@geminixiang/mikan 1.0.0-beta.76 → 1.0.0-beta.78

package/dist/file-guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-guards.js","sourceRoot":"","sources":["../src/file-guards.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAwC,EACxC,gBAA4C;IAE5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAY,EACZ,MAAS,EACT,gBAA4C;IAE5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,gBAA4C;IAC1E,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,QAAwC,EACxC,gBAA4C;IAE5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAS,EACT,gBAA4C;IAE5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,IAAI,UAAyD,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/C,UAAU,GAAG,GAAG,CAAC;YACjB,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GACV,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,KAAK,GAAG;YAC9D,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,OAAe;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAClB,GAAG,EACH,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAChF,CAAC;IACF,MAAM,EAAE,GAAG,QAAQ,CACjB,OAAO,EACP,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAC/D,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,MAAc;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC;QAAE,OAAO;IAChD,MAAM,OAAO,GACX,gBAAgB,QAAQ,+CAA+C,UAAU,KAAK;QACtF,0EAA0E;QAC1E,mFAAmF,CAAC;IACtF,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC","sourcesContent":["import type { Static, TSchema } from \"@sinclair/typebox\";\nimport { Value } from \"@sinclair/typebox/value\";\nimport {\n  closeSync,\n  constants as fsConstants,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  unlinkSync,\n  writeSync,\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport * as log from \"./log.js\";\nimport { randomBytes } from \"node:crypto\";\nimport { basename, dirname, join } from \"node:path\";\n\nexport function ensureDirExists(dir: string): void {\n  mkdirSync(dir, { recursive: true });\n}\n\nexport function readTextFileIfExists(path: string): string | undefined {\n  try {\n    return readFileSync(path, \"utf-8\");\n  } catch (err) {\n    if (err instanceof Error && \"code\" in err && err.code === \"ENOENT\") {\n      return undefined;\n    }\n    throw err;\n  }\n}\n\nexport function readJsonFileIfExists<T>(\n  path: string,\n  validate: (value: unknown) => value is T,\n  malformedMessage: (detail: string) => string,\n): T | undefined {\n  const raw = readTextFileIfExists(path);\n  return raw === undefined ? undefined : parseJsonValue(raw, validate, malformedMessage);\n}\n\nexport function readJsonSchemaFileIfExists<T extends TSchema>(\n  path: string,\n  schema: T,\n  malformedMessage: (detail: string) => string,\n): Static<T> | undefined {\n  const raw = readTextFileIfExists(path);\n  return raw === undefined ? undefined : parseJsonSchemaValue(raw, schema, malformedMessage);\n}\n\nfunction parseJson(raw: string, malformedMessage: (detail: string) => string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new Error(malformedMessage(detail), { cause: err });\n  }\n}\n\nexport function parseJsonValue<T>(\n  raw: string,\n  validate: (value: unknown) => value is T,\n  malformedMessage: (detail: string) => string,\n): T {\n  const parsed = parseJson(raw, malformedMessage);\n  if (!validate(parsed)) {\n    throw new Error(malformedMessage(\"unexpected JSON shape\"));\n  }\n  return parsed;\n}\n\nexport function parseJsonSchemaValue<T extends TSchema>(\n  raw: string,\n  schema: T,\n  malformedMessage: (detail: string) => string,\n): Static<T> {\n  const parsed = parseJson(raw, malformedMessage);\n  if (!Value.Check(schema, parsed)) {\n    let firstError: { path: string; message: string } | undefined;\n    for (const err of Value.Errors(schema, parsed)) {\n      firstError = err;\n      break;\n    }\n    const detail =\n      !firstError || firstError.path === \"\" || firstError.path === \"/\"\n        ? \"unexpected JSON shape\"\n        : `${firstError.path}: ${firstError.message}`;\n    throw new Error(malformedMessage(detail));\n  }\n  return parsed;\n}\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nconst PRIVATE_FILE_MODE = 0o600;\n\n/**\n * Write `content` to `targetPath` with mode 0600, even when `targetPath`\n * already exists. Uses O_CREAT|O_EXCL on a temp sibling (so the kernel\n * guarantees permissions at creation, not after a racy chmod) and then\n * rename(2) into place for atomicity. Readers never see a torn write,\n * and a crash mid-write leaves either the old file or a stray .tmp\n * (cleaned by the next attempt or manually) — never a half-written target.\n */\nexport function atomicWritePrivateFile(targetPath: string, content: string): void {\n  const dir = dirname(targetPath);\n  const tmpPath = join(\n    dir,\n    `.${basename(targetPath)}.${process.pid}.${randomBytes(8).toString(\"hex\")}.tmp`,\n  );\n  const fd = openSync(\n    tmpPath,\n    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL,\n    PRIVATE_FILE_MODE,\n  );\n  try {\n    writeSync(fd, content);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // ignore — original error is more informative\n    }\n    throw err;\n  } finally {\n    closeSync(fd);\n  }\n  try {\n    renameSync(tmpPath, targetPath);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // ignore\n    }\n    throw err;\n  }\n}\n\n/**\n * True when `child` is `parent` or a path inside it. Purely lexical (no\n * symlink resolution) — used for configuration sanity checks, not as the\n * final security boundary.\n */\nfunction isPathInside(child: string, parent: string): boolean {\n  const parentPath = resolve(parent);\n  const childPath = resolve(child);\n  return childPath === parentPath || childPath.startsWith(parentPath + \"/\");\n}\n\n/**\n * The state dir (settings, office records, vaults) must never live inside\n * the working dir: conversation opt-in \"full\" mode mounts the entire working\n * dir read-write into sandbox containers, which would expose host-authoritative\n * state and credentials. Fatal under sandboxed modes; host mode has no mounts,\n * so only warn about the bad hygiene.\n */\nexport function assertStateDirOutsideWorkspace(\n  stateDir: string,\n  workingDir: string,\n  sandboxType: string,\n): void {\n  if (!isPathInside(stateDir, workingDir)) return;\n  const message =\n    `--state-dir (${stateDir}) must not be inside the working directory (${workingDir}): ` +\n    `sandbox containers mount the working directory, and a mounted state dir ` +\n    `would expose settings, office records, vaults, and credentials to sandboxed code.`;\n  if (sandboxType === \"host\") {\n    log.logWarning(\"Insecure state dir location\", message);\n    return;\n  }\n  throw new Error(message);\n}\n"]}
+{"version":3,"file":"file-guards.js","sourceRoot":"","sources":["../src/file-guards.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAwC,EACxC,gBAA4C;IAE5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAY,EACZ,MAAS,EACT,gBAA4C;IAE5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,gBAA4C;IAC1E,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,QAAwC,EACxC,gBAA4C;IAE5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAS,EACT,gBAA4C;IAE5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,IAAI,UAAyD,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/C,UAAU,GAAG,GAAG,CAAC;YACjB,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GACV,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,KAAK,GAAG;YAC9D,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,OAAe;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAClB,GAAG,EACH,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAChF,CAAC;IACF,MAAM,EAAE,GAAG,QAAQ,CACjB,OAAO,EACP,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAC/D,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,MAAc;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC;QAAE,OAAO;IAChD,MAAM,OAAO,GACX,gBAAgB,QAAQ,+CAA+C,UAAU,KAAK;QACtF,0EAA0E;QAC1E,mFAAmF,CAAC;IACtF,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC","sourcesContent":["import type { Static, TSchema } from \"@sinclair/typebox\";\nimport { Value } from \"@sinclair/typebox/value\";\nimport {\n  closeSync,\n  constants as fsConstants,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  unlinkSync,\n  writeSync,\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport * as log from \"./log.js\";\nimport { randomBytes } from \"node:crypto\";\nimport { basename, dirname, join } from \"node:path\";\n\nexport function ensureDirExists(dir: string): void {\n  mkdirSync(dir, { recursive: true });\n}\n\nexport function readTextFileIfExists(path: string): string | undefined {\n  try {\n    return readFileSync(path, \"utf-8\");\n  } catch (err) {\n    if (err instanceof Error && \"code\" in err && err.code === \"ENOENT\") {\n      return undefined;\n    }\n    throw err;\n  }\n}\n\nexport function readJsonFileIfExists<T>(\n  path: string,\n  validate: (value: unknown) => value is T,\n  malformedMessage: (detail: string) => string,\n): T | undefined {\n  const raw = readTextFileIfExists(path);\n  return raw === undefined ? undefined : parseJsonValue(raw, validate, malformedMessage);\n}\n\nexport function readJsonSchemaFileIfExists<T extends TSchema>(\n  path: string,\n  schema: T,\n  malformedMessage: (detail: string) => string,\n): Static<T> | undefined {\n  const raw = readTextFileIfExists(path);\n  return raw === undefined ? undefined : parseJsonSchemaValue(raw, schema, malformedMessage);\n}\n\nfunction parseJson(raw: string, malformedMessage: (detail: string) => string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new Error(malformedMessage(detail), { cause: err });\n  }\n}\n\nexport function parseJsonValue<T>(\n  raw: string,\n  validate: (value: unknown) => value is T,\n  malformedMessage: (detail: string) => string,\n): T {\n  const parsed = parseJson(raw, malformedMessage);\n  if (!validate(parsed)) {\n    throw new Error(malformedMessage(\"unexpected JSON shape\"));\n  }\n  return parsed;\n}\n\nexport function parseJsonSchemaValue<T extends TSchema>(\n  raw: string,\n  schema: T,\n  malformedMessage: (detail: string) => string,\n): Static<T> {\n  const parsed = parseJson(raw, malformedMessage);\n  if (!Value.Check(schema, parsed)) {\n    let firstError: { path: string; message: string } | undefined;\n    for (const err of Value.Errors(schema, parsed)) {\n      firstError = err;\n      break;\n    }\n    const detail =\n      !firstError || firstError.path === \"\" || firstError.path === \"/\"\n        ? \"unexpected JSON shape\"\n        : `${firstError.path}: ${firstError.message}`;\n    throw new Error(malformedMessage(detail));\n  }\n  return parsed;\n}\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nconst PRIVATE_FILE_MODE = 0o600;\n\nexport function atomicWritePrivateFile(targetPath: string, content: string): void {\n  const dir = dirname(targetPath);\n  const tmpPath = join(\n    dir,\n    `.${basename(targetPath)}.${process.pid}.${randomBytes(8).toString(\"hex\")}.tmp`,\n  );\n  const fd = openSync(\n    tmpPath,\n    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL,\n    PRIVATE_FILE_MODE,\n  );\n  try {\n    writeSync(fd, content);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {}\n    throw err;\n  } finally {\n    closeSync(fd);\n  }\n  try {\n    renameSync(tmpPath, targetPath);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {}\n    throw err;\n  }\n}\n\nfunction isPathInside(child: string, parent: string): boolean {\n  const parentPath = resolve(parent);\n  const childPath = resolve(child);\n  return childPath === parentPath || childPath.startsWith(parentPath + \"/\");\n}\n\nexport function assertStateDirOutsideWorkspace(\n  stateDir: string,\n  workingDir: string,\n  sandboxType: string,\n): void {\n  if (!isPathInside(stateDir, workingDir)) return;\n  const message =\n    `--state-dir (${stateDir}) must not be inside the working directory (${workingDir}): ` +\n    `sandbox containers mount the working directory, and a mounted state dir ` +\n    `would expose settings, office records, vaults, and credentials to sandboxed code.`;\n  if (sandboxType === \"host\") {\n    log.logWarning(\"Insecure state dir location\", message);\n    return;\n  }\n  throw new Error(message);\n}\n"]}

package/dist/harness/execution-env.d.ts

@@ -1,19 +1,4 @@
 import { type ExecutionEnv } from "@earendil-works/pi-agent-core";
 import type { Executor, SandboxConfig } from "../sandbox/index.js";
-/**
- * pi's harness tools address files through an {@link ExecutionEnv}. mikan's
- * `Executor` is the sandbox transport, so this bridges the two:
- *
- * - `host` uses pi's own `NodeExecutionEnv` — the host executor is plain node
- *   fs + spawn, so there is nothing to adapt.
- * - container / cloudflare are reached only through `exec`, so every file op
- *   is a shell round-trip over the executor. The methods pi's four tools
- *   actually call (`absolutePath`, `exists`, `readTextFile`, `readBinaryFile`,
- *   `writeFile`, `fileInfo`, `exec`) delegate to the executor's existing
- *   correct transports; the rest are shell fallbacks.
- *
- * The executor passed here is mikan's stable wrapper, which delegates to the
- * actor-resolved executor at call time, so one env serves every run.
- */
 export declare function createSandboxExecutionEnv(executor: Executor, sandboxType: SandboxConfig["type"], runtimeWorkspaceRoot: string): ExecutionEnv;
 //# sourceMappingURL=execution-env.d.ts.map

package/dist/harness/execution-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-env.d.ts","sourceRoot":"","sources":["../../src/harness/execution-env.ts"],"names":[],"mappings":"AAEA,OAAO,EAUL,KAAK,YAAY,EAQlB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASnE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,EAClC,oBAAoB,EAAE,MAAM,GAC3B,YAAY,CAKd"}
+{"version":3,"file":"execution-env.d.ts","sourceRoot":"","sources":["../../src/harness/execution-env.ts"],"names":[],"mappings":"AAEA,OAAO,EAUL,KAAK,YAAY,EAQlB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKnE,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,EAClC,oBAAoB,EAAE,MAAM,GAC3B,YAAY,CAKd"}

package/dist/harness/execution-env.js

@@ -2,26 +2,8 @@ import { randomBytes } from "node:crypto";
 import { posix } from "node:path";
 import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, ExecutionError, FileError, err, ok, truncateHead, truncateTail, } from "@earendil-works/pi-agent-core";
 import { NodeExecutionEnv } from "@earendil-works/pi-agent-core/node";
-import { shellEscape } from "../sandbox/utils.js";
-/** Bash output spill directory, relative to the runtime workspace root. */
+import { execAppendFile, execWriteFile, shellEscape } from "../sandbox/utils.js";
 const SPILL_DIR = ".mikan/bash-output";
-/** Matches the sandbox executor's own write chunking. */
-const WRITE_CHUNK_CHARS = 65536;
-/**
- * pi's harness tools address files through an {@link ExecutionEnv}. mikan's
- * `Executor` is the sandbox transport, so this bridges the two:
- *
- * - `host` uses pi's own `NodeExecutionEnv` — the host executor is plain node
- *   fs + spawn, so there is nothing to adapt.
- * - container / cloudflare are reached only through `exec`, so every file op
- *   is a shell round-trip over the executor. The methods pi's four tools
- *   actually call (`absolutePath`, `exists`, `readTextFile`, `readBinaryFile`,
- *   `writeFile`, `fileInfo`, `exec`) delegate to the executor's existing
- *   correct transports; the rest are shell fallbacks.
- *
- * The executor passed here is mikan's stable wrapper, which delegates to the
- * actor-resolved executor at call time, so one env serves every run.
- */
 export function createSandboxExecutionEnv(executor, sandboxType, runtimeWorkspaceRoot) {
     if (sandboxType === "host") {
         return new NodeExecutionEnv({ cwd: runtimeWorkspaceRoot });
@@ -65,22 +47,10 @@ class ShellExecutionEnv {
         });
     }
     writeFile(path, content, context) {
-        return this.fileOp(async () => {
-            if (typeof content === "string") {
-                await this.executor.writeFile(path, content, this.execOptions(context));
-                return;
-            }
-            await this.writeBase64(path, Buffer.from(content).toString("base64"), context);
-        });
+        return this.fileOp(() => execWriteFile(this.executor, path, content, this.execOptions(context)));
     }
     appendFile(path, content, context) {
-        return this.fileOp(async () => {
-            const base64 = Buffer.from(content).toString("base64");
-            const stage = `${path}.mikan-append.b64`;
-            await this.run(`mkdir -p ${shellEscape(posix.dirname(path))} && : > ${shellEscape(stage)}`, context);
-            await this.appendBase64Chunks(stage, base64, context);
-            await this.run(`base64 -d < ${shellEscape(stage)} >> ${shellEscape(path)} && rm -f ${shellEscape(stage)}`, context);
-        });
+        return this.fileOp(() => execAppendFile(this.executor, path, content, this.execOptions(context)));
     }
     renameFile(sourcePath, destinationPath, context) {
         return this.fileOp(async () => {
@@ -163,9 +133,7 @@ class ShellExecutionEnv {
             return stdout.trim();
         });
     }
-    async cleanup(_context) {
-        // The sandbox executor owns process lifetime; nothing to release here.
-    }
+    async cleanup(_context) { }
     async exec(command, options, context) {
         try {
             const result = await this.executor.exec(command, {
@@ -210,20 +178,6 @@ class ShellExecutionEnv {
         }
         return result;
     }
-    async writeBase64(path, base64, context) {
-        const stage = `${path}.mikan-stage`;
-        const stageB64 = `${path}.mikan-stage.b64`;
-        await this.run(`mkdir -p ${shellEscape(posix.dirname(path))} && : > ${shellEscape(stageB64)}`, context);
-        await this.appendBase64Chunks(stageB64, base64, context);
-        await this.run(`base64 -d < ${shellEscape(stageB64)} > ${shellEscape(stage)} && mv ${shellEscape(stage)} ` +
-            `${shellEscape(path)} && rm -f ${shellEscape(stageB64)}`, context);
-    }
-    async appendBase64Chunks(targetB64, base64, context) {
-        for (let offset = 0; offset === 0 || offset < base64.length; offset += WRITE_CHUNK_CHARS) {
-            const chunk = base64.slice(offset, offset + WRITE_CHUNK_CHARS);
-            await this.run(`printf '%s' ${shellEscape(chunk)} >> ${shellEscape(targetB64)}`, context);
-        }
-    }
     async fileOp(op) {
         try {
             return ok(await op());
@@ -233,11 +187,6 @@ class ShellExecutionEnv {
         }
     }
 }
-/**
- * Line reader over content already fetched in full through the executor's `readFile` transport.
- * container/cloudflare have no incremental file-descriptor primitive, so this buffers the whole
- * file once and serves lines from memory, matching {@link TextLineReader}'s pull-based contract.
- */
 class ShellTextLineReader {
     constructor(content) {
         this.content = content;

package/dist/harness/execution-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-env.js","sourceRoot":"","sources":["../../src/harness/execution-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,GAAG,EACH,EAAE,EACF,YAAY,EACZ,YAAY,GAUb,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,2EAA2E;AAC3E,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAEvC,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAkB,EAClB,WAAkC,EAClC,oBAA4B;IAE5B,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;AAC/D,CAAC;AAYD,MAAM,iBAAiB;IAGrB,YACmB,QAAkB,EACnC,oBAA4B;wBADX,QAAQ;QAGzB,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,QAAiB;QAChD,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAe,EAAE,QAAiB;QAC/C,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,kBAAkB,CAAC,IAAY,EAAE,OAAgB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,OAAgB;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED,aAAa,CACX,IAAY,EACZ,OAA0C,EAC1C,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,GAAG,GAAG,OAAO,EAAE,QAAQ,CAAC;YAC9B,MAAM,OAAO,GACX,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE;gBAC5B,CAAC,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,IAAY,EACZ,OAA4B,EAC5B,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CACR,IAAY,EACZ,OAA4B,EAC5B,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,GAAG,IAAI,mBAAmB,CAAC;YACzC,MAAM,IAAI,CAAC,GAAG,CACZ,YAAY,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,WAAW,CAAC,KAAK,CAAC,EAAE,EAC3E,OAAO,CACR,CAAC;YACF,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,GAAG,CACZ,eAAe,WAAW,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,KAAK,CAAC,EAAE,EAC1F,OAAO,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CACR,UAAkB,EAClB,eAAuB,EACvB,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAgB;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACpC,WAAW,OAAO,wCAAwC,OAAO,+BAA+B;gBAC9F,aAAa,OAAO,yCAAyC,EAC/D,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAC1B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAc,CAAC;YAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvF,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;oBAAE,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,OAAO,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5F,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YACvF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAe,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACjD,IAAI,IAAI,CAAC,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,IAAY,EAAE,OAAgB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAC5B,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAgB;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACrC,WAAW,WAAW,CAAC,IAAI,CAAC,EAAE,EAC9B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAC1B,CAAC;YACF,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,SAAS,CACP,IAAY,EACZ,OAA4C,EAC5C,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,GAAG,OAAO,EAAE,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACvD,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CACJ,IAAY,EACZ,OAA6D,EAC7D,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,IAAI,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,MAA0B,EAAE,OAAgB;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YAC3E,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CACZ,OAAyD,EACzD,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GACZ,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS;gBAC5D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,WAAW,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,SAAS,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAiB;QAC7B,uEAAuE;IACzE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAAqC,EACrC,OAAgB;QAEhB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE;gBAC/C,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,EAAE,OAAO,CAAC,WAAW;aAC5B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI;gBACzC,QAAQ,EAAE,iBAAiB;gBAC3B,QAAQ,EAAE,iBAAiB;gBAC3B,MAAM,EAAE,MAAe;aACxB,CAAC;YACF,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,MAAM;gBACtB,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClF,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEvF,IAAI,SAA6B,CAAC;YAClC,IAAI,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACpD,IAAI,CAAC;oBACH,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACrF,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChF,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,EAAE,QAAQ,EAAE,CACjB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,EAAE,EACtE,OAAO,CACR,CAAC;YACF,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAgB;QAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,OAAe,EACf,OAAgB;QAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,mBAAmB,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,OAAgB;QACtE,MAAM,KAAK,GAAG,GAAG,IAAI,cAAc,CAAC;QACpC,MAAM,QAAQ,GAAG,GAAG,IAAI,kBAAkB,CAAC;QAC3C,MAAM,IAAI,CAAC,GAAG,CACZ,YAAY,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,WAAW,CAAC,QAAQ,CAAC,EAAE,EAC9E,OAAO,CACR,CAAC;QACF,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,GAAG,CACZ,eAAe,WAAW,CAAC,QAAQ,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,UAAU,WAAW,CAAC,KAAK,CAAC,GAAG;YACzF,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,QAAQ,CAAC,EAAE,EAC1D,OAAO,CACR,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,SAAiB,EACjB,MAAc,EACd,OAAgB;QAEhB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACzF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAI,EAAoB;QAC1C,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,mBAAmB;IAGvB,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;QAFpC,WAAM,GAAG,CAAC,CAAC;IAE4B,CAAC;IAEhD,KAAK,CAAC,QAAQ,CAAC,QAAiB;QAC9B,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAiB;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IACpC,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,UAA4B,EAC5B,SAA6B;IAE7B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxF,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC3F,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACrF,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,OAAgB;IACxD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { posix } from \"node:path\";\nimport {\n  DEFAULT_MAX_BYTES,\n  DEFAULT_MAX_LINES,\n  ExecutionError,\n  FileError,\n  err,\n  ok,\n  truncateHead,\n  truncateTail,\n  type Context,\n  type ExecutionEnv,\n  type FileInfo,\n  type FileKind,\n  type Result,\n  type ShellExecOptions,\n  type ShellExecResult,\n  type ShellOutputMetadata,\n  type TruncationResult,\n} from \"@earendil-works/pi-agent-core\";\nimport { NodeExecutionEnv } from \"@earendil-works/pi-agent-core/node\";\nimport type { Executor, SandboxConfig } from \"../sandbox/index.js\";\nimport { shellEscape } from \"../sandbox/utils.js\";\n\n/** Bash output spill directory, relative to the runtime workspace root. */\nconst SPILL_DIR = \".mikan/bash-output\";\n\n/** Matches the sandbox executor's own write chunking. */\nconst WRITE_CHUNK_CHARS = 65536;\n\n/**\n * pi's harness tools address files through an {@link ExecutionEnv}. mikan's\n * `Executor` is the sandbox transport, so this bridges the two:\n *\n * - `host` uses pi's own `NodeExecutionEnv` — the host executor is plain node\n *   fs + spawn, so there is nothing to adapt.\n * - container / cloudflare are reached only through `exec`, so every file op\n *   is a shell round-trip over the executor. The methods pi's four tools\n *   actually call (`absolutePath`, `exists`, `readTextFile`, `readBinaryFile`,\n *   `writeFile`, `fileInfo`, `exec`) delegate to the executor's existing\n *   correct transports; the rest are shell fallbacks.\n *\n * The executor passed here is mikan's stable wrapper, which delegates to the\n * actor-resolved executor at call time, so one env serves every run.\n */\nexport function createSandboxExecutionEnv(\n  executor: Executor,\n  sandboxType: SandboxConfig[\"type\"],\n  runtimeWorkspaceRoot: string,\n): ExecutionEnv {\n  if (sandboxType === \"host\") {\n    return new NodeExecutionEnv({ cwd: runtimeWorkspaceRoot });\n  }\n  return new ShellExecutionEnv(executor, runtimeWorkspaceRoot);\n}\n\n/** `ExecutionEnv` does not export {@link TextLineReader}/{@link TextLine} directly; derive them structurally. */\ntype TextLineReader =\n  Awaited<ReturnType<ExecutionEnv[\"openTextLineReader\"]>> extends Result<infer T, FileError>\n    ? T\n    : never;\ntype TextLine =\n  Awaited<ReturnType<TextLineReader[\"readLine\"]>> extends Result<infer T, FileError>\n    ? Exclude<T, undefined>\n    : never;\n\nclass ShellExecutionEnv implements ExecutionEnv {\n  readonly cwd: string;\n\n  constructor(\n    private readonly executor: Executor,\n    runtimeWorkspaceRoot: string,\n  ) {\n    this.cwd = runtimeWorkspaceRoot;\n  }\n\n  async absolutePath(path: string, _context: Context): Promise<Result<string, FileError>> {\n    return ok(posix.isAbsolute(path) ? posix.normalize(path) : posix.resolve(this.cwd, path));\n  }\n\n  async joinPath(parts: string[], _context: Context): Promise<Result<string, FileError>> {\n    return ok(posix.join(...parts));\n  }\n\n  readTextFile(path: string, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(() => this.executor.readFile(path, this.execOptions(context)));\n  }\n\n  openTextLineReader(path: string, context: Context): Promise<Result<TextLineReader, FileError>> {\n    return this.fileOp(async () => {\n      const content = await this.executor.readFile(path, this.execOptions(context));\n      return new ShellTextLineReader(content);\n    });\n  }\n\n  async readBinaryFile(path: string, context: Context): Promise<Result<Uint8Array, FileError>> {\n    return this.fileOp(async () =>\n      Buffer.from(await this.executor.readFileBase64(path, this.execOptions(context)), \"base64\"),\n    );\n  }\n\n  readTextLines(\n    path: string,\n    options: { maxLines?: number } | undefined,\n    context: Context,\n  ): Promise<Result<string[], FileError>> {\n    return this.fileOp(async () => {\n      const max = options?.maxLines;\n      const command =\n        max === undefined\n          ? `cat ${shellEscape(path)}`\n          : `head -n ${Math.max(0, Math.floor(max))} ${shellEscape(path)}`;\n      const { stdout } = await this.run(command, context);\n      const lines = stdout.split(\"\\n\");\n      if (lines.at(-1) === \"\") lines.pop();\n      return lines;\n    });\n  }\n\n  writeFile(\n    path: string,\n    content: string | Uint8Array,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      if (typeof content === \"string\") {\n        await this.executor.writeFile(path, content, this.execOptions(context));\n        return;\n      }\n      await this.writeBase64(path, Buffer.from(content).toString(\"base64\"), context);\n    });\n  }\n\n  appendFile(\n    path: string,\n    content: string | Uint8Array,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const base64 = Buffer.from(content).toString(\"base64\");\n      const stage = `${path}.mikan-append.b64`;\n      await this.run(\n        `mkdir -p ${shellEscape(posix.dirname(path))} && : > ${shellEscape(stage)}`,\n        context,\n      );\n      await this.appendBase64Chunks(stage, base64, context);\n      await this.run(\n        `base64 -d < ${shellEscape(stage)} >> ${shellEscape(path)} && rm -f ${shellEscape(stage)}`,\n        context,\n      );\n    });\n  }\n\n  renameFile(\n    sourcePath: string,\n    destinationPath: string,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      await this.run(`mv -f ${shellEscape(sourcePath)} ${shellEscape(destinationPath)}`, context);\n    });\n  }\n\n  fileInfo(path: string, context: Context): Promise<Result<FileInfo, FileError>> {\n    return this.fileOp(async () => {\n      const escaped = shellEscape(path);\n      const probe = await this.executor.exec(\n        `if [ -L ${escaped} ]; then printf 'symlink'; elif [ -d ${escaped} ]; then printf 'directory'; ` +\n          `elif [ -f ${escaped} ]; then printf 'file'; else exit 1; fi`,\n        this.execOptions(context),\n      );\n      if (probe.code !== 0) throw new Error(`No such file or directory: ${path}`);\n      const kind = probe.stdout.trim() as FileKind;\n      let size = 0;\n      if (kind === \"file\") {\n        const stat = await this.executor.exec(`wc -c < ${escaped}`, this.execOptions(context));\n        if (stat.code === 0) size = Number.parseInt(stat.stdout.trim(), 10) || 0;\n      }\n      let mtimeMs = 0;\n      const mtime = await this.executor.exec(`date -r ${escaped} +%s`, this.execOptions(context));\n      if (mtime.code === 0) mtimeMs = (Number.parseInt(mtime.stdout.trim(), 10) || 0) * 1000;\n      return { name: posix.basename(path), path, kind, size, mtimeMs };\n    });\n  }\n\n  async listDir(path: string, context: Context): Promise<Result<FileInfo[], FileError>> {\n    return this.fileOp(async () => {\n      const { stdout } = await this.run(`ls -A ${shellEscape(path)}`, context);\n      const names = stdout.split(\"\\n\").filter(Boolean).toSorted();\n      const entries: FileInfo[] = [];\n      for (const name of names) {\n        const child = posix.join(path, name);\n        const info = await this.fileInfo(child, context);\n        if (info.ok) entries.push(info.value);\n      }\n      return entries;\n    });\n  }\n\n  canonicalPath(path: string, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(async () =>\n      (await this.run(`realpath ${shellEscape(path)}`, context)).stdout.trim(),\n    );\n  }\n\n  async exists(path: string, context: Context): Promise<Result<boolean, FileError>> {\n    try {\n      const result = await this.executor.exec(\n        `test -e ${shellEscape(path)}`,\n        this.execOptions(context),\n      );\n      return ok(result.code === 0);\n    } catch (error) {\n      return err(toFileError(error));\n    }\n  }\n\n  createDir(\n    path: string,\n    options: { recursive?: boolean } | undefined,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const flag = options?.recursive === false ? \"\" : \"-p \";\n      await this.run(`mkdir ${flag}${shellEscape(path)}`, context);\n    });\n  }\n\n  remove(\n    path: string,\n    options: { recursive?: boolean; force?: boolean } | undefined,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const recursive = options?.recursive ? \"-r\" : \"\";\n      const force = options?.force ? \"-f\" : \"\";\n      await this.run(`rm ${recursive} ${force} ${shellEscape(path)}`, context);\n    });\n  }\n\n  createTempDir(prefix: string | undefined, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(async () => {\n      const template = prefix === undefined ? \"\" : shellEscape(`${prefix}XXXXXX`);\n      const { stdout } = await this.run(`mktemp -d ${template}`.trim(), context);\n      return stdout.trim();\n    });\n  }\n\n  createTempFile(\n    options: { prefix?: string; suffix?: string } | undefined,\n    context: Context,\n  ): Promise<Result<string, FileError>> {\n    return this.fileOp(async () => {\n      const template =\n        options?.prefix === undefined && options?.suffix === undefined\n          ? \"\"\n          : shellEscape(`${options?.prefix ?? \"\"}XXXXXX${options?.suffix ?? \"\"}`);\n      const { stdout } = await this.run(`mktemp ${template}`.trim(), context);\n      return stdout.trim();\n    });\n  }\n\n  async cleanup(_context: Context): Promise<void> {\n    // The sandbox executor owns process lifetime; nothing to release here.\n  }\n\n  async exec(\n    command: string,\n    options: ShellExecOptions | undefined,\n    context: Context,\n  ): Promise<Result<ShellExecResult, ExecutionError>> {\n    try {\n      const result = await this.executor.exec(command, {\n        ...(options?.cwd ? { cwd: options.cwd } : {}),\n        ...(options?.timeout ? { timeout: options.timeout } : {}),\n        signal: context.abortSignal,\n      });\n      const combined = [result.stdout, result.stderr].filter((part) => part.length > 0).join(\"\\n\");\n      const limits = options?.capture?.limits ?? {\n        maxBytes: DEFAULT_MAX_BYTES,\n        maxLines: DEFAULT_MAX_LINES,\n        retain: \"tail\" as const,\n      };\n      const truncation =\n        limits.retain === \"head\"\n          ? truncateHead(combined, { maxLines: limits.maxLines, maxBytes: limits.maxBytes })\n          : truncateTail(combined, { maxLines: limits.maxLines, maxBytes: limits.maxBytes });\n\n      let spillPath: string | undefined;\n      if (options?.capture?.spill && truncation.truncated) {\n        try {\n          spillPath = posix.join(this.cwd, SPILL_DIR, `${randomBytes(8).toString(\"hex\")}.log`);\n          await this.executor.writeFile(spillPath, combined, this.execOptions(context));\n        } catch {\n          spillPath = undefined;\n        }\n      }\n\n      const metadata = shellOutputMetadata(truncation, spillPath);\n      options?.onUpdate?.(\n        { kind: \"replace\", output: { text: truncation.content, ...metadata } },\n        context,\n      );\n      return ok({ exitCode: result.code, ...metadata });\n    } catch (error) {\n      return err(toExecutionError(error, context));\n    }\n  }\n\n  private execOptions(context: Context): { signal: AbortSignal | undefined } {\n    return { signal: context.abortSignal };\n  }\n\n  private async run(\n    command: string,\n    context: Context,\n  ): Promise<{ stdout: string; stderr: string }> {\n    const result = await this.executor.exec(command, this.execOptions(context));\n    if (result.code !== 0) {\n      throw new Error(result.stderr.trim() || `Command failed (${result.code}): ${command}`);\n    }\n    return result;\n  }\n\n  private async writeBase64(path: string, base64: string, context: Context): Promise<void> {\n    const stage = `${path}.mikan-stage`;\n    const stageB64 = `${path}.mikan-stage.b64`;\n    await this.run(\n      `mkdir -p ${shellEscape(posix.dirname(path))} && : > ${shellEscape(stageB64)}`,\n      context,\n    );\n    await this.appendBase64Chunks(stageB64, base64, context);\n    await this.run(\n      `base64 -d < ${shellEscape(stageB64)} > ${shellEscape(stage)} && mv ${shellEscape(stage)} ` +\n        `${shellEscape(path)} && rm -f ${shellEscape(stageB64)}`,\n      context,\n    );\n  }\n\n  private async appendBase64Chunks(\n    targetB64: string,\n    base64: string,\n    context: Context,\n  ): Promise<void> {\n    for (let offset = 0; offset === 0 || offset < base64.length; offset += WRITE_CHUNK_CHARS) {\n      const chunk = base64.slice(offset, offset + WRITE_CHUNK_CHARS);\n      await this.run(`printf '%s' ${shellEscape(chunk)} >> ${shellEscape(targetB64)}`, context);\n    }\n  }\n\n  private async fileOp<T>(op: () => Promise<T>): Promise<Result<T, FileError>> {\n    try {\n      return ok(await op());\n    } catch (error) {\n      return err(toFileError(error));\n    }\n  }\n}\n\n/**\n * Line reader over content already fetched in full through the executor's `readFile` transport.\n * container/cloudflare have no incremental file-descriptor primitive, so this buffers the whole\n * file once and serves lines from memory, matching {@link TextLineReader}'s pull-based contract.\n */\nclass ShellTextLineReader implements TextLineReader {\n  private offset = 0;\n\n  constructor(private readonly content: string) {}\n\n  async readLine(_context: Context): Promise<Result<TextLine | undefined, FileError>> {\n    if (this.offset >= this.content.length) return ok(undefined);\n    const newline = this.content.indexOf(\"\\n\", this.offset);\n    if (newline === -1) {\n      const text = this.content.slice(this.offset);\n      this.offset = this.content.length;\n      return ok({ text, terminated: false });\n    }\n    const text = this.content.slice(this.offset, newline);\n    this.offset = newline + 1;\n    return ok({ text, terminated: true });\n  }\n\n  async close(_context: Context): Promise<void> {\n    this.offset = this.content.length;\n  }\n}\n\nfunction shellOutputMetadata(\n  truncation: TruncationResult,\n  spillPath: string | undefined,\n): ShellOutputMetadata {\n  const { content: _content, ...metadata } = truncation;\n  const lastLine = truncation.content.split(\"\\n\").at(-1) ?? \"\";\n  return {\n    truncation: metadata,\n    ...(spillPath ? { spillPath } : {}),\n    ...(truncation.lastLinePartial ? { lastLineBytes: Buffer.byteLength(lastLine, \"utf8\") } : {}),\n  };\n}\n\nfunction toFileError(error: unknown): FileError {\n  const message = error instanceof Error ? error.message : String(error);\n  if (/aborted/i.test(message)) return new FileError(\"aborted\", message);\n  if (/no such file|not found/i.test(message)) return new FileError(\"not_found\", message);\n  if (/permission denied/i.test(message)) return new FileError(\"permission_denied\", message);\n  if (/not a directory/i.test(message)) return new FileError(\"not_directory\", message);\n  if (/is a directory/i.test(message)) return new FileError(\"is_directory\", message);\n  return new FileError(\"unknown\", message, undefined, error instanceof Error ? error : undefined);\n}\n\nfunction toExecutionError(error: unknown, context: Context): ExecutionError {\n  const message = error instanceof Error ? error.message : String(error);\n  if (context.abortSignal?.aborted || /aborted/i.test(message)) {\n    return new ExecutionError(\"aborted\", message);\n  }\n  if (/timed out/i.test(message)) return new ExecutionError(\"timeout\", message);\n  return new ExecutionError(\"unknown\", message, error instanceof Error ? error : undefined);\n}\n"]}
+{"version":3,"file":"execution-env.js","sourceRoot":"","sources":["../../src/harness/execution-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,GAAG,EACH,EAAE,EACF,YAAY,EACZ,YAAY,GAUb,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAEvC,MAAM,UAAU,yBAAyB,CACvC,QAAkB,EAClB,WAAkC,EAClC,oBAA4B;IAE5B,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;AAC/D,CAAC;AAWD,MAAM,iBAAiB;IAGrB,YACmB,QAAkB,EACnC,oBAA4B;wBADX,QAAQ;QAGzB,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,QAAiB;QAChD,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAe,EAAE,QAAiB;QAC/C,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,kBAAkB,CAAC,IAAY,EAAE,OAAgB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,OAAgB;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED,aAAa,CACX,IAAY,EACZ,OAA0C,EAC1C,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,GAAG,GAAG,OAAO,EAAE,QAAQ,CAAC;YAC9B,MAAM,OAAO,GACX,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE;gBAC5B,CAAC,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,IAAY,EACZ,OAA4B,EAC5B,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CACtB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,UAAU,CACR,IAAY,EACZ,OAA4B,EAC5B,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CACtB,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;IAED,UAAU,CACR,UAAkB,EAClB,eAAuB,EACvB,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAgB;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACpC,WAAW,OAAO,wCAAwC,OAAO,+BAA+B;gBAC9F,aAAa,OAAO,yCAAyC,EAC/D,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAC1B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAc,CAAC;YAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvF,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;oBAAE,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,OAAO,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5F,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YACvF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAe,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACjD,IAAI,IAAI,CAAC,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,IAAY,EAAE,OAAgB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAC5B,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAgB;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACrC,WAAW,WAAW,CAAC,IAAI,CAAC,EAAE,EAC9B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAC1B,CAAC;YACF,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,SAAS,CACP,IAAY,EACZ,OAA4C,EAC5C,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,GAAG,OAAO,EAAE,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACvD,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CACJ,IAAY,EACZ,OAA6D,EAC7D,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,IAAI,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,MAA0B,EAAE,OAAgB;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YAC3E,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CACZ,OAAyD,EACzD,OAAgB;QAEhB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GACZ,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS;gBAC5D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,WAAW,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,SAAS,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAiB,IAAkB,CAAC;IAElD,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAAqC,EACrC,OAAgB;QAEhB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE;gBAC/C,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,EAAE,OAAO,CAAC,WAAW;aAC5B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI;gBACzC,QAAQ,EAAE,iBAAiB;gBAC3B,QAAQ,EAAE,iBAAiB;gBAC3B,MAAM,EAAE,MAAe;aACxB,CAAC;YACF,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,MAAM;gBACtB,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClF,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEvF,IAAI,SAA6B,CAAC;YAClC,IAAI,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACpD,IAAI,CAAC;oBACH,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACrF,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChF,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,EAAE,QAAQ,EAAE,CACjB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,EAAE,EACtE,OAAO,CACR,CAAC;YACF,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAgB;QAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,OAAe,EACf,OAAgB;QAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,mBAAmB,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAI,EAAoB;QAC1C,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,MAAM,mBAAmB;IAGvB,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;QAFpC,WAAM,GAAG,CAAC,CAAC;IAE4B,CAAC;IAEhD,KAAK,CAAC,QAAQ,CAAC,QAAiB;QAC9B,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAiB;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IACpC,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,UAA4B,EAC5B,SAA6B;IAE7B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxF,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC3F,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACrF,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,OAAgB;IACxD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { posix } from \"node:path\";\nimport {\n  DEFAULT_MAX_BYTES,\n  DEFAULT_MAX_LINES,\n  ExecutionError,\n  FileError,\n  err,\n  ok,\n  truncateHead,\n  truncateTail,\n  type Context,\n  type ExecutionEnv,\n  type FileInfo,\n  type FileKind,\n  type Result,\n  type ShellExecOptions,\n  type ShellExecResult,\n  type ShellOutputMetadata,\n  type TruncationResult,\n} from \"@earendil-works/pi-agent-core\";\nimport { NodeExecutionEnv } from \"@earendil-works/pi-agent-core/node\";\nimport type { Executor, SandboxConfig } from \"../sandbox/index.js\";\nimport { execAppendFile, execWriteFile, shellEscape } from \"../sandbox/utils.js\";\n\nconst SPILL_DIR = \".mikan/bash-output\";\n\nexport function createSandboxExecutionEnv(\n  executor: Executor,\n  sandboxType: SandboxConfig[\"type\"],\n  runtimeWorkspaceRoot: string,\n): ExecutionEnv {\n  if (sandboxType === \"host\") {\n    return new NodeExecutionEnv({ cwd: runtimeWorkspaceRoot });\n  }\n  return new ShellExecutionEnv(executor, runtimeWorkspaceRoot);\n}\n\ntype TextLineReader =\n  Awaited<ReturnType<ExecutionEnv[\"openTextLineReader\"]>> extends Result<infer T, FileError>\n    ? T\n    : never;\ntype TextLine =\n  Awaited<ReturnType<TextLineReader[\"readLine\"]>> extends Result<infer T, FileError>\n    ? Exclude<T, undefined>\n    : never;\n\nclass ShellExecutionEnv implements ExecutionEnv {\n  readonly cwd: string;\n\n  constructor(\n    private readonly executor: Executor,\n    runtimeWorkspaceRoot: string,\n  ) {\n    this.cwd = runtimeWorkspaceRoot;\n  }\n\n  async absolutePath(path: string, _context: Context): Promise<Result<string, FileError>> {\n    return ok(posix.isAbsolute(path) ? posix.normalize(path) : posix.resolve(this.cwd, path));\n  }\n\n  async joinPath(parts: string[], _context: Context): Promise<Result<string, FileError>> {\n    return ok(posix.join(...parts));\n  }\n\n  readTextFile(path: string, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(() => this.executor.readFile(path, this.execOptions(context)));\n  }\n\n  openTextLineReader(path: string, context: Context): Promise<Result<TextLineReader, FileError>> {\n    return this.fileOp(async () => {\n      const content = await this.executor.readFile(path, this.execOptions(context));\n      return new ShellTextLineReader(content);\n    });\n  }\n\n  async readBinaryFile(path: string, context: Context): Promise<Result<Uint8Array, FileError>> {\n    return this.fileOp(async () =>\n      Buffer.from(await this.executor.readFileBase64(path, this.execOptions(context)), \"base64\"),\n    );\n  }\n\n  readTextLines(\n    path: string,\n    options: { maxLines?: number } | undefined,\n    context: Context,\n  ): Promise<Result<string[], FileError>> {\n    return this.fileOp(async () => {\n      const max = options?.maxLines;\n      const command =\n        max === undefined\n          ? `cat ${shellEscape(path)}`\n          : `head -n ${Math.max(0, Math.floor(max))} ${shellEscape(path)}`;\n      const { stdout } = await this.run(command, context);\n      const lines = stdout.split(\"\\n\");\n      if (lines.at(-1) === \"\") lines.pop();\n      return lines;\n    });\n  }\n\n  writeFile(\n    path: string,\n    content: string | Uint8Array,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(() =>\n      execWriteFile(this.executor, path, content, this.execOptions(context)),\n    );\n  }\n\n  appendFile(\n    path: string,\n    content: string | Uint8Array,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(() =>\n      execAppendFile(this.executor, path, content, this.execOptions(context)),\n    );\n  }\n\n  renameFile(\n    sourcePath: string,\n    destinationPath: string,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      await this.run(`mv -f ${shellEscape(sourcePath)} ${shellEscape(destinationPath)}`, context);\n    });\n  }\n\n  fileInfo(path: string, context: Context): Promise<Result<FileInfo, FileError>> {\n    return this.fileOp(async () => {\n      const escaped = shellEscape(path);\n      const probe = await this.executor.exec(\n        `if [ -L ${escaped} ]; then printf 'symlink'; elif [ -d ${escaped} ]; then printf 'directory'; ` +\n          `elif [ -f ${escaped} ]; then printf 'file'; else exit 1; fi`,\n        this.execOptions(context),\n      );\n      if (probe.code !== 0) throw new Error(`No such file or directory: ${path}`);\n      const kind = probe.stdout.trim() as FileKind;\n      let size = 0;\n      if (kind === \"file\") {\n        const stat = await this.executor.exec(`wc -c < ${escaped}`, this.execOptions(context));\n        if (stat.code === 0) size = Number.parseInt(stat.stdout.trim(), 10) || 0;\n      }\n      let mtimeMs = 0;\n      const mtime = await this.executor.exec(`date -r ${escaped} +%s`, this.execOptions(context));\n      if (mtime.code === 0) mtimeMs = (Number.parseInt(mtime.stdout.trim(), 10) || 0) * 1000;\n      return { name: posix.basename(path), path, kind, size, mtimeMs };\n    });\n  }\n\n  async listDir(path: string, context: Context): Promise<Result<FileInfo[], FileError>> {\n    return this.fileOp(async () => {\n      const { stdout } = await this.run(`ls -A ${shellEscape(path)}`, context);\n      const names = stdout.split(\"\\n\").filter(Boolean).toSorted();\n      const entries: FileInfo[] = [];\n      for (const name of names) {\n        const child = posix.join(path, name);\n        const info = await this.fileInfo(child, context);\n        if (info.ok) entries.push(info.value);\n      }\n      return entries;\n    });\n  }\n\n  canonicalPath(path: string, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(async () =>\n      (await this.run(`realpath ${shellEscape(path)}`, context)).stdout.trim(),\n    );\n  }\n\n  async exists(path: string, context: Context): Promise<Result<boolean, FileError>> {\n    try {\n      const result = await this.executor.exec(\n        `test -e ${shellEscape(path)}`,\n        this.execOptions(context),\n      );\n      return ok(result.code === 0);\n    } catch (error) {\n      return err(toFileError(error));\n    }\n  }\n\n  createDir(\n    path: string,\n    options: { recursive?: boolean } | undefined,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const flag = options?.recursive === false ? \"\" : \"-p \";\n      await this.run(`mkdir ${flag}${shellEscape(path)}`, context);\n    });\n  }\n\n  remove(\n    path: string,\n    options: { recursive?: boolean; force?: boolean } | undefined,\n    context: Context,\n  ): Promise<Result<void, FileError>> {\n    return this.fileOp(async () => {\n      const recursive = options?.recursive ? \"-r\" : \"\";\n      const force = options?.force ? \"-f\" : \"\";\n      await this.run(`rm ${recursive} ${force} ${shellEscape(path)}`, context);\n    });\n  }\n\n  createTempDir(prefix: string | undefined, context: Context): Promise<Result<string, FileError>> {\n    return this.fileOp(async () => {\n      const template = prefix === undefined ? \"\" : shellEscape(`${prefix}XXXXXX`);\n      const { stdout } = await this.run(`mktemp -d ${template}`.trim(), context);\n      return stdout.trim();\n    });\n  }\n\n  createTempFile(\n    options: { prefix?: string; suffix?: string } | undefined,\n    context: Context,\n  ): Promise<Result<string, FileError>> {\n    return this.fileOp(async () => {\n      const template =\n        options?.prefix === undefined && options?.suffix === undefined\n          ? \"\"\n          : shellEscape(`${options?.prefix ?? \"\"}XXXXXX${options?.suffix ?? \"\"}`);\n      const { stdout } = await this.run(`mktemp ${template}`.trim(), context);\n      return stdout.trim();\n    });\n  }\n\n  async cleanup(_context: Context): Promise<void> {}\n\n  async exec(\n    command: string,\n    options: ShellExecOptions | undefined,\n    context: Context,\n  ): Promise<Result<ShellExecResult, ExecutionError>> {\n    try {\n      const result = await this.executor.exec(command, {\n        ...(options?.cwd ? { cwd: options.cwd } : {}),\n        ...(options?.timeout ? { timeout: options.timeout } : {}),\n        signal: context.abortSignal,\n      });\n      const combined = [result.stdout, result.stderr].filter((part) => part.length > 0).join(\"\\n\");\n      const limits = options?.capture?.limits ?? {\n        maxBytes: DEFAULT_MAX_BYTES,\n        maxLines: DEFAULT_MAX_LINES,\n        retain: \"tail\" as const,\n      };\n      const truncation =\n        limits.retain === \"head\"\n          ? truncateHead(combined, { maxLines: limits.maxLines, maxBytes: limits.maxBytes })\n          : truncateTail(combined, { maxLines: limits.maxLines, maxBytes: limits.maxBytes });\n\n      let spillPath: string | undefined;\n      if (options?.capture?.spill && truncation.truncated) {\n        try {\n          spillPath = posix.join(this.cwd, SPILL_DIR, `${randomBytes(8).toString(\"hex\")}.log`);\n          await this.executor.writeFile(spillPath, combined, this.execOptions(context));\n        } catch {\n          spillPath = undefined;\n        }\n      }\n\n      const metadata = shellOutputMetadata(truncation, spillPath);\n      options?.onUpdate?.(\n        { kind: \"replace\", output: { text: truncation.content, ...metadata } },\n        context,\n      );\n      return ok({ exitCode: result.code, ...metadata });\n    } catch (error) {\n      return err(toExecutionError(error, context));\n    }\n  }\n\n  private execOptions(context: Context): { signal: AbortSignal | undefined } {\n    return { signal: context.abortSignal };\n  }\n\n  private async run(\n    command: string,\n    context: Context,\n  ): Promise<{ stdout: string; stderr: string }> {\n    const result = await this.executor.exec(command, this.execOptions(context));\n    if (result.code !== 0) {\n      throw new Error(result.stderr.trim() || `Command failed (${result.code}): ${command}`);\n    }\n    return result;\n  }\n\n  private async fileOp<T>(op: () => Promise<T>): Promise<Result<T, FileError>> {\n    try {\n      return ok(await op());\n    } catch (error) {\n      return err(toFileError(error));\n    }\n  }\n}\n\nclass ShellTextLineReader implements TextLineReader {\n  private offset = 0;\n\n  constructor(private readonly content: string) {}\n\n  async readLine(_context: Context): Promise<Result<TextLine | undefined, FileError>> {\n    if (this.offset >= this.content.length) return ok(undefined);\n    const newline = this.content.indexOf(\"\\n\", this.offset);\n    if (newline === -1) {\n      const text = this.content.slice(this.offset);\n      this.offset = this.content.length;\n      return ok({ text, terminated: false });\n    }\n    const text = this.content.slice(this.offset, newline);\n    this.offset = newline + 1;\n    return ok({ text, terminated: true });\n  }\n\n  async close(_context: Context): Promise<void> {\n    this.offset = this.content.length;\n  }\n}\n\nfunction shellOutputMetadata(\n  truncation: TruncationResult,\n  spillPath: string | undefined,\n): ShellOutputMetadata {\n  const { content: _content, ...metadata } = truncation;\n  const lastLine = truncation.content.split(\"\\n\").at(-1) ?? \"\";\n  return {\n    truncation: metadata,\n    ...(spillPath ? { spillPath } : {}),\n    ...(truncation.lastLinePartial ? { lastLineBytes: Buffer.byteLength(lastLine, \"utf8\") } : {}),\n  };\n}\n\nfunction toFileError(error: unknown): FileError {\n  const message = error instanceof Error ? error.message : String(error);\n  if (/aborted/i.test(message)) return new FileError(\"aborted\", message);\n  if (/no such file|not found/i.test(message)) return new FileError(\"not_found\", message);\n  if (/permission denied/i.test(message)) return new FileError(\"permission_denied\", message);\n  if (/not a directory/i.test(message)) return new FileError(\"not_directory\", message);\n  if (/is a directory/i.test(message)) return new FileError(\"is_directory\", message);\n  return new FileError(\"unknown\", message, undefined, error instanceof Error ? error : undefined);\n}\n\nfunction toExecutionError(error: unknown, context: Context): ExecutionError {\n  const message = error instanceof Error ? error.message : String(error);\n  if (context.abortSignal?.aborted || /aborted/i.test(message)) {\n    return new ExecutionError(\"aborted\", message);\n  }\n  if (/timed out/i.test(message)) return new ExecutionError(\"timeout\", message);\n  return new ExecutionError(\"unknown\", message, error instanceof Error ? error : undefined);\n}\n"]}

package/dist/harness/http.d.ts

@@ -1,16 +1,4 @@
-/** Idle timeout applied to HTTP headers/body when none is configured. */
 export declare const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300000;
-/**
- * Parse an idle-timeout setting into milliseconds.
- *
- * Accepts a non-negative number of milliseconds or its string form;
- * `"disabled"` (case-insensitive) yields `0`. Returns `undefined` for
- * anything unparseable so callers can fall back to the default.
- */
 export declare function parseHttpIdleTimeoutMs(value: unknown): number | undefined;
-/**
- * Install the global HTTP dispatcher and fetch. A timeout of `0` disables
- * idle timeouts. Safe to call more than once; the last call wins.
- */
 export declare function configureHttpDispatcher(timeoutMs?: number): void;
 //# sourceMappingURL=http.d.ts.map

package/dist/harness/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/harness/http.ts"],"names":[],"mappings":"AAmBA,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,SAAU,CAAC;AAKpD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWzE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,GAAE,MAAqC,GAAG,IAAI,CA2B9F"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/harness/http.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4BAA4B,SAAU,CAAC;AAKpD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWzE;AAED,wBAAgB,uBAAuB,CAAC,SAAS,GAAE,MAAqC,GAAG,IAAI,CAsB9F"}

package/dist/harness/http.js

@@ -1,32 +1,7 @@
-/**
- * Global HTTP dispatcher configuration for the mikan harness.
- *
- * mikan is a long-running headless process whose LLM traffic goes through
- * global `fetch`. Node's built-in fetch ignores `HTTP_PROXY`/`HTTPS_PROXY`/
- * `NO_PROXY` and offers no idle-timeout control, so a proxied deployment
- * cannot reach providers and a silently stalled streaming response would
- * hang a session without ever erroring (auto-retry never kicks in).
- *
- * `configureHttpDispatcher` installs undici's `EnvHttpProxyAgent` as the
- * global dispatcher (proxy support via the standard env vars) with
- * headers/body idle timeouts, and swaps global `fetch` to undici's so both
- * share one implementation. A caller that deliberately replaced `fetch`
- * after module load is left alone.
- *
- * Design adapted from pi-coding-agent's http-dispatcher.
- */
 import * as undici from "undici";
-/** Idle timeout applied to HTTP headers/body when none is configured. */
 export const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300_000;
 const originalGlobalFetch = globalThis.fetch;
 let installedGlobalFetch;
-/**
- * Parse an idle-timeout setting into milliseconds.
- *
- * Accepts a non-negative number of milliseconds or its string form;
- * `"disabled"` (case-insensitive) yields `0`. Returns `undefined` for
- * anything unparseable so callers can fall back to the default.
- */
 export function parseHttpIdleTimeoutMs(value) {
     if (typeof value === "string") {
         const trimmed = value.trim();
@@ -41,10 +16,6 @@ export function parseHttpIdleTimeoutMs(value) {
     }
     return Math.floor(value);
 }
-/**
- * Install the global HTTP dispatcher and fetch. A timeout of `0` disables
- * idle timeouts. Safe to call more than once; the last call wins.
- */
 export function configureHttpDispatcher(timeoutMs = DEFAULT_HTTP_IDLE_TIMEOUT_MS) {
     const normalizedTimeoutMs = parseHttpIdleTimeoutMs(timeoutMs);
     if (normalizedTimeoutMs === undefined) {
@@ -55,15 +26,10 @@ export function configureHttpDispatcher(timeoutMs = DEFAULT_HTTP_IDLE_TIMEOUT_MS
         bodyTimeout: normalizedTimeoutMs,
         headersTimeout: normalizedTimeoutMs,
     }));
-    // Node's built-in fetch uses its own bundled undici and never sees the
-    // dispatcher installed above, so global fetch must be swapped to undici's.
     const shouldInstallGlobals = installedGlobalFetch === undefined
         ? globalThis.fetch === originalGlobalFetch
         : globalThis.fetch === installedGlobalFetch;
     if (shouldInstallGlobals) {
-        // `install` swaps global fetch to undici's; it only exists in undici >= 7,
-        // whose types aren't guaranteed here, so access it defensively and no-op
-        // on older undici (runtime behavior unchanged from the original `?.` call).
         undici.install?.();
         installedGlobalFetch = globalThis.fetch;
     }

package/dist/harness/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/harness/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,yEAAyE;AACzE,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC;AAC7C,IAAI,oBAAyD,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAS,GAAW,4BAA4B;IACtF,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,mBAAmB,CACxB,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAC3B,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,mBAAmB;QAChC,cAAc,EAAE,mBAAmB;KACpC,CAAC,CACH,CAAC;IAEF,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,oBAAoB,GACxB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,mBAAmB;QAC1C,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,oBAAoB,CAAC;IAChD,IAAI,oBAAoB,EAAE,CAAC;QACzB,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC3E,MAAmC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,oBAAoB,GAAG,UAAU,CAAC,KAAK,CAAC;IAC1C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Global HTTP dispatcher configuration for the mikan harness.\n *\n * mikan is a long-running headless process whose LLM traffic goes through\n * global `fetch`. Node's built-in fetch ignores `HTTP_PROXY`/`HTTPS_PROXY`/\n * `NO_PROXY` and offers no idle-timeout control, so a proxied deployment\n * cannot reach providers and a silently stalled streaming response would\n * hang a session without ever erroring (auto-retry never kicks in).\n *\n * `configureHttpDispatcher` installs undici's `EnvHttpProxyAgent` as the\n * global dispatcher (proxy support via the standard env vars) with\n * headers/body idle timeouts, and swaps global `fetch` to undici's so both\n * share one implementation. A caller that deliberately replaced `fetch`\n * after module load is left alone.\n *\n * Design adapted from pi-coding-agent's http-dispatcher.\n */\nimport * as undici from \"undici\";\n\n/** Idle timeout applied to HTTP headers/body when none is configured. */\nexport const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300_000;\n\nconst originalGlobalFetch = globalThis.fetch;\nlet installedGlobalFetch: typeof globalThis.fetch | undefined;\n\n/**\n * Parse an idle-timeout setting into milliseconds.\n *\n * Accepts a non-negative number of milliseconds or its string form;\n * `\"disabled\"` (case-insensitive) yields `0`. Returns `undefined` for\n * anything unparseable so callers can fall back to the default.\n */\nexport function parseHttpIdleTimeoutMs(value: unknown): number | undefined {\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (trimmed.toLowerCase() === \"disabled\") return 0;\n    if (trimmed.length === 0) return undefined;\n    return parseHttpIdleTimeoutMs(Number(trimmed));\n  }\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) {\n    return undefined;\n  }\n  return Math.floor(value);\n}\n\n/**\n * Install the global HTTP dispatcher and fetch. A timeout of `0` disables\n * idle timeouts. Safe to call more than once; the last call wins.\n */\nexport function configureHttpDispatcher(timeoutMs: number = DEFAULT_HTTP_IDLE_TIMEOUT_MS): void {\n  const normalizedTimeoutMs = parseHttpIdleTimeoutMs(timeoutMs);\n  if (normalizedTimeoutMs === undefined) {\n    throw new Error(`Invalid HTTP idle timeout: ${String(timeoutMs)}`);\n  }\n\n  undici.setGlobalDispatcher(\n    new undici.EnvHttpProxyAgent({\n      allowH2: false,\n      bodyTimeout: normalizedTimeoutMs,\n      headersTimeout: normalizedTimeoutMs,\n    }),\n  );\n\n  // Node's built-in fetch uses its own bundled undici and never sees the\n  // dispatcher installed above, so global fetch must be swapped to undici's.\n  const shouldInstallGlobals =\n    installedGlobalFetch === undefined\n      ? globalThis.fetch === originalGlobalFetch\n      : globalThis.fetch === installedGlobalFetch;\n  if (shouldInstallGlobals) {\n    // `install` swaps global fetch to undici's; it only exists in undici >= 7,\n    // whose types aren't guaranteed here, so access it defensively and no-op\n    // on older undici (runtime behavior unchanged from the original `?.` call).\n    (undici as { install?: () => void }).install?.();\n    installedGlobalFetch = globalThis.fetch;\n  }\n}\n"]}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/harness/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC;AAC7C,IAAI,oBAAyD,CAAC;AAE9D,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAS,GAAW,4BAA4B;IACtF,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,mBAAmB,CACxB,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAC3B,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,mBAAmB;QAChC,cAAc,EAAE,mBAAmB;KACpC,CAAC,CACH,CAAC;IAEF,MAAM,oBAAoB,GACxB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,mBAAmB;QAC1C,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,oBAAoB,CAAC;IAChD,IAAI,oBAAoB,EAAE,CAAC;QACxB,MAAmC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,oBAAoB,GAAG,UAAU,CAAC,KAAK,CAAC;IAC1C,CAAC;AACH,CAAC","sourcesContent":["import * as undici from \"undici\";\n\nexport const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300_000;\n\nconst originalGlobalFetch = globalThis.fetch;\nlet installedGlobalFetch: typeof globalThis.fetch | undefined;\n\nexport function parseHttpIdleTimeoutMs(value: unknown): number | undefined {\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (trimmed.toLowerCase() === \"disabled\") return 0;\n    if (trimmed.length === 0) return undefined;\n    return parseHttpIdleTimeoutMs(Number(trimmed));\n  }\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) {\n    return undefined;\n  }\n  return Math.floor(value);\n}\n\nexport function configureHttpDispatcher(timeoutMs: number = DEFAULT_HTTP_IDLE_TIMEOUT_MS): void {\n  const normalizedTimeoutMs = parseHttpIdleTimeoutMs(timeoutMs);\n  if (normalizedTimeoutMs === undefined) {\n    throw new Error(`Invalid HTTP idle timeout: ${String(timeoutMs)}`);\n  }\n\n  undici.setGlobalDispatcher(\n    new undici.EnvHttpProxyAgent({\n      allowH2: false,\n      bodyTimeout: normalizedTimeoutMs,\n      headersTimeout: normalizedTimeoutMs,\n    }),\n  );\n\n  const shouldInstallGlobals =\n    installedGlobalFetch === undefined\n      ? globalThis.fetch === originalGlobalFetch\n      : globalThis.fetch === installedGlobalFetch;\n  if (shouldInstallGlobals) {\n    (undici as { install?: () => void }).install?.();\n    installedGlobalFetch = globalThis.fetch;\n  }\n}\n"]}

package/dist/harness/index.d.ts

@@ -1,10 +1,3 @@
-/**
- * mikan agent harness.
- *
- * Application integration of pi-agent-core's native AgentHarness (durable
- * operations, tools, retries, compaction, recovery) and pi-ai (providers,
- * models, auth). See `src/harness/README.md` for the architecture.
- */
 export { DEFAULT_HTTP_IDLE_TIMEOUT_MS, configureHttpDispatcher, parseHttpIdleTimeoutMs, } from "./http.js";
 export { MikanModels, defaultModelsJsonPath } from "./models.js";
 export type { CreateMikanModelsOptions } from "./types.js";
@@ -13,6 +6,10 @@ export { SessionStore } from "../sessions/session-store.js";
 export type { SessionContext, SessionEntry, SessionHeader, SessionMessageEntry, } from "../sessions/types.js";
 export { CURRENT_SESSION_VERSION } from "../sessions/types.js";
 export { MikanAgentSession } from "./session.js";
+export { runSubagent } from "./subagent.js";
+export { resolveTriggerAttribution } from "./prompt.js";
+export { isEventTriggerAttribution } from "./presenter.js";
+export { redactSecrets } from "./tools/secret-redaction.js";
 export type { CompactionReason, HarnessEvent, HarnessEventListener, MikanAgentSessionOptions, } from "./types.js";
 export { formatSkillsForPrompt, loadSkillsFromDir, parseFrontmatter, validateSkill, } from "./skills.js";
 export type { LoadSkillsResult, MikanSkill, SkillDiagnostic } from "./types.js";

package/dist/harness/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/harness/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjE,YAAY,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,YAAY,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/harness/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjE,YAAY,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,YAAY,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}

package/dist/harness/index.js

@@ -1,16 +1,13 @@
-/**
- * mikan agent harness.
- *
- * Application integration of pi-agent-core's native AgentHarness (durable
- * operations, tools, retries, compaction, recovery) and pi-ai (providers,
- * models, auth). See `src/harness/README.md` for the architecture.
- */
 export { DEFAULT_HTTP_IDLE_TIMEOUT_MS, configureHttpDispatcher, parseHttpIdleTimeoutMs, } from "./http.js";
 export { MikanModels, defaultModelsJsonPath } from "./models.js";
 export { JEV_MODEL_ID, JevNotConfiguredError, JevRequestError, evaluateWithJev, } from "./jev.js";
 export { SessionStore } from "../sessions/session-store.js";
 export { CURRENT_SESSION_VERSION } from "../sessions/types.js";
 export { MikanAgentSession } from "./session.js";
+export { runSubagent } from "./subagent.js";
+export { resolveTriggerAttribution } from "./prompt.js";
+export { isEventTriggerAttribution } from "./presenter.js";
+export { redactSecrets } from "./tools/secret-redaction.js";
 export { formatSkillsForPrompt, loadSkillsFromDir, parseFrontmatter, validateSkill, } from "./skills.js";
 export { loadSubagentProfiles } from "./subagent-profiles.js";
 export { DEFAULT_BUDGET_SETTINGS, DEFAULT_EVENT_BUDGET, DEFAULT_RETRY_SETTINGS, resolveHarnessSettings, } from "./session.js";

package/dist/harness/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/harness/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,eAAe,GAOhB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAO5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAOjD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GAEvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAcN,MAAM,YAAY,CAAC","sourcesContent":["/**\n * mikan agent harness.\n *\n * Application integration of pi-agent-core's native AgentHarness (durable\n * operations, tools, retries, compaction, recovery) and pi-ai (providers,\n * models, auth). See `src/harness/README.md` for the architecture.\n */\nexport {\n  DEFAULT_HTTP_IDLE_TIMEOUT_MS,\n  configureHttpDispatcher,\n  parseHttpIdleTimeoutMs,\n} from \"./http.js\";\nexport { MikanModels, defaultModelsJsonPath } from \"./models.js\";\nexport type { CreateMikanModelsOptions } from \"./types.js\";\nexport {\n  JEV_MODEL_ID,\n  JevNotConfiguredError,\n  JevRequestError,\n  evaluateWithJev,\n  type EvaluateWithJevOptions,\n  type JevAnswer,\n  type JevEntry,\n  type JevQuestion,\n  type JevQuestions,\n  type JevResult,\n} from \"./jev.js\";\nexport { SessionStore } from \"../sessions/session-store.js\";\nexport type {\n  SessionContext,\n  SessionEntry,\n  SessionHeader,\n  SessionMessageEntry,\n} from \"../sessions/types.js\";\nexport { CURRENT_SESSION_VERSION } from \"../sessions/types.js\";\nexport { MikanAgentSession } from \"./session.js\";\nexport type {\n  CompactionReason,\n  HarnessEvent,\n  HarnessEventListener,\n  MikanAgentSessionOptions,\n} from \"./types.js\";\nexport {\n  formatSkillsForPrompt,\n  loadSkillsFromDir,\n  parseFrontmatter,\n  validateSkill,\n} from \"./skills.js\";\nexport type { LoadSkillsResult, MikanSkill, SkillDiagnostic } from \"./types.js\";\nexport { loadSubagentProfiles } from \"./subagent-profiles.js\";\nexport type { LoadSubagentProfilesResult, SubagentProfileDiagnostic } from \"./types.js\";\nexport {\n  DEFAULT_BUDGET_SETTINGS,\n  DEFAULT_EVENT_BUDGET,\n  DEFAULT_RETRY_SETTINGS,\n  resolveHarnessSettings,\n  type CompactionSettings,\n} from \"./session.js\";\nexport type { BudgetSettings, HarnessSettings, RetrySettings } from \"./types.js\";\nexport {\n  type SubagentModelSpec,\n  type SubagentProfile,\n  type SubagentParentContext,\n  type SubagentRunBudget,\n  type SubagentRunOutput,\n  type SubagentRunRequest,\n  type SubagentRunResult,\n  type SubagentRunStatus,\n  type SubagentUsage,\n  type SubagentUsageSink,\n  type BranchSummaryEntry,\n  type CompactionEntry,\n  type CustomEntry,\n} from \"./types.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/harness/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,eAAe,GAOhB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAO5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAO5D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GAEvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAcN,MAAM,YAAY,CAAC","sourcesContent":["export {\n  DEFAULT_HTTP_IDLE_TIMEOUT_MS,\n  configureHttpDispatcher,\n  parseHttpIdleTimeoutMs,\n} from \"./http.js\";\nexport { MikanModels, defaultModelsJsonPath } from \"./models.js\";\nexport type { CreateMikanModelsOptions } from \"./types.js\";\nexport {\n  JEV_MODEL_ID,\n  JevNotConfiguredError,\n  JevRequestError,\n  evaluateWithJev,\n  type EvaluateWithJevOptions,\n  type JevAnswer,\n  type JevEntry,\n  type JevQuestion,\n  type JevQuestions,\n  type JevResult,\n} from \"./jev.js\";\nexport { SessionStore } from \"../sessions/session-store.js\";\nexport type {\n  SessionContext,\n  SessionEntry,\n  SessionHeader,\n  SessionMessageEntry,\n} from \"../sessions/types.js\";\nexport { CURRENT_SESSION_VERSION } from \"../sessions/types.js\";\nexport { MikanAgentSession } from \"./session.js\";\nexport { runSubagent } from \"./subagent.js\";\nexport { resolveTriggerAttribution } from \"./prompt.js\";\nexport { isEventTriggerAttribution } from \"./presenter.js\";\nexport { redactSecrets } from \"./tools/secret-redaction.js\";\nexport type {\n  CompactionReason,\n  HarnessEvent,\n  HarnessEventListener,\n  MikanAgentSessionOptions,\n} from \"./types.js\";\nexport {\n  formatSkillsForPrompt,\n  loadSkillsFromDir,\n  parseFrontmatter,\n  validateSkill,\n} from \"./skills.js\";\nexport type { LoadSkillsResult, MikanSkill, SkillDiagnostic } from \"./types.js\";\nexport { loadSubagentProfiles } from \"./subagent-profiles.js\";\nexport type { LoadSubagentProfilesResult, SubagentProfileDiagnostic } from \"./types.js\";\nexport {\n  DEFAULT_BUDGET_SETTINGS,\n  DEFAULT_EVENT_BUDGET,\n  DEFAULT_RETRY_SETTINGS,\n  resolveHarnessSettings,\n  type CompactionSettings,\n} from \"./session.js\";\nexport type { BudgetSettings, HarnessSettings, RetrySettings } from \"./types.js\";\nexport {\n  type SubagentModelSpec,\n  type SubagentProfile,\n  type SubagentParentContext,\n  type SubagentRunBudget,\n  type SubagentRunOutput,\n  type SubagentRunRequest,\n  type SubagentRunResult,\n  type SubagentRunStatus,\n  type SubagentUsage,\n  type SubagentUsageSink,\n  type BranchSummaryEntry,\n  type CompactionEntry,\n  type CustomEntry,\n} from \"./types.js\";\n"]}

package/dist/harness/jev.d.ts

@@ -1,20 +1,11 @@
 import { type JevCaller } from "../observability/index.js";
-/** The current public Jev model id on OpenRouter. */
 export declare const JEV_MODEL_ID = "~typesafe/jev-latest";
-/**
- * Any value Jev accepts as text-bearing structure: a string, a JSON object,
- * an array, or `null`. State, instructions, and criteria descriptions all
- * take this shape; Jev is trained to read the structure, so objects with
- * labelled keys are preferred over string templates.
- */
 export type JevEntry = string | number | boolean | null | JevEntry[] | {
     [key: string]: JevEntry;
 };
-/** A shared caller-facing question shape; translated to `@geminixiang/jev`'s shape below. */
 export type JevQuestion = {
     type: "boolean";
     instructions: JevEntry;
-    /** Optional descriptions of the yes / no outcomes. */
     criteria?: {
         true?: JevEntry;
         false?: JevEntry;
@@ -35,16 +26,13 @@ export type JevAnswer<QUESTION extends JevQuestion> = QUESTION extends {
     type: "choice";
     choice: string;
     probabilities?: Record<string, number>;
-    /** 0-1 statistic over `probabilities`; low means no option clearly fits. */
     confidence?: number;
 } : QUESTION extends {
     type: "score";
 } ? {
     type: "score";
-    /** Expected level index; fractional between levels. */
     score: number;
     probabilities?: Record<string, number>;
-    /** Level index -> criterion text, as echoed by Jev. */
     legend?: Record<string, string>;
     confidence?: number;
 } : {
@@ -62,7 +50,6 @@ export interface JevResult<QUESTIONS extends JevQuestions> {
     };
     readonly model: string;
 }
-/** Thrown when no Jev backend has a usable credential. Callers fail closed on this. */
 export declare class JevNotConfiguredError extends Error {
     constructor();
 }
@@ -71,25 +58,10 @@ export declare class JevRequestError extends Error {
     constructor(message: string, status: number);
 }
 export interface EvaluateWithJevOptions {
-    /** Evaluation model id; defaults to the current public Jev model. */
     model?: string;
     abortSignal?: AbortSignal;
     headers?: Record<string, string>;
-    /**
-     * Which call site is asking, so Jev spend is attributable in Sentry/OTel
-     * (`agent.jev.cost`, tagged `caller`) without any judged content leaving
-     * this function. Required rather than defaulted so a new call site must
-     * consciously pick an attribution instead of spend silently landing in a
-     * generic bucket.
-     */
     caller: JevCaller;
 }
-/**
- * Evaluate one or more typed questions against a shared `state` using Jev,
- * reached through OpenRouter's decisions API by way of `@geminixiang/jev`.
- * Every question is scored independently against the same state in a
- * single request; batching questions here is cheap (they share the input)
- * and is preferred over separate calls per question.
- */
 export declare function evaluateWithJev<const QUESTIONS extends JevQuestions>(state: JevEntry, questions: QUESTIONS, options: EvaluateWithJevOptions): Promise<JevResult<QUESTIONS>>;
 //# sourceMappingURL=jev.d.ts.map

package/dist/harness/jev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jev.d.ts","sourceRoot":"","sources":["../../src/harness/jev.ts"],"names":[],"mappings":"AAsCA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE7E,qDAAqD;AACrD,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEnG,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GACnB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,QAAQ,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;CAClD,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAA;CAAE,CAAC;AAE7E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAEvD,MAAM,MAAM,SAAS,CAAC,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GACrF;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD,QAAQ,SAAS;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAChC;IACE,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,SAAS,CAAC,SAAS,SAAS,YAAY;IACvD,QAAQ,CAAC,OAAO,EAAE;SAAG,EAAE,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;KAAE,CAAC;IACxE,QAAQ,CAAC,KAAK,EAAE;QACd,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,uFAAuF;AACvF,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,cAKC;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;IAFhC,YACE,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EAI/B;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,CAAC;CACnB;AA6ED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,CAAC,SAAS,SAAS,YAAY,EACxE,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAuE/B"}
+{"version":3,"file":"jev.d.ts","sourceRoot":"","sources":["../../src/harness/jev.ts"],"names":[],"mappings":"AAcA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE7E,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEnG,MAAM,MAAM,WAAW,GACnB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;CAClD,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAA;CAAE,CAAC;AAE7E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAEvD,MAAM,MAAM,SAAS,CAAC,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GACrF;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD,QAAQ,SAAS;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAChC;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,SAAS,CAAC,SAAS,SAAS,YAAY;IACvD,QAAQ,CAAC,OAAO,EAAE;SAAG,EAAE,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;KAAE,CAAC;IACxE,QAAQ,CAAC,KAAK,EAAE;QACd,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,cAKC;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;IAFhC,YACE,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EAI/B;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,SAAS,CAAC;CACnB;AAmED,wBAAsB,eAAe,CAAC,KAAK,CAAC,SAAS,SAAS,YAAY,EACxE,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAoE/B"}