@gitroll/tacitt-cli 0.0.0-stage → 0.1.0

package/dist/run-CCATsHS2.mjs

@@ -0,0 +1,916 @@
+import { tn as sessionSchema } from "./locate-Bn32k2se.mjs";
+import { t as createZstdFrameCheck$1 } from "./frame-D1j9R8xX.mjs";
+import "./src-CPPjOyHZ.mjs";
+import { a as isRecord } from "./model-7Nu7szNP.mjs";
+import { constants } from "node:fs";
+import { z } from "zod";
+import { lstat, open, stat } from "node:fs/promises";
+import { isIP } from "node:net";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { PassThrough, Readable } from "node:stream";
+import { createHash } from "node:crypto";
+import { pipeline } from "node:stream/promises";
+import { constants as constants$1, createZstdDecompress } from "node:zlib";
+import { getHeapStatistics } from "node:v8";
+import { lintSource } from "@secretlint/core";
+import { creator } from "@secretlint/secretlint-rule-aws";
+import { creator as creator$1 } from "@secretlint/secretlint-rule-privatekey";
+import { creator as creator$2 } from "@secretlint/secretlint-rule-basicauth";
+import { creator as creator$3 } from "@secretlint/secretlint-rule-github";
+//#region packages/harnesses/src/source/files.ts
+async function noSymlinks(path) {
+	if (!isAbsolute(path) || path.length > 16384) throw new Error("UNSAFE_SOURCE_PATH");
+	let current = resolve(path);
+	let depth = 0;
+	while (true) {
+		if (++depth > 256) throw new Error("UNSAFE_SOURCE_PATH");
+		if ((await lstat(current)).isSymbolicLink()) throw new Error("UNSAFE_SOURCE_PATH");
+		const parent = dirname(current);
+		if (parent === current) return;
+		current = parent;
+	}
+}
+function matches(value, snapshot, mode = "snapshot") {
+	if (!value.isFile() || value.dev.toString() !== snapshot.dev || value.ino.toString() !== snapshot.ino) return false;
+	if (mode === "append" && value.size > BigInt(snapshot.size)) return true;
+	return value.size === BigInt(snapshot.size) && value.mtimeNs.toString() === snapshot.mtimeNs && value.ctimeNs.toString() === snapshot.ctimeNs;
+}
+async function fileSnapshot(path, target) {
+	const value = target ?? await stat(path, { bigint: true });
+	if (!value.isFile() || value.size > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error("UNSAFE_SOURCE_PATH");
+	return {
+		dev: value.dev.toString(),
+		ino: value.ino.toString(),
+		size: Number(value.size),
+		mtimeNs: value.mtimeNs.toString(),
+		ctimeNs: value.ctimeNs.toString()
+	};
+}
+async function openSource(part, mode = "snapshot") {
+	const child = relative(resolve(part.root), resolve(part.path));
+	if (!isAbsolute(part.root) || !isAbsolute(part.path) || part.root.length > 16384 || part.path.length > 16384 || !child || isAbsolute(child) || child === ".." || child.startsWith(`..${sep}`)) throw new Error("UNSAFE_SOURCE_PATH");
+	if (!matches(await stat(part.path, { bigint: true }), part.snapshot, mode)) throw new Error("SOURCE_CHANGED");
+	const handle = await open(part.path, constants.O_RDONLY);
+	try {
+		if (!matches(await handle.stat({ bigint: true }), part.snapshot, mode)) throw new Error("SOURCE_CHANGED");
+		return handle;
+	} catch (error) {
+		try {
+			await handle.close();
+		} catch (cleanupError) {
+			throw new AggregateError([error, cleanupError], "SOURCE_METADATA_UNAVAILABLE", { cause: error });
+		}
+		throw error;
+	}
+}
+/** Returns true only when the source still matches the complete recorded snapshot. */
+async function checkOpenSource(part, handle, mode = "snapshot") {
+	const opened = await handle.stat({ bigint: true });
+	const current = await stat(part.path, { bigint: true });
+	if (!matches(opened, part.snapshot, mode) || !matches(current, part.snapshot, mode)) throw new Error("SOURCE_CHANGED");
+	return matches(opened, part.snapshot) && matches(current, part.snapshot);
+}
+async function checkSource(part) {
+	await (await openSource(part)).close();
+}
+//#endregion
+//#region packages/harnesses/src/preview/zstd/frame.ts
+function createZstdFrameCheck() {
+	return createZstdFrameCheck$1(() => {
+		throw new Error("PREVIEW_DECODE_FAILED");
+	});
+}
+//#endregion
+//#region packages/harnesses/src/preview/policy.ts
+const previewPolicyVersion = "turn-preview-v2";
+const previewLimits = {
+	recordBytes: 262144,
+	unitBytes: 65536,
+	messageBytes: 32768,
+	responseBytes: 131072,
+	pageUnits: 8,
+	completeUsers: 64,
+	gap: 8,
+	unitMilliseconds: 2e3,
+	requestMilliseconds: 3e4,
+	zstdWindowLogMax: 26
+};
+function previewSourceVersion(session) {
+	return createHash("sha256").update(JSON.stringify({
+		harness: session.harness,
+		sourceKey: session.sourceKey,
+		parts: session.parts.map((part) => ({
+			path: part.path,
+			root: part.root,
+			representation: part.representation,
+			snapshot: part.snapshot
+		}))
+	})).digest("hex");
+}
+function parsePreviewCursor(cursor, sourceVersion) {
+	if (cursor === null) return {
+		mode: "o",
+		ordinal: 0
+	};
+	if (cursor.length > 128) throw new Error("INVALID_PREVIEW_CURSOR");
+	const match = /^turn-preview-v2:([a-f0-9]{64}):([odr]):(0|[1-9][0-9]*)$/.exec(cursor);
+	const mode = match?.[2];
+	const ordinal = Number(match?.[3]);
+	if (!match || match[1] !== sourceVersion || mode !== "o" && mode !== "d" && mode !== "r" || !Number.isSafeInteger(ordinal) || mode === "d" && ordinal === 0) throw new Error("INVALID_PREVIEW_CURSOR");
+	return {
+		mode,
+		ordinal
+	};
+}
+function previewCursor(sourceVersion, mode, ordinal) {
+	return `${previewPolicyVersion}:${sourceVersion}:${mode}:${ordinal}`;
+}
+function selectedCount(total, mode) {
+	if (mode === "r") return 0;
+	if (total <= previewLimits.completeUsers) return total;
+	return Math.floor((total - 1) / previewLimits.gap) + 1 + ((total - 1) % previewLimits.gap === 0 ? 0 : 1);
+}
+function nextOrdinal(ordinal, total, mode) {
+	if (mode === "r" || ordinal >= total) return null;
+	if (ordinal === 0) return total > 0 ? 1 : null;
+	return mode === "d" || total <= previewLimits.completeUsers ? ordinal + 1 : Math.min(ordinal + previewLimits.gap, total);
+}
+function pageOrdinals(cursor, total, preamble) {
+	if (cursor.ordinal > total || cursor.mode === "d" && total === 0 || cursor.mode === "o" && total > previewLimits.completeUsers && cursor.ordinal > 0 && cursor.ordinal !== total && (cursor.ordinal - 1) % previewLimits.gap !== 0) throw new Error("INVALID_PREVIEW_CURSOR");
+	if (cursor.mode === "r") return [cursor.ordinal];
+	const result = [];
+	let ordinal = cursor.ordinal === 0 && !preamble && total > 0 ? 1 : cursor.ordinal;
+	while (ordinal !== null && result.length < previewLimits.pageUnits) {
+		result.push(ordinal);
+		ordinal = nextOrdinal(ordinal, total, cursor.mode);
+	}
+	return result;
+}
+//#endregion
+//#region packages/harnesses/src/preview/protocol.ts
+const previewInputSchema = z.object({
+	session: sessionSchema,
+	cursor: z.string().max(128).nullable()
+});
+const previewPageSchema = z.object({
+	processing: z.object({
+		kind: z.literal("configured"),
+		configurationId: z.string().max(128),
+		metadata: z.string().max(16384).nullable(),
+		metadataWithheld: z.boolean()
+	}).optional(),
+	policyVersion: z.literal(previewPolicyVersion),
+	sourceVersion: z.string().regex(/^[a-f0-9]{64}$/),
+	totalUserMessages: z.number().int().nonnegative(),
+	sampledUserMessages: z.number().int().nonnegative(),
+	skippedRanges: z.array(z.string().regex(/^[0-9]+-[0-9]+$/)).max(previewLimits.pageUnits),
+	incomplete: z.boolean(),
+	nextCursor: z.string().max(128).nullable(),
+	warnings: z.array(z.string().max(80)).max(32),
+	units: z.array(z.object({
+		ordinal: z.number().int().nonnegative(),
+		role: z.enum(["preamble", "user-turn"]),
+		text: z.string().nullable(),
+		detailsWithheld: z.boolean(),
+		conversation: z.object({
+			user: z.string().nullable(),
+			assistant: z.string().nullable(),
+			userWithheld: z.boolean(),
+			assistantWithheld: z.boolean(),
+			activities: z.array(z.string().max(80)).max(3)
+		}).nullable(),
+		withheld: z.boolean(),
+		warnings: z.array(z.string().max(80)).max(32)
+	})).max(previewLimits.pageUnits)
+});
+const previewMessageSchema = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("processing-start") }),
+	z.object({ kind: z.literal("processing-end") }),
+	z.object({
+		kind: z.literal("unit-start"),
+		ordinal: z.number().int().nonnegative(),
+		timeoutPage: previewPageSchema
+	}),
+	z.object({
+		kind: z.literal("unit-end"),
+		ordinal: z.number().int().nonnegative()
+	}),
+	z.object({
+		kind: z.literal("result"),
+		page: previewPageSchema
+	}),
+	z.object({
+		kind: z.literal("error"),
+		code: z.enum([
+			"SOURCE_CHANGED",
+			"INVALID_PREVIEW_CURSOR",
+			"PREVIEW_WITHHELD",
+			"PREVIEW_ENVELOPE_CHANGED",
+			"PROCESSING_PROTECTED_CUSTOM_TERM"
+		])
+	})
+]);
+//#endregion
+//#region packages/harnesses/src/preview/source-stream.ts
+async function* previewChunks(part) {
+	const handle = await openSource(part);
+	const framing = part.representation === "jsonl.zst" ? createZstdFrameCheck() : void 0;
+	async function* source() {
+		let position = 0;
+		while (position < part.snapshot.size) {
+			const bytes = new Uint8Array(Math.min(65536, part.snapshot.size - position));
+			const { bytesRead } = await handle.read(bytes, 0, bytes.length, position);
+			if (!bytesRead) throw new Error("SOURCE_CHANGED");
+			position += bytesRead;
+			const chunk = bytes.subarray(0, bytesRead);
+			const boundaries = framing?.push(chunk) ?? [];
+			let start = 0;
+			for (const end of boundaries) {
+				if (end > start) yield chunk.subarray(start, end);
+				start = end;
+			}
+			if (start < chunk.length) yield chunk.subarray(start);
+		}
+		framing?.finish();
+	}
+	const input = Readable.from(source(), {
+		objectMode: false,
+		highWaterMark: 65536
+	});
+	const decoded = part.representation === "jsonl.zst" ? createZstdDecompress({
+		chunkSize: 65536,
+		params: { [constants$1.ZSTD_d_windowLogMax]: previewLimits.zstdWindowLogMax }
+	}) : new PassThrough({ highWaterMark: 65536 });
+	const cancellation = new AbortController();
+	const completion = pipeline(input, decoded, { signal: cancellation.signal }).then(() => true, () => false);
+	let failed = false;
+	try {
+		try {
+			for await (const chunk of decoded) {
+				if (!(chunk instanceof Uint8Array)) throw new Error("PREVIEW_DECODE_FAILED");
+				yield chunk;
+			}
+			failed = !await completion;
+		} catch {
+			failed = true;
+		}
+		if (failed) yield null;
+	} finally {
+		cancellation.abort();
+		await completion;
+		try {
+			await checkOpenSource(part, handle);
+		} finally {
+			await handle.close();
+		}
+	}
+}
+//#endregion
+//#region packages/harnesses/src/preview/records.ts
+async function* streamRecords(part) {
+	const decoder = new TextDecoder("utf-8", {
+		fatal: true,
+		ignoreBOM: true
+	});
+	let pieces = [];
+	let length = 0;
+	let oversized = false;
+	const finish = (newline) => {
+		const bytes = length + (newline ? 1 : 0);
+		let result;
+		if (oversized) result = {
+			kind: "unclassified",
+			warning: "PREVIEW_RECORD_LIMIT",
+			bytes
+		};
+		else try {
+			const text = decoder.decode(Buffer.concat(pieces, length));
+			if (/^[\t\r ]*$/.test(text)) result = null;
+			else result = {
+				kind: "record",
+				value: JSON.parse(text),
+				bytes
+			};
+		} catch {
+			result = {
+				kind: "unclassified",
+				warning: "MALFORMED_PREVIEW_RECORD",
+				bytes
+			};
+		}
+		pieces = [];
+		length = 0;
+		oversized = false;
+		return result;
+	};
+	for await (const chunk of previewChunks(part)) {
+		if (chunk === null) {
+			if (length > 0) {
+				pieces = [];
+				length = 0;
+				oversized = false;
+			}
+			yield {
+				kind: "unclassified",
+				warning: "PREVIEW_DECODE_FAILED",
+				bytes: 0
+			};
+			continue;
+		}
+		let start = 0;
+		while (start < chunk.length) {
+			const newline = chunk.indexOf(10, start);
+			const end = newline < 0 ? chunk.length : newline;
+			const piece = chunk.subarray(start, end);
+			length += piece.length;
+			if (!Number.isSafeInteger(length)) throw new Error("PREVIEW_WITHHELD");
+			if (length > previewLimits.recordBytes) {
+				oversized = true;
+				pieces = [];
+			} else if (!oversized && piece.length) pieces.push(piece);
+			if (newline >= 0) {
+				if (length > 0) {
+					const record = finish(true);
+					if (record) yield record;
+				}
+				start = newline + 1;
+			} else start = chunk.length;
+		}
+	}
+	if (length > 0) {
+		const record = finish(false);
+		if (record) yield record;
+	}
+}
+//#endregion
+//#region packages/harnesses/src/preview/classify.ts
+function classifyRecord(value, harness, sourceRole) {
+	if (!isRecord(value)) return {
+		responseUser: false,
+		eventUser: false,
+		known: false
+	};
+	if (harness === "claude") {
+		const message = isRecord(value["message"]) ? value["message"] : null;
+		const content = Array.isArray(message?.["content"]) ? message["content"] : null;
+		const toolOnly = content !== null && content.length > 0 && content.every((item) => isRecord(item) && item["type"] === "tool_result");
+		return {
+			responseUser: sourceRole !== "worker" && value["isSidechain"] !== true && value["type"] === "user" && !toolOnly && value["isMeta"] !== true,
+			eventUser: false,
+			known: [
+				"user",
+				"assistant",
+				"system",
+				"progress",
+				"summary",
+				"result",
+				"queue-operation",
+				"file-history-snapshot",
+				"last-prompt",
+				"custom-title",
+				"compact-boundary"
+			].includes(String(value["type"]))
+		};
+	}
+	const payload = isRecord(value["payload"]) ? value["payload"] : null;
+	return {
+		responseUser: sourceRole !== "worker" && value["type"] === "response_item" && payload?.["role"] === "user" && (payload["type"] === "message" || payload["type"] === void 0),
+		eventUser: sourceRole !== "worker" && value["type"] === "event_msg" && payload?.["type"] === "user_message",
+		known: [
+			"session_meta",
+			"turn_context",
+			"compacted"
+		].includes(String(value["type"])) || payload !== null && ["response_item", "event_msg"].includes(String(value["type"]))
+	};
+}
+//#endregion
+//#region packages/harnesses/src/preview/conversation.ts
+function emptyConversation() {
+	return {
+		user: null,
+		assistant: null,
+		userWithheld: false,
+		assistantWithheld: false,
+		assistantMessages: 0,
+		toolCalls: 0,
+		toolResults: 0,
+		attachments: 0
+	};
+}
+function contentText(value, conversation) {
+	if (typeof value === "string") return value;
+	if (!Array.isArray(value)) return null;
+	const parts = [];
+	for (const item of value) {
+		if (!isRecord(item)) continue;
+		if ([
+			"text",
+			"input_text",
+			"output_text"
+		].includes(String(item["type"]))) {
+			if (typeof item["text"] === "string") parts.push(item["text"]);
+		} else if (item["type"] === "tool_use") conversation.toolCalls++;
+		else if (item["type"] === "tool_result") conversation.toolResults++;
+		else if ([
+			"image",
+			"input_image",
+			"document",
+			"attachment"
+		].includes(String(item["type"]))) conversation.attachments++;
+	}
+	return parts.length > 0 ? parts.join("\n\n") : null;
+}
+function assignMessage(conversation, role, text) {
+	if (text === null || role !== "user" && role !== "assistant") return;
+	const withheld = Buffer.byteLength(text) > previewLimits.messageBytes;
+	if (role === "user") {
+		conversation.user = withheld ? null : text;
+		conversation.userWithheld = withheld;
+	} else {
+		conversation.assistantMessages++;
+		conversation.assistant = withheld ? null : text;
+		conversation.assistantWithheld = withheld;
+	}
+}
+function collectConversation(conversation, value, harness, mode, sourceRole) {
+	if (!isRecord(value)) return;
+	if (harness === "claude") {
+		const message = isRecord(value["message"]) ? value["message"] : null;
+		if (message && value["isMeta"] !== true && (value["type"] === "user" || value["type"] === "assistant")) {
+			const text = contentText(message["content"], conversation);
+			if (sourceRole !== "worker" && value["isSidechain"] !== true) assignMessage(conversation, value["type"], text);
+		}
+		return;
+	}
+	const payload = isRecord(value["payload"]) ? value["payload"] : null;
+	if (!payload) return;
+	const type = typeof payload["type"] === "string" ? payload["type"] : "";
+	if (value["type"] === "response_item") {
+		if ((payload["type"] === "message" || payload["type"] === void 0) && (payload["role"] === "user" || payload["role"] === "assistant")) {
+			const text = contentText(payload["content"], conversation);
+			if (sourceRole !== "worker") assignMessage(conversation, payload["role"], text);
+		} else if (["function_call", "custom_tool_call"].includes(type)) conversation.toolCalls++;
+		else if (["function_call_output", "custom_tool_call_output"].includes(type)) conversation.toolResults++;
+	} else if (value["type"] === "event_msg" && mode === "event") {
+		const role = payload["type"] === "user_message" ? "user" : payload["type"] === "agent_message" ? "assistant" : null;
+		const text = contentText(payload["message"], conversation);
+		if (sourceRole !== "worker") assignMessage(conversation, role, text);
+	}
+}
+function activitySummaries(conversation) {
+	const summaries = [];
+	const tools = Math.max(conversation.toolCalls, conversation.toolResults);
+	if (tools > 0) summaries.push(`${tools} tool ${tools === 1 ? "activity" : "activities"}`);
+	if (conversation.attachments > 0) summaries.push(`${conversation.attachments} ${conversation.attachments === 1 ? "attachment" : "attachments"}`);
+	const earlier = conversation.assistantMessages - 1;
+	if (earlier > 0) summaries.push(`${earlier} earlier assistant ${earlier === 1 ? "update" : "updates"}`);
+	return summaries;
+}
+//#endregion
+//#region packages/harnesses/src/preview/sequence.ts
+async function countSequence(session, stream = streamRecords) {
+	const parts = [];
+	const warnings = /* @__PURE__ */ new Set();
+	let totalUsers = 0;
+	let preamble = false;
+	let incomplete = false;
+	for (const part of session.parts) {
+		let responseUsers = 0;
+		let eventUsers = 0;
+		let responsePrefix = false;
+		let eventPrefix = false;
+		for await (const record of stream(part)) {
+			if (record.kind === "unclassified") {
+				incomplete = true;
+				warnings.add(record.warning);
+				responsePrefix ||= responseUsers === 0;
+				eventPrefix ||= eventUsers === 0;
+				continue;
+			}
+			const boundary = record.kind === "boundary" ? {
+				...record,
+				known: true
+			} : classifyRecord(record.value, session.harness, record.sourceRole);
+			if (!boundary.known) {
+				incomplete = true;
+				warnings.add("UNKNOWN_PREVIEW_RECORD");
+			}
+			if (boundary.responseUser) responseUsers++;
+			else responsePrefix ||= responseUsers === 0;
+			if (boundary.eventUser) eventUsers++;
+			else eventPrefix ||= eventUsers === 0;
+		}
+		const mode = session.harness === "codex" && responseUsers === 0 && eventUsers > 0 ? "event" : "response";
+		const users = mode === "event" ? eventUsers : responseUsers;
+		if (totalUsers === 0) preamble ||= mode === "event" ? eventPrefix : responsePrefix;
+		totalUsers += users;
+		if (!Number.isSafeInteger(totalUsers)) throw new Error("PREVIEW_WITHHELD");
+		parts.push({
+			mode,
+			users
+		});
+		if (mode === "event") warnings.add("CODEX_EVENT_MESSAGE_FALLBACK");
+	}
+	if (incomplete) warnings.add("USER_COUNT_INCOMPLETE");
+	if (totalUsers === 0) {
+		preamble = true;
+		warnings.add("NO_RECOGNIZED_USER_MESSAGES");
+	}
+	return {
+		parts,
+		totalUsers,
+		preamble,
+		incomplete,
+		warnings: [...warnings]
+	};
+}
+async function retainUnits(session, summary, ordinals, details = false, stream = streamRecords) {
+	const units = new Map(ordinals.map((ordinal) => [ordinal, {
+		ordinal,
+		records: [],
+		bytes: 0,
+		withheld: false,
+		detailsWithheld: false,
+		conversation: emptyConversation(),
+		warnings: [],
+		seen: false
+	}]));
+	let ordinal = 0;
+	for (const [index, part] of session.parts.entries()) {
+		const mode = summary.parts[index]?.mode;
+		if (!mode) throw new Error("SOURCE_CHANGED");
+		for await (const record of stream(part)) {
+			if (record.kind === "record" || record.kind === "boundary") {
+				const boundary = record.kind === "boundary" ? record : classifyRecord(record.value, session.harness, record.sourceRole);
+				if (mode === "event" ? boundary.eventUser : boundary.responseUser) ordinal++;
+			}
+			const unit = units.get(ordinal);
+			if (!unit) continue;
+			unit.seen = true;
+			unit.bytes += record.bytes;
+			if (record.kind === "boundary") {
+				unit.withheld = true;
+				unit.warnings.push("PREVIEW_WITHHELD");
+			}
+			if (record.kind === "unclassified") {
+				unit.withheld = true;
+				if (!unit.warnings.includes(record.warning)) unit.warnings.push(record.warning);
+			}
+			if (unit.bytes > previewLimits.unitBytes) {
+				unit.detailsWithheld = true;
+				if (!unit.warnings.includes("PREVIEW_DETAILS_LIMIT")) unit.warnings.push("PREVIEW_DETAILS_LIMIT");
+			}
+			if (!details && !unit.withheld && record.kind === "record") collectConversation(unit.conversation, record.value, session.harness, mode, record.sourceRole);
+			if (unit.withheld || unit.detailsWithheld) unit.records = [];
+			else if (details && record.kind === "record") unit.records.push(record.value);
+		}
+	}
+	if (ordinal !== summary.totalUsers) throw new Error("SOURCE_CHANGED");
+	for (const unit of units.values()) {
+		if (!unit.seen) {
+			unit.withheld = true;
+			unit.warnings.push("EMPTY_PREVIEW_UNIT");
+		}
+		unit.warnings = [...new Set(unit.warnings)];
+	}
+	return [...units.values()];
+}
+//#endregion
+//#region packages/harnesses/src/preview/page.ts
+function previewPage(context, units) {
+	const { sourceVersion, cursor, summary } = context;
+	const last = units.at(-1)?.ordinal;
+	const next = last === void 0 ? cursor.ordinal : nextOrdinal(last, summary.totalUsers, cursor.mode);
+	const skippedRanges = [];
+	if (cursor.mode === "o" && summary.totalUsers > previewLimits.completeUsers) for (const unit of units) {
+		if (unit.ordinal === 0) continue;
+		const following = nextOrdinal(unit.ordinal, summary.totalUsers, cursor.mode);
+		if (following !== null && following > unit.ordinal + 1) skippedRanges.push(`${unit.ordinal + 1}-${following - 1}`);
+	}
+	const incomplete = summary.incomplete || (context.processing?.metadataWithheld ?? false) || units.some((unit) => unit.withheld || unit.detailsWithheld || unit.conversation?.userWithheld || unit.conversation?.assistantWithheld);
+	return {
+		...context.processing ? { processing: context.processing } : {},
+		policyVersion: previewPolicyVersion,
+		sourceVersion,
+		totalUserMessages: summary.totalUsers,
+		sampledUserMessages: cursor.mode === "d" ? units.length : selectedCount(summary.totalUsers, cursor.mode),
+		skippedRanges,
+		incomplete,
+		units,
+		nextCursor: next === null ? null : previewCursor(sourceVersion, cursor.mode, next),
+		warnings: [
+			...summary.warnings,
+			...incomplete ? ["INCOMPLETE_PREVIEW"] : [],
+			...cursor.mode === "d" ? ["CONSECUTIVE_DRILLDOWN"] : []
+		]
+	};
+}
+function pageFits(page) {
+	return Buffer.byteLength(JSON.stringify(page)) <= previewLimits.responseBytes;
+}
+function withheldUnit(ordinal, warnings) {
+	return {
+		ordinal,
+		role: ordinal === 0 ? "preamble" : "user-turn",
+		text: null,
+		detailsWithheld: true,
+		conversation: null,
+		withheld: true,
+		warnings: [...new Set(warnings)]
+	};
+}
+//#endregion
+//#region packages/harnesses/src/preview/worker/heap.ts
+const previewHeapLimits = {
+	maxOldGenerationSizeMb: 128,
+	maxYoungGenerationSizeMb: 32
+};
+const maximumBytes = (previewHeapLimits.maxOldGenerationSizeMb + 96) * 1024 ** 2;
+const minimumBytes = previewHeapLimits.maxOldGenerationSizeMb * 1024 ** 2;
+/** Fails closed so no preview runs under a heap the Worker resource limits did not bound. */
+function assertPreviewHeap(limitBytes = getHeapStatistics().heap_size_limit) {
+	if (limitBytes < minimumBytes || limitBytes > maximumBytes) throw new Error("PREVIEW_HEAP_LIMIT_INVALID");
+}
+//#endregion
+//#region packages/harnesses/src/preview/guard/identifiers.ts
+function luhn(value) {
+	let sum = 0;
+	let double = false;
+	for (let index = value.length - 1; index >= 0; index--) {
+		let digit = Number(value[index]);
+		if (double) {
+			digit *= 2;
+			if (digit > 9) digit -= 9;
+		}
+		sum += digit;
+		double = !double;
+	}
+	return sum % 10 === 0;
+}
+function redactIdentifiers(text) {
+	return text.replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[EMAIL]").replace(/\b[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/gi, "[UUID]").replace(/\b(?:\d{1,3}\.){3}\d{1,3}\b/g, (candidate) => isIP(candidate) === 4 ? "[IP]" : candidate).replace(/(?<![\w:])\[?[0-9a-f.:]+(?:%[\w.-]+)?\]?(?![\w:])/gi, (candidate) => {
+		if (!candidate.includes(":")) return candidate;
+		const address = candidate.replace(/^\[|\]$/g, "").split("%")[0] ?? "";
+		return isIP(address) === 6 ? "[IP]" : candidate;
+	}).replace(/(?<!\d)(?:\d[ -]?){12,18}\d(?!\d)/g, (candidate) => {
+		const digits = candidate.replace(/[ -]/g, "");
+		return !/^(\d)\1+$/.test(digits) && luhn(digits) ? "[PAYMENT_CARD]" : candidate;
+	});
+}
+//#endregion
+//#region packages/harnesses/src/preview/guard/context.ts
+const sensitiveKeys = /* @__PURE__ */ new Set([
+	"password",
+	"passwd",
+	"pwd",
+	"secret",
+	"clientsecret",
+	"token",
+	"accesstoken",
+	"refreshtoken",
+	"idtoken",
+	"apikey",
+	"credential",
+	"credentials",
+	"privatekey",
+	"authorization",
+	"proxyauthorization",
+	"cookie",
+	"setcookie",
+	"xapikey",
+	"awsaccesskeyid",
+	"awssecretaccesskey",
+	"awssessiontoken",
+	"databasepassword"
+]);
+const pathKeys = /* @__PURE__ */ new Set([
+	"cwd",
+	"workingdirectory",
+	"filepath",
+	"filename",
+	"directory",
+	"homedir",
+	"path"
+]);
+const normalizeKey = (key) => key.toLowerCase().replace(/[^a-z0-9]/g, "");
+function valueCategory(key, value) {
+	if (key === void 0) return null;
+	const normalized = normalizeKey(key);
+	if (sensitiveKeys.has(normalized)) return "[SECRET]";
+	if (typeof value === "string" && pathKeys.has(normalized) && /^(?:\/|[a-z]:[\\/]|\\\\|~[^/]*\/)/i.test(value)) return "[PATH]";
+	if (typeof value === "string" && [
+		"hostname",
+		"server",
+		"endpoint",
+		"host"
+	].includes(normalized) && /^[a-z0-9.-]+(?::\d+)?$/i.test(value)) return "[HOST]";
+	return null;
+}
+function redactContext(text) {
+	return text.replace(/-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-\r\n]*PRIVATE KEY-----|$)/g, "[PRIVATE_KEY]").replace(/\b(?:gh[pousr]_[a-z0-9_]{8,}|github_pat_[a-z0-9_]{8,}|sk-(?:ant-)?[a-z0-9_-]{8,}|AKIA[A-Z0-9]{16}|ASIA[A-Z0-9]{16})\b/gi, "[SECRET]").replace(/\beyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_.-]+\b/g, "[TOKEN]").replace(/\b(authorization|proxy-authorization|cookie|set-cookie)\s*["']?\s*[:=]\s*[^\r\n]+/gi, "$1: [SECRET]").replace(/\b((?:aws[_-]?)?(?:secret[_-]?access[_-]?key|access[_-]?key[_-]?id|session[_-]?token)|password|passwd|client[_-]?secret|secret|(?:access[_-]?|refresh[_-]?|id[_-]?)?token|api[_-]?key|credential|private[_-]?key)\s*["']?\s*[:=]\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,;\]}]+)/gi, "$1=[SECRET]").replace(/--(?:password|passwd|token|api-key|secret)(?:=|\s+)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s]+)/gi, "--credential [SECRET]");
+}
+//#endregion
+//#region packages/harnesses/src/preview/guard/paths.ts
+const sensitiveQuery = /^(?:access_token|token|api[_-]?key|key|secret|password|signature|sig|credential|x-amz-.+|x-goog-.+)$/i;
+function redactLocations(text, localRoots) {
+	let result = text;
+	for (const root of [...localRoots].filter((value) => value.length > 1).sort((a, b) => b.length - a.length)) {
+		const escaped = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		result = result.replace(new RegExp(`${escaped}(?![a-zA-Z0-9_.-])(?:[/\\\\][^\\s"'<>]*)?`, "g"), "[PATH]");
+	}
+	result = result.replace(/\b(?:https?|ssh|git|file|postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s<>"']+/gi, (candidate) => {
+		try {
+			const url = new URL(candidate);
+			if (url.protocol === "file:") return "[PATH]";
+			if (url.username || url.password || [...url.searchParams.keys()].some((key) => sensitiveQuery.test(key)) || url.hash) return "[PRIVATE_URL]";
+			if (["ssh:", "git:"].includes(url.protocol) || /\.git\/?$/.test(url.pathname) || /^(?:github\.com|gitlab\.com|bitbucket\.org|dev\.azure\.com)$/i.test(url.hostname)) return "[GIT_REMOTE]";
+			return candidate;
+		} catch {
+			return "[PRIVATE_URL]";
+		}
+	});
+	return result.replace(/\b[a-z]:[\\/][^\r\n"'<>]+/gi, "[PATH]").replace(/\\\\[^\s"'<>]+/g, "[PATH]").replace(/(?<![\w/])~[^\s/]*\/[^\s"'<>]+/g, "[PATH]").replace(/(?<![\w/:])\/(?:home|Users|tmp|var|opt|mnt|workspace|workspaces|private|root)\/[^\s"'<>]+/g, "[PATH]").replace(/\b[a-z0-9._-]+@[a-z0-9.-]+:[^\s"'<>]+/gi, "[GIT_REMOTE]").replace(/\bFile\s+["']\/[^"'\r\n]+["']/g, "File [PATH]");
+}
+//#endregion
+//#region packages/harnesses/src/preview/guard/index.ts
+const selected = [
+	creator,
+	creator$1,
+	creator$2,
+	creator$3
+];
+const config = { rules: selected.map((rule) => ({
+	id: rule.meta.id,
+	rule,
+	options: rule === creator ? { enableIDScanRule: true } : {}
+})) };
+selected.map((rule) => rule.meta.id);
+async function redact(text, roots) {
+	if (text.length > 65536) throw new Error("TEXT_LIMIT");
+	const spans = (await lintSource({
+		source: {
+			content: text,
+			filePath: "/virtual/session.txt",
+			contentType: "text"
+		},
+		options: {
+			config,
+			maskSecrets: true,
+			noPhysicFilePath: true
+		}
+	})).messages.map((message) => message.range).sort((a, b) => a[0] - b[0]);
+	let end = 0;
+	let output = "";
+	for (const span of spans) {
+		if (span[1] <= end) continue;
+		if (span[0] > end) output += text.slice(end, span[0]);
+		output += "[SECRET]";
+		end = span[1];
+	}
+	output += text.slice(end);
+	return redactIdentifiers(redactContext(redactLocations(output, roots)));
+}
+async function previewText(text, roots) {
+	try {
+		if (Buffer.byteLength(text) > previewLimits.messageBytes) return null;
+		const safe = await redact(text, roots);
+		return Buffer.byteLength(safe) <= previewLimits.messageBytes ? safe : null;
+	} catch {
+		return null;
+	}
+}
+async function preview(value, injectFailure = false, context = {}) {
+	let fields = 0;
+	const parts = [];
+	let outputBytes = 0;
+	const roots = context.localRoots ?? [];
+	const append = async (value) => {
+		const safe = await redact(value, roots);
+		outputBytes += Buffer.byteLength(safe) + 1;
+		if (outputBytes > 65536) throw new Error("PREVIEW_LIMIT");
+		parts.push(safe);
+	};
+	async function visit(input, depth, key) {
+		if (injectFailure) throw new Error("INJECTED_SCANNER_FAILURE");
+		if (depth > 32 || ++fields > 4096) throw new Error("STRUCTURE_LIMIT");
+		const category = valueCategory(key, input);
+		if (category) {
+			await append(`${key ?? ""}: ${category}`);
+			return;
+		}
+		if (Array.isArray(input)) {
+			if (key !== void 0) await append(key);
+			for (const item of input) await visit(item, depth + 1);
+		} else if (input !== null && typeof input === "object") {
+			if (key !== void 0) await append(key);
+			for (const [childKey, child] of Object.entries(input)) await visit(child, depth + 1, childKey);
+		} else await append(`${key === void 0 ? "" : `${key}: `}${String(input)}`);
+	}
+	try {
+		await visit(value, 0);
+		const text = parts.join("\n");
+		if (Buffer.byteLength(text) > 65536) throw new Error("PREVIEW_LIMIT");
+		return {
+			status: "ready",
+			text,
+			fields
+		};
+	} catch {
+		return {
+			status: "withheld",
+			fields
+		};
+	}
+}
+//#endregion
+//#region packages/harnesses/src/preview/presentation.ts
+async function presentUnit(item, details, localRoots, presentation = {
+	records: async (records) => {
+		const guarded = await preview(records, false, { localRoots });
+		return guarded.status === "withheld" ? null : guarded.text ?? null;
+	},
+	text: (text) => previewText(text, localRoots)
+}) {
+	const warnings = [...item.warnings];
+	let text = null;
+	let detailsWithheld = item.detailsWithheld;
+	let conversation = null;
+	if (details && !detailsWithheld) {
+		text = await presentation.records(item.records);
+		detailsWithheld = text === null;
+		if (detailsWithheld) warnings.push("PREVIEW_DETAILS_WITHHELD");
+	} else if (!details && item.ordinal > 0) {
+		const body = item.conversation;
+		const user = body.user === null ? null : await presentation.text(body.user);
+		const assistant = body.assistant === null ? null : await presentation.text(body.assistant);
+		const userWithheld = body.userWithheld || body.user !== null && user === null;
+		const assistantWithheld = body.assistantWithheld || body.assistant !== null && assistant === null;
+		conversation = {
+			user,
+			assistant,
+			userWithheld,
+			assistantWithheld,
+			activities: activitySummaries(body)
+		};
+		if (userWithheld || assistantWithheld) warnings.push("PREVIEW_MESSAGE_WITHHELD");
+	}
+	return {
+		ordinal: item.ordinal,
+		role: item.ordinal === 0 ? "preamble" : "user-turn",
+		text,
+		detailsWithheld,
+		conversation,
+		withheld: false,
+		warnings
+	};
+}
+//#endregion
+//#region packages/harnesses/src/preview/run.ts
+async function runPreview(session, rawCursor, notify, processed) {
+	const sourceVersion = processed?.sourceVersion ?? previewSourceVersion(session);
+	const cursor = parsePreviewCursor(rawCursor, sourceVersion);
+	const stream = processed?.stream;
+	const summary = await countSequence(session, processed?.countStream ?? processed?.stream);
+	const ordinals = pageOrdinals(cursor, summary.totalUsers, summary.preamble);
+	processed?.select?.(summary, ordinals);
+	const retained = await retainUnits(session, summary, ordinals, cursor.mode === "r", stream);
+	const processing = processed?.processing();
+	const context = {
+		sourceVersion,
+		cursor,
+		summary,
+		...processing ? { processing } : {}
+	};
+	const units = [];
+	const localRoots = [...new Set(session.parts.map((part) => part.root))];
+	for (const item of retained) {
+		let unit;
+		if (item.withheld) unit = withheldUnit(item.ordinal, item.warnings);
+		else {
+			const timeoutPage = previewPage(context, [...units, withheldUnit(item.ordinal, ["PREVIEW_UNIT_TIMEOUT"])]);
+			if (!pageFits(timeoutPage)) break;
+			notify({
+				kind: "unit-start",
+				ordinal: item.ordinal,
+				timeoutPage
+			});
+			unit = await presentUnit(item, cursor.mode === "r", localRoots, processed?.presentation);
+			notify({
+				kind: "unit-end",
+				ordinal: item.ordinal
+			});
+			item.records = [];
+		}
+		if (!pageFits(previewPage(context, [...units, unit]))) {
+			if (units.length > 0) break;
+			unit = withheldUnit(item.ordinal, ["PREVIEW_RESPONSE_LIMIT"]);
+		}
+		units.push(unit);
+	}
+	for (const part of session.parts) await checkSource(part);
+	const result = previewPage(context, units);
+	if (units.length === 0 || !pageFits(result)) throw new Error("PREVIEW_WITHHELD");
+	return result;
+}
+//#endregion
+export { classifyRecord as a, previewLimits as c, checkOpenSource as d, checkSource as f, openSource as h, pageFits as i, previewSourceVersion as l, noSymlinks as m, assertPreviewHeap as n, previewInputSchema as o, fileSnapshot as p, previewHeapLimits as r, previewMessageSchema as s, runPreview as t, createZstdFrameCheck as u };