@geminixiang/mikan 1.0.0-beta.4 → 1.0.0-beta.40

package/dist/sandbox/types.d.ts

@@ -1,4 +1,5 @@
-export type SandboxConfig = HostSandboxConfig | ContainerSandboxConfig | ImageSandboxConfig | FirecrackerSandboxConfig | CloudflareSandboxConfig;
+import type { ResourceLimits } from "../types.js";
+export type SandboxConfig = HostSandboxConfig | ContainerSandboxConfig | ImageSandboxConfig | GondolinSandboxConfig | FirecrackerSandboxConfig | CloudflareSandboxConfig;
 export interface HostSandboxConfig {
     type: "host";
 }
@@ -10,6 +11,41 @@ export interface ImageSandboxConfig {
     type: "image";
     image: string;
 }
+export interface GondolinSandboxConfig {
+    type: "gondolin";
+    profile: "default";
+    /** Local-only runtime details supplied after actor/workspace resolution. */
+    image?: string;
+    workspacePath?: string;
+    mounts?: Array<{
+        source: string;
+        target: string;
+        readOnly?: boolean;
+    }>;
+    instanceId?: string;
+    resourceKey?: string;
+}
+export interface GondolinBootstrapOptions {
+    /** Default per-runtime resource limits. */
+    limits?: ResourceLimits;
+    /** Boosted limits applied while a runtime holds a boost. */
+    boostLimits?: ResourceLimits;
+}
+export interface SessionClientCallbacks {
+    onJson: (message: {
+        type: string;
+        id?: number;
+        exit_code?: number | null;
+        code?: string;
+        message?: string;
+    }) => void;
+    onBinary: (frame: Buffer) => void;
+    onClose: (error?: Error) => void;
+}
+export interface SessionClient {
+    send(message: object): void;
+    close(): void;
+}
 export interface FirecrackerSandboxConfig {
     type: "firecracker";
     vmId: string;
@@ -26,6 +62,23 @@ export interface Executor {
      * Execute a bash command.
      */
     exec(command: string, options?: ExecOptions): Promise<ExecResult>;
+    /**
+     * Read a runtime file as UTF-8 text. The executor owns the transport, so
+     * file contents never pass through shell argv or extra shell parse layers.
+     */
+    readFile(path: string, options?: ExecOptions): Promise<string>;
+    /**
+     * Read a runtime file as base64 (for binary content, e.g. images). Same
+     * transport ownership as readFile.
+     */
+    readFileBase64(path: string, options?: ExecOptions): Promise<string>;
+    /**
+     * Write a runtime file, creating parent directories and replacing via a
+     * staging file so an aborted write never truncates the target. Like
+     * readFile, transport is the executor's concern — content must survive
+     * arbitrary quoting and ARG_MAX limits.
+     */
+    writeFile(path: string, content: string, options?: ExecOptions): Promise<void>;
     /**
      * Get the workspace path prefix for this executor.
      * Host: returns the actual path.
@@ -58,10 +111,21 @@ export interface ExecResult {
     stderr: string;
     code: number;
 }
+export interface SandboxCredentialCapabilities {
+    env: boolean;
+    fileMounts: boolean;
+}
+interface SandboxWorkspaceCapabilities {
+    /** Whether mikan can enforce the managed conversation workspace projection. */
+    managedProjection: boolean;
+}
 export interface SandboxAdapter<TConfig extends SandboxConfig = SandboxConfig> {
     type: TConfig["type"];
+    credentials: SandboxCredentialCapabilities;
+    workspace: SandboxWorkspaceCapabilities;
     parse(value: string): TConfig | undefined;
     validate?(config: TConfig): Promise<void>;
     createExecutor?(config: TConfig, env?: Record<string, string>, ensureReady?: () => Promise<void>): Executor;
 }
+export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/sandbox/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,sBAAsB,GACtB,kBAAkB,GAClB,wBAAwB,GACxB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElE;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAE3C;;OAEG;IACH,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAE9D;;OAEG;IACH,gBAAgB,IAAI,aAAa,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,aAAa,GAAG,aAAa;IAC3E,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,CACb,MAAM,EAAE,OAAO,EACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CAAC;CACb"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,sBAAsB,GACtB,kBAAkB,GAClB,qBAAqB,GACrB,wBAAwB,GACxB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,SAAS,CAAC;IACnB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,CAAC,OAAO,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,KAAK,IAAI,CAAC;IACX,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/D;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAErE;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/E;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAE3C;;OAEG;IACH,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAE9D;;OAEG;IACH,gBAAgB,IAAI,aAAa,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,4BAA4B;IACpC,+EAA+E;IAC/E,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,aAAa,GAAG,aAAa;IAC3E,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,WAAW,EAAE,6BAA6B,CAAC;IAC3C,SAAS,EAAE,4BAA4B,CAAC;IACxC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,CACb,MAAM,EAAE,OAAO,EACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CAAC;CACb"}

package/dist/sandbox/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"","sourcesContent":["export type SandboxConfig =\n  | HostSandboxConfig\n  | ContainerSandboxConfig\n  | ImageSandboxConfig\n  | FirecrackerSandboxConfig\n  | CloudflareSandboxConfig;\n\nexport interface HostSandboxConfig {\n  type: \"host\";\n}\n\nexport interface ContainerSandboxConfig {\n  type: \"container\";\n  container: string;\n}\n\nexport interface ImageSandboxConfig {\n  type: \"image\";\n  image: string;\n}\n\nexport interface FirecrackerSandboxConfig {\n  type: \"firecracker\";\n  vmId: string;\n  hostPath: string;\n  sshUser?: string;\n  sshPort?: number;\n}\n\nexport interface CloudflareSandboxConfig {\n  type: \"cloudflare\";\n  sandboxId: string;\n}\n\nexport interface Executor {\n  /**\n   * Execute a bash command.\n   */\n  exec(command: string, options?: ExecOptions): Promise<ExecResult>;\n\n  /**\n   * Get the workspace path prefix for this executor.\n   * Host: returns the actual path.\n   * Container/Firecracker: returns /workspace.\n   */\n  getWorkspacePath(hostPath: string): string;\n\n  /**\n   * Return explicit host/control-plane/runtime path semantics for this executor.\n   */\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext;\n\n  /**\n   * Get the current sandbox config used by this executor.\n   */\n  getSandboxConfig(): SandboxConfig;\n}\n\nexport interface RuntimePathContext {\n  /** Host-side workspace root used by mikan's control plane. */\n  hostWorkspaceRoot: string;\n  /** Workspace root as seen by bash/read/write/edit inside the runtime. */\n  runtimeWorkspaceRoot: string;\n  /** Translate a runtime path back to a host path when the runtime is host-backed. */\n  runtimeToHostPath?: (runtimePath: string) => string;\n}\n\nexport interface ExecOptions {\n  timeout?: number;\n  signal?: AbortSignal;\n}\n\nexport interface ExecResult {\n  stdout: string;\n  stderr: string;\n  code: number;\n}\n\nexport interface SandboxAdapter<TConfig extends SandboxConfig = SandboxConfig> {\n  type: TConfig[\"type\"];\n  parse(value: string): TConfig | undefined;\n  validate?(config: TConfig): Promise<void>;\n  createExecutor?(\n    config: TConfig,\n    env?: Record<string, string>,\n    ensureReady?: () => Promise<void>,\n  ): Executor;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ResourceLimits } from \"../types.js\";\n\nexport type SandboxConfig =\n  | HostSandboxConfig\n  | ContainerSandboxConfig\n  | ImageSandboxConfig\n  | GondolinSandboxConfig\n  | FirecrackerSandboxConfig\n  | CloudflareSandboxConfig;\n\nexport interface HostSandboxConfig {\n  type: \"host\";\n}\n\nexport interface ContainerSandboxConfig {\n  type: \"container\";\n  container: string;\n}\n\nexport interface ImageSandboxConfig {\n  type: \"image\";\n  image: string;\n}\n\nexport interface GondolinSandboxConfig {\n  type: \"gondolin\";\n  profile: \"default\";\n  /** Local-only runtime details supplied after actor/workspace resolution. */\n  image?: string;\n  workspacePath?: string;\n  mounts?: Array<{ source: string; target: string; readOnly?: boolean }>;\n  instanceId?: string;\n  resourceKey?: string;\n}\n\nexport interface GondolinBootstrapOptions {\n  /** Default per-runtime resource limits. */\n  limits?: ResourceLimits;\n  /** Boosted limits applied while a runtime holds a boost. */\n  boostLimits?: ResourceLimits;\n}\n\nexport interface SessionClientCallbacks {\n  onJson: (message: {\n    type: string;\n    id?: number;\n    exit_code?: number | null;\n    code?: string;\n    message?: string;\n  }) => void;\n  onBinary: (frame: Buffer) => void;\n  onClose: (error?: Error) => void;\n}\n\nexport interface SessionClient {\n  send(message: object): void;\n  close(): void;\n}\n\nexport interface FirecrackerSandboxConfig {\n  type: \"firecracker\";\n  vmId: string;\n  hostPath: string;\n  sshUser?: string;\n  sshPort?: number;\n}\n\nexport interface CloudflareSandboxConfig {\n  type: \"cloudflare\";\n  sandboxId: string;\n}\n\nexport interface Executor {\n  /**\n   * Execute a bash command.\n   */\n  exec(command: string, options?: ExecOptions): Promise<ExecResult>;\n\n  /**\n   * Read a runtime file as UTF-8 text. The executor owns the transport, so\n   * file contents never pass through shell argv or extra shell parse layers.\n   */\n  readFile(path: string, options?: ExecOptions): Promise<string>;\n\n  /**\n   * Read a runtime file as base64 (for binary content, e.g. images). Same\n   * transport ownership as readFile.\n   */\n  readFileBase64(path: string, options?: ExecOptions): Promise<string>;\n\n  /**\n   * Write a runtime file, creating parent directories and replacing via a\n   * staging file so an aborted write never truncates the target. Like\n   * readFile, transport is the executor's concern — content must survive\n   * arbitrary quoting and ARG_MAX limits.\n   */\n  writeFile(path: string, content: string, options?: ExecOptions): Promise<void>;\n\n  /**\n   * Get the workspace path prefix for this executor.\n   * Host: returns the actual path.\n   * Container/Firecracker: returns /workspace.\n   */\n  getWorkspacePath(hostPath: string): string;\n\n  /**\n   * Return explicit host/control-plane/runtime path semantics for this executor.\n   */\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext;\n\n  /**\n   * Get the current sandbox config used by this executor.\n   */\n  getSandboxConfig(): SandboxConfig;\n}\n\nexport interface RuntimePathContext {\n  /** Host-side workspace root used by mikan's control plane. */\n  hostWorkspaceRoot: string;\n  /** Workspace root as seen by bash/read/write/edit inside the runtime. */\n  runtimeWorkspaceRoot: string;\n  /** Translate a runtime path back to a host path when the runtime is host-backed. */\n  runtimeToHostPath?: (runtimePath: string) => string;\n}\n\nexport interface ExecOptions {\n  timeout?: number;\n  signal?: AbortSignal;\n}\n\nexport interface ExecResult {\n  stdout: string;\n  stderr: string;\n  code: number;\n}\n\nexport interface SandboxCredentialCapabilities {\n  env: boolean;\n  fileMounts: boolean;\n}\n\ninterface SandboxWorkspaceCapabilities {\n  /** Whether mikan can enforce the managed conversation workspace projection. */\n  managedProjection: boolean;\n}\n\nexport interface SandboxAdapter<TConfig extends SandboxConfig = SandboxConfig> {\n  type: TConfig[\"type\"];\n  credentials: SandboxCredentialCapabilities;\n  workspace: SandboxWorkspaceCapabilities;\n  parse(value: string): TConfig | undefined;\n  validate?(config: TConfig): Promise<void>;\n  createExecutor?(\n    config: TConfig,\n    env?: Record<string, string>,\n    ensureReady?: () => Promise<void>,\n  ): Executor;\n}\n"]}

package/dist/sandbox/utils.d.ts

@@ -1,4 +1,18 @@
+import type { RuntimePathContext } from "./types.js";
 export declare function execSimple(cmd: string, args: string[]): Promise<string>;
 export declare function killProcessTree(pid: number): void;
 export declare function shellEscape(s: string): string;
+interface ExecLikeResult {
+    stdout: string;
+    stderr: string;
+    code: number;
+}
+interface ExecLike<TOptions> {
+    exec(command: string, options?: TOptions): Promise<ExecLikeResult>;
+}
+export declare function execReadFileBase64<TOptions>(executor: ExecLike<TOptions>, path: string, options?: TOptions): Promise<string>;
+export declare function execReadFile<TOptions>(executor: ExecLike<TOptions>, path: string, options?: TOptions): Promise<string>;
+export declare function execWriteFile<TOptions>(executor: ExecLike<TOptions>, path: string, content: string, options?: TOptions): Promise<void>;
+export declare function createMountedRuntimePathContext(hostWorkspaceRoot: string, runtimeWorkspaceRoot: string): RuntimePathContext;
+export {};
 //# sourceMappingURL=utils.d.ts.map

package/dist/sandbox/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/utils.ts"],"names":[],"mappings":"AAEA,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAqBjD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAG7C"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAqBjD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAG7C;AAWD,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,QAAQ,CAAC,QAAQ;IACzB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpE;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAC/C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,YAAY,CAAC,QAAQ,EACzC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAC1C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,wBAAgB,+BAA+B,CAC7C,iBAAiB,EAAE,MAAM,EACzB,oBAAoB,EAAE,MAAM,GAC3B,kBAAkB,CAOpB"}

package/dist/sandbox/utils.js

@@ -1,4 +1,5 @@
-import { spawn } from "child_process";
+import { spawn } from "node:child_process";
+import { isAbsolute, relative, resolve as resolvePath, sep } from "node:path";
 export function execSimple(cmd, args) {
     return new Promise((resolve, reject) => {
         const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
@@ -48,4 +49,70 @@ export function shellEscape(s) {
     // Escape for passing to sh -c
     return `'${s.replace(/'/g, "'\\''")}'`;
 }
+/**
+ * Shared exec-backed file transport for executors whose only channel into the
+ * runtime is `exec` (docker exec, ssh, HTTP). Contents travel base64-encoded —
+ * the base64 alphabet is inert under every shell parse layer — and writes are
+ * chunked so no single command approaches the per-argument ARG_MAX limit,
+ * staged, then moved into place so an aborted write never truncates the file.
+ */
+const WRITE_CHUNK_CHARS = 65536;
+export async function execReadFileBase64(executor, path, options) {
+    const result = await executor.exec(`base64 < ${shellEscape(path)}`, options);
+    if (result.code !== 0) {
+        throw new Error(result.stderr.trim() || `Failed to read file: ${path}`);
+    }
+    return result.stdout.replace(/\s+/g, "");
+}
+export async function execReadFile(executor, path, options) {
+    return Buffer.from(await execReadFileBase64(executor, path, options), "base64").toString("utf-8");
+}
+export async function execWriteFile(executor, path, content, options) {
+    const encoded = Buffer.from(content, "utf-8").toString("base64");
+    const escapedPath = shellEscape(path);
+    const stage = shellEscape(`${path}.mikan-stage`);
+    const stageB64 = shellEscape(`${path}.mikan-stage.b64`);
+    const run = async (command) => {
+        const result = await executor.exec(command, options);
+        if (result.code !== 0) {
+            await executor.exec(`rm -f ${stage} ${stageB64}`, options).catch(() => { });
+            throw new Error(result.stderr.trim() || `Failed to write file: ${path}`);
+        }
+    };
+    const dir = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) || "/" : ".";
+    await run(`mkdir -p ${shellEscape(dir)} && : > ${stageB64}`);
+    for (let offset = 0; offset === 0 || offset < encoded.length; offset += WRITE_CHUNK_CHARS) {
+        const chunk = encoded.slice(offset, offset + WRITE_CHUNK_CHARS);
+        await run(`printf '%s' ${shellEscape(chunk)} >> ${stageB64}`);
+    }
+    await run(`base64 -d < ${stageB64} > ${stage} && mv ${stage} ${escapedPath} && rm -f ${stageB64}`);
+}
+export function createMountedRuntimePathContext(hostWorkspaceRoot, runtimeWorkspaceRoot) {
+    return {
+        hostWorkspaceRoot,
+        runtimeWorkspaceRoot,
+        runtimeToHostPath: (runtimePath) => translateMountedRuntimePathToHost(runtimePath, runtimeWorkspaceRoot, hostWorkspaceRoot),
+    };
+}
+function translateMountedRuntimePathToHost(runtimePath, runtimeWorkspaceRoot, hostWorkspaceRoot) {
+    if (!isAbsolute(runtimePath)) {
+        return runtimePath;
+    }
+    const runtimeRoot = resolvePath(runtimeWorkspaceRoot);
+    const normalizedRuntimePath = resolvePath(runtimePath);
+    const runtimeRelativePath = relative(runtimeRoot, normalizedRuntimePath);
+    const escapesRuntimeRoot = runtimeRelativePath === ".." ||
+        runtimeRelativePath.startsWith(`..${sep}`) ||
+        isAbsolute(runtimeRelativePath);
+    if (escapesRuntimeRoot) {
+        return runtimePath;
+    }
+    const hostRoot = resolvePath(hostWorkspaceRoot);
+    const hostPath = resolvePath(hostRoot, runtimeRelativePath);
+    const hostRelativePath = relative(hostRoot, hostPath);
+    const escapesHostRoot = hostRelativePath === ".." ||
+        hostRelativePath.startsWith(`..${sep}`) ||
+        isAbsolute(hostRelativePath);
+    return escapesHostRoot ? runtimePath : hostPath;
+}
 //# sourceMappingURL=utils.js.map

package/dist/sandbox/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/sandbox/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAc;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,IAAI,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,IAAI,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,CAAC;;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;gBACnD,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,8BAA8B;IAC9B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC","sourcesContent":["import { spawn } from \"child_process\";\n\nexport function execSimple(cmd: string, args: string[]): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const child = spawn(cmd, args, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout?.on(\"data\", (d) => {\n      stdout += d;\n    });\n    child.stderr?.on(\"data\", (d) => {\n      stderr += d;\n    });\n    child.on(\"close\", (code) => {\n      if (code === 0) resolve(stdout);\n      else reject(new Error(stderr || `Exit code ${code}`));\n    });\n  });\n}\n\nexport function killProcessTree(pid: number): void {\n  if (process.platform === \"win32\") {\n    try {\n      spawn(\"taskkill\", [\"/F\", \"/T\", \"/PID\", String(pid)], {\n        stdio: \"ignore\",\n        detached: true,\n      });\n    } catch {\n      // Ignore errors\n    }\n  } else {\n    try {\n      process.kill(-pid, \"SIGKILL\");\n    } catch {\n      try {\n        process.kill(pid, \"SIGKILL\");\n      } catch {\n        // Process already dead\n      }\n    }\n  }\n}\n\nexport function shellEscape(s: string): string {\n  // Escape for passing to sh -c\n  return `'${s.replace(/'/g, \"'\\\\''\")}'`;\n}\n"]}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/sandbox/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAG9E,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAc;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,IAAI,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,IAAI,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,CAAC;;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;gBACnD,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,8BAA8B;IAC9B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAYhC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAA4B,EAC5B,IAAY,EACZ,OAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA4B,EAC5B,IAAY,EACZ,OAAkB;IAElB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA4B,EAC5B,IAAY,EACZ,OAAe,EACf,OAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC;IAExD,MAAM,GAAG,GAAG,KAAK,EAAE,OAAe,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnF,MAAM,GAAG,CAAC,YAAY,WAAW,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IAC7D,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAC1F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC;QAChE,MAAM,GAAG,CAAC,eAAe,WAAW,CAAC,KAAK,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,CACP,eAAe,QAAQ,MAAM,KAAK,UAAU,KAAK,IAAI,WAAW,aAAa,QAAQ,EAAE,CACxF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,iBAAyB,EACzB,oBAA4B;IAE5B,OAAO;QACL,iBAAiB;QACjB,oBAAoB;QACpB,iBAAiB,EAAE,CAAC,WAAW,EAAE,EAAE,CACjC,iCAAiC,CAAC,WAAW,EAAE,oBAAoB,EAAE,iBAAiB,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,WAAmB,EACnB,oBAA4B,EAC5B,iBAAyB;IAEzB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IACtD,MAAM,qBAAqB,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IACzE,MAAM,kBAAkB,GACtB,mBAAmB,KAAK,IAAI;QAC5B,mBAAmB,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QAC1C,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAElC,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,eAAe,GACnB,gBAAgB,KAAK,IAAI;QACzB,gBAAgB,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAE/B,OAAO,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC","sourcesContent":["import { spawn } from \"node:child_process\";\nimport { isAbsolute, relative, resolve as resolvePath, sep } from \"node:path\";\nimport type { RuntimePathContext } from \"./types.js\";\n\nexport function execSimple(cmd: string, args: string[]): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const child = spawn(cmd, args, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout?.on(\"data\", (d) => {\n      stdout += d;\n    });\n    child.stderr?.on(\"data\", (d) => {\n      stderr += d;\n    });\n    child.on(\"close\", (code) => {\n      if (code === 0) resolve(stdout);\n      else reject(new Error(stderr || `Exit code ${code}`));\n    });\n  });\n}\n\nexport function killProcessTree(pid: number): void {\n  if (process.platform === \"win32\") {\n    try {\n      spawn(\"taskkill\", [\"/F\", \"/T\", \"/PID\", String(pid)], {\n        stdio: \"ignore\",\n        detached: true,\n      });\n    } catch {\n      // Ignore errors\n    }\n  } else {\n    try {\n      process.kill(-pid, \"SIGKILL\");\n    } catch {\n      try {\n        process.kill(pid, \"SIGKILL\");\n      } catch {\n        // Process already dead\n      }\n    }\n  }\n}\n\nexport function shellEscape(s: string): string {\n  // Escape for passing to sh -c\n  return `'${s.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n/**\n * Shared exec-backed file transport for executors whose only channel into the\n * runtime is `exec` (docker exec, ssh, HTTP). Contents travel base64-encoded —\n * the base64 alphabet is inert under every shell parse layer — and writes are\n * chunked so no single command approaches the per-argument ARG_MAX limit,\n * staged, then moved into place so an aborted write never truncates the file.\n */\nconst WRITE_CHUNK_CHARS = 65536;\n\ninterface ExecLikeResult {\n  stdout: string;\n  stderr: string;\n  code: number;\n}\n\ninterface ExecLike<TOptions> {\n  exec(command: string, options?: TOptions): Promise<ExecLikeResult>;\n}\n\nexport async function execReadFileBase64<TOptions>(\n  executor: ExecLike<TOptions>,\n  path: string,\n  options?: TOptions,\n): Promise<string> {\n  const result = await executor.exec(`base64 < ${shellEscape(path)}`, options);\n  if (result.code !== 0) {\n    throw new Error(result.stderr.trim() || `Failed to read file: ${path}`);\n  }\n  return result.stdout.replace(/\\s+/g, \"\");\n}\n\nexport async function execReadFile<TOptions>(\n  executor: ExecLike<TOptions>,\n  path: string,\n  options?: TOptions,\n): Promise<string> {\n  return Buffer.from(await execReadFileBase64(executor, path, options), \"base64\").toString(\"utf-8\");\n}\n\nexport async function execWriteFile<TOptions>(\n  executor: ExecLike<TOptions>,\n  path: string,\n  content: string,\n  options?: TOptions,\n): Promise<void> {\n  const encoded = Buffer.from(content, \"utf-8\").toString(\"base64\");\n  const escapedPath = shellEscape(path);\n  const stage = shellEscape(`${path}.mikan-stage`);\n  const stageB64 = shellEscape(`${path}.mikan-stage.b64`);\n\n  const run = async (command: string) => {\n    const result = await executor.exec(command, options);\n    if (result.code !== 0) {\n      await executor.exec(`rm -f ${stage} ${stageB64}`, options).catch(() => {});\n      throw new Error(result.stderr.trim() || `Failed to write file: ${path}`);\n    }\n  };\n\n  const dir = path.includes(\"/\") ? path.slice(0, path.lastIndexOf(\"/\")) || \"/\" : \".\";\n  await run(`mkdir -p ${shellEscape(dir)} && : > ${stageB64}`);\n  for (let offset = 0; offset === 0 || offset < encoded.length; offset += WRITE_CHUNK_CHARS) {\n    const chunk = encoded.slice(offset, offset + WRITE_CHUNK_CHARS);\n    await run(`printf '%s' ${shellEscape(chunk)} >> ${stageB64}`);\n  }\n  await run(\n    `base64 -d < ${stageB64} > ${stage} && mv ${stage} ${escapedPath} && rm -f ${stageB64}`,\n  );\n}\n\nexport function createMountedRuntimePathContext(\n  hostWorkspaceRoot: string,\n  runtimeWorkspaceRoot: string,\n): RuntimePathContext {\n  return {\n    hostWorkspaceRoot,\n    runtimeWorkspaceRoot,\n    runtimeToHostPath: (runtimePath) =>\n      translateMountedRuntimePathToHost(runtimePath, runtimeWorkspaceRoot, hostWorkspaceRoot),\n  };\n}\n\nfunction translateMountedRuntimePathToHost(\n  runtimePath: string,\n  runtimeWorkspaceRoot: string,\n  hostWorkspaceRoot: string,\n): string {\n  if (!isAbsolute(runtimePath)) {\n    return runtimePath;\n  }\n\n  const runtimeRoot = resolvePath(runtimeWorkspaceRoot);\n  const normalizedRuntimePath = resolvePath(runtimePath);\n  const runtimeRelativePath = relative(runtimeRoot, normalizedRuntimePath);\n  const escapesRuntimeRoot =\n    runtimeRelativePath === \"..\" ||\n    runtimeRelativePath.startsWith(`..${sep}`) ||\n    isAbsolute(runtimeRelativePath);\n\n  if (escapesRuntimeRoot) {\n    return runtimePath;\n  }\n\n  const hostRoot = resolvePath(hostWorkspaceRoot);\n  const hostPath = resolvePath(hostRoot, runtimeRelativePath);\n  const hostRelativePath = relative(hostRoot, hostPath);\n  const escapesHostRoot =\n    hostRelativePath === \"..\" ||\n    hostRelativePath.startsWith(`..${sep}`) ||\n    isAbsolute(hostRelativePath);\n\n  return escapesHostRoot ? runtimePath : hostPath;\n}\n"]}

package/dist/sessions/chat-history-sync.d.ts

@@ -0,0 +1,25 @@
+import { type ResolvedSessionScope } from "./store.js";
+export type { ChatHistorySyncOptions, HasMaterializedSessionOptions, RegisterThreadSessionOptions, ResetChatSessionOptions, ResolveChatSessionScopeOptions, SyncChatSessionOptions, ThreadBootstrapWaitOptions, ChatSyncReport, } from "./types.js";
+import type { ChatHistorySyncOptions, HasMaterializedSessionOptions, RegisterThreadSessionOptions, ResetChatSessionOptions, ResolveChatSessionScopeOptions, SyncChatSessionOptions, ThreadBootstrapWaitOptions, ChatSyncReport } from "./types.js";
+export declare function hasMaterializedChatSession(options: HasMaterializedSessionOptions): boolean;
+export declare function registerThreadSession(options: RegisterThreadSessionOptions): string | null;
+export declare function waitForThreadSessionBootstrap(options: ThreadBootstrapWaitOptions): Promise<boolean>;
+/**
+ * Syncs the platform chat transcript (log.jsonl) into managed session files:
+ * resolves which session file a message belongs to (top-level vs thread,
+ * with biweekly rotation), bootstraps new sessions from recent history, and
+ * incrementally appends log messages the session does not yet represent.
+ */
+export declare class ChatHistorySync {
+    private readonly recentDays;
+    private readonly maxTopLevelMessages;
+    private readonly now;
+    constructor(options?: ChatHistorySyncOptions);
+    resolveSessionScope(options: ResolveChatSessionScopeOptions): Promise<ResolvedSessionScope>;
+    syncSessionManager(options: SyncChatSessionOptions): ChatSyncReport;
+    resetSession(options: ResetChatSessionOptions): string;
+    private resolveTopLevelSessionFile;
+    private historyWindow;
+    private resolveThreadSessionScope;
+}
+//# sourceMappingURL=chat-history-sync.d.ts.map

package/dist/sessions/chat-history-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-history-sync.d.ts","sourceRoot":"","sources":["../../src/sessions/chat-history-sync.ts"],"names":[],"mappings":"AAWA,OAAO,EAWL,KAAK,oBAAoB,EAE1B,MAAM,YAAY,CAAC;AAQpB,YAAY,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,cAAc,EAEf,MAAM,YAAY,CAAC;AAEpB,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAQ1F;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,MAAM,GAAG,IAAI,CAe1F;AAED,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IAEjC,YAAY,OAAO,GAAE,sBAA2B,EAI/C;IAEK,mBAAmB,CACvB,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAsB/B;IAED,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,CAUlE;IAED,YAAY,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CA6CrD;IAED,OAAO,CAAC,0BAA0B;IA2ClC,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,yBAAyB;CAgDlC"}