@geminixiang/mikan 1.3.0 → 1.4.0

package/dist/env-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-manifest.d.ts","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,QAAQ,EA6K3C,CAAC;AAkCF,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAA4D,GAC3F,MAAM,EAAE,CAMV;AAED,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAEtD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,SAAmB,GAAG,OAAO,CAI/E;AAOD,wBAAgB,kBAAkB,IAAI,MAAM,CAK3C;AAED,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAI1C;AAED,wBAAgB,SAAS,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,CA+B1D;AAED,wBAAgB,YAAY,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,CAO7D;AAED,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAmB,GACnD,MAAM,CAER;AAED,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD"}
+{"version":3,"file":"env-manifest.d.ts","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,QAAQ,EAwL3C,CAAC;AAkCF,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAA4D,GAC3F,MAAM,EAAE,CAMV;AAED,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAEtD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,SAAmB,GAAG,OAAO,CAI/E;AAOD,wBAAgB,kBAAkB,IAAI,MAAM,CAK3C;AAED,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAI1C;AAED,wBAAgB,SAAS,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,CA+B1D;AAED,wBAAgB,YAAY,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,CAO7D;AAED,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAmB,GACnD,MAAM,CAER;AAED,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD"}

package/dist/env-manifest.js

@@ -131,6 +131,17 @@ export const ENV_MANIFEST = [
             },
         ],
     },
+    {
+        key: "sandbox",
+        title: "Sandbox",
+        kind: "feature",
+        vars: [
+            {
+                name: "CONTAINER_ENGINE",
+                doc: "Override the container engine for container:* and oci:* sandboxes; by default mikan uses the first of nerdctl, podman, docker that answers `info`",
+            },
+        ],
+    },
     {
         key: "observability",
         title: "Observability",

package/dist/env-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-manifest.js","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,QAAQ,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAwB;IAC/C;QACE,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,gCAAgC;aACtC;YACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE;SACrF;KACF;IACD;QACE,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;KAC7F;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,0HAA0H;QAC/H,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,wEAAwE;aAC9E;YACD;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,kEAAkE;aACxE;SACF;KACF;IACD;QACE,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,mBAAmB,EAAE;YACrE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE;YAC/D;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,sGAAsG;aAC5G;SACF;KACF;IACD;QACE,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,iEAAiE;QACtE,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,6DAA6D,EAAE;YACxF,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,iDAAiD,EAAE;YAC7E;gBACE,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,0EAA0E;aAChF;YACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,qCAAqC,EAAE;YAC9E,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,yBAAyB,EAAE;YACpF,EAAE,IAAI,EAAE,gCAAgC,EAAE,GAAG,EAAE,0CAA0C,EAAE;YAC3F;gBACE,IAAI,EAAE,oCAAoC;gBAC1C,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;YACD,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0CAA0C,EAAE;YACvF;gBACE,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;YACD;gBACE,IAAI,EAAE,mCAAmC;gBACzC,GAAG,EAAE,+DAA+D;aACrE;YACD;gBACE,IAAI,EAAE,+BAA+B;gBACrC,GAAG,EAAE,+DAA+D;aACrE;YACD;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,GAAG,EAAE,sFAAsF;aAC5F;YACD;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,sDAAsD;aAC5D;SACF;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,kGAAkG;QACvG,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,GAAG,EAAE,+EAA+E;aACrF;YACD;gBACE,IAAI,EAAE,2BAA2B;gBACjC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,8FAA8F;aACpG;SACF;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,6CAA6C,EAAE;YACxF;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,6CAA6C;aACnD;YACD;gBACE,IAAI,EAAE,2BAA2B;gBACjC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,wEAAwE;aAC9E;SACF;KACF;IACD;QACE,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,yEAAyE;QAC9E,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,sCAAsC,EAAE;YAC1E,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mCAAmC,EAAE;YACvE;gBACE,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,qCAAqC;aAC3C;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,8BAA8B,EAAE;YACrE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,gCAAgC,EAAE;YACxE,EAAE,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,yBAAyB,EAAE;YACrF,EAAE,IAAI,EAAE,oCAAoC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,sBAAsB,EAAE;YACzF,EAAE,IAAI,EAAE,qCAAqC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,uBAAuB,EAAE;YAC3F,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,0BAA0B,EAAE;YACrF,EAAE,IAAI,EAAE,mCAAmC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE;YACtF,EAAE,IAAI,EAAE,oCAAoC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE;YACxF,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,wCAAwC,EAAE;YACtF,EAAE,IAAI,EAAE,oCAAoC,EAAE,GAAG,EAAE,yBAAyB,EAAE;YAC9E,EAAE,IAAI,EAAE,qCAAqC,EAAE,GAAG,EAAE,0BAA0B,EAAE;YAChF,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,qCAAqC,EAAE;YAClF,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,EAAE,+BAA+B,EAAE;YACnF,EAAE,IAAI,EAAE,oCAAoC,EAAE,GAAG,EAAE,gCAAgC,EAAE;YACrF,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,wCAAwC,EAAE;YACtF,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,uCAAuC,EAAE;SACrF;KACF;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,OAAO,GAAG,4BAA4B,CAAC;AAChD,CAAC;AAED,MAAM,aAAa,GAAG,2DAA2D,CAAC;AAElF,MAAM,WAAW,GAA8C;IAC7D,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,CAAC,cAAc,CAAC,EAAE;IAC/D,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,eAAe,CAAC,oBAAoB,CAAC,EAAE;IAC5E,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,CAAC,cAAc,CAAC,EAAE;IAC/D;QACE,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,eAAe,CAAC,sBAAsB,CAAC;KAC9C;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,CAAC,iBAAiB,CAAC,EAAE;IACrE;QACE,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,eAAe,CAAC,qBAAqB,CAAC;KAC7C;IACD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE;IAC9C,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE;IAC5D,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,aAAa,EAAE;IACvD;QACE,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,yDAAyD;KAChE;IACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,oDAAoD,EAAE;IACtF,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,yCAAyC,EAAE;IACtE,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,qCAAqC,EAAE;IAC/E,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,qCAAqC,EAAE;CAClF,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAChC,GAAG,GAAyC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;IAE5F,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAC5C,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAC7C,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAG,GAAc,OAAO;IACpE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,KAAe;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;SACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,0CAA0C,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAClE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAG,GAAc,OAAO;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;gBAChC,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,aAAa;YACjB,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/D,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,SAAS,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAChD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAG,GAAc,OAAO;IACnD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,OAAO;QACL,gBAAgB;QAChB,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7D,oDAAoD;KACrD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,IAAI,GAAyC,OAAO;IAEpD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC","sourcesContent":["import type { EnvGroup } from \"./types.js\";\n\nexport function readEnv(name: string): string | undefined {\n  const raw = process.env[name]?.trim();\n  if (raw) return raw;\n\n  const prefixed = process.env[`MIKAN_${name}`]?.trim();\n  return prefixed || undefined;\n}\n\nexport function readStandardEnv(name: string): string | undefined {\n  return process.env[name]?.trim() || undefined;\n}\n\nexport const ENV_MANIFEST: readonly EnvGroup[] = [\n  {\n    key: \"slack\",\n    title: \"Slack\",\n    kind: \"platform\",\n    vars: [\n      {\n        name: \"SLACK_APP_TOKEN\",\n        required: true,\n        secret: true,\n        doc: \"Socket-mode app token (xapp-…)\",\n      },\n      { name: \"SLACK_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token (xoxb-…)\" },\n    ],\n  },\n  {\n    key: \"telegram\",\n    title: \"Telegram\",\n    kind: \"platform\",\n    vars: [{ name: \"TELEGRAM_BOT_TOKEN\", required: true, secret: true, doc: \"BotFather token\" }],\n  },\n  {\n    key: \"discord\",\n    title: \"Discord\",\n    kind: \"platform\",\n    vars: [{ name: \"DISCORD_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token\" }],\n  },\n  {\n    key: \"github\",\n    title: \"GitHub\",\n    kind: \"platform\",\n    doc: \"Issue/PR conversations as a bound GitHub account, driven by webhooks (needs LINK_PORT and github.repos in settings.json)\",\n    vars: [\n      {\n        name: \"GITHUB_AGENT_TOKEN\",\n        required: true,\n        secret: true,\n        doc: \"Fine-grained PAT of the agent account; mikan acts on GitHub only as it\",\n      },\n      {\n        name: \"GITHUB_WEBHOOK_SECRET\",\n        required: true,\n        secret: true,\n        doc: \"Secret of the webhook that delivers to <LINK_URL>/github/webhook\",\n      },\n    ],\n  },\n  {\n    key: \"llm\",\n    title: \"LLM providers\",\n    kind: \"feature\",\n    vars: [\n      { name: \"ANTHROPIC_API_KEY\", secret: true, doc: \"Anthropic API key\" },\n      { name: \"OPENAI_API_KEY\", secret: true, doc: \"OpenAI API key\" },\n      {\n        name: \"OPENROUTER_API_KEY\",\n        secret: true,\n        doc: \"OpenRouter API key (chat models routed through OpenRouter, and Jev's first choice in harness/jev.ts)\",\n      },\n    ],\n  },\n  {\n    key: \"link\",\n    title: \"Link/OAuth server\",\n    kind: \"feature\",\n    doc: \"Credential onboarding links, session view, and the Admin portal\",\n    vars: [\n      { name: \"LINK_URL\", doc: \"Externally visible base URL, e.g. https://mikan.example.com\" },\n      { name: \"LINK_PORT\", doc: \"Listen port (default 8181 when LINK_URL is set)\" },\n      {\n        name: \"LINK_HOST\",\n        doc: \"Listen address (default 127.0.0.1, for a reverse proxy on the same host)\",\n      },\n      { name: \"GITHUB_OAUTH_CLIENT_ID\", doc: \"GitHub OAuth app for /login linking\" },\n      { name: \"GITHUB_OAUTH_CLIENT_SECRET\", secret: true, doc: \"GitHub OAuth app secret\" },\n      { name: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\", doc: \"Google Workspace OAuth client for /login\" },\n      {\n        name: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Workspace OAuth secret\",\n      },\n      { name: \"GOOGLE_CLOUD_SDK_CLIENT_ID\", doc: \"Google Cloud SDK OAuth client for /login\" },\n      {\n        name: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Cloud SDK OAuth secret\",\n      },\n      {\n        name: \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n        doc: \"Scopes /login requests for Google Workspace (space-separated)\",\n      },\n      {\n        name: \"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\",\n        doc: \"Scopes /login requests for Google Cloud SDK (space-separated)\",\n      },\n      {\n        name: \"GITHUB_OAUTH_SCOPES\",\n        doc: \"Scopes /login requests from GitHub (default repo read:user user:email read:org gist)\",\n      },\n      {\n        name: \"OAUTH_SERVICES_JSON\",\n        secret: true,\n        doc: \"JSON array of extra OAuth services offered by /login\",\n      },\n    ],\n  },\n  {\n    key: \"openconnector\",\n    title: \"OpenConnector\",\n    kind: \"feature\",\n    doc: \"Default open-connector MCP server and the admin token that mints per-conversation runtime tokens\",\n    vars: [\n      {\n        name: \"OPENCONNECTOR_ENDPOINT\",\n        doc: \"Default MCP endpoint used when a conversation does not declare open-connector\",\n      },\n      {\n        name: \"OPENCONNECTOR_ADMIN_TOKEN\",\n        secret: true,\n        doc: \"Host-only admin token used to mint one runtime token per conversation for the default server\",\n      },\n    ],\n  },\n  {\n    key: \"observability\",\n    title: \"Observability\",\n    kind: \"feature\",\n    vars: [\n      { name: \"SENTRY_DSN\", secret: true, doc: \"Sentry DSN; Sentry is off while it is unset\" },\n      {\n        name: \"SENTRY_ENVIRONMENT\",\n        deploy: false,\n        doc: \"Sentry environment tag (default production)\",\n      },\n      {\n        name: \"SENTRY_TRACES_SAMPLE_RATE\",\n        deploy: false,\n        doc: \"Sentry trace sample rate, 0 to 1 (default 1; ignored with OTLP traces)\",\n      },\n    ],\n  },\n  {\n    key: \"otel\",\n    title: \"OpenTelemetry\",\n    kind: \"feature\",\n    folded: true,\n    doc: \"Standard OTEL_* exporter variables; mikan sends OTLP over HTTP/protobuf\",\n    vars: [\n      { name: \"OTEL_SDK_DISABLED\", doc: \"Set to true to disable OpenTelemetry\" },\n      { name: \"OTEL_SERVICE_NAME\", doc: \"OTLP service name (default mikan)\" },\n      {\n        name: \"OTEL_RESOURCE_ATTRIBUTES\",\n        secret: true,\n        doc: \"Comma-separated safe resource attrs\",\n      },\n      { name: \"OTEL_TRACES_EXPORTER\", doc: \"Trace exporter: otlp or none\" },\n      { name: \"OTEL_METRICS_EXPORTER\", doc: \"Metrics exporter: otlp or none\" },\n      { name: \"OTEL_EXPORTER_OTLP_ENDPOINT\", secret: true, doc: \"Base OTLP HTTP endpoint\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_ENDPOINT\", secret: true, doc: \"OTLP traces endpoint\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_ENDPOINT\", secret: true, doc: \"OTLP metrics endpoint\" },\n      { name: \"OTEL_EXPORTER_OTLP_HEADERS\", secret: true, doc: \"Shared OTLP auth headers\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_HEADERS\", secret: true, doc: \"OTLP trace headers\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_HEADERS\", secret: true, doc: \"OTLP metric headers\" },\n      { name: \"OTEL_EXPORTER_OTLP_PROTOCOL\", doc: \"OTLP protocol; http/protobuf supported\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_PROTOCOL\", doc: \"Trace protocol override\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_PROTOCOL\", doc: \"Metric protocol override\" },\n      { name: \"OTEL_EXPORTER_OTLP_TIMEOUT\", doc: \"Shared OTLP timeout in milliseconds\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_TIMEOUT\", doc: \"Trace timeout in milliseconds\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_TIMEOUT\", doc: \"Metric timeout in milliseconds\" },\n      { name: \"OTEL_METRIC_EXPORT_INTERVAL\", doc: \"Metric export interval in milliseconds\" },\n      { name: \"OTEL_METRIC_EXPORT_TIMEOUT\", doc: \"Metric export timeout in milliseconds\" },\n    ],\n  },\n];\n\nfunction movedToSettings(key: string): string {\n  return `set ${key} in ~/.mikan/settings.json`;\n}\n\nconst NO_GITHUB_APP = \"removed; GitHub runs as the account of GITHUB_AGENT_TOKEN\";\n\nconst RETIRED_ENV: readonly { name: string; note: string }[] = [\n  { name: \"GITHUB_REPOS\", note: movedToSettings(\"github.repos\") },\n  { name: \"GITHUB_PUBLIC_REPOS\", note: movedToSettings(\"github.publicRepos\") },\n  { name: \"GITHUB_USERS\", note: movedToSettings(\"github.users\") },\n  {\n    name: \"GITHUB_MIN_PERMISSION\",\n    note: movedToSettings(\"github.minPermission\"),\n  },\n  { name: \"GITHUB_TRIGGERS\", note: movedToSettings(\"github.triggers\") },\n  {\n    name: \"GITHUB_CAPABILITIES\",\n    note: movedToSettings(\"github.capabilities\"),\n  },\n  { name: \"GITHUB_APP_ID\", note: NO_GITHUB_APP },\n  { name: \"GITHUB_APP_PRIVATE_KEY_PATH\", note: NO_GITHUB_APP },\n  { name: \"GITHUB_INSTALLATION_ID\", note: NO_GITHUB_APP },\n  {\n    name: \"HTTP_IDLE_TIMEOUT\",\n    note: \"removed; outbound HTTP streams time out after 5 minutes\",\n  },\n  { name: \"SENTRY_ENABLED\", note: \"removed; leave SENTRY_DSN unset to turn Sentry off\" },\n  { name: \"STATE_DIR\", note: \"removed; state always lives in ~/.mikan\" },\n  { name: \"CLOUDFLARE_SANDBOX_URL\", note: \"removed with the cloudflare sandbox\" },\n  { name: \"CLOUDFLARE_SANDBOX_TOKEN\", note: \"removed with the cloudflare sandbox\" },\n];\n\nexport function retiredEnvWarnings(\n  env: (name: string) => string | undefined = (name) => process.env[name]?.trim() || undefined,\n): string[] {\n  return RETIRED_ENV.flatMap(({ name, note }) =>\n    [name, `MIKAN_${name}`]\n      .filter((spelling) => env(spelling))\n      .map((spelling) => `${spelling}: ${note}`),\n  );\n}\n\ntype EnvLookup = (name: string) => string | undefined;\n\nexport function platformIsActive(key: string, env: EnvLookup = readEnv): boolean {\n  const group = ENV_MANIFEST.find((candidate) => candidate.key === key);\n  if (!group) throw new Error(`Unknown env-manifest group: ${key}`);\n  return group.vars.filter((spec) => spec.required).every((spec) => env(spec.name));\n}\n\nfunction platformRecipe(group: EnvGroup): string {\n  const required = group.vars.filter((spec) => spec.required).map((spec) => spec.name);\n  return `${group.title}: ${required.join(\" + \")}`;\n}\n\nexport function noPlatformsMessage(): string {\n  const recipes = ENV_MANIFEST.filter((group) => group.kind === \"platform\")\n    .map((group) => `  ${platformRecipe(group)}`)\n    .join(\"\\n\");\n  return `No platform tokens found. Set one of:\\n${recipes}`;\n}\n\nexport function envSummaryLines(): string[] {\n  return ENV_MANIFEST.filter((group) => group.kind === \"platform\").map(\n    (group) => `  ${platformRecipe(group)}`,\n  );\n}\n\nexport function envReport(env: EnvLookup = readEnv): string {\n  const lines: string[] = [];\n  for (const group of ENV_MANIFEST) {\n    const active =\n      group.kind === \"platform\"\n        ? platformIsActive(group.key, env)\n          ? \" — active\"\n          : \" — inactive\"\n        : \"\";\n    if (group.folded) {\n      const set = group.vars.filter((spec) => env(spec.name)).length;\n      const pattern = `${group.vars[0]!.name.split(\"_\")[0]}_*`;\n      lines.push(group.title);\n      lines.push(`  ${pattern.padEnd(36)} ${set} of ${group.vars.length} set  ${group.doc ?? \"\"}`);\n      lines.push(\"\");\n      continue;\n    }\n    lines.push(`${group.title}${active}${group.doc ? ` · ${group.doc}` : \"\"}`);\n    for (const spec of group.vars) {\n      const status = env(spec.name) ? \"set\" : \"unset\";\n      const marks = [spec.required ? \"required\" : \"\", spec.secret ? \"secret\" : \"\"]\n        .filter(Boolean)\n        .join(\", \");\n      lines.push(\n        `  ${spec.name.padEnd(36)} ${status.padEnd(6)}${marks ? ` [${marks}]` : \"\"}  ${spec.doc}`,\n      );\n    }\n    lines.push(\"\");\n  }\n  lines.push(\"Each var also accepts a MIKAN_-prefixed alias (e.g. MIKAN_LINK_URL).\");\n  return lines.join(\"\\n\");\n}\n\nexport function envSetReport(env: EnvLookup = readEnv): string {\n  const set = ENV_MANIFEST.flatMap((group) => group.vars).filter((spec) => env(spec.name));\n  return [\n    \"Variables set:\",\n    ...set.map((spec) => `  ${spec.name.padEnd(36)} ${spec.doc}`),\n    \"Run `mikan env` to see every variable mikan reads.\",\n  ].join(\"\\n\");\n}\n\nexport function resolveLinkListenHost(\n  read: (name: string) => string | undefined = readEnv,\n): string {\n  return read(\"LINK_HOST\") ?? \"127.0.0.1\";\n}\n\nexport function resolveLinkBaseUrl(): string | undefined {\n  const raw = readEnv(\"LINK_URL\");\n  if (!raw) return undefined;\n  return raw.replace(/\\/+$/, \"\");\n}\n"]}
+{"version":3,"file":"env-manifest.js","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,QAAQ,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAwB;IAC/C;QACE,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,gCAAgC;aACtC;YACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE;SACrF;KACF;IACD;QACE,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;KAC7F;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,0HAA0H;QAC/H,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,wEAAwE;aAC9E;YACD;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,kEAAkE;aACxE;SACF;KACF;IACD;QACE,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,mBAAmB,EAAE;YACrE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE;YAC/D;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,sGAAsG;aAC5G;SACF;KACF;IACD;QACE,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,iEAAiE;QACtE,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,6DAA6D,EAAE;YACxF,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,iDAAiD,EAAE;YAC7E;gBACE,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,0EAA0E;aAChF;YACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,qCAAqC,EAAE;YAC9E,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,yBAAyB,EAAE;YACpF,EAAE,IAAI,EAAE,gCAAgC,EAAE,GAAG,EAAE,0CAA0C,EAAE;YAC3F;gBACE,IAAI,EAAE,oCAAoC;gBAC1C,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;YACD,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0CAA0C,EAAE;YACvF;gBACE,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;YACD;gBACE,IAAI,EAAE,mCAAmC;gBACzC,GAAG,EAAE,+DAA+D;aACrE;YACD;gBACE,IAAI,EAAE,+BAA+B;gBACrC,GAAG,EAAE,+DAA+D;aACrE;YACD;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,GAAG,EAAE,sFAAsF;aAC5F;YACD;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,sDAAsD;aAC5D;SACF;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,kGAAkG;QACvG,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,GAAG,EAAE,+EAA+E;aACrF;YACD;gBACE,IAAI,EAAE,2BAA2B;gBACjC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,8FAA8F;aACpG;SACF;KACF;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,kBAAkB;gBACxB,GAAG,EAAE,mJAAmJ;aACzJ;SACF;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,6CAA6C,EAAE;YACxF;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,6CAA6C;aACnD;YACD;gBACE,IAAI,EAAE,2BAA2B;gBACjC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,wEAAwE;aAC9E;SACF;KACF;IACD;QACE,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,yEAAyE;QAC9E,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,sCAAsC,EAAE;YAC1E,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mCAAmC,EAAE;YACvE;gBACE,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,qCAAqC;aAC3C;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,8BAA8B,EAAE;YACrE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,gCAAgC,EAAE;YACxE,EAAE,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,yBAAyB,EAAE;YACrF,EAAE,IAAI,EAAE,oCAAoC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,sBAAsB,EAAE;YACzF,EAAE,IAAI,EAAE,qCAAqC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,uBAAuB,EAAE;YAC3F,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,0BAA0B,EAAE;YACrF,EAAE,IAAI,EAAE,mCAAmC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE;YACtF,EAAE,IAAI,EAAE,oCAAoC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE;YACxF,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,wCAAwC,EAAE;YACtF,EAAE,IAAI,EAAE,oCAAoC,EAAE,GAAG,EAAE,yBAAyB,EAAE;YAC9E,EAAE,IAAI,EAAE,qCAAqC,EAAE,GAAG,EAAE,0BAA0B,EAAE;YAChF,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,qCAAqC,EAAE;YAClF,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,EAAE,+BAA+B,EAAE;YACnF,EAAE,IAAI,EAAE,oCAAoC,EAAE,GAAG,EAAE,gCAAgC,EAAE;YACrF,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,wCAAwC,EAAE;YACtF,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,uCAAuC,EAAE;SACrF;KACF;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,OAAO,GAAG,4BAA4B,CAAC;AAChD,CAAC;AAED,MAAM,aAAa,GAAG,2DAA2D,CAAC;AAElF,MAAM,WAAW,GAA8C;IAC7D,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,CAAC,cAAc,CAAC,EAAE;IAC/D,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,eAAe,CAAC,oBAAoB,CAAC,EAAE;IAC5E,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,CAAC,cAAc,CAAC,EAAE;IAC/D;QACE,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,eAAe,CAAC,sBAAsB,CAAC;KAC9C;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,CAAC,iBAAiB,CAAC,EAAE;IACrE;QACE,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,eAAe,CAAC,qBAAqB,CAAC;KAC7C;IACD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE;IAC9C,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE;IAC5D,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,aAAa,EAAE;IACvD;QACE,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,yDAAyD;KAChE;IACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,oDAAoD,EAAE;IACtF,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,yCAAyC,EAAE;IACtE,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,qCAAqC,EAAE;IAC/E,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,qCAAqC,EAAE;CAClF,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAChC,GAAG,GAAyC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;IAE5F,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAC5C,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAC7C,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAG,GAAc,OAAO;IACpE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,KAAe;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;SACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,0CAA0C,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAClE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAG,GAAc,OAAO;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;gBAChC,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,aAAa;YACjB,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/D,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,SAAS,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAChD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAG,GAAc,OAAO;IACnD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,OAAO;QACL,gBAAgB;QAChB,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7D,oDAAoD;KACrD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,IAAI,GAAyC,OAAO;IAEpD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC","sourcesContent":["import type { EnvGroup } from \"./types.js\";\n\nexport function readEnv(name: string): string | undefined {\n  const raw = process.env[name]?.trim();\n  if (raw) return raw;\n\n  const prefixed = process.env[`MIKAN_${name}`]?.trim();\n  return prefixed || undefined;\n}\n\nexport function readStandardEnv(name: string): string | undefined {\n  return process.env[name]?.trim() || undefined;\n}\n\nexport const ENV_MANIFEST: readonly EnvGroup[] = [\n  {\n    key: \"slack\",\n    title: \"Slack\",\n    kind: \"platform\",\n    vars: [\n      {\n        name: \"SLACK_APP_TOKEN\",\n        required: true,\n        secret: true,\n        doc: \"Socket-mode app token (xapp-…)\",\n      },\n      { name: \"SLACK_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token (xoxb-…)\" },\n    ],\n  },\n  {\n    key: \"telegram\",\n    title: \"Telegram\",\n    kind: \"platform\",\n    vars: [{ name: \"TELEGRAM_BOT_TOKEN\", required: true, secret: true, doc: \"BotFather token\" }],\n  },\n  {\n    key: \"discord\",\n    title: \"Discord\",\n    kind: \"platform\",\n    vars: [{ name: \"DISCORD_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token\" }],\n  },\n  {\n    key: \"github\",\n    title: \"GitHub\",\n    kind: \"platform\",\n    doc: \"Issue/PR conversations as a bound GitHub account, driven by webhooks (needs LINK_PORT and github.repos in settings.json)\",\n    vars: [\n      {\n        name: \"GITHUB_AGENT_TOKEN\",\n        required: true,\n        secret: true,\n        doc: \"Fine-grained PAT of the agent account; mikan acts on GitHub only as it\",\n      },\n      {\n        name: \"GITHUB_WEBHOOK_SECRET\",\n        required: true,\n        secret: true,\n        doc: \"Secret of the webhook that delivers to <LINK_URL>/github/webhook\",\n      },\n    ],\n  },\n  {\n    key: \"llm\",\n    title: \"LLM providers\",\n    kind: \"feature\",\n    vars: [\n      { name: \"ANTHROPIC_API_KEY\", secret: true, doc: \"Anthropic API key\" },\n      { name: \"OPENAI_API_KEY\", secret: true, doc: \"OpenAI API key\" },\n      {\n        name: \"OPENROUTER_API_KEY\",\n        secret: true,\n        doc: \"OpenRouter API key (chat models routed through OpenRouter, and Jev's first choice in harness/jev.ts)\",\n      },\n    ],\n  },\n  {\n    key: \"link\",\n    title: \"Link/OAuth server\",\n    kind: \"feature\",\n    doc: \"Credential onboarding links, session view, and the Admin portal\",\n    vars: [\n      { name: \"LINK_URL\", doc: \"Externally visible base URL, e.g. https://mikan.example.com\" },\n      { name: \"LINK_PORT\", doc: \"Listen port (default 8181 when LINK_URL is set)\" },\n      {\n        name: \"LINK_HOST\",\n        doc: \"Listen address (default 127.0.0.1, for a reverse proxy on the same host)\",\n      },\n      { name: \"GITHUB_OAUTH_CLIENT_ID\", doc: \"GitHub OAuth app for /login linking\" },\n      { name: \"GITHUB_OAUTH_CLIENT_SECRET\", secret: true, doc: \"GitHub OAuth app secret\" },\n      { name: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\", doc: \"Google Workspace OAuth client for /login\" },\n      {\n        name: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Workspace OAuth secret\",\n      },\n      { name: \"GOOGLE_CLOUD_SDK_CLIENT_ID\", doc: \"Google Cloud SDK OAuth client for /login\" },\n      {\n        name: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Cloud SDK OAuth secret\",\n      },\n      {\n        name: \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n        doc: \"Scopes /login requests for Google Workspace (space-separated)\",\n      },\n      {\n        name: \"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\",\n        doc: \"Scopes /login requests for Google Cloud SDK (space-separated)\",\n      },\n      {\n        name: \"GITHUB_OAUTH_SCOPES\",\n        doc: \"Scopes /login requests from GitHub (default repo read:user user:email read:org gist)\",\n      },\n      {\n        name: \"OAUTH_SERVICES_JSON\",\n        secret: true,\n        doc: \"JSON array of extra OAuth services offered by /login\",\n      },\n    ],\n  },\n  {\n    key: \"openconnector\",\n    title: \"OpenConnector\",\n    kind: \"feature\",\n    doc: \"Default open-connector MCP server and the admin token that mints per-conversation runtime tokens\",\n    vars: [\n      {\n        name: \"OPENCONNECTOR_ENDPOINT\",\n        doc: \"Default MCP endpoint used when a conversation does not declare open-connector\",\n      },\n      {\n        name: \"OPENCONNECTOR_ADMIN_TOKEN\",\n        secret: true,\n        doc: \"Host-only admin token used to mint one runtime token per conversation for the default server\",\n      },\n    ],\n  },\n  {\n    key: \"sandbox\",\n    title: \"Sandbox\",\n    kind: \"feature\",\n    vars: [\n      {\n        name: \"CONTAINER_ENGINE\",\n        doc: \"Override the container engine for container:* and oci:* sandboxes; by default mikan uses the first of nerdctl, podman, docker that answers `info`\",\n      },\n    ],\n  },\n  {\n    key: \"observability\",\n    title: \"Observability\",\n    kind: \"feature\",\n    vars: [\n      { name: \"SENTRY_DSN\", secret: true, doc: \"Sentry DSN; Sentry is off while it is unset\" },\n      {\n        name: \"SENTRY_ENVIRONMENT\",\n        deploy: false,\n        doc: \"Sentry environment tag (default production)\",\n      },\n      {\n        name: \"SENTRY_TRACES_SAMPLE_RATE\",\n        deploy: false,\n        doc: \"Sentry trace sample rate, 0 to 1 (default 1; ignored with OTLP traces)\",\n      },\n    ],\n  },\n  {\n    key: \"otel\",\n    title: \"OpenTelemetry\",\n    kind: \"feature\",\n    folded: true,\n    doc: \"Standard OTEL_* exporter variables; mikan sends OTLP over HTTP/protobuf\",\n    vars: [\n      { name: \"OTEL_SDK_DISABLED\", doc: \"Set to true to disable OpenTelemetry\" },\n      { name: \"OTEL_SERVICE_NAME\", doc: \"OTLP service name (default mikan)\" },\n      {\n        name: \"OTEL_RESOURCE_ATTRIBUTES\",\n        secret: true,\n        doc: \"Comma-separated safe resource attrs\",\n      },\n      { name: \"OTEL_TRACES_EXPORTER\", doc: \"Trace exporter: otlp or none\" },\n      { name: \"OTEL_METRICS_EXPORTER\", doc: \"Metrics exporter: otlp or none\" },\n      { name: \"OTEL_EXPORTER_OTLP_ENDPOINT\", secret: true, doc: \"Base OTLP HTTP endpoint\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_ENDPOINT\", secret: true, doc: \"OTLP traces endpoint\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_ENDPOINT\", secret: true, doc: \"OTLP metrics endpoint\" },\n      { name: \"OTEL_EXPORTER_OTLP_HEADERS\", secret: true, doc: \"Shared OTLP auth headers\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_HEADERS\", secret: true, doc: \"OTLP trace headers\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_HEADERS\", secret: true, doc: \"OTLP metric headers\" },\n      { name: \"OTEL_EXPORTER_OTLP_PROTOCOL\", doc: \"OTLP protocol; http/protobuf supported\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_PROTOCOL\", doc: \"Trace protocol override\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_PROTOCOL\", doc: \"Metric protocol override\" },\n      { name: \"OTEL_EXPORTER_OTLP_TIMEOUT\", doc: \"Shared OTLP timeout in milliseconds\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_TIMEOUT\", doc: \"Trace timeout in milliseconds\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_TIMEOUT\", doc: \"Metric timeout in milliseconds\" },\n      { name: \"OTEL_METRIC_EXPORT_INTERVAL\", doc: \"Metric export interval in milliseconds\" },\n      { name: \"OTEL_METRIC_EXPORT_TIMEOUT\", doc: \"Metric export timeout in milliseconds\" },\n    ],\n  },\n];\n\nfunction movedToSettings(key: string): string {\n  return `set ${key} in ~/.mikan/settings.json`;\n}\n\nconst NO_GITHUB_APP = \"removed; GitHub runs as the account of GITHUB_AGENT_TOKEN\";\n\nconst RETIRED_ENV: readonly { name: string; note: string }[] = [\n  { name: \"GITHUB_REPOS\", note: movedToSettings(\"github.repos\") },\n  { name: \"GITHUB_PUBLIC_REPOS\", note: movedToSettings(\"github.publicRepos\") },\n  { name: \"GITHUB_USERS\", note: movedToSettings(\"github.users\") },\n  {\n    name: \"GITHUB_MIN_PERMISSION\",\n    note: movedToSettings(\"github.minPermission\"),\n  },\n  { name: \"GITHUB_TRIGGERS\", note: movedToSettings(\"github.triggers\") },\n  {\n    name: \"GITHUB_CAPABILITIES\",\n    note: movedToSettings(\"github.capabilities\"),\n  },\n  { name: \"GITHUB_APP_ID\", note: NO_GITHUB_APP },\n  { name: \"GITHUB_APP_PRIVATE_KEY_PATH\", note: NO_GITHUB_APP },\n  { name: \"GITHUB_INSTALLATION_ID\", note: NO_GITHUB_APP },\n  {\n    name: \"HTTP_IDLE_TIMEOUT\",\n    note: \"removed; outbound HTTP streams time out after 5 minutes\",\n  },\n  { name: \"SENTRY_ENABLED\", note: \"removed; leave SENTRY_DSN unset to turn Sentry off\" },\n  { name: \"STATE_DIR\", note: \"removed; state always lives in ~/.mikan\" },\n  { name: \"CLOUDFLARE_SANDBOX_URL\", note: \"removed with the cloudflare sandbox\" },\n  { name: \"CLOUDFLARE_SANDBOX_TOKEN\", note: \"removed with the cloudflare sandbox\" },\n];\n\nexport function retiredEnvWarnings(\n  env: (name: string) => string | undefined = (name) => process.env[name]?.trim() || undefined,\n): string[] {\n  return RETIRED_ENV.flatMap(({ name, note }) =>\n    [name, `MIKAN_${name}`]\n      .filter((spelling) => env(spelling))\n      .map((spelling) => `${spelling}: ${note}`),\n  );\n}\n\ntype EnvLookup = (name: string) => string | undefined;\n\nexport function platformIsActive(key: string, env: EnvLookup = readEnv): boolean {\n  const group = ENV_MANIFEST.find((candidate) => candidate.key === key);\n  if (!group) throw new Error(`Unknown env-manifest group: ${key}`);\n  return group.vars.filter((spec) => spec.required).every((spec) => env(spec.name));\n}\n\nfunction platformRecipe(group: EnvGroup): string {\n  const required = group.vars.filter((spec) => spec.required).map((spec) => spec.name);\n  return `${group.title}: ${required.join(\" + \")}`;\n}\n\nexport function noPlatformsMessage(): string {\n  const recipes = ENV_MANIFEST.filter((group) => group.kind === \"platform\")\n    .map((group) => `  ${platformRecipe(group)}`)\n    .join(\"\\n\");\n  return `No platform tokens found. Set one of:\\n${recipes}`;\n}\n\nexport function envSummaryLines(): string[] {\n  return ENV_MANIFEST.filter((group) => group.kind === \"platform\").map(\n    (group) => `  ${platformRecipe(group)}`,\n  );\n}\n\nexport function envReport(env: EnvLookup = readEnv): string {\n  const lines: string[] = [];\n  for (const group of ENV_MANIFEST) {\n    const active =\n      group.kind === \"platform\"\n        ? platformIsActive(group.key, env)\n          ? \" — active\"\n          : \" — inactive\"\n        : \"\";\n    if (group.folded) {\n      const set = group.vars.filter((spec) => env(spec.name)).length;\n      const pattern = `${group.vars[0]!.name.split(\"_\")[0]}_*`;\n      lines.push(group.title);\n      lines.push(`  ${pattern.padEnd(36)} ${set} of ${group.vars.length} set  ${group.doc ?? \"\"}`);\n      lines.push(\"\");\n      continue;\n    }\n    lines.push(`${group.title}${active}${group.doc ? ` · ${group.doc}` : \"\"}`);\n    for (const spec of group.vars) {\n      const status = env(spec.name) ? \"set\" : \"unset\";\n      const marks = [spec.required ? \"required\" : \"\", spec.secret ? \"secret\" : \"\"]\n        .filter(Boolean)\n        .join(\", \");\n      lines.push(\n        `  ${spec.name.padEnd(36)} ${status.padEnd(6)}${marks ? ` [${marks}]` : \"\"}  ${spec.doc}`,\n      );\n    }\n    lines.push(\"\");\n  }\n  lines.push(\"Each var also accepts a MIKAN_-prefixed alias (e.g. MIKAN_LINK_URL).\");\n  return lines.join(\"\\n\");\n}\n\nexport function envSetReport(env: EnvLookup = readEnv): string {\n  const set = ENV_MANIFEST.flatMap((group) => group.vars).filter((spec) => env(spec.name));\n  return [\n    \"Variables set:\",\n    ...set.map((spec) => `  ${spec.name.padEnd(36)} ${spec.doc}`),\n    \"Run `mikan env` to see every variable mikan reads.\",\n  ].join(\"\\n\");\n}\n\nexport function resolveLinkListenHost(\n  read: (name: string) => string | undefined = readEnv,\n): string {\n  return read(\"LINK_HOST\") ?? \"127.0.0.1\";\n}\n\nexport function resolveLinkBaseUrl(): string | undefined {\n  const raw = readEnv(\"LINK_URL\");\n  if (!raw) return undefined;\n  return raw.replace(/\\/+$/, \"\");\n}\n"]}

package/dist/harness/execution-resolver.d.ts

@@ -8,9 +8,10 @@ export declare class ActorExecutionResolver {
     private vaultManager;
     private provisioner;
     private workspace;
-    constructor(baseConfig: SandboxConfig, vaultManager: Pick<VaultManager, "hasEntry" | "resolve" | "copySharedVaultTo">, provisioner: Pick<DockerContainerManager, "provision"> | undefined, workspace: Workspace);
+    constructor(baseConfig: SandboxConfig, vaultManager: Pick<VaultManager, "hasEntry" | "resolve" | "copySharedVaultTo">, provisioner: Pick<DockerContainerManager, "provision" | "markUsed"> | undefined, workspace: Workspace);
     resolve(context: ActorContext): Promise<{
-        executor: import("../sandbox/types.js").Executor;
+        env: import("@earendil-works/pi-durable/env").ExecutionEnv;
+        sandboxConfig: SandboxConfig;
         pathContext: import("../sandbox/types.js").RuntimePathContext;
         projection: WorkspaceProjection;
     }>;

package/dist/harness/execution-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../../src/harness/execution-resolver.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAkB,YAAY,EAAiB,MAAM,aAAa,CAAC;AAE/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEzE,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,SAAS;IAJnB,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,SAAS,GAAG,mBAAmB,CAAC,EAC9E,WAAW,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,GAAG,SAAS,EAClE,SAAS,EAAE,SAAS,EAC1B;IAEE,OAAO,CAAC,OAAO,EAAE,YAAY;;;;OAYlC;IAED,OAAO,CAAC,WAAW;IAmCnB,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,wBAAwB;IA0ChC,OAAO,CAAC,aAAa;CA4BtB"}
+{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../../src/harness/execution-resolver.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAkB,YAAY,EAAiB,MAAM,aAAa,CAAC;AAM/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEzE,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,SAAS;IAJnB,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,SAAS,GAAG,mBAAmB,CAAC,EAC9E,WAAW,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,SAAS,EAC/E,SAAS,EAAE,SAAS,EAC1B;IAEE,OAAO,CAAC,OAAO,EAAE,YAAY;;;;;OAUlC;IAED,OAAO,CAAC,WAAW;IAmCnB,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,wBAAwB;IA0ChC,OAAO,CAAC,aAAa;CA4BtB"}

package/dist/harness/execution-resolver.js

@@ -1,7 +1,7 @@
 import { posix } from "node:path";
 import { loadGlobalSettings } from "../settings/index.js";
 import { DockerContainerManager } from "../sandbox/provisioner.js";
-import { createExecutor, getSandboxCredentialCapabilities } from "../sandbox/registry.js";
+import { createSandboxEnv, getSandboxCredentialCapabilities, getSandboxPathContext, } from "../sandbox/registry.js";
 import { reportUserFacingError } from "../observability/index.js";
 import { normalizeSharedVaultName } from "../vault/index.js";
 import { allowsAmbientDefaultSharedVault, resolveVaultInjection } from "../vault/index.js";
@@ -16,12 +16,14 @@ export class ActorExecutionResolver {
     }
     async resolve(context) {
         const { plan, projection } = this.resolvePlan(context);
-        const executor = createExecutor(plan.sandboxConfig, plan.env, this.buildEnsureReadyCallback(plan, context.address.conversationId));
-        return {
-            executor,
-            pathContext: executor.getPathContext(this.workspace.root),
-            projection,
-        };
+        const pathContext = getSandboxPathContext(plan.sandboxConfig, this.workspace.root);
+        const env = createSandboxEnv(plan.sandboxConfig, {
+            cwd: pathContext.runtimeWorkspaceRoot,
+            env: plan.env,
+            ensureReady: this.buildEnsureReadyCallback(plan, context.address.conversationId),
+            markUsed: () => this.provisioner?.markUsed(plan.resourceKey),
+        });
+        return { env, sandboxConfig: plan.sandboxConfig, pathContext, projection };
     }
     resolvePlan(context) {
         const scope = { userId: context.userId, address: context.address };
@@ -70,7 +72,7 @@ export class ActorExecutionResolver {
         this.vaultManager.copySharedVaultTo(profile, credentialKey);
     }
     resolveSandboxConfig(resourceKey) {
-        if (this.baseConfig.type !== "image")
+        if (this.baseConfig.type !== "oci")
             return this.baseConfig;
         return {
             type: "container",
@@ -78,7 +80,7 @@ export class ActorExecutionResolver {
         };
     }
     buildEnsureReadyCallback(plan, conversationId) {
-        if (this.baseConfig.type !== "image" || plan.sandboxConfig.type !== "container") {
+        if (this.baseConfig.type !== "oci" || plan.sandboxConfig.type !== "container") {
             return undefined;
         }
         return async () => {
@@ -98,7 +100,7 @@ export class ActorExecutionResolver {
                     operation: "ensure_image_container_ready",
                     severity: "error",
                     context: {
-                        sandboxType: "image",
+                        sandboxType: "oci",
                         conversationId,
                         credentialKey: plan.credentialKey,
                         resourceKey: plan.resourceKey,

package/dist/harness/execution-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../../src/harness/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAE1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGrE,MAAM,OAAO,sBAAsB;IACjC,YACU,UAAyB,EACzB,YAA8E,EAC9E,WAAkE,EAClE,SAAoB;0BAHpB,UAAU;4BACV,YAAY;2BACZ,WAAW;yBACX,SAAS;IAChB,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,cAAc,CAC7B,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CACpE,CAAC;QACF,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACzD,UAAU;SACX,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,OAAqB;QAIvC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE;YACtD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC;YACtC,KAAK;YACL,YAAY;YACZ,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,OAAO;YACL,IAAI,EAAE;gBACJ,aAAa;gBACb,WAAW;gBACX,aAAa,EAAE,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;gBACrD,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,MAAM;aACP;YACD,UAAU;SACX,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,aAAqB,EACrB,UAAsC;QAEtC,IAAI,CAAC,+BAA+B,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QAChG,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO;QAEtD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QACtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;IAEO,oBAAoB,CAAC,WAAmB;QAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,WAAW,CAAC;SAC7D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,IAAmB,EACnB,cAAsB;QAEtB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE;oBAC3D,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,cAAc;wBACd,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;qBACtD;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,uBAAuB,IAAI,CAAC,WAAW,gBAAgB,QAAQ,GAAG,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CACnB,WAA6B,EAC7B,UAA+B;QAE/B,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;QAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YACvC,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CACjE,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CACzD,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,0CAA0C,kBAAkB,CAAC,MAAM,GAAG,CAC/G,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,WAAW;iBAC/B,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,4BAA4B,cAAc,CAAC,MAAM,GAAG,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,eAAe,EAAE,GAAG,WAAW,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/C,CAAC","sourcesContent":["import { posix } from \"node:path\";\n\nimport { loadGlobalSettings } from \"../settings/index.js\";\nimport { DockerContainerManager } from \"../sandbox/provisioner.js\";\nimport type { ContainerMount, ActorContext, ExecutionPlan } from \"../types.js\";\nimport { createExecutor, getSandboxCredentialCapabilities } from \"../sandbox/registry.js\";\nimport type { SandboxConfig } from \"../sandbox/types.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\nimport { normalizeSharedVaultName } from \"../vault/index.js\";\nimport type { VaultManager } from \"../vault/types.js\";\nimport { allowsAmbientDefaultSharedVault, resolveVaultInjection } from \"../vault/index.js\";\nimport { credentialAuthorizationKey, runtimeResourceKey } from \"../sandbox/identity.js\";\nimport { resolveWorkspaceProjection } from \"../office/projection.js\";\nimport type { WorkspaceProjection, Workspace } from \"../office/types.js\";\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: Pick<VaultManager, \"hasEntry\" | \"resolve\" | \"copySharedVaultTo\">,\n    private provisioner: Pick<DockerContainerManager, \"provision\"> | undefined,\n    private workspace: Workspace,\n  ) {}\n\n  async resolve(context: ActorContext) {\n    const { plan, projection } = this.resolvePlan(context);\n    const executor = createExecutor(\n      plan.sandboxConfig,\n      plan.env,\n      this.buildEnsureReadyCallback(plan, context.address.conversationId),\n    );\n    return {\n      executor,\n      pathContext: executor.getPathContext(this.workspace.root),\n      projection,\n    };\n  }\n\n  private resolvePlan(context: ActorContext): {\n    plan: ExecutionPlan;\n    projection: WorkspaceProjection;\n  } {\n    const scope = { userId: context.userId, address: context.address };\n    const credentialKey = credentialAuthorizationKey(this.baseConfig, scope);\n    const resourceKey = runtimeResourceKey(this.baseConfig, {\n      userId: context.userId,\n      address: context.address,\n    });\n    this.ensureDefaultSharedVault(credentialKey, context.trustModel);\n\n    const vault = this.vaultManager.resolve(credentialKey);\n    const capabilities = getSandboxCredentialCapabilities(this.baseConfig.type);\n    const office = this.workspace.office(context.address);\n    const projection = resolveWorkspaceProjection(office);\n    const injection = resolveVaultInjection({\n      vault,\n      capabilities,\n      sandboxType: this.baseConfig.type,\n      address: office.address,\n    });\n    const mounts = this.resolveMounts(injection.mounts, projection);\n    return {\n      plan: {\n        credentialKey,\n        resourceKey,\n        sandboxConfig: this.resolveSandboxConfig(resourceKey),\n        env: injection.env,\n        mounts,\n      },\n      projection,\n    };\n  }\n\n  private ensureDefaultSharedVault(\n    credentialKey: string,\n    trustModel: ActorContext[\"trustModel\"],\n  ): void {\n    if (!allowsAmbientDefaultSharedVault({ trustModel, sandboxType: this.baseConfig.type })) return;\n    if (this.vaultManager.hasEntry(credentialKey)) return;\n\n    let profile: string | undefined;\n    try {\n      profile = loadGlobalSettings(this.workspace.stateDir).sandbox?.defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n    this.vaultManager.copySharedVaultTo(profile, credentialKey);\n  }\n\n  private resolveSandboxConfig(resourceKey: string): SandboxConfig {\n    if (this.baseConfig.type !== \"image\") return this.baseConfig;\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(resourceKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    plan: ExecutionPlan,\n    conversationId: string,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || plan.sandboxConfig.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = plan.sandboxConfig.type === \"container\" ? plan.sandboxConfig.container : \"\";\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(plan.resourceKey, {\n          containerName: expected,\n          mounts: plan.mounts,\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"image\",\n            conversationId,\n            credentialKey: plan.credentialKey,\n            resourceKey: plan.resourceKey,\n            expectedContainer: expected,\n            hasVault: Boolean(plan.env || plan.mounts.length > 0),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for resource key \"${plan.resourceKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(\n    vaultMounts: ContainerMount[],\n    projection: WorkspaceProjection,\n  ): ContainerMount[] {\n    const protectedMounts = projection.mounts;\n    for (let index = 0; index < vaultMounts.length; index += 1) {\n      const vaultMount = vaultMounts[index];\n      if (vaultMount === undefined) continue;\n      const workspaceCollision = protectedMounts.find((protectedMount) =>\n        targetsOverlap(protectedMount.target, vaultMount.target),\n      );\n      if (workspaceCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps protected workspace target \"${workspaceCollision.target}\"`,\n        );\n      }\n\n      const vaultCollision = vaultMounts\n        .slice(0, index)\n        .find((other) => targetsOverlap(other.target, vaultMount.target));\n      if (vaultCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps vault target \"${vaultCollision.target}\"`,\n        );\n      }\n    }\n    return [...protectedMounts, ...vaultMounts];\n  }\n}\n\nfunction targetsOverlap(left: string, right: string): boolean {\n  const a = normalizeMountTarget(left);\n  const b = normalizeMountTarget(right);\n  return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);\n}\n\nfunction normalizeMountTarget(value: string): string {\n  const normalized = posix.normalize(value);\n  return normalized.replace(/\\/+$/, \"\") || \"/\";\n}\n"]}
+{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../../src/harness/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGrE,MAAM,OAAO,sBAAsB;IACjC,YACU,UAAyB,EACzB,YAA8E,EAC9E,WAA+E,EAC/E,SAAoB;0BAHpB,UAAU;4BACV,YAAY;2BACZ,WAAW;yBACX,SAAS;IAChB,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE;YAC/C,GAAG,EAAE,WAAW,CAAC,oBAAoB;YACrC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;YAChF,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IAC7E,CAAC;IAEO,WAAW,CAAC,OAAqB;QAIvC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE;YACtD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC;YACtC,KAAK;YACL,YAAY;YACZ,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,OAAO;YACL,IAAI,EAAE;gBACJ,aAAa;gBACb,WAAW;gBACX,aAAa,EAAE,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;gBACrD,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,MAAM;aACP;YACD,UAAU;SACX,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,aAAqB,EACrB,UAAsC;QAEtC,IAAI,CAAC,+BAA+B,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QAChG,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO;QAEtD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QACtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;IAEO,oBAAoB,CAAC,WAAmB;QAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,WAAW,CAAC;SAC7D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,IAAmB,EACnB,cAAsB;QAEtB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE;oBAC3D,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,KAAK;wBAClB,cAAc;wBACd,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;qBACtD;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,uBAAuB,IAAI,CAAC,WAAW,gBAAgB,QAAQ,GAAG,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CACnB,WAA6B,EAC7B,UAA+B;QAE/B,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;QAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YACvC,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CACjE,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CACzD,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,0CAA0C,kBAAkB,CAAC,MAAM,GAAG,CAC/G,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,WAAW;iBAC/B,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,4BAA4B,cAAc,CAAC,MAAM,GAAG,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,eAAe,EAAE,GAAG,WAAW,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/C,CAAC","sourcesContent":["import { posix } from \"node:path\";\n\nimport { loadGlobalSettings } from \"../settings/index.js\";\nimport { DockerContainerManager } from \"../sandbox/provisioner.js\";\nimport type { ContainerMount, ActorContext, ExecutionPlan } from \"../types.js\";\nimport {\n  createSandboxEnv,\n  getSandboxCredentialCapabilities,\n  getSandboxPathContext,\n} from \"../sandbox/registry.js\";\nimport type { SandboxConfig } from \"../sandbox/types.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\nimport { normalizeSharedVaultName } from \"../vault/index.js\";\nimport type { VaultManager } from \"../vault/types.js\";\nimport { allowsAmbientDefaultSharedVault, resolveVaultInjection } from \"../vault/index.js\";\nimport { credentialAuthorizationKey, runtimeResourceKey } from \"../sandbox/identity.js\";\nimport { resolveWorkspaceProjection } from \"../office/projection.js\";\nimport type { WorkspaceProjection, Workspace } from \"../office/types.js\";\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: Pick<VaultManager, \"hasEntry\" | \"resolve\" | \"copySharedVaultTo\">,\n    private provisioner: Pick<DockerContainerManager, \"provision\" | \"markUsed\"> | undefined,\n    private workspace: Workspace,\n  ) {}\n\n  async resolve(context: ActorContext) {\n    const { plan, projection } = this.resolvePlan(context);\n    const pathContext = getSandboxPathContext(plan.sandboxConfig, this.workspace.root);\n    const env = createSandboxEnv(plan.sandboxConfig, {\n      cwd: pathContext.runtimeWorkspaceRoot,\n      env: plan.env,\n      ensureReady: this.buildEnsureReadyCallback(plan, context.address.conversationId),\n      markUsed: () => this.provisioner?.markUsed(plan.resourceKey),\n    });\n    return { env, sandboxConfig: plan.sandboxConfig, pathContext, projection };\n  }\n\n  private resolvePlan(context: ActorContext): {\n    plan: ExecutionPlan;\n    projection: WorkspaceProjection;\n  } {\n    const scope = { userId: context.userId, address: context.address };\n    const credentialKey = credentialAuthorizationKey(this.baseConfig, scope);\n    const resourceKey = runtimeResourceKey(this.baseConfig, {\n      userId: context.userId,\n      address: context.address,\n    });\n    this.ensureDefaultSharedVault(credentialKey, context.trustModel);\n\n    const vault = this.vaultManager.resolve(credentialKey);\n    const capabilities = getSandboxCredentialCapabilities(this.baseConfig.type);\n    const office = this.workspace.office(context.address);\n    const projection = resolveWorkspaceProjection(office);\n    const injection = resolveVaultInjection({\n      vault,\n      capabilities,\n      sandboxType: this.baseConfig.type,\n      address: office.address,\n    });\n    const mounts = this.resolveMounts(injection.mounts, projection);\n    return {\n      plan: {\n        credentialKey,\n        resourceKey,\n        sandboxConfig: this.resolveSandboxConfig(resourceKey),\n        env: injection.env,\n        mounts,\n      },\n      projection,\n    };\n  }\n\n  private ensureDefaultSharedVault(\n    credentialKey: string,\n    trustModel: ActorContext[\"trustModel\"],\n  ): void {\n    if (!allowsAmbientDefaultSharedVault({ trustModel, sandboxType: this.baseConfig.type })) return;\n    if (this.vaultManager.hasEntry(credentialKey)) return;\n\n    let profile: string | undefined;\n    try {\n      profile = loadGlobalSettings(this.workspace.stateDir).sandbox?.defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n    this.vaultManager.copySharedVaultTo(profile, credentialKey);\n  }\n\n  private resolveSandboxConfig(resourceKey: string): SandboxConfig {\n    if (this.baseConfig.type !== \"oci\") return this.baseConfig;\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(resourceKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    plan: ExecutionPlan,\n    conversationId: string,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"oci\" || plan.sandboxConfig.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = plan.sandboxConfig.type === \"container\" ? plan.sandboxConfig.container : \"\";\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(plan.resourceKey, {\n          containerName: expected,\n          mounts: plan.mounts,\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"oci\",\n            conversationId,\n            credentialKey: plan.credentialKey,\n            resourceKey: plan.resourceKey,\n            expectedContainer: expected,\n            hasVault: Boolean(plan.env || plan.mounts.length > 0),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for resource key \"${plan.resourceKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(\n    vaultMounts: ContainerMount[],\n    projection: WorkspaceProjection,\n  ): ContainerMount[] {\n    const protectedMounts = projection.mounts;\n    for (let index = 0; index < vaultMounts.length; index += 1) {\n      const vaultMount = vaultMounts[index];\n      if (vaultMount === undefined) continue;\n      const workspaceCollision = protectedMounts.find((protectedMount) =>\n        targetsOverlap(protectedMount.target, vaultMount.target),\n      );\n      if (workspaceCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps protected workspace target \"${workspaceCollision.target}\"`,\n        );\n      }\n\n      const vaultCollision = vaultMounts\n        .slice(0, index)\n        .find((other) => targetsOverlap(other.target, vaultMount.target));\n      if (vaultCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps vault target \"${vaultCollision.target}\"`,\n        );\n      }\n    }\n    return [...protectedMounts, ...vaultMounts];\n  }\n}\n\nfunction targetsOverlap(left: string, right: string): boolean {\n  const a = normalizeMountTarget(left);\n  const b = normalizeMountTarget(right);\n  return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);\n}\n\nfunction normalizeMountTarget(value: string): string {\n  const normalized = posix.normalize(value);\n  return normalized.replace(/\\/+$/, \"\") || \"/\";\n}\n"]}

package/dist/harness/prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/harness/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAiB,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAiD3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CA0BjE;AAkBD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,kBAAkB,EAChC,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACxD,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,YAAY,EAAE,CAAC;CAClC,CAAC,CAmBD;AAiBD,wBAAgB,SAAS,CAAC,UAAU,EAAE,mBAAmB,GAAG,MAAM,CAQjE;AAwBD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,GAAG,MAAM,GAAG,UAAU,CAAC,GAC7D,MAAM,GAAG,SAAS,CAKpB;AA+LD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAGzE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQ3E;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAWR"}
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/harness/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAiB,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAiD3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CA0BjE;AAkBD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,kBAAkB,EAChC,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACxD,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,YAAY,EAAE,CAAC;CAClC,CAAC,CAmBD;AAiBD,wBAAgB,SAAS,CAAC,UAAU,EAAE,mBAAmB,GAAG,MAAM,CAQjE;AAwBD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,GAAG,MAAM,GAAG,UAAU,CAAC,GAC7D,MAAM,GAAG,SAAS,CAKpB;AAgMD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAGzE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQ3E;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAWR"}

package/dist/harness/prompt.js

@@ -118,7 +118,7 @@ export function getMemory(projection) {
 }
 function buildEnvDescription(sandboxType, workspaceRoot) {
     switch (sandboxType) {
-        case "image":
+        case "oci":
             return `You are running inside a managed per-conversation container.
 - Runtime workspace root: ${workspaceRoot}
 - Bash commands start in: ${workspaceRoot}
@@ -243,7 +243,7 @@ ${skills.length > 0 ? formatSkillsForPrompt(skills) : "(no skills installed yet)
 function buildOperatingPrompt(input, paths) {
     const { memory, projection, sandboxConfig } = input;
     const { workspaceRoot, conversationPath } = paths;
-    const isContainerLike = sandboxConfig.type === "container" || sandboxConfig.type === "image";
+    const isContainerLike = sandboxConfig.type === "container" || sandboxConfig.type === "oci";
     const globalMemoryReadOnly = projection.promptSources.globalKnowledgeReadOnly === true;
     const memoryGuidance = globalMemoryReadOnly
         ? `\`${workspaceRoot}/MEMORY.md\` is shared workspace memory mounted read-only for this private office: you can read what public channels have learned, but writes to it are rejected. Write everything you learn here to \`${conversationPath}/MEMORY.md\` instead; it never leaves this conversation.`
@@ -306,6 +306,7 @@ grep '"userName":"mario"' log.jsonl | tail -20 | jq -c '{date: .date[0:19], text
 - sandbox: Inspect or temporarily adjust sandbox limits
 - attach: Share files to the platform
 - jev: Ask Jev (a fast calibrated decision model) boolean / choice / score questions about a state you supply; returns probabilities and confidence, never text. Use it whenever you need to classify, detect, score, rank, route, pick among known candidates, or verify.
+- web_fetch: Read a public web page or API as text. For versions, releases, prices, and dates, read the official page, registry, or API instead of answering from memory, and cite the URL.
 - react: Add an emoji reaction to the triggering message. mikan already acknowledges work on its own when your first tool starts, so do not react before starting work. Use a short name without colons (e.g. eyes, white_check_mark, +1); GitHub only accepts +1, -1, laugh, confused, heart, hooray, rocket, eyes and rejects anything else.
 
 Each tool requires a "label" parameter (shown to user).

package/dist/harness/prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/harness/prompt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGvF,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,MAAM,gBAAgB,GAA2B;IAC/C,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;CACnB,CAAC;AAEF,KAAK,UAAU,yBAAyB,CACtC,OAA4B,EAC5B,aAAqB,EACrB,WAAgC,EAChC,cAAyD;IAEzD,MAAM,gBAAgB,GAAmB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,GAAG,aAAa,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,WAAW,EAAE,iBAAiB,EAAE,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;QAC9E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7F,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,cAAc,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,OAAO;oBACb,QAAQ;oBACR,IAAI,EAAE,MAAM,cAAc,CAAC,WAAW,CAAC;iBACxC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAErC,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO;aACpB,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC9E,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,CAAC,CAAC;aACD,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,OAAO;iBACb,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;iBAC/B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;iBAC5B,QAAQ,EAAE;YACb,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,qBAAqB,CAAC;SAC7D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAuB;IACnD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC,KAAK,CAAC;AAChG,CAAC;AAED,SAAS,iBAAiB,CAAC,oBAA4B,EAAE,MAAc;IACrE,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACtE,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO;QACL,aAAa;QACb,gBAAgB;QAChB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA4B,EAC5B,aAAqB,EACrB,WAAgC,EAChC,cAAyD;IAKzD,IAAI,WAAW,GAAG,iBAAiB,CAAC;QAClC,IAAI,EAAE,IAAI,IAAI,EAAE;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,MAAM,yBAAyB,CACzE,OAAO,EACP,aAAa,EACb,WAAW,EACX,cAAc,CACf,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,WAAW,IAAI,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC9F,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CACpB,IAAwB,EACxB,OAAe,EACf,KAAa;IAEb,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,4BAA4B,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,UAAU,CAAC,kBAAkB,KAAK,EAAE,EAAE,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA+B;IACvD,MAAM,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,UAAU,CAAC,aAAa,CAAC;IAC9E,MAAM,QAAQ,GAAG;QACf,aAAa,CAAC,gBAAgB,EAAE,yBAAyB,EAAE,kBAAkB,CAAC;QAC9E,aAAa,CAAC,sBAAsB,EAAE,8BAA8B,EAAE,qBAAqB,CAAC;KAC7F,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAC3E,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAkC,EAAE,aAAqB;IACpF,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,OAAO;4BACe,aAAa;4BACb,aAAa;;qBAEpB,aAAa,iHAAiH,CAAC;QAChJ,KAAK,WAAW;YACd,OAAO;4BACe,aAAa;4BACb,aAAa;;uCAEF,CAAC;QACpC;YACE,OAAO;4BACe,aAAa;4BACb,aAAa;uCACF,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAA8D;IAE9D,MAAM,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,YAAY;QAAE,OAAO,WAAW,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAID,SAAS,YAAY,CAAC,IAAc,EAAE,KAAa;IACjD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA+B,EAAE,KAAyB;IACpF,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,YAAY,CAClC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EACrF,sBAAsB,CACvB,CAAC;IACF,MAAM,YAAY,GAAG,YAAY,CAC/B,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,EACtE,mBAAmB,CACpB,CAAC;IACF,MAAM,cAAc,GAAG,mBAAmB,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9E,MAAM,yBAAyB,GAC7B,QAAQ,CAAC,IAAI,KAAK,OAAO;QACvB,CAAC,CAAC;;;;;;;;;;CAUP;QACK,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,oBAAoB,QAAQ,CAAC,IAAI;;;;;;;EAOxC,QAAQ,CAAC,eAAe,GAAG,yBAAyB;;;YAG1C,eAAe;;SAElB,YAAY;;;;;EAKnB,cAAc;0DAC0C,WAAW;gCACrC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC;;0FAEuB,CAAC;AAC3F,CAAC;AAED,SAAS,0BAA0B,CACjC,KAA+B,EAC/B,KAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;IACrE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC/D,MAAM,iBAAiB,GAAG,UAAU,CAAC,aAAa,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACpF,MAAM,eAAe,GAAG,iBAAiB;QACvC,CAAC,CAAC,GAAG,aAAa,qJAAqJ;QACvK,CAAC,CAAC,GAAG,aAAa,0IAA0I,CAAC;IAC/J,MAAM,oBAAoB,GAAG,iBAAiB;QAC5C,CAAC,CAAC,qBAAqB,gBAAgB,+BAA+B,aAAa,kDAAkD;QACrI,CAAC,CAAC,4BAA4B,aAAa,0DAA0D,gBAAgB,oBAAoB,CAAC;IAE5I,OAAO;EACP,eAAe;EACf,aAAa;kDACmC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,6BAA6B;qDACpE,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa;;MAEtG,MAAM,CAAC,GAAG;;;;yFAIyE,WAAW;;;;;;;EAOlG,oBAAoB;;;;;;;;;;;;;;;;;;EAkBpB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,2BAA2B,GAC7E,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,+IAA+I,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,mFAAmF;QAChQ,CAAC,CAAC,EACN,EAAE,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA+B,EAAE,KAAyB;IACtF,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IAClD,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,KAAK,WAAW,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,CAAC;IAC7F,MAAM,oBAAoB,GAAG,UAAU,CAAC,aAAa,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACvF,MAAM,cAAc,GAAG,oBAAoB;QACzC,CAAC,CAAC,KAAK,aAAa,0MAA0M,gBAAgB,0DAA0D;QACxS,CAAC,CAAC,yCAAyC,aAAa,yDAAyD,gBAAgB;;4eAEuW,gBAAgB,6FAA6F,CAAC;IACxlB,OAAO;;;;;mIAK0H,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ;;;;;EAKjL,cAAc;;;;;;;;;;;;;;;;;;EAkBd,MAAM;;;;;;EAMN,eAAe,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BxD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAA+B;IAC/D,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;AACvI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAA6B;IACjE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO;2CACkC,SAAS;;;;6FAIyC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,kBAAsC,EACtC,WAAoB;IAEpB,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,iBAAiB,kBAAkB,GAAG,CAAC;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,SAAS,eAAe,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,MAAM,GAAG,gBAAgB,kBAAkB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;QAC7D,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,GAAG,IAAI,OAAO,MAAM,EAAE,CAAC;AAChC,CAAC","sourcesContent":["import type { ImageContent } from \"@earendil-works/pi-ai\";\nimport { existsSync, lstatSync } from \"node:fs\";\nimport { join, posix } from \"node:path\";\nimport type { ConversationMessage } from \"../types.js\";\nimport type { RuntimePathContext, SandboxConfig } from \"../sandbox/types.js\";\nimport { formatSkillsForPrompt } from \"./skills.js\";\nimport type { WorkspaceProjection, Office } from \"../office/types.js\";\nimport { formatHistoryLine, stripTriggerSignature } from \"../sessions/history-line.js\";\nimport type { BuildSystemPromptOptions, ScratchListing } from \"./types.js\";\n\nimport { pinDirectoryNoFollow, readTextFileNoFollowIfExists } from \"../file-guards.js\";\nimport type { PinnedDirectory } from \"../file-guards.js\";\nimport * as log from \"../log.js\";\n\nconst IMAGE_MIME_TYPES: Record<string, string> = {\n  jpg: \"image/jpeg\",\n  jpeg: \"image/jpeg\",\n  png: \"image/png\",\n  gif: \"image/gif\",\n  webp: \"image/webp\",\n};\n\nasync function collectMessageAttachments(\n  message: ConversationMessage,\n  workspacePath: string,\n  pathContext?: RuntimePathContext,\n  readAttachment?: (runtimePath: string) => Promise<string>,\n): Promise<{ imageAttachments: ImageContent[]; nonImagePaths: string[] }> {\n  const imageAttachments: ImageContent[] = [];\n  const nonImagePaths: string[] = [];\n\n  for (const attachment of message.attachments || []) {\n    const runtimePath = `${workspacePath}/${attachment.localPath}`;\n    const hostPath = pathContext?.runtimeToHostPath?.(runtimePath) ?? runtimePath;\n    const mimeType = IMAGE_MIME_TYPES[attachment.localPath.toLowerCase().split(\".\").pop() || \"\"];\n\n    if (mimeType && existsSync(hostPath) && readAttachment) {\n      try {\n        imageAttachments.push({\n          type: \"image\",\n          mimeType,\n          data: await readAttachment(runtimePath),\n        });\n      } catch {\n        nonImagePaths.push(runtimePath);\n      }\n    } else {\n      nonImagePaths.push(runtimePath);\n    }\n  }\n\n  return { imageAttachments, nonImagePaths };\n}\n\nconst SCRATCH_LISTING_LIMIT = 30;\nconst UNSAFE_FOLDER_NAME = /\\p{Cc}/u;\n\nexport function listScratchFolders(office: Office): ScratchListing {\n  let scratch: PinnedDirectory;\n  try {\n    scratch = pinDirectoryNoFollow(join(office.dir, \"scratch\"));\n  } catch {\n    return { folders: [], omitted: 0 };\n  }\n  try {\n    const folders = scratch\n      .entries()\n      .filter((entry) => entry.isDirectory() && !UNSAFE_FOLDER_NAME.test(entry.name))\n      .flatMap((entry) => {\n        const stats = lstatSync(scratch.pathOf(entry.name), { throwIfNoEntry: false });\n        return stats ? [{ name: entry.name, mtimeMs: stats.mtimeMs }] : [];\n      })\n      .toSorted((a, b) => b.mtimeMs - a.mtimeMs);\n    return {\n      folders: folders\n        .slice(0, SCRATCH_LISTING_LIMIT)\n        .map((folder) => folder.name)\n        .toSorted(),\n      omitted: Math.max(0, folders.length - SCRATCH_LISTING_LIMIT),\n    };\n  } finally {\n    scratch.close();\n  }\n}\n\nfunction formatScratchListing(listing: ScratchListing): string {\n  if (listing.folders.length === 0) return \"(none)\";\n  const names = listing.folders.join(\", \");\n  return listing.omitted > 0 ? `${names} (and ${listing.omitted} older; run \\`ls -t\\`)` : names;\n}\n\nfunction buildRuntimePaths(runtimeWorkspaceRoot: string, office: Office) {\n  const workspaceRoot = runtimeWorkspaceRoot.replace(/\\/+$/, \"\") || \"/\";\n  const conversationPath = posix.join(workspaceRoot, office.key);\n  return {\n    workspaceRoot,\n    conversationPath,\n    scratchPath: posix.join(conversationPath, \"scratch\"),\n  };\n}\n\nexport async function buildPromptPayload(\n  message: ConversationMessage,\n  workspacePath: string,\n  pathContext?: RuntimePathContext,\n  readAttachment?: (runtimePath: string) => Promise<string>,\n): Promise<{\n  userMessage: string;\n  imageAttachments: ImageContent[];\n}> {\n  let userMessage = formatHistoryLine({\n    date: new Date(),\n    userName: message.userName,\n    threadTs: message.threadTs,\n    text: message.text,\n  });\n  const { imageAttachments, nonImagePaths } = await collectMessageAttachments(\n    message,\n    workspacePath,\n    pathContext,\n    readAttachment,\n  );\n\n  if (nonImagePaths.length > 0) {\n    userMessage += `\\n\\n<slack_attachments>\\n${nonImagePaths.join(\"\\n\")}\\n</slack_attachments>`;\n  }\n\n  return { userMessage, imageAttachments };\n}\n\nfunction memorySection(\n  path: string | undefined,\n  heading: string,\n  label: string,\n): string | undefined {\n  if (!path) return undefined;\n  try {\n    const content = readTextFileNoFollowIfExists(path)?.trim();\n    return content ? `### ${heading}\\n${content}` : undefined;\n  } catch (error) {\n    log.logWarning(`Failed to read ${label}`, `${path}: ${error}`);\n    return undefined;\n  }\n}\n\nexport function getMemory(projection: WorkspaceProjection): string {\n  const { globalMemoryPath, conversationMemoryPath } = projection.promptSources;\n  const sections = [\n    memorySection(globalMemoryPath, \"Global Workspace Memory\", \"workspace memory\"),\n    memorySection(conversationMemoryPath, \"Conversation-Specific Memory\", \"conversation memory\"),\n  ];\n  const parts = sections.filter((section) => section !== undefined);\n  return parts.length > 0 ? parts.join(\"\\n\\n\") : \"(no working memory yet)\";\n}\n\nfunction buildEnvDescription(sandboxType: SandboxConfig[\"type\"], workspaceRoot: string): string {\n  switch (sandboxType) {\n    case \"image\":\n      return `You are running inside a managed per-conversation container.\n- Runtime workspace root: ${workspaceRoot}\n- Bash commands start in: ${workspaceRoot}\n- Install tools with the image's package manager\n- Only files under ${workspaceRoot} persist; installed packages and anything else in the container are discarded when the sandbox image is updated`;\n    case \"container\":\n      return `You are running inside a shared container.\n- Runtime workspace root: ${workspaceRoot}\n- Bash commands start in: ${workspaceRoot}\n- Install tools with the container's package manager\n- Your changes persist across sessions`;\n    default:\n      return `You are running directly on the host machine.\n- Runtime workspace root: ${workspaceRoot}\n- Bash commands start in: ${workspaceRoot}\n- Be careful with system modifications`;\n  }\n}\n\nexport function resolveTriggerAttribution(\n  message: Pick<ConversationMessage, \"id\" | \"text\" | \"userName\">,\n): string | undefined {\n  const eventIdMatch = message.id.match(/^event:([^:]+)/);\n  if (eventIdMatch) return `[event: ${eventIdMatch[1]}]`;\n  if (message.userName) return `@${message.userName}`;\n  return undefined;\n}\n\ntype RuntimePromptPaths = ReturnType<typeof buildRuntimePaths>;\n\nfunction mappingTable(rows: string[], empty: string): string {\n  return rows.length > 0 ? rows.join(\"\\n\") : empty;\n}\n\nfunction buildContextPrompt(input: BuildSystemPromptOptions, paths: RuntimePromptPaths): string {\n  const { platform, sandboxConfig, projection } = input;\n  const { workspaceRoot, scratchPath } = paths;\n  const readable = new Set(projection.readableConversationIds);\n  const channelMappings = mappingTable(\n    platform.channels.filter((c) => readable.has(c.id)).map((c) => `${c.id}\\t#${c.name}`),\n    \"(no channels loaded)\",\n  );\n  const userMappings = mappingTable(\n    platform.users.map((u) => `${u.id}\\t@${u.userName}\\t${u.displayName}`),\n    \"(no users loaded)\",\n  );\n  const envDescription = buildEnvDescription(sandboxConfig.type, workspaceRoot);\n  const slackBlockKitInstructions =\n    platform.name === \"slack\"\n      ? `\n## Slack Tasks\n- In top-level Slack DMs, use start_task for multi-step investigations, changes/tests, or long waits so the user can keep chatting. Write a short, casual acknowledgement like a helpful colleague (e.g. 好，我來整理一下，弄好再通知你), not a formal restatement of the task. Do not invent an ETA. Separately provide a self-contained task with constraints and attachment paths. Call it alone before executing the work.\n- For questions about task progress, always call task_status before answering. Its observations are the only authority for current task status. Never infer progress, completion, or an ETA from elapsed time or your earlier promises. acknowledgement is only the original task description, NOT live progress. Only currentTool describes a current operation; if absent, say it is still running without inventing a phase. Never translate subagent into a more specific activity than the observation supports. If multiple tasks match, ask which one. If status is unknown, say so. For status-only questions, report the task_status observation directly; do not search history, run shell probes, or repeat the investigation just to reconfirm it. Only inspect the result content when the user asks for that content.\n- In a thread, continue the task directly; do not hand it off again. Other platforms and shared channels do not support start_task yet.\n\n## Slack Rendering\n- The Slack adapter renders responses natively from standard Markdown. Answer in normal Markdown/GFM.\n- Markdown pipe tables are rendered as native Slack tables.\n- For interactive elements (buttons, select menus), use the slack_blockkit tool; user interactions arrive as \"[Slack action] <action_id>: <value>\" messages.\n`\n      : \"\";\n\n  return `You are mikan, a ${platform.name} bot assistant. Be concise. No emojis.\n\n## Context\n- Each user message starts with its send time in \\`[YYYY-MM-DD HH:MM:SS+ZZ:ZZ]\\`; treat it as the current date and time instead of running \\`date\\`.\n- Messages in your context are reliable: answer from them directly, including anything the user asked you to remember in this conversation.\n- Your context does not hold tool output from other sessions: a thread or a session started by \\`/new\\` sees earlier work only as chat text. When the user asks for a result your context lacks, such as a command's output, call the \\`history\\` tool instead of guessing or rerunning the command.\n- User messages include a \\`[in-thread:TS]\\` marker when sent from within a platform thread/reply (TS is the thread or parent message identifier). Without this marker, the message is a top-level conversation message.\n${platform.formattingGuide}${slackBlockKitInstructions}\n\n## Platform IDs\nChannels: ${channelMappings}\n\nUsers: ${userMappings}\n\nWhen mentioning users, write <@userName> using the exact userName from the Users table above (e.g., <@mario>). Never invent handles from other platforms (GitHub, email); the platform adapter converts <@userName> to the platform's native mention form.\n\n## Environment\n${envDescription}\n- Default place for clones, downloads, and experiments: ${scratchPath}\n- Folders already in scratch: ${formatScratchListing(input.scratch)}\n- Before cloning a repository, check whether one of these folders already holds it (\\`git -C <folder> remote get-url origin\\`). Reuse it with \\`git fetch\\`, and use \\`git worktree add\\` when a branch or pull request needs its own checkout. Clone only when no folder holds the repository.\n- Do not use host-only paths unless you are running in host mode and verified they exist.`;\n}\n\nfunction buildWorkspaceSkillsPrompt(\n  input: BuildSystemPromptOptions,\n  paths: RuntimePromptPaths,\n): string {\n  const { office, projection, skills, skippedSkillLinks = [] } = input;\n  const { workspaceRoot, conversationPath, scratchPath } = paths;\n  const knowledgeReadOnly = projection.promptSources.globalKnowledgeReadOnly === true;\n  const workspaceLayout = knowledgeReadOnly\n    ? `${workspaceRoot}/ contains this private conversation's directory, read-only shared MEMORY.md and skills/, and read-only public/ with every public channel's office.`\n    : `${workspaceRoot}/ contains this public conversation's directory, shared MEMORY.md and skills/, and read-only public/ with every public channel's office.`;\n  const skillStorageGuidance = knowledgeReadOnly\n    ? `Store skills in \\`${conversationPath}/skills/<name>/\\`; shared \\`${workspaceRoot}/skills/\\` is read-only for this private office.`\n    : `Store shared skills in \\`${workspaceRoot}/skills/<name>/\\` or conversation-specific skills in \\`${conversationPath}/skills/<name>/\\`.`;\n\n  return `## Workspace Layout\n${workspaceLayout}\n${workspaceRoot}/\n├── MEMORY.md                    # Shared memory${knowledgeReadOnly ? \" (read-only here)\" : \" (all public conversations)\"}\n├── skills/                      # Shared CLI tools${knowledgeReadOnly ? \" (read-only here)\" : \" you create\"}\n├── public/<office-key>/         # Other public channels' offices (read-only)\n└── ${office.key}/           # This conversation\n    ├── MEMORY.md                # Conversation-specific memory\n    ├── log.jsonl                # Human-readable message history (no tool results)\n    ├── attachments/             # User-shared files\n    ├── scratch/                 # Working directory for clones/downloads/experiments: ${scratchPath}\n    └── skills/                  # Conversation-specific tools\n\n## Skills (Custom CLI Tools)\nYou can create reusable CLI tools for recurring tasks (email, APIs, data processing, etc.).\n\n### Creating Skills\n${skillStorageGuidance}\nEach skill directory needs a \\`SKILL.md\\` with YAML frontmatter:\n\n\\`\\`\\`markdown\n---\nname: skill-name\ndescription: Short description of what this skill does\n---\n\n# Skill Name\n\nUsage instructions, examples, etc.\nScripts are in: {baseDir}/\n\\`\\`\\`\n\n\\`name\\` and \\`description\\` are required. Use \\`{baseDir}\\` as placeholder for the skill's directory path.\n\n### Available Skills\n${skills.length > 0 ? formatSkillsForPrompt(skills) : \"(no skills installed yet)\"}${\n    skippedSkillLinks.length > 0\n      ? `\\n\\nNote: these skill entries were skipped because they are symlinks, which the host never follows when reading this conversation's skills: ${skippedSkillLinks.join(\", \")}. Replace each with a real file or directory (for example \\`cp -rL\\`) to load it.`\n      : \"\"\n  }`;\n}\n\nfunction buildOperatingPrompt(input: BuildSystemPromptOptions, paths: RuntimePromptPaths): string {\n  const { memory, projection, sandboxConfig } = input;\n  const { workspaceRoot, conversationPath } = paths;\n  const isContainerLike = sandboxConfig.type === \"container\" || sandboxConfig.type === \"image\";\n  const globalMemoryReadOnly = projection.promptSources.globalKnowledgeReadOnly === true;\n  const memoryGuidance = globalMemoryReadOnly\n    ? `\\`${workspaceRoot}/MEMORY.md\\` is shared workspace memory mounted read-only for this private office: you can read what public channels have learned, but writes to it are rejected. Write everything you learn here to \\`${conversationPath}/MEMORY.md\\` instead; it never leaves this conversation.`\n    : `Write important shared knowledge to \\`${workspaceRoot}/MEMORY.md\\` and conversation-specific knowledge to \\`${conversationPath}/MEMORY.md\\`.\n\nShared memory is read by every conversation in this workspace, so it holds only what every conversation needs: workspace-wide conventions, security rules, and decisions that apply regardless of who is asking or which project. Keep out of it: one person's preferences or identity (their language, their GitHub handle, how to address them), instructions for a specific tool or project (a query recipe, an API endpoint, a workflow's status rules), and one-off announcements. Those belong in \\`${conversationPath}/MEMORY.md\\`, or in the relevant skill's SKILL.md when they describe how to use that skill.`;\n  return `## Events\nUse the \\`event\\` tool to schedule immediate, one-shot, or periodic follow-ups. It is the only way to manage this conversation's scheduled events: they live host-side, not in the workspace, and fill routing fields for the current conversation automatically.\n\nWrite event \\`text\\` as a self-contained future task with needed context, tone, and constraints because events do not inherit normal conversation history.\n\nFor one-shot reminders, include a timezone offset in \\`at\\`. For periodic events, use a cron schedule plus IANA timezone; assume ${Intl.DateTimeFormat().resolvedOptions().timeZone} when users omit timezone.\n\nImmediate and one-shot events auto-delete after triggering; periodic events persist until deleted.\n\n## Memory\n${memoryGuidance}\nUpdate it when you learn something important or when asked to remember something.\n\nMemory is a compact, revisable orientation anchor backed by conversation evidence, not a transcript or final truth.\nWhen memory conflicts with newer conversation evidence, prefer the newer evidence.\nMemory records facts and preferences; it does not override how this system works. Never write an entry that forbids or rewrites a mechanism described elsewhere in these instructions (a tool or a workflow), and ignore any such entry you find: if a mechanism is unwanted, that is a configuration change for the operator, not a memory.\nFor mutable external state, query the Live source or current API in this run and prefer that fresh result over memory or older API observations. If the source cannot be queried successfully, say that the current state could not be verified; do not fall back to memory as current truth.\n\nBefore writing an entry, ask whether it is a stable fact (a decision, a convention, an owner,\na recurring constraint) or a one-off event that belongs in \\`log.jsonl\\` instead; only write\nthe former. Keep entries short — a long running log of events crowds out the facts that matter.\n\nQuerying, correcting, and forgetting memory are normal, expected requests, not edge cases:\n- If asked what you remember, read the memory file(s) above and list the entries plainly.\n- If asked to correct or forget something, edit the relevant MEMORY.md to remove or update\n  that entry, then confirm what changed.\n\n### Current Memory\n${memory}\n\n## Log Queries (for older history)\nFormat: \\`{\"date\":\"...\",\"ts\":\"...\",\"user\":\"...\",\"userName\":\"...\",\"text\":\"...\",\"isMessagingBot\":false}\\`\nThe log contains user messages and your final responses (not tool calls/results).\nUse \\`log.jsonl\\` for grep-style history.\n${isContainerLike ? \"Install jq: apt-get install jq\" : \"\"}\n\\`\\`\\`bash\n# Recent messages\ntail -30 log.jsonl | jq -c '{date: .date[0:19], user: (.userName // .user), text}'\n\n# Search for specific topic\ngrep -i \"topic\" log.jsonl | jq -c '{date: .date[0:19], user: (.userName // .user), text}'\n\n# Messages from specific user\ngrep '\"userName\":\"mario\"' log.jsonl | tail -20 | jq -c '{date: .date[0:19], text}'\n\n\\`\\`\\`\n\n## Tools\n- bash: Run shell commands (primary tool). Install packages as needed.\n- read: Read files\n- write: Create/overwrite files\n- edit: Surgical file edits\n- event: Schedule immediate, one-shot, or periodic follow-ups\n- sandbox: Inspect or temporarily adjust sandbox limits\n- attach: Share files to the platform\n- jev: Ask Jev (a fast calibrated decision model) boolean / choice / score questions about a state you supply; returns probabilities and confidence, never text. Use it whenever you need to classify, detect, score, rank, route, pick among known candidates, or verify.\n- react: Add an emoji reaction to the triggering message. mikan already acknowledges work on its own when your first tool starts, so do not react before starting work. Use a short name without colons (e.g. eyes, white_check_mark, +1); GitHub only accepts +1, -1, laugh, confused, heart, hooray, rocket, eyes and rejects anything else.\n\nEach tool requires a \"label\" parameter (shown to user).\n\n## Signatures\nmikan adds the \\`_Triggered by …_\\` signature to your final chat response; do not write it there yourself. When you write to GitHub (\\`gh issue comment\\`, \\`gh issue create\\`, \\`gh pr comment\\`, \\`gh pr create\\`, \\`gh pr review\\`, or a github_* tool that posts text), end the body with \\`_Triggered by @<user>_\\`, where <user> is the name in the triggering message's \\`[user]\\` prefix. For a scheduled event, use \\`_Triggered by [event: <name>]_\\`, where <name> is the event file named in the Event Trigger Mode instructions, without \\`.json\\`.\n`;\n}\n\nexport function buildSystemPrompt(input: BuildSystemPromptOptions): string {\n  const paths = buildRuntimePaths(input.workspacePath, input.office);\n  return `${buildContextPrompt(input, paths)}\\n\\n${buildWorkspaceSkillsPrompt(input, paths)}\\n\\n${buildOperatingPrompt(input, paths)}`;\n}\n\nexport function buildTurnInstructions(eventName: string | undefined): string {\n  if (eventName === undefined) return \"\";\n  return `## Event Trigger Mode\n- You are handling the scheduled event \\`${eventName}.json\\`, not opening a brand new chat with a stranger.\n- Treat the incoming user message as a self-contained task prepared by an earlier run.\n- Complete the task directly. Avoid generic greetings, self-introductions, or boilerplate offers to help.\n- For reminders/follow-ups, prefer a short direct response that sounds like a continuation of prior intent.\n- If the event text includes tone, brevity, or language instructions, follow them literally.`;\n}\n\nexport function appendTriggerAttribution(\n  text: string,\n  triggerAttribution: string | undefined,\n  sessionLink?: string,\n): string {\n  if (!triggerAttribution) return text;\n  const trimmed = text.trimEnd();\n  const signature = `_Triggered by ${triggerAttribution}_`;\n  const suffix = sessionLink ? `${signature} · session: ${sessionLink}` : signature;\n  const echoed = `Triggered by ${triggerAttribution}`;\n  const inline = trimmed.replace(/_$/, \"\");\n  const body = inline.endsWith(echoed)\n    ? inline.slice(0, -echoed.length).replace(/_$/, \"\").trimEnd()\n    : stripTriggerSignature(trimmed);\n  return `${body}\\n\\n${suffix}`;\n}\n"]}
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/harness/prompt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGvF,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,MAAM,gBAAgB,GAA2B;IAC/C,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;CACnB,CAAC;AAEF,KAAK,UAAU,yBAAyB,CACtC,OAA4B,EAC5B,aAAqB,EACrB,WAAgC,EAChC,cAAyD;IAEzD,MAAM,gBAAgB,GAAmB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,GAAG,aAAa,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,WAAW,EAAE,iBAAiB,EAAE,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;QAC9E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7F,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,cAAc,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,OAAO;oBACb,QAAQ;oBACR,IAAI,EAAE,MAAM,cAAc,CAAC,WAAW,CAAC;iBACxC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAErC,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO;aACpB,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC9E,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,CAAC,CAAC;aACD,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,OAAO;iBACb,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;iBAC/B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;iBAC5B,QAAQ,EAAE;YACb,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,qBAAqB,CAAC;SAC7D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAuB;IACnD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC,KAAK,CAAC;AAChG,CAAC;AAED,SAAS,iBAAiB,CAAC,oBAA4B,EAAE,MAAc;IACrE,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACtE,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO;QACL,aAAa;QACb,gBAAgB;QAChB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA4B,EAC5B,aAAqB,EACrB,WAAgC,EAChC,cAAyD;IAKzD,IAAI,WAAW,GAAG,iBAAiB,CAAC;QAClC,IAAI,EAAE,IAAI,IAAI,EAAE;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,MAAM,yBAAyB,CACzE,OAAO,EACP,aAAa,EACb,WAAW,EACX,cAAc,CACf,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,WAAW,IAAI,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC9F,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CACpB,IAAwB,EACxB,OAAe,EACf,KAAa;IAEb,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,4BAA4B,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,UAAU,CAAC,kBAAkB,KAAK,EAAE,EAAE,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA+B;IACvD,MAAM,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,UAAU,CAAC,aAAa,CAAC;IAC9E,MAAM,QAAQ,GAAG;QACf,aAAa,CAAC,gBAAgB,EAAE,yBAAyB,EAAE,kBAAkB,CAAC;QAC9E,aAAa,CAAC,sBAAsB,EAAE,8BAA8B,EAAE,qBAAqB,CAAC;KAC7F,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAC3E,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAkC,EAAE,aAAqB;IACpF,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,OAAO;4BACe,aAAa;4BACb,aAAa;;qBAEpB,aAAa,iHAAiH,CAAC;QAChJ,KAAK,WAAW;YACd,OAAO;4BACe,aAAa;4BACb,aAAa;;uCAEF,CAAC;QACpC;YACE,OAAO;4BACe,aAAa;4BACb,aAAa;uCACF,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAA8D;IAE9D,MAAM,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,YAAY;QAAE,OAAO,WAAW,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAID,SAAS,YAAY,CAAC,IAAc,EAAE,KAAa;IACjD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA+B,EAAE,KAAyB;IACpF,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,YAAY,CAClC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EACrF,sBAAsB,CACvB,CAAC;IACF,MAAM,YAAY,GAAG,YAAY,CAC/B,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,EACtE,mBAAmB,CACpB,CAAC;IACF,MAAM,cAAc,GAAG,mBAAmB,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9E,MAAM,yBAAyB,GAC7B,QAAQ,CAAC,IAAI,KAAK,OAAO;QACvB,CAAC,CAAC;;;;;;;;;;CAUP;QACK,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,oBAAoB,QAAQ,CAAC,IAAI;;;;;;;EAOxC,QAAQ,CAAC,eAAe,GAAG,yBAAyB;;;YAG1C,eAAe;;SAElB,YAAY;;;;;EAKnB,cAAc;0DAC0C,WAAW;gCACrC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC;;0FAEuB,CAAC;AAC3F,CAAC;AAED,SAAS,0BAA0B,CACjC,KAA+B,EAC/B,KAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;IACrE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC/D,MAAM,iBAAiB,GAAG,UAAU,CAAC,aAAa,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACpF,MAAM,eAAe,GAAG,iBAAiB;QACvC,CAAC,CAAC,GAAG,aAAa,qJAAqJ;QACvK,CAAC,CAAC,GAAG,aAAa,0IAA0I,CAAC;IAC/J,MAAM,oBAAoB,GAAG,iBAAiB;QAC5C,CAAC,CAAC,qBAAqB,gBAAgB,+BAA+B,aAAa,kDAAkD;QACrI,CAAC,CAAC,4BAA4B,aAAa,0DAA0D,gBAAgB,oBAAoB,CAAC;IAE5I,OAAO;EACP,eAAe;EACf,aAAa;kDACmC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,6BAA6B;qDACpE,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa;;MAEtG,MAAM,CAAC,GAAG;;;;yFAIyE,WAAW;;;;;;;EAOlG,oBAAoB;;;;;;;;;;;;;;;;;;EAkBpB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,2BAA2B,GAC7E,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,+IAA+I,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,mFAAmF;QAChQ,CAAC,CAAC,EACN,EAAE,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA+B,EAAE,KAAyB;IACtF,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IAClD,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,KAAK,WAAW,IAAI,aAAa,CAAC,IAAI,KAAK,KAAK,CAAC;IAC3F,MAAM,oBAAoB,GAAG,UAAU,CAAC,aAAa,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACvF,MAAM,cAAc,GAAG,oBAAoB;QACzC,CAAC,CAAC,KAAK,aAAa,0MAA0M,gBAAgB,0DAA0D;QACxS,CAAC,CAAC,yCAAyC,aAAa,yDAAyD,gBAAgB;;4eAEuW,gBAAgB,6FAA6F,CAAC;IACxlB,OAAO;;;;;mIAK0H,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ;;;;;EAKjL,cAAc;;;;;;;;;;;;;;;;;;EAkBd,MAAM;;;;;;EAMN,eAAe,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BxD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAA+B;IAC/D,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;AACvI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAA6B;IACjE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO;2CACkC,SAAS;;;;6FAIyC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,kBAAsC,EACtC,WAAoB;IAEpB,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,iBAAiB,kBAAkB,GAAG,CAAC;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,SAAS,eAAe,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,MAAM,GAAG,gBAAgB,kBAAkB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;QAC7D,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,GAAG,IAAI,OAAO,MAAM,EAAE,CAAC;AAChC,CAAC","sourcesContent":["import type { ImageContent } from \"@earendil-works/pi-ai\";\nimport { existsSync, lstatSync } from \"node:fs\";\nimport { join, posix } from \"node:path\";\nimport type { ConversationMessage } from \"../types.js\";\nimport type { RuntimePathContext, SandboxConfig } from \"../sandbox/types.js\";\nimport { formatSkillsForPrompt } from \"./skills.js\";\nimport type { WorkspaceProjection, Office } from \"../office/types.js\";\nimport { formatHistoryLine, stripTriggerSignature } from \"../sessions/history-line.js\";\nimport type { BuildSystemPromptOptions, ScratchListing } from \"./types.js\";\n\nimport { pinDirectoryNoFollow, readTextFileNoFollowIfExists } from \"../file-guards.js\";\nimport type { PinnedDirectory } from \"../file-guards.js\";\nimport * as log from \"../log.js\";\n\nconst IMAGE_MIME_TYPES: Record<string, string> = {\n  jpg: \"image/jpeg\",\n  jpeg: \"image/jpeg\",\n  png: \"image/png\",\n  gif: \"image/gif\",\n  webp: \"image/webp\",\n};\n\nasync function collectMessageAttachments(\n  message: ConversationMessage,\n  workspacePath: string,\n  pathContext?: RuntimePathContext,\n  readAttachment?: (runtimePath: string) => Promise<string>,\n): Promise<{ imageAttachments: ImageContent[]; nonImagePaths: string[] }> {\n  const imageAttachments: ImageContent[] = [];\n  const nonImagePaths: string[] = [];\n\n  for (const attachment of message.attachments || []) {\n    const runtimePath = `${workspacePath}/${attachment.localPath}`;\n    const hostPath = pathContext?.runtimeToHostPath?.(runtimePath) ?? runtimePath;\n    const mimeType = IMAGE_MIME_TYPES[attachment.localPath.toLowerCase().split(\".\").pop() || \"\"];\n\n    if (mimeType && existsSync(hostPath) && readAttachment) {\n      try {\n        imageAttachments.push({\n          type: \"image\",\n          mimeType,\n          data: await readAttachment(runtimePath),\n        });\n      } catch {\n        nonImagePaths.push(runtimePath);\n      }\n    } else {\n      nonImagePaths.push(runtimePath);\n    }\n  }\n\n  return { imageAttachments, nonImagePaths };\n}\n\nconst SCRATCH_LISTING_LIMIT = 30;\nconst UNSAFE_FOLDER_NAME = /\\p{Cc}/u;\n\nexport function listScratchFolders(office: Office): ScratchListing {\n  let scratch: PinnedDirectory;\n  try {\n    scratch = pinDirectoryNoFollow(join(office.dir, \"scratch\"));\n  } catch {\n    return { folders: [], omitted: 0 };\n  }\n  try {\n    const folders = scratch\n      .entries()\n      .filter((entry) => entry.isDirectory() && !UNSAFE_FOLDER_NAME.test(entry.name))\n      .flatMap((entry) => {\n        const stats = lstatSync(scratch.pathOf(entry.name), { throwIfNoEntry: false });\n        return stats ? [{ name: entry.name, mtimeMs: stats.mtimeMs }] : [];\n      })\n      .toSorted((a, b) => b.mtimeMs - a.mtimeMs);\n    return {\n      folders: folders\n        .slice(0, SCRATCH_LISTING_LIMIT)\n        .map((folder) => folder.name)\n        .toSorted(),\n      omitted: Math.max(0, folders.length - SCRATCH_LISTING_LIMIT),\n    };\n  } finally {\n    scratch.close();\n  }\n}\n\nfunction formatScratchListing(listing: ScratchListing): string {\n  if (listing.folders.length === 0) return \"(none)\";\n  const names = listing.folders.join(\", \");\n  return listing.omitted > 0 ? `${names} (and ${listing.omitted} older; run \\`ls -t\\`)` : names;\n}\n\nfunction buildRuntimePaths(runtimeWorkspaceRoot: string, office: Office) {\n  const workspaceRoot = runtimeWorkspaceRoot.replace(/\\/+$/, \"\") || \"/\";\n  const conversationPath = posix.join(workspaceRoot, office.key);\n  return {\n    workspaceRoot,\n    conversationPath,\n    scratchPath: posix.join(conversationPath, \"scratch\"),\n  };\n}\n\nexport async function buildPromptPayload(\n  message: ConversationMessage,\n  workspacePath: string,\n  pathContext?: RuntimePathContext,\n  readAttachment?: (runtimePath: string) => Promise<string>,\n): Promise<{\n  userMessage: string;\n  imageAttachments: ImageContent[];\n}> {\n  let userMessage = formatHistoryLine({\n    date: new Date(),\n    userName: message.userName,\n    threadTs: message.threadTs,\n    text: message.text,\n  });\n  const { imageAttachments, nonImagePaths } = await collectMessageAttachments(\n    message,\n    workspacePath,\n    pathContext,\n    readAttachment,\n  );\n\n  if (nonImagePaths.length > 0) {\n    userMessage += `\\n\\n<slack_attachments>\\n${nonImagePaths.join(\"\\n\")}\\n</slack_attachments>`;\n  }\n\n  return { userMessage, imageAttachments };\n}\n\nfunction memorySection(\n  path: string | undefined,\n  heading: string,\n  label: string,\n): string | undefined {\n  if (!path) return undefined;\n  try {\n    const content = readTextFileNoFollowIfExists(path)?.trim();\n    return content ? `### ${heading}\\n${content}` : undefined;\n  } catch (error) {\n    log.logWarning(`Failed to read ${label}`, `${path}: ${error}`);\n    return undefined;\n  }\n}\n\nexport function getMemory(projection: WorkspaceProjection): string {\n  const { globalMemoryPath, conversationMemoryPath } = projection.promptSources;\n  const sections = [\n    memorySection(globalMemoryPath, \"Global Workspace Memory\", \"workspace memory\"),\n    memorySection(conversationMemoryPath, \"Conversation-Specific Memory\", \"conversation memory\"),\n  ];\n  const parts = sections.filter((section) => section !== undefined);\n  return parts.length > 0 ? parts.join(\"\\n\\n\") : \"(no working memory yet)\";\n}\n\nfunction buildEnvDescription(sandboxType: SandboxConfig[\"type\"], workspaceRoot: string): string {\n  switch (sandboxType) {\n    case \"oci\":\n      return `You are running inside a managed per-conversation container.\n- Runtime workspace root: ${workspaceRoot}\n- Bash commands start in: ${workspaceRoot}\n- Install tools with the image's package manager\n- Only files under ${workspaceRoot} persist; installed packages and anything else in the container are discarded when the sandbox image is updated`;\n    case \"container\":\n      return `You are running inside a shared container.\n- Runtime workspace root: ${workspaceRoot}\n- Bash commands start in: ${workspaceRoot}\n- Install tools with the container's package manager\n- Your changes persist across sessions`;\n    default:\n      return `You are running directly on the host machine.\n- Runtime workspace root: ${workspaceRoot}\n- Bash commands start in: ${workspaceRoot}\n- Be careful with system modifications`;\n  }\n}\n\nexport function resolveTriggerAttribution(\n  message: Pick<ConversationMessage, \"id\" | \"text\" | \"userName\">,\n): string | undefined {\n  const eventIdMatch = message.id.match(/^event:([^:]+)/);\n  if (eventIdMatch) return `[event: ${eventIdMatch[1]}]`;\n  if (message.userName) return `@${message.userName}`;\n  return undefined;\n}\n\ntype RuntimePromptPaths = ReturnType<typeof buildRuntimePaths>;\n\nfunction mappingTable(rows: string[], empty: string): string {\n  return rows.length > 0 ? rows.join(\"\\n\") : empty;\n}\n\nfunction buildContextPrompt(input: BuildSystemPromptOptions, paths: RuntimePromptPaths): string {\n  const { platform, sandboxConfig, projection } = input;\n  const { workspaceRoot, scratchPath } = paths;\n  const readable = new Set(projection.readableConversationIds);\n  const channelMappings = mappingTable(\n    platform.channels.filter((c) => readable.has(c.id)).map((c) => `${c.id}\\t#${c.name}`),\n    \"(no channels loaded)\",\n  );\n  const userMappings = mappingTable(\n    platform.users.map((u) => `${u.id}\\t@${u.userName}\\t${u.displayName}`),\n    \"(no users loaded)\",\n  );\n  const envDescription = buildEnvDescription(sandboxConfig.type, workspaceRoot);\n  const slackBlockKitInstructions =\n    platform.name === \"slack\"\n      ? `\n## Slack Tasks\n- In top-level Slack DMs, use start_task for multi-step investigations, changes/tests, or long waits so the user can keep chatting. Write a short, casual acknowledgement like a helpful colleague (e.g. 好，我來整理一下，弄好再通知你), not a formal restatement of the task. Do not invent an ETA. Separately provide a self-contained task with constraints and attachment paths. Call it alone before executing the work.\n- For questions about task progress, always call task_status before answering. Its observations are the only authority for current task status. Never infer progress, completion, or an ETA from elapsed time or your earlier promises. acknowledgement is only the original task description, NOT live progress. Only currentTool describes a current operation; if absent, say it is still running without inventing a phase. Never translate subagent into a more specific activity than the observation supports. If multiple tasks match, ask which one. If status is unknown, say so. For status-only questions, report the task_status observation directly; do not search history, run shell probes, or repeat the investigation just to reconfirm it. Only inspect the result content when the user asks for that content.\n- In a thread, continue the task directly; do not hand it off again. Other platforms and shared channels do not support start_task yet.\n\n## Slack Rendering\n- The Slack adapter renders responses natively from standard Markdown. Answer in normal Markdown/GFM.\n- Markdown pipe tables are rendered as native Slack tables.\n- For interactive elements (buttons, select menus), use the slack_blockkit tool; user interactions arrive as \"[Slack action] <action_id>: <value>\" messages.\n`\n      : \"\";\n\n  return `You are mikan, a ${platform.name} bot assistant. Be concise. No emojis.\n\n## Context\n- Each user message starts with its send time in \\`[YYYY-MM-DD HH:MM:SS+ZZ:ZZ]\\`; treat it as the current date and time instead of running \\`date\\`.\n- Messages in your context are reliable: answer from them directly, including anything the user asked you to remember in this conversation.\n- Your context does not hold tool output from other sessions: a thread or a session started by \\`/new\\` sees earlier work only as chat text. When the user asks for a result your context lacks, such as a command's output, call the \\`history\\` tool instead of guessing or rerunning the command.\n- User messages include a \\`[in-thread:TS]\\` marker when sent from within a platform thread/reply (TS is the thread or parent message identifier). Without this marker, the message is a top-level conversation message.\n${platform.formattingGuide}${slackBlockKitInstructions}\n\n## Platform IDs\nChannels: ${channelMappings}\n\nUsers: ${userMappings}\n\nWhen mentioning users, write <@userName> using the exact userName from the Users table above (e.g., <@mario>). Never invent handles from other platforms (GitHub, email); the platform adapter converts <@userName> to the platform's native mention form.\n\n## Environment\n${envDescription}\n- Default place for clones, downloads, and experiments: ${scratchPath}\n- Folders already in scratch: ${formatScratchListing(input.scratch)}\n- Before cloning a repository, check whether one of these folders already holds it (\\`git -C <folder> remote get-url origin\\`). Reuse it with \\`git fetch\\`, and use \\`git worktree add\\` when a branch or pull request needs its own checkout. Clone only when no folder holds the repository.\n- Do not use host-only paths unless you are running in host mode and verified they exist.`;\n}\n\nfunction buildWorkspaceSkillsPrompt(\n  input: BuildSystemPromptOptions,\n  paths: RuntimePromptPaths,\n): string {\n  const { office, projection, skills, skippedSkillLinks = [] } = input;\n  const { workspaceRoot, conversationPath, scratchPath } = paths;\n  const knowledgeReadOnly = projection.promptSources.globalKnowledgeReadOnly === true;\n  const workspaceLayout = knowledgeReadOnly\n    ? `${workspaceRoot}/ contains this private conversation's directory, read-only shared MEMORY.md and skills/, and read-only public/ with every public channel's office.`\n    : `${workspaceRoot}/ contains this public conversation's directory, shared MEMORY.md and skills/, and read-only public/ with every public channel's office.`;\n  const skillStorageGuidance = knowledgeReadOnly\n    ? `Store skills in \\`${conversationPath}/skills/<name>/\\`; shared \\`${workspaceRoot}/skills/\\` is read-only for this private office.`\n    : `Store shared skills in \\`${workspaceRoot}/skills/<name>/\\` or conversation-specific skills in \\`${conversationPath}/skills/<name>/\\`.`;\n\n  return `## Workspace Layout\n${workspaceLayout}\n${workspaceRoot}/\n├── MEMORY.md                    # Shared memory${knowledgeReadOnly ? \" (read-only here)\" : \" (all public conversations)\"}\n├── skills/                      # Shared CLI tools${knowledgeReadOnly ? \" (read-only here)\" : \" you create\"}\n├── public/<office-key>/         # Other public channels' offices (read-only)\n└── ${office.key}/           # This conversation\n    ├── MEMORY.md                # Conversation-specific memory\n    ├── log.jsonl                # Human-readable message history (no tool results)\n    ├── attachments/             # User-shared files\n    ├── scratch/                 # Working directory for clones/downloads/experiments: ${scratchPath}\n    └── skills/                  # Conversation-specific tools\n\n## Skills (Custom CLI Tools)\nYou can create reusable CLI tools for recurring tasks (email, APIs, data processing, etc.).\n\n### Creating Skills\n${skillStorageGuidance}\nEach skill directory needs a \\`SKILL.md\\` with YAML frontmatter:\n\n\\`\\`\\`markdown\n---\nname: skill-name\ndescription: Short description of what this skill does\n---\n\n# Skill Name\n\nUsage instructions, examples, etc.\nScripts are in: {baseDir}/\n\\`\\`\\`\n\n\\`name\\` and \\`description\\` are required. Use \\`{baseDir}\\` as placeholder for the skill's directory path.\n\n### Available Skills\n${skills.length > 0 ? formatSkillsForPrompt(skills) : \"(no skills installed yet)\"}${\n    skippedSkillLinks.length > 0\n      ? `\\n\\nNote: these skill entries were skipped because they are symlinks, which the host never follows when reading this conversation's skills: ${skippedSkillLinks.join(\", \")}. Replace each with a real file or directory (for example \\`cp -rL\\`) to load it.`\n      : \"\"\n  }`;\n}\n\nfunction buildOperatingPrompt(input: BuildSystemPromptOptions, paths: RuntimePromptPaths): string {\n  const { memory, projection, sandboxConfig } = input;\n  const { workspaceRoot, conversationPath } = paths;\n  const isContainerLike = sandboxConfig.type === \"container\" || sandboxConfig.type === \"oci\";\n  const globalMemoryReadOnly = projection.promptSources.globalKnowledgeReadOnly === true;\n  const memoryGuidance = globalMemoryReadOnly\n    ? `\\`${workspaceRoot}/MEMORY.md\\` is shared workspace memory mounted read-only for this private office: you can read what public channels have learned, but writes to it are rejected. Write everything you learn here to \\`${conversationPath}/MEMORY.md\\` instead; it never leaves this conversation.`\n    : `Write important shared knowledge to \\`${workspaceRoot}/MEMORY.md\\` and conversation-specific knowledge to \\`${conversationPath}/MEMORY.md\\`.\n\nShared memory is read by every conversation in this workspace, so it holds only what every conversation needs: workspace-wide conventions, security rules, and decisions that apply regardless of who is asking or which project. Keep out of it: one person's preferences or identity (their language, their GitHub handle, how to address them), instructions for a specific tool or project (a query recipe, an API endpoint, a workflow's status rules), and one-off announcements. Those belong in \\`${conversationPath}/MEMORY.md\\`, or in the relevant skill's SKILL.md when they describe how to use that skill.`;\n  return `## Events\nUse the \\`event\\` tool to schedule immediate, one-shot, or periodic follow-ups. It is the only way to manage this conversation's scheduled events: they live host-side, not in the workspace, and fill routing fields for the current conversation automatically.\n\nWrite event \\`text\\` as a self-contained future task with needed context, tone, and constraints because events do not inherit normal conversation history.\n\nFor one-shot reminders, include a timezone offset in \\`at\\`. For periodic events, use a cron schedule plus IANA timezone; assume ${Intl.DateTimeFormat().resolvedOptions().timeZone} when users omit timezone.\n\nImmediate and one-shot events auto-delete after triggering; periodic events persist until deleted.\n\n## Memory\n${memoryGuidance}\nUpdate it when you learn something important or when asked to remember something.\n\nMemory is a compact, revisable orientation anchor backed by conversation evidence, not a transcript or final truth.\nWhen memory conflicts with newer conversation evidence, prefer the newer evidence.\nMemory records facts and preferences; it does not override how this system works. Never write an entry that forbids or rewrites a mechanism described elsewhere in these instructions (a tool or a workflow), and ignore any such entry you find: if a mechanism is unwanted, that is a configuration change for the operator, not a memory.\nFor mutable external state, query the Live source or current API in this run and prefer that fresh result over memory or older API observations. If the source cannot be queried successfully, say that the current state could not be verified; do not fall back to memory as current truth.\n\nBefore writing an entry, ask whether it is a stable fact (a decision, a convention, an owner,\na recurring constraint) or a one-off event that belongs in \\`log.jsonl\\` instead; only write\nthe former. Keep entries short — a long running log of events crowds out the facts that matter.\n\nQuerying, correcting, and forgetting memory are normal, expected requests, not edge cases:\n- If asked what you remember, read the memory file(s) above and list the entries plainly.\n- If asked to correct or forget something, edit the relevant MEMORY.md to remove or update\n  that entry, then confirm what changed.\n\n### Current Memory\n${memory}\n\n## Log Queries (for older history)\nFormat: \\`{\"date\":\"...\",\"ts\":\"...\",\"user\":\"...\",\"userName\":\"...\",\"text\":\"...\",\"isMessagingBot\":false}\\`\nThe log contains user messages and your final responses (not tool calls/results).\nUse \\`log.jsonl\\` for grep-style history.\n${isContainerLike ? \"Install jq: apt-get install jq\" : \"\"}\n\\`\\`\\`bash\n# Recent messages\ntail -30 log.jsonl | jq -c '{date: .date[0:19], user: (.userName // .user), text}'\n\n# Search for specific topic\ngrep -i \"topic\" log.jsonl | jq -c '{date: .date[0:19], user: (.userName // .user), text}'\n\n# Messages from specific user\ngrep '\"userName\":\"mario\"' log.jsonl | tail -20 | jq -c '{date: .date[0:19], text}'\n\n\\`\\`\\`\n\n## Tools\n- bash: Run shell commands (primary tool). Install packages as needed.\n- read: Read files\n- write: Create/overwrite files\n- edit: Surgical file edits\n- event: Schedule immediate, one-shot, or periodic follow-ups\n- sandbox: Inspect or temporarily adjust sandbox limits\n- attach: Share files to the platform\n- jev: Ask Jev (a fast calibrated decision model) boolean / choice / score questions about a state you supply; returns probabilities and confidence, never text. Use it whenever you need to classify, detect, score, rank, route, pick among known candidates, or verify.\n- web_fetch: Read a public web page or API as text. For versions, releases, prices, and dates, read the official page, registry, or API instead of answering from memory, and cite the URL.\n- react: Add an emoji reaction to the triggering message. mikan already acknowledges work on its own when your first tool starts, so do not react before starting work. Use a short name without colons (e.g. eyes, white_check_mark, +1); GitHub only accepts +1, -1, laugh, confused, heart, hooray, rocket, eyes and rejects anything else.\n\nEach tool requires a \"label\" parameter (shown to user).\n\n## Signatures\nmikan adds the \\`_Triggered by …_\\` signature to your final chat response; do not write it there yourself. When you write to GitHub (\\`gh issue comment\\`, \\`gh issue create\\`, \\`gh pr comment\\`, \\`gh pr create\\`, \\`gh pr review\\`, or a github_* tool that posts text), end the body with \\`_Triggered by @<user>_\\`, where <user> is the name in the triggering message's \\`[user]\\` prefix. For a scheduled event, use \\`_Triggered by [event: <name>]_\\`, where <name> is the event file named in the Event Trigger Mode instructions, without \\`.json\\`.\n`;\n}\n\nexport function buildSystemPrompt(input: BuildSystemPromptOptions): string {\n  const paths = buildRuntimePaths(input.workspacePath, input.office);\n  return `${buildContextPrompt(input, paths)}\\n\\n${buildWorkspaceSkillsPrompt(input, paths)}\\n\\n${buildOperatingPrompt(input, paths)}`;\n}\n\nexport function buildTurnInstructions(eventName: string | undefined): string {\n  if (eventName === undefined) return \"\";\n  return `## Event Trigger Mode\n- You are handling the scheduled event \\`${eventName}.json\\`, not opening a brand new chat with a stranger.\n- Treat the incoming user message as a self-contained task prepared by an earlier run.\n- Complete the task directly. Avoid generic greetings, self-introductions, or boilerplate offers to help.\n- For reminders/follow-ups, prefer a short direct response that sounds like a continuation of prior intent.\n- If the event text includes tone, brevity, or language instructions, follow them literally.`;\n}\n\nexport function appendTriggerAttribution(\n  text: string,\n  triggerAttribution: string | undefined,\n  sessionLink?: string,\n): string {\n  if (!triggerAttribution) return text;\n  const trimmed = text.trimEnd();\n  const signature = `_Triggered by ${triggerAttribution}_`;\n  const suffix = sessionLink ? `${signature} · session: ${sessionLink}` : signature;\n  const echoed = `Triggered by ${triggerAttribution}`;\n  const inline = trimmed.replace(/_$/, \"\");\n  const body = inline.endsWith(echoed)\n    ? inline.slice(0, -echoed.length).replace(/_$/, \"\").trimEnd()\n    : stripTriggerSignature(trimmed);\n  return `${body}\\n\\n${suffix}`;\n}\n"]}

package/dist/harness/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/harness/runner.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA8uBvE,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoGxF"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/harness/runner.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAktBvE,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAiGxF"}