uBAAuB,CAAC,cAAsB;QACpD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,eAAe,CAAC,CAAC;YACjC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,CAAC;QAED,OAAO;YACL,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE;YAChF,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC1E,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC1E,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,cAAc,EAAE,EAAE;SACpE,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { existsSync } from \"fs\";\nimport { join } from \"path\";\nimport { loadAgentConfig, loadAgentConfigForConversation } from \"./config.js\";\nimport { ensureDirExists, isRecord, readJsonFileIfExists } from \"./file-guards.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport { createExecutor, type Executor, type SandboxConfig } from \"./sandbox/index.js\";\nimport { reportUserFacingError } from \"./sentry.js\";\nimport { normalizeSharedVaultName, type ResolvedVault, type VaultManager } from \"./vault.js\";\nimport { resolveActorVaultKey } from \"./vault-routing.js\";\n\nexport interface ActorContext {\n  platform: string;\n  userId: string;\n  conversationId: string;\n}\n\nexport type ImageWorkspaceMountMode = \"private\" | \"full\";\n\nexport function readConversationWorkspaceMountMode(\n  workspaceDir: string | undefined,\n  conversationId: string,\n): ImageWorkspaceMountMode {\n  const globalDefault = readGlobalWorkspaceMountMode();\n  if (!workspaceDir) {\n    return globalDefault;\n  }\n\n  const conversationDir = join(workspaceDir, conversationId);\n  try {\n    return (\n      loadAgentConfigForConversation(conversationDir).sandboxImageWorkspaceMount ?? globalDefault\n    );\n  } catch {\n    const conversationSettingsPath = join(conversationDir, \"settings.json\");\n    const raw = readConversationSettingsFallback(conversationSettingsPath);\n    return raw?.sandbox?.image?.workspaceMount ?? globalDefault;\n  }\n}\n\nfunction readGlobalWorkspaceMountMode(): ImageWorkspaceMountMode {\n  try {\n    return loadAgentConfig().sandboxImageWorkspaceMount ?? \"private\";\n  } catch {\n    return \"private\";\n  }\n}\n\nfunction readConversationSettingsFallback(\n  settingsPath: string,\n): { sandbox?: { image?: { workspaceMount?: ImageWorkspaceMountMode } } } | undefined {\n  try {\n    return readJsonFileIfExists(\n      settingsPath,\n      (value): value is { sandbox?: { image?: { workspaceMount?: ImageWorkspaceMountMode } } } =>\n        isRecord(value),\n      () => \"Ignoring malformed conversation settings file while resolving workspace mount\",\n    );\n  } catch {\n    return undefined;\n  }\n}\n\nexport class ActorExecutionResolver {\n  private readonly ensuredConversationDirs = new Set<string>();\n\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private provisioner?: DockerContainerManager,\n    private workspaceDir?: string,\n  ) {}\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const vaultKey = resolveActorVaultKey(this.baseConfig, context.userId, context.conversationId);\n    this.ensureDefaultSharedVault(vaultKey);\n\n    const vault = this.vaultManager.resolve(vaultKey);\n    const config = this.resolveSandboxConfig(vaultKey);\n    const env =\n      config.type !== \"host\" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n    return createExecutor(\n      config,\n      env,\n      this.buildEnsureReadyCallback(vaultKey, context.conversationId, config, vault),\n    );\n  }\n\n  private ensureDefaultSharedVault(vaultKey: string): void {\n    if (this.baseConfig.type !== \"image\" && this.baseConfig.type !== \"cloudflare\") return;\n    if (this.vaultManager.hasEntry(vaultKey)) return;\n\n    let profile: string | undefined;\n    try {\n      profile = loadAgentConfig().defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n\n    this.vaultManager.copySharedVaultTo(profile, vaultKey);\n  }\n\n  private resolveSandboxConfig(vaultKey: string): SandboxConfig {\n    const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);\n    if (this.baseConfig.type !== \"image\") {\n      return config;\n    }\n\n    if (config.type === \"container\") {\n      return config;\n    }\n\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(vaultKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    vaultKey: string,\n    conversationId: string,\n    config: SandboxConfig,\n    vault?: ResolvedVault,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || config.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = config.container || DockerContainerManager.containerName(vaultKey);\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(vaultKey, {\n          containerName: expected,\n          mounts: this.resolveMounts(conversationId, vault),\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"image\",\n            resolvedSandboxType: config.type,\n            conversationId,\n            vaultKey,\n            expectedContainer: expected,\n            hasVault: Boolean(vault),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for container key \"${vaultKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(conversationId: string, vault?: ResolvedVault): ContainerMount[] {\n    const mountsByTarget = new Map<string, ContainerMount>();\n    for (const mount of this.buildImageSandboxMounts(conversationId)) {\n      mountsByTarget.set(mount.target, mount);\n    }\n    for (const mount of vault?.mounts ?? []) {\n      if (!existsSync(mount.source)) {\n        reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n          domain: \"sandbox\",\n          surface: \"vault_injection\",\n          operation: \"resolve_mounts\",\n          severity: \"warning\",\n          context: {\n            sandboxType: \"image\",\n            conversationId,\n            target: mount.target,\n            hasVault: Boolean(vault),\n          },\n        });\n        continue;\n      }\n      mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });\n    }\n    return [...mountsByTarget.values()];\n  }\n\n  private buildImageSandboxMounts(conversationId: string): ContainerMount[] {\n    if (!this.workspaceDir) {\n      return [];\n    }\n\n    if (readConversationWorkspaceMountMode(this.workspaceDir, conversationId) === \"full\") {\n      return [{ source: this.workspaceDir, target: \"/workspace\" }];\n    }\n\n    const conversationDir = join(this.workspaceDir, conversationId);\n    if (!this.ensuredConversationDirs.has(conversationId)) {\n      ensureDirExists(conversationDir);\n      this.ensuredConversationDirs.add(conversationId);\n    }\n\n    return [\n      { source: join(this.workspaceDir, \"MEMORY.md\"), target: \"/workspace/MEMORY.md\" },\n      { source: join(this.workspaceDir, \"skills\"), target: \"/workspace/skills\" },\n      { source: join(this.workspaceDir, \"events\"), target: \"/workspace/events\" },\n      { source: conversationDir, target: `/workspace/${conversationId}` },\n    ];\n  }\n}\n"]}

package/dist/file-guards.d.ts

@@ -0,0 +1,9 @@
+import type { Static, TSchema } from "@sinclair/typebox";
+export declare function ensureDirExists(dir: string): void;
+export declare function readTextFileIfExists(path: string): string | undefined;
+export declare function readJsonFileIfExists<T>(path: string, validate: (value: unknown) => value is T, malformedMessage: (detail: string) => string): T | undefined;
+export declare function readJsonSchemaFileIfExists<T extends TSchema>(path: string, schema: T, malformedMessage: (detail: string) => string): Static<T> | undefined;
+export declare function parseJsonValue<T>(raw: string, validate: (value: unknown) => value is T, malformedMessage: (detail: string) => string): T;
+export declare function parseJsonSchemaValue<T extends TSchema>(raw: string, schema: T, malformedMessage: (detail: string) => string): Static<T>;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=file-guards.d.ts.map

package/dist/file-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-guards.d.ts","sourceRoot":"","sources":["../src/file-guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAIzD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAIjD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMrE;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,EACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAC3C,CAAC,GAAG,SAAS,CAGf;AAED,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,OAAO,EAC1D,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,EACT,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAC3C,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAGvB;AAWD,wBAAgB,cAAc,CAAC,CAAC,EAC9B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,EACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAC3C,CAAC,CAMH;AAED,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,OAAO,EACpD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,EACT,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAC3C,MAAM,CAAC,CAAC,CAAC,CAeX;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE","sourcesContent":["import type { Static, TSchema } from \"@sinclair/typebox\";\nimport { Value } from \"@sinclair/typebox/value\";\nimport { existsSync, mkdirSync, readFileSync } from \"fs\";\n\nexport function ensureDirExists(dir: string): void {\n  if (!existsSync(dir)) {\n    mkdirSync(dir, { recursive: true });\n  }\n}\n\nexport function readTextFileIfExists(path: string): string | undefined {\n  if (!existsSync(path)) {\n    return undefined;\n  }\n\n  return readFileSync(path, \"utf-8\");\n}\n\nexport function readJsonFileIfExists<T>(\n  path: string,\n  validate: (value: unknown) => value is T,\n  malformedMessage: (detail: string) => string,\n): T | undefined {\n  const raw = readTextFileIfExists(path);\n  return raw === undefined ? undefined : parseJsonValue(raw, validate, malformedMessage);\n}\n\nexport function readJsonSchemaFileIfExists<T extends TSchema>(\n  path: string,\n  schema: T,\n  malformedMessage: (detail: string) => string,\n): Static<T> | undefined {\n  const raw = readTextFileIfExists(path);\n  return raw === undefined ? undefined : parseJsonSchemaValue(raw, schema, malformedMessage);\n}\n\nfunction parseJson(raw: string, malformedMessage: (detail: string) => string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new Error(malformedMessage(detail), { cause: err });\n  }\n}\n\nexport function parseJsonValue<T>(\n  raw: string,\n  validate: (value: unknown) => value is T,\n  malformedMessage: (detail: string) => string,\n): T {\n  const parsed = parseJson(raw, malformedMessage);\n  if (!validate(parsed)) {\n    throw new Error(malformedMessage(\"unexpected JSON shape\"));\n  }\n  return parsed;\n}\n\nexport function parseJsonSchemaValue<T extends TSchema>(\n  raw: string,\n  schema: T,\n  malformedMessage: (detail: string) => string,\n): Static<T> {\n  const parsed = parseJson(raw, malformedMessage);\n  if (!Value.Check(schema, parsed)) {\n    let firstError: { path: string; message: string } | undefined;\n    for (const err of Value.Errors(schema, parsed)) {\n      firstError = err;\n      break;\n    }\n    const detail =\n      !firstError || firstError.path === \"\" || firstError.path === \"/\"\n        ? \"unexpected JSON shape\"\n        : `${firstError.path}: ${firstError.message}`;\n    throw new Error(malformedMessage(detail));\n  }\n  return parsed;\n}\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n"]}

package/dist/file-guards.js

@@ -0,0 +1,56 @@
+import { Value } from "@sinclair/typebox/value";
+import { existsSync, mkdirSync, readFileSync } from "fs";
+export function ensureDirExists(dir) {
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+}
+export function readTextFileIfExists(path) {
+    if (!existsSync(path)) {
+        return undefined;
+    }
+    return readFileSync(path, "utf-8");
+}
+export function readJsonFileIfExists(path, validate, malformedMessage) {
+    const raw = readTextFileIfExists(path);
+    return raw === undefined ? undefined : parseJsonValue(raw, validate, malformedMessage);
+}
+export function readJsonSchemaFileIfExists(path, schema, malformedMessage) {
+    const raw = readTextFileIfExists(path);
+    return raw === undefined ? undefined : parseJsonSchemaValue(raw, schema, malformedMessage);
+}
+function parseJson(raw, malformedMessage) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(malformedMessage(detail), { cause: err });
+    }
+}
+export function parseJsonValue(raw, validate, malformedMessage) {
+    const parsed = parseJson(raw, malformedMessage);
+    if (!validate(parsed)) {
+        throw new Error(malformedMessage("unexpected JSON shape"));
+    }
+    return parsed;
+}
+export function parseJsonSchemaValue(raw, schema, malformedMessage) {
+    const parsed = parseJson(raw, malformedMessage);
+    if (!Value.Check(schema, parsed)) {
+        let firstError;
+        for (const err of Value.Errors(schema, parsed)) {
+            firstError = err;
+            break;
+        }
+        const detail = !firstError || firstError.path === "" || firstError.path === "/"
+            ? "unexpected JSON shape"
+            : `${firstError.path}: ${firstError.message}`;
+        throw new Error(malformedMessage(detail));
+    }
+    return parsed;
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=file-guards.js.map

package/dist/file-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-guards.js","sourceRoot":"","sources":["../src/file-guards.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAwC,EACxC,gBAA4C;IAE5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAY,EACZ,MAAS,EACT,gBAA4C;IAE5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,gBAA4C;IAC1E,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,QAAwC,EACxC,gBAA4C;IAE5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAS,EACT,gBAA4C;IAE5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,IAAI,UAAyD,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/C,UAAU,GAAG,GAAG,CAAC;YACjB,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GACV,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,KAAK,GAAG;YAC9D,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import type { Static, TSchema } from \"@sinclair/typebox\";\nimport { Value } from \"@sinclair/typebox/value\";\nimport { existsSync, mkdirSync, readFileSync } from \"fs\";\n\nexport function ensureDirExists(dir: string): void {\n  if (!existsSync(dir)) {\n    mkdirSync(dir, { recursive: true });\n  }\n}\n\nexport function readTextFileIfExists(path: string): string | undefined {\n  if (!existsSync(path)) {\n    return undefined;\n  }\n\n  return readFileSync(path, \"utf-8\");\n}\n\nexport function readJsonFileIfExists<T>(\n  path: string,\n  validate: (value: unknown) => value is T,\n  malformedMessage: (detail: string) => string,\n): T | undefined {\n  const raw = readTextFileIfExists(path);\n  return raw === undefined ? undefined : parseJsonValue(raw, validate, malformedMessage);\n}\n\nexport function readJsonSchemaFileIfExists<T extends TSchema>(\n  path: string,\n  schema: T,\n  malformedMessage: (detail: string) => string,\n): Static<T> | undefined {\n  const raw = readTextFileIfExists(path);\n  return raw === undefined ? undefined : parseJsonSchemaValue(raw, schema, malformedMessage);\n}\n\nfunction parseJson(raw: string, malformedMessage: (detail: string) => string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new Error(malformedMessage(detail), { cause: err });\n  }\n}\n\nexport function parseJsonValue<T>(\n  raw: string,\n  validate: (value: unknown) => value is T,\n  malformedMessage: (detail: string) => string,\n): T {\n  const parsed = parseJson(raw, malformedMessage);\n  if (!validate(parsed)) {\n    throw new Error(malformedMessage(\"unexpected JSON shape\"));\n  }\n  return parsed;\n}\n\nexport function parseJsonSchemaValue<T extends TSchema>(\n  raw: string,\n  schema: T,\n  malformedMessage: (detail: string) => string,\n): Static<T> {\n  const parsed = parseJson(raw, malformedMessage);\n  if (!Value.Check(schema, parsed)) {\n    let firstError: { path: string; message: string } | undefined;\n    for (const err of Value.Errors(schema, parsed)) {\n      firstError = err;\n      break;\n    }\n    const detail =\n      !firstError || firstError.path === \"\" || firstError.path === \"/\"\n        ? \"unexpected JSON shape\"\n        : `${firstError.path}: ${firstError.message}`;\n    throw new Error(malformedMessage(detail));\n  }\n  return parsed;\n}\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n"]}

package/dist/fs-atomic.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Write `content` to `targetPath` with mode 0600, even when `targetPath`
+ * already exists. Uses O_CREAT|O_EXCL on a temp sibling (so the kernel
+ * guarantees permissions at creation, not after a racy chmod) and then
+ * rename(2) into place for atomicity. Readers never see a torn write,
+ * and a crash mid-write leaves either the old file or a stray .tmp
+ * (cleaned by the next attempt or manually) — never a half-written target.
+ */
+export declare function atomicWritePrivateFile(targetPath: string, content: string): void;
+//# sourceMappingURL=fs-atomic.d.ts.map

package/dist/fs-atomic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-atomic.d.ts","sourceRoot":"","sources":["../src/fs-atomic.ts"],"names":[],"mappings":"AAaA;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAiChF","sourcesContent":["import {\n  closeSync,\n  constants as fsConstants,\n  openSync,\n  renameSync,\n  unlinkSync,\n  writeSync,\n} from \"fs\";\nimport { randomBytes } from \"crypto\";\nimport { basename, dirname, join } from \"path\";\n\nconst PRIVATE_FILE_MODE = 0o600;\n\n/**\n * Write `content` to `targetPath` with mode 0600, even when `targetPath`\n * already exists. Uses O_CREAT|O_EXCL on a temp sibling (so the kernel\n * guarantees permissions at creation, not after a racy chmod) and then\n * rename(2) into place for atomicity. Readers never see a torn write,\n * and a crash mid-write leaves either the old file or a stray .tmp\n * (cleaned by the next attempt or manually) — never a half-written target.\n */\nexport function atomicWritePrivateFile(targetPath: string, content: string): void {\n  const dir = dirname(targetPath);\n  const tmpPath = join(\n    dir,\n    `.${basename(targetPath)}.${process.pid}.${randomBytes(8).toString(\"hex\")}.tmp`,\n  );\n  const fd = openSync(\n    tmpPath,\n    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL,\n    PRIVATE_FILE_MODE,\n  );\n  try {\n    writeSync(fd, content);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // ignore — original error is more informative\n    }\n    throw err;\n  } finally {\n    closeSync(fd);\n  }\n  try {\n    renameSync(tmpPath, targetPath);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // ignore\n    }\n    throw err;\n  }\n}\n"]}

package/dist/fs-atomic.js

@@ -0,0 +1,45 @@
+import { closeSync, constants as fsConstants, openSync, renameSync, unlinkSync, writeSync, } from "fs";
+import { randomBytes } from "crypto";
+import { basename, dirname, join } from "path";
+const PRIVATE_FILE_MODE = 0o600;
+/**
+ * Write `content` to `targetPath` with mode 0600, even when `targetPath`
+ * already exists. Uses O_CREAT|O_EXCL on a temp sibling (so the kernel
+ * guarantees permissions at creation, not after a racy chmod) and then
+ * rename(2) into place for atomicity. Readers never see a torn write,
+ * and a crash mid-write leaves either the old file or a stray .tmp
+ * (cleaned by the next attempt or manually) — never a half-written target.
+ */
+export function atomicWritePrivateFile(targetPath, content) {
+    const dir = dirname(targetPath);
+    const tmpPath = join(dir, `.${basename(targetPath)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+    const fd = openSync(tmpPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, PRIVATE_FILE_MODE);
+    try {
+        writeSync(fd, content);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch {
+            // ignore — original error is more informative
+        }
+        throw err;
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        renameSync(tmpPath, targetPath);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch {
+            // ignore
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=fs-atomic.js.map

package/dist/fs-atomic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-atomic.js","sourceRoot":"","sources":["../src/fs-atomic.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,QAAQ,EACR,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE/C,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,OAAe;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAClB,GAAG,EACH,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAChF,CAAC;IACF,MAAM,EAAE,GAAG,QAAQ,CACjB,OAAO,EACP,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAC/D,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import {\n  closeSync,\n  constants as fsConstants,\n  openSync,\n  renameSync,\n  unlinkSync,\n  writeSync,\n} from \"fs\";\nimport { randomBytes } from \"crypto\";\nimport { basename, dirname, join } from \"path\";\n\nconst PRIVATE_FILE_MODE = 0o600;\n\n/**\n * Write `content` to `targetPath` with mode 0600, even when `targetPath`\n * already exists. Uses O_CREAT|O_EXCL on a temp sibling (so the kernel\n * guarantees permissions at creation, not after a racy chmod) and then\n * rename(2) into place for atomicity. Readers never see a torn write,\n * and a crash mid-write leaves either the old file or a stray .tmp\n * (cleaned by the next attempt or manually) — never a half-written target.\n */\nexport function atomicWritePrivateFile(targetPath: string, content: string): void {\n  const dir = dirname(targetPath);\n  const tmpPath = join(\n    dir,\n    `.${basename(targetPath)}.${process.pid}.${randomBytes(8).toString(\"hex\")}.tmp`,\n  );\n  const fd = openSync(\n    tmpPath,\n    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL,\n    PRIVATE_FILE_MODE,\n  );\n  try {\n    writeSync(fd, content);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // ignore — original error is more informative\n    }\n    throw err;\n  } finally {\n    closeSync(fd);\n  }\n  try {\n    renameSync(tmpPath, targetPath);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // ignore\n    }\n    throw err;\n  }\n}\n"]}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { defaultCommandHandlers, dispatchCommand } from "./commands/index.js";
+export type { CommandContext, CommandHandler, CommandServices } from "./commands/index.js";
+export * from "./sessions/metadata.js";
+export * from "./sessions/policy.js";
+export * from "./sessions/store.js";
+export { createSessionRuntime, type CreateSessionSandboxOptions, type RunSessionOptions, type SessionRuntime, type SessionRuntimeOptions, } from "./runtime/index.js";
+export type { Bot, BotAdapters, BotEvent, BotHandler, ChatAdapter, ChatMessage, ChatResponseContext, ChatToolResult, ConversationKind, PlatformInfo, RunningSession, } from "./adapter.js";
+export { SandboxError, createExecutor, getSandboxAdapters, parseSandboxArg, validateSandbox, } from "./sandbox/index.js";
+export type { CloudflareSandboxConfig, ExecOptions, ExecResult, Executor, SandboxAdapter, SandboxConfig, } from "./sandbox/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9E,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3F,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,GAAG,EACH,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,cAAc,EACd,aAAa,GACd,MAAM,oBAAoB,CAAC","sourcesContent":["export { defaultCommandHandlers, dispatchCommand } from \"./commands/index.js\";\nexport type { CommandContext, CommandHandler, CommandServices } from \"./commands/index.js\";\nexport * from \"./sessions/metadata.js\";\nexport * from \"./sessions/policy.js\";\nexport * from \"./sessions/store.js\";\nexport {\n  createSessionRuntime,\n  type CreateSessionSandboxOptions,\n  type RunSessionOptions,\n  type SessionRuntime,\n  type SessionRuntimeOptions,\n} from \"./runtime/index.js\";\nexport type {\n  Bot,\n  BotAdapters,\n  BotEvent,\n  BotHandler,\n  ChatAdapter,\n  ChatMessage,\n  ChatResponseContext,\n  ChatToolResult,\n  ConversationKind,\n  PlatformInfo,\n  RunningSession,\n} from \"./adapter.js\";\nexport {\n  SandboxError,\n  createExecutor,\n  getSandboxAdapters,\n  parseSandboxArg,\n  validateSandbox,\n} from \"./sandbox/index.js\";\nexport type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./sandbox/index.js\";\n"]}

package/dist/index.js

@@ -0,0 +1,7 @@
+export { defaultCommandHandlers, dispatchCommand } from "./commands/index.js";
+export * from "./sessions/metadata.js";
+export * from "./sessions/policy.js";
+export * from "./sessions/store.js";
+export { createSessionRuntime, } from "./runtime/index.js";
+export { SandboxError, createExecutor, getSandboxAdapters, parseSandboxArg, validateSandbox, } from "./sandbox/index.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE9E,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,OAAO,EACL,oBAAoB,GAKrB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,eAAe,GAChB,MAAM,oBAAoB,CAAC","sourcesContent":["export { defaultCommandHandlers, dispatchCommand } from \"./commands/index.js\";\nexport type { CommandContext, CommandHandler, CommandServices } from \"./commands/index.js\";\nexport * from \"./sessions/metadata.js\";\nexport * from \"./sessions/policy.js\";\nexport * from \"./sessions/store.js\";\nexport {\n  createSessionRuntime,\n  type CreateSessionSandboxOptions,\n  type RunSessionOptions,\n  type SessionRuntime,\n  type SessionRuntimeOptions,\n} from \"./runtime/index.js\";\nexport type {\n  Bot,\n  BotAdapters,\n  BotEvent,\n  BotHandler,\n  ChatAdapter,\n  ChatMessage,\n  ChatResponseContext,\n  ChatToolResult,\n  ConversationKind,\n  PlatformInfo,\n  RunningSession,\n} from \"./adapter.js\";\nexport {\n  SandboxError,\n  createExecutor,\n  getSandboxAdapters,\n  parseSandboxArg,\n  validateSandbox,\n} from \"./sandbox/index.js\";\nexport type {\n  CloudflareSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./sandbox/index.js\";\n"]}

package/dist/instrument.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=instrument.d.ts.map

package/dist/instrument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrument.d.ts","sourceRoot":"","sources":["../src/instrument.ts"],"names":[],"mappings":"","sourcesContent":["import * as Sentry from \"@sentry/node\";\nimport { resolveSentryDsn, resolveStateDirFromArgv } from \"./config.js\";\nimport { setEnvAliases } from \"./env.js\";\nimport { createSentryInitOptions } from \"./sentry.js\";\n\nif (!process.env.STATE_DIR && !process.env.MIKAN_STATE_DIR) {\n  setEnvAliases(\"STATE_DIR\", resolveStateDirFromArgv());\n}\nconst sentryDsn = resolveSentryDsn();\n\nSentry.init(createSentryInitOptions(sentryDsn));\n"]}

package/dist/instrument.js

@@ -0,0 +1,10 @@
+import * as Sentry from "@sentry/node";
+import { resolveSentryDsn, resolveStateDirFromArgv } from "./config.js";
+import { setEnvAliases } from "./env.js";
+import { createSentryInitOptions } from "./sentry.js";
+if (!process.env.STATE_DIR && !process.env.MIKAN_STATE_DIR) {
+    setEnvAliases("STATE_DIR", resolveStateDirFromArgv());
+}
+const sentryDsn = resolveSentryDsn();
+Sentry.init(createSentryInitOptions(sentryDsn));
+//# sourceMappingURL=instrument.js.map

package/dist/instrument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrument.js","sourceRoot":"","sources":["../src/instrument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;IAC3D,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,CAAC,CAAC;AACxD,CAAC;AACD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;AAErC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC","sourcesContent":["import * as Sentry from \"@sentry/node\";\nimport { resolveSentryDsn, resolveStateDirFromArgv } from \"./config.js\";\nimport { setEnvAliases } from \"./env.js\";\nimport { createSentryInitOptions } from \"./sentry.js\";\n\nif (!process.env.STATE_DIR && !process.env.MIKAN_STATE_DIR) {\n  setEnvAliases(\"STATE_DIR\", resolveStateDirFromArgv());\n}\nconst sentryDsn = resolveSentryDsn();\n\nSentry.init(createSentryInitOptions(sentryDsn));\n"]}

package/dist/log.d.ts

@@ -0,0 +1,36 @@
+export interface LogContext {
+    conversationId: string;
+    userName?: string;
+    conversationName?: string;
+    sessionId?: string;
+}
+export declare function logUserMessage(ctx: LogContext, text: string): void;
+export declare function logToolStart(ctx: LogContext, toolName: string, label: string, args: Record<string, unknown>): void;
+export declare function logToolSuccess(ctx: LogContext, toolName: string, durationMs: number, result: string): void;
+export declare function logToolError(ctx: LogContext, toolName: string, durationMs: number, error: string): void;
+export declare function logResponseStart(ctx: LogContext): void;
+export declare function logThinking(ctx: LogContext, thinking: string): void;
+export declare function logResponse(ctx: LogContext, text: string): void;
+export declare function logInfo(message: string): void;
+export declare function logWarning(message: string, details?: string): void;
+export declare function logAgentError(ctx: LogContext | "system", error: string): void;
+export declare function logUsageSummary(ctx: LogContext, usage: {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+    cost: {
+        input: number;
+        output: number;
+        cacheRead: number;
+        cacheWrite: number;
+        total: number;
+    };
+}, contextTokens?: number, contextWindow?: number): string;
+export declare function logStartup(workingDir: string, sandbox: string): void;
+export declare function logConnected(platform: string): void;
+export declare function logDisconnected(): void;
+export declare function logBackfillStart(channelCount: number): void;
+export declare function logBackfillChannel(channelName: string, messageCount: number): void;
+export declare function logBackfillComplete(totalMessages: number, durationMs: number): void;
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoED,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAElE;AAGD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,IAAI,CAWN;AAED,wBAAgB,cAAc,CAC5B,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,IAAI,CAYN;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,IAAI,CAUN;AAGD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAEtD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQnE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAQ/D;AAGD,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CASlE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQ7E;AAUD,wBAAgB,eAAe,CAC7B,GAAG,EAAE,UAAU,EACf,KAAK,EAAE;IACL,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/F,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAqCR;AAGD,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAIpE;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAGnD;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAGD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAElF;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAOnF","sourcesContent":["import chalk from \"chalk\";\n\nexport interface LogContext {\n  conversationId: string;\n  userName?: string;\n  conversationName?: string; // For display like #dev-team vs C16HET4EQ\n  sessionId?: string;\n}\n\nfunction timestamp(): string {\n  const now = new Date();\n  const hh = String(now.getHours()).padStart(2, \"0\");\n  const mm = String(now.getMinutes()).padStart(2, \"0\");\n  const ss = String(now.getSeconds()).padStart(2, \"0\");\n  return `[${hh}:${mm}:${ss}]`;\n}\n\nfunction formatContext(ctx: LogContext): string {\n  const session = ctx.sessionId ? `:${ctx.sessionId}` : \"\";\n  if (ctx.conversationId.startsWith(\"D\")) {\n    return `[DM:${ctx.userName || ctx.conversationId}${session}]`;\n  }\n  const conversation = ctx.conversationName || ctx.conversationId;\n  const user = ctx.userName || \"unknown\";\n  return `[${conversation.startsWith(\"#\") ? conversation : `#${conversation}`}:${user}${session}]`;\n}\n\n// Keep stdout/stderr lines manageable when echoing tool/agent output. Long bodies\n// flow through Sentry and session storage; the console stream just needs a preview.\nconst LOG_PREVIEW_MAX = 1000;\n\nfunction truncate(text: string, maxLen: number): string {\n  if (text.length <= maxLen) return text;\n  return `${text.substring(0, maxLen)}\\n(truncated at ${maxLen} chars)`;\n}\n\nfunction formatToolArgs(args: Record<string, unknown>): string {\n  const lines: string[] = [];\n\n  for (const [key, value] of Object.entries(args)) {\n    // Skip the label - it's already shown in the tool name\n    if (key === \"label\") continue;\n\n    // For read tool, format path with offset/limit\n    if (key === \"path\" && typeof value === \"string\") {\n      const offset = args.offset as number | undefined;\n      const limit = args.limit as number | undefined;\n      if (offset !== undefined && limit !== undefined) {\n        lines.push(`${value}:${offset}-${offset + limit}`);\n      } else {\n        lines.push(value);\n      }\n      continue;\n    }\n\n    // Skip offset/limit since we already handled them\n    if (key === \"offset\" || key === \"limit\") continue;\n\n    // For other values, format them\n    if (typeof value === \"string\") {\n      // Multi-line strings get indented\n      if (value.includes(\"\\n\")) {\n        lines.push(value);\n      } else {\n        lines.push(value);\n      }\n    } else {\n      lines.push(JSON.stringify(value));\n    }\n  }\n\n  return lines.join(\"\\n\");\n}\n\n// User messages\nexport function logUserMessage(ctx: LogContext, text: string): void {\n  console.log(chalk.green(`${timestamp()} ${formatContext(ctx)} ${text}`));\n}\n\n// Tool execution\nexport function logToolStart(\n  ctx: LogContext,\n  toolName: string,\n  label: string,\n  args: Record<string, unknown>,\n): void {\n  const formattedArgs = formatToolArgs(args);\n  console.log(chalk.yellow(`${timestamp()} ${formatContext(ctx)} ↳ ${toolName}: ${label}`));\n  if (formattedArgs) {\n    // Indent the args\n    const indented = formattedArgs\n      .split(\"\\n\")\n      .map((line) => `           ${line}`)\n      .join(\"\\n\");\n    console.log(chalk.dim(indented));\n  }\n}\n\nexport function logToolSuccess(\n  ctx: LogContext,\n  toolName: string,\n  durationMs: number,\n  result: string,\n): void {\n  const duration = (durationMs / 1000).toFixed(1);\n  console.log(chalk.yellow(`${timestamp()} ${formatContext(ctx)} ✓ ${toolName} (${duration}s)`));\n\n  const truncated = truncate(result, LOG_PREVIEW_MAX);\n  if (truncated) {\n    const indented = truncated\n      .split(\"\\n\")\n      .map((line) => `           ${line}`)\n      .join(\"\\n\");\n    console.log(chalk.dim(indented));\n  }\n}\n\nexport function logToolError(\n  ctx: LogContext,\n  toolName: string,\n  durationMs: number,\n  error: string,\n): void {\n  const duration = (durationMs / 1000).toFixed(1);\n  console.log(chalk.yellow(`${timestamp()} ${formatContext(ctx)} ✗ ${toolName} (${duration}s)`));\n\n  const truncated = truncate(error, LOG_PREVIEW_MAX);\n  const indented = truncated\n    .split(\"\\n\")\n    .map((line) => `           ${line}`)\n    .join(\"\\n\");\n  console.log(chalk.dim(indented));\n}\n\n// Response streaming\nexport function logResponseStart(ctx: LogContext): void {\n  console.log(chalk.yellow(`${timestamp()} ${formatContext(ctx)} → Streaming response...`));\n}\n\nexport function logThinking(ctx: LogContext, thinking: string): void {\n  console.log(chalk.yellow(`${timestamp()} ${formatContext(ctx)} 💭 Thinking`));\n  const truncated = truncate(thinking, LOG_PREVIEW_MAX);\n  const indented = truncated\n    .split(\"\\n\")\n    .map((line) => `           ${line}`)\n    .join(\"\\n\");\n  console.log(chalk.dim(indented));\n}\n\nexport function logResponse(ctx: LogContext, text: string): void {\n  console.log(chalk.yellow(`${timestamp()} ${formatContext(ctx)} 💬 Response`));\n  const truncated = truncate(text, LOG_PREVIEW_MAX);\n  const indented = truncated\n    .split(\"\\n\")\n    .map((line) => `           ${line}`)\n    .join(\"\\n\");\n  console.log(chalk.dim(indented));\n}\n\n// System\nexport function logInfo(message: string): void {\n  console.log(chalk.blue(`${timestamp()} [system] ${message}`));\n}\n\nexport function logWarning(message: string, details?: string): void {\n  console.log(chalk.yellow(`${timestamp()} [system] ⚠ ${message}`));\n  if (details) {\n    const indented = details\n      .split(\"\\n\")\n      .map((line) => `           ${line}`)\n      .join(\"\\n\");\n    console.log(chalk.dim(indented));\n  }\n}\n\nexport function logAgentError(ctx: LogContext | \"system\", error: string): void {\n  const context = ctx === \"system\" ? \"[system]\" : formatContext(ctx);\n  console.log(chalk.yellow(`${timestamp()} ${context} ✗ Agent error`));\n  const indented = error\n    .split(\"\\n\")\n    .map((line) => `           ${line}`)\n    .join(\"\\n\");\n  console.log(chalk.dim(indented));\n}\n\nfunction formatTokenCount(count: number): string {\n  if (count < 1000) return count.toString();\n  if (count < 10000) return `${(count / 1000).toFixed(1)}k`;\n  if (count < 1000000) return `${Math.round(count / 1000)}k`;\n  return `${(count / 1000000).toFixed(1)}M`;\n}\n\n// Usage summary\nexport function logUsageSummary(\n  ctx: LogContext,\n  usage: {\n    input: number;\n    output: number;\n    cacheRead: number;\n    cacheWrite: number;\n    cost: { input: number; output: number; cacheRead: number; cacheWrite: number; total: number };\n  },\n  contextTokens?: number,\n  contextWindow?: number,\n): string {\n  const lines: string[] = [];\n  lines.push(\"_Usage Summary_\");\n  lines.push(`Tokens: ${usage.input.toLocaleString()} in, ${usage.output.toLocaleString()} out`);\n  if (usage.cacheRead > 0 || usage.cacheWrite > 0) {\n    lines.push(\n      `Cache: ${usage.cacheRead.toLocaleString()} read, ${usage.cacheWrite.toLocaleString()} write`,\n    );\n  }\n  if (contextTokens && contextWindow) {\n    const contextPercent = ((contextTokens / contextWindow) * 100).toFixed(1);\n    lines.push(\n      `Context: ${formatTokenCount(contextTokens)} / ${formatTokenCount(contextWindow)} (${contextPercent}%)`,\n    );\n  }\n  lines.push(\n    `Cost: $${usage.cost.input.toFixed(4)} in, $${usage.cost.output.toFixed(4)} out` +\n      (usage.cacheRead > 0 || usage.cacheWrite > 0\n        ? `, $${usage.cost.cacheRead.toFixed(4)} cache read, $${usage.cost.cacheWrite.toFixed(4)} cache write`\n        : \"\"),\n  );\n  lines.push(`*Total: $${usage.cost.total.toFixed(4)}*`);\n\n  const summary = lines.join(\"\\n\");\n\n  console.log(chalk.yellow(`${timestamp()} ${formatContext(ctx)} 💰 Usage`));\n  console.log(\n    chalk.dim(\n      `           ${usage.input.toLocaleString()} in + ${usage.output.toLocaleString()} out` +\n        (usage.cacheRead > 0 || usage.cacheWrite > 0\n          ? ` (${usage.cacheRead.toLocaleString()} cache read, ${usage.cacheWrite.toLocaleString()} cache write)`\n          : \"\") +\n        ` = $${usage.cost.total.toFixed(4)}`,\n    ),\n  );\n\n  return summary;\n}\n\n// Startup (no context needed)\nexport function logStartup(workingDir: string, sandbox: string): void {\n  console.log(\"Starting mikan...\");\n  console.log(`  Working directory: ${workingDir}`);\n  console.log(`  Sandbox: ${sandbox}`);\n}\n\nexport function logConnected(platform: string): void {\n  console.log(`⚡️ Mikan connected to ${platform} and listening!`);\n  console.log(\"\");\n}\n\nexport function logDisconnected(): void {\n  console.log(\"Mikan disconnected.\");\n}\n\n// Backfill\nexport function logBackfillStart(channelCount: number): void {\n  console.log(chalk.blue(`${timestamp()} [system] Backfilling ${channelCount} channels...`));\n}\n\nexport function logBackfillChannel(channelName: string, messageCount: number): void {\n  console.log(chalk.blue(`${timestamp()} [system]   #${channelName}: ${messageCount} messages`));\n}\n\nexport function logBackfillComplete(totalMessages: number, durationMs: number): void {\n  const duration = (durationMs / 1000).toFixed(1);\n  console.log(\n    chalk.blue(\n      `${timestamp()} [system] Backfill complete: ${totalMessages} messages in ${duration}s`,\n    ),\n  );\n}\n"]}