@gobing-ai/ts-runtime 0.4.28 → 0.4.31

package/README.md

@@ -261,16 +261,17 @@ the most secure and performant default:
 | ------- | --------- | ------------ | ------- |
 | **Package specifier** (recommended) | `$schema: "@gobing-ai/ts-rule-engine/schemas/rule-file.schema.json"` | Resolved through `node_modules` via the module resolver, then read from disk | No network, no path guessing; survives hoisting/pnpm/monorepo layouts. Schemas ship in each package's `schemas/` (declared in `files`). **Quote the value** — YAML treats a leading `@` as reserved. |
 | Relative path | `$schema: ./schemas/rule-file.schema.json` | Resolved against the config file's directory | Fine for repo-local schemas; brittle if the config moves. |
-| Remote URL | `$schema: https://json-schema.org/.../rule-file.schema.json` | Fetched over HTTP(S) — **off by default** | SSRF/DoS surface for third-party configs. Opt in with `{ allowRemote: true }` (5s timeout) or supply your own `fetch`. |
+| Remote URL | `$schema: https://json-schema.org/.../rule-file.schema.json` | Fetched over HTTP(S) — **off by default** | SSRF/DoS surface for third-party configs. Opt in with **both** `{ allowRemote: true }` **and** a `fetch` implementation — there is no built-in fetch; the caller owns timeout/credentials. |
 
 ```ts
 // Bundled package schema (default path — no extra options needed):
 //   $schema: "@gobing-ai/ts-rule-engine/schemas/rule-file.schema.json"
 await loadStructuredConfig('rules.yaml');
 
-// Remote schema is refused unless explicitly enabled:
-await loadStructuredConfig('rules.yaml', { allowRemote: true });        // built-in fetch, time-bounded
-await loadStructuredConfig('rules.yaml', { fetch: myFetch });           // or inject your own
+// Remote schema is refused unless BOTH flags are present:
+await loadStructuredConfig('rules.yaml', { allowRemote: true, fetch: myFetch }); // caller-supplied fetch
+// { allowRemote: true } alone -> refused (no built-in fetch)
+// { fetch: myFetch } alone     -> refused (no explicit opt-in)
 ```
 
 > **Security:** remote schema fetching is disabled by default. Resolving a bundled schema from

package/dist/fs.d.ts

@@ -5,13 +5,21 @@ export declare function ensureDirForFile(path: string, fs?: CanonicalFileSystem)
 export declare function atomicWriteFile(path: string, content: string, fs?: CanonicalFileSystem): Promise<void>;
 /** Atomically writes a value as JSON with trailing newline. */
 export declare function atomicWriteJson(path: string, value: unknown, fs?: CanonicalFileSystem): Promise<void>;
-/** Reads and parses a JSON file. */
+/** Reads and parses a JSON file. Throws with the file named when the content is not valid JSON. */
 export declare function readJsonFile<T = unknown>(path: string, fs?: CanonicalFileSystem): Promise<T>;
 /** Writes a value as JSON with 2-space indentation and trailing newline. */
 export declare function writeJsonFile(path: string, value: unknown, fs?: CanonicalFileSystem): Promise<void>;
 /**
  * Recursively walks a directory, returning sorted paths to all files,
  * optionally excluding entries by name.
+ *
+ * Cycle-safe and root-confined (task 0060 F3): directory symlinks are tracked
+ * by their canonical real path, so a link back to an ancestor (or the start
+ * root itself) is walked once at most, and a link escaping the start root is
+ * skipped. In-root directory symlinks are still traversed — importer and
+ * rule-engine walk `$HOME/...` trees that are often symlinks into a dotfiles
+ * repo. When the filesystem has no `realPath` (in-memory / CF stubs), today's
+ * follow-`stat` behaviour is kept (no ambient capability).
  */
 export declare function walkDir(path: string, fs?: CanonicalFileSystem, exclude?: Set<string>): Promise<string[]>;
 /**

package/dist/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,IAAI,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGvE,iEAAiE;AACjE,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,mBAA4C,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpH;AAED,0GAA0G;AAC1G,wBAAsB,eAAe,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,EAAE,GAAE,mBAA4C,GACjD,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,+DAA+D;AAC/D,wBAAsB,eAAe,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,EAAE,GAAE,mBAA4C,GACjD,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,oCAAoC;AACpC,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC1C,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE,mBAA4C,GACjD,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,EAAE,GAAE,mBAA4C,GACjD,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;GAGG;AACH,wBAAsB,OAAO,CACzB,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE,mBAA4C,EAChD,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACtB,OAAO,CAAC,MAAM,EAAE,CAAC,CAcnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC3B,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE,mBAA4C,GACjD;IAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,IAAI,IAAI,CAAA;CAAE,CAE7C"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,IAAI,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGvE,iEAAiE;AACjE,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,mBAA4C,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpH;AAED,0GAA0G;AAC1G,wBAAsB,eAAe,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,EAAE,GAAE,mBAA4C,GACjD,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,+DAA+D;AAC/D,wBAAsB,eAAe,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,EAAE,GAAE,mBAA4C,GACjD,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,mGAAmG;AACnG,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC1C,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE,mBAA4C,GACjD,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,EAAE,GAAE,mBAA4C,GACjD,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,OAAO,CACzB,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE,mBAA4C,EAChD,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACtB,OAAO,CAAC,MAAM,EAAE,CAAC,CAMnB;AAkCD;;GAEG;AACH,wBAAgB,eAAe,CAC3B,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE,mBAA4C,GACjD;IAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,IAAI,IAAI,CAAA;CAAE,CAE7C"}

package/dist/fs.js

@@ -15,9 +15,15 @@ export async function atomicWriteFile(path, content, fs = createNodeFileSystem()
 export async function atomicWriteJson(path, value, fs = createNodeFileSystem()) {
     await atomicWriteFile(path, `${JSON.stringify(value, null, 2)}\n`, fs);
 }
-/** Reads and parses a JSON file. */
+/** Reads and parses a JSON file. Throws with the file named when the content is not valid JSON. */
 export async function readJsonFile(path, fs = createNodeFileSystem()) {
-    return JSON.parse(await fs.readFile(path));
+    const content = await fs.readFile(path);
+    try {
+        return JSON.parse(content);
+    }
+    catch (error) {
+        throw new Error(`Failed to parse JSON file "${path}": ${error.message}`);
+    }
 }
 /** Writes a value as JSON with 2-space indentation and trailing newline. */
 export async function writeJsonFile(path, value, fs = createNodeFileSystem()) {
@@ -26,23 +32,46 @@ export async function writeJsonFile(path, value, fs = createNodeFileSystem()) {
 /**
  * Recursively walks a directory, returning sorted paths to all files,
  * optionally excluding entries by name.
+ *
+ * Cycle-safe and root-confined (task 0060 F3): directory symlinks are tracked
+ * by their canonical real path, so a link back to an ancestor (or the start
+ * root itself) is walked once at most, and a link escaping the start root is
+ * skipped. In-root directory symlinks are still traversed — importer and
+ * rule-engine walk `$HOME/...` trees that are often symlinks into a dotfiles
+ * repo. When the filesystem has no `realPath` (in-memory / CF stubs), today's
+ * follow-`stat` behaviour is kept (no ambient capability).
  */
 export async function walkDir(path, fs = createNodeFileSystem(), exclude) {
-    const entries = (await fs.readDir(path)).sort();
+    const startReal = fs.realPath?.(path) ?? path;
+    const visited = new Set([startReal]);
     const result = [];
+    await walkDirInto(path, fs, exclude, startReal, visited, result);
+    return result;
+}
+async function walkDirInto(path, fs, exclude, startReal, visited, result) {
+    const entries = (await fs.readDir(path)).sort();
     for (const entry of entries) {
         if (exclude?.has(entry))
             continue;
         const fullPath = joinPath(path, entry);
         const entryStat = await fs.stat(fullPath);
         if (entryStat?.isDirectory()) {
-            result.push(...(await walkDir(fullPath, fs, exclude)));
+            const entryReal = fs.realPath?.(fullPath) ?? fullPath;
+            if (visited.has(entryReal))
+                continue; // cycle or already-walked real dir
+            if (fs.realPath !== undefined &&
+                entryReal !== startReal &&
+                !entryReal.startsWith(`${startReal}/`) &&
+                !entryReal.startsWith(`${startReal}\\`)) {
+                continue; // symlink escapes the start root
+            }
+            visited.add(entryReal);
+            await walkDirInto(fullPath, fs, exclude, startReal, visited, result);
         }
         else if (entryStat?.isFile()) {
             result.push(fullPath);
         }
     }
-    return result;
 }
 /**
  * Creates a writable stream for append-only output at the given path.

package/dist/process-executor.d.ts

@@ -48,6 +48,13 @@ export interface ProcessOptions {
     args?: string[];
     cwd?: string;
     env?: Record<string, string>;
+    /**
+     * `'merge'` (default): a partial `env` extends the parent environment (execa
+     * `extendEnv: true` semantics). `'replace'`: the child gets exactly `env` and
+     * none of the parent variables. Task 0060 R5 unified the default to merge so
+     * `run` and `runStreaming` share one contract.
+     */
+    envMode?: 'merge' | 'replace';
     timeout?: number;
     maxOutput?: number;
     label?: string;
@@ -114,6 +121,8 @@ export interface ProcessEventDetail {
     timestamp: string;
     label?: string;
     error?: string;
+    /** Producer-owned observability severity. */
+    severity: 'info' | 'warning' | 'error';
 }
 /** Zero-dependency structural event sink for process observability. */
 export interface ProcessEventSink {
@@ -134,6 +143,12 @@ export interface PipeProcessOptions {
     args?: string[];
     cwd?: string;
     env?: Record<string, string>;
+    /**
+     * `'merge'` (default): a partial `env` extends the parent environment, matching
+     * {@link ProcessExecutor.run}. `'replace'`: the child gets exactly `env`.
+     * Previously `runStreaming` always replaced; task 0060 R5 made merge the default.
+     */
+    envMode?: 'merge' | 'replace';
     label?: string;
     /**
      * Registry metadata (spur#0264). Defaults: source `'other'` for streaming.

package/dist/process-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-executor.d.ts","sourceRoot":"","sources":["../src/process-executor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAIpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzG,sGAAsG;AACtG,MAAM,WAAW,qBAAqB;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAChD;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAExE,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC7B,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACvF;AAED,yFAAyF;AACzF,MAAM,MAAM,aAAa,GAAG;IACxB,iBAAiB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACxD,gBAAgB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC1D,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACvB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAED,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iDAAiD;AACjD,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AAElD,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAC7C,QAAQ,IAAI,IAAI,CAAC;IACjB,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC5B;;;OAGG;IACH,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAErD;;;;;OAKG;IACH,YAAY,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAAC;CAC1D;AAID;;;;;;;GAOG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEnC,MAAM,GAAE,qBAA0B;IAI9C;;;OAGG;IACG,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;YAI5C,WAAW;IA6FzB;;;;;OAKG;IACH,YAAY,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW;YA2DxC,KAAK;IAKnB,OAAO,CAAC,aAAa;IAwBrB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,oBAAoB;IA0B5B,OAAO,CAAC,gBAAgB;CAG3B;AAiHD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,4BAAsB,CAAC;AAInD;;;;GAIG;AACH,qBAAa,sBAAsB;IAC/B,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,aAAa;CA2BnE;AAED;;;GAGG;AACH,qBAAa,qBAAqB;IAC9B,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW;CAWlD"}
+{"version":3,"file":"process-executor.d.ts","sourceRoot":"","sources":["../src/process-executor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAIpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzG,sGAAsG;AACtG,MAAM,WAAW,qBAAqB;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAChD;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AASxE,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;CAC1C;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC7B,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACvF;AAED,yFAAyF;AACzF,MAAM,MAAM,aAAa,GAAG;IACxB,iBAAiB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACxD,gBAAgB,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC1D,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACvB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9E;AAED,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iDAAiD;AACjD,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AAmBlD,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAC7C,QAAQ,IAAI,IAAI,CAAC;IACjB,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACtC;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC5B;;;OAGG;IACH,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAErD;;;;;OAKG;IACH,YAAY,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAAC;CAC1D;AAID;;;;;;;GAOG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEnC,MAAM,GAAE,qBAA0B;IAI9C;;;OAGG;IACG,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;YAI5C,WAAW;IA8FzB;;;;;OAKG;IACH,YAAY,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW;YA6DxC,KAAK;IAKnB,OAAO,CAAC,aAAa;IAwBrB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,oBAAoB;IA2B5B,OAAO,CAAC,gBAAgB;CAG3B;AAkHD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,4BAAsB,CAAC;AAInD;;;;GAIG;AACH,qBAAa,sBAAsB;IAC/B,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,aAAa;CA2BnE;AAED;;;GAGG;AACH,qBAAa,qBAAqB;IAC9B,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW;CAWlD"}

package/dist/process-executor.js

@@ -1,5 +1,30 @@
 import { isatty } from 'node:tty';
 import { execa } from 'execa';
+import { getProcessEnv } from './config.js';
+function processEventSeverity(reason, exitCode) {
+    if (reason === 'error')
+        return 'error';
+    if (reason === 'timeout')
+        return 'warning';
+    if (exitCode !== null && exitCode !== 0)
+        return 'warning';
+    return 'info';
+}
+/**
+ * Resolve the child env per the unified contract (task 0060 R5): a partial env
+ * extends the parent environment unless `envMode: 'replace'` opts out. Parent
+ * values can be `undefined` (deleted keys) — Bun's env is string-only, so filter them.
+ */
+function resolveChildEnv(env, envMode) {
+    if (envMode === 'replace')
+        return env;
+    const merged = {};
+    for (const [key, value] of Object.entries(getProcessEnv())) {
+        if (value !== undefined)
+            merged[key] = value;
+    }
+    return { ...merged, ...env };
+}
 // ── NodeProcessExecutor (concrete Node/Bun implementation) ───────────────
 /**
  * Concrete Node/Bun implementation of {@link ProcessExecutor}, wrapping `execa`
@@ -49,6 +74,7 @@ export class NodeProcessExecutor {
             durationMs: 0,
             reason: 'exit',
             timestamp: startedIso,
+            severity: 'info',
             ...(options.label !== undefined ? { label: options.label } : {}),
         });
         try {
@@ -133,6 +159,7 @@ export class NodeProcessExecutor {
                 durationMs: 0,
                 reason: 'exit',
                 timestamp: startedIso,
+                severity: 'info',
                 ...(options.label !== undefined ? { label: options.label } : {}),
             });
             const subprocess = Bun.spawn({
@@ -141,7 +168,7 @@ export class NodeProcessExecutor {
                 stdout: 'pipe',
                 stderr: 'pipe',
                 ...(options.cwd !== undefined ? { cwd: options.cwd } : {}),
-                ...(options.env !== undefined ? { env: options.env } : {}),
+                ...(options.env !== undefined ? { env: resolveChildEnv(options.env, options.envMode) } : {}),
             });
             const pipe = new BunPipeProcess(subprocess);
             if (pipe.pid !== null) {
@@ -165,6 +192,7 @@ export class NodeProcessExecutor {
                 durationMs: 0,
                 reason: 'error',
                 timestamp: new Date().toISOString(),
+                severity: processEventSeverity('error', null),
                 ...(options.label !== undefined ? { label: options.label } : {}),
                 error: errorMessage(error),
             });
@@ -214,6 +242,7 @@ export class NodeProcessExecutor {
             durationMs: result.durationMs,
             reason,
             timestamp: new Date().toISOString(),
+            severity: processEventSeverity(reason, result.exitCode),
             ...(options.label !== undefined ? { label: options.label } : {}),
             ...(error !== undefined ? { error: errorMessage(error) } : {}),
         });
@@ -243,6 +272,7 @@ class ObservedPipeProcess {
                 durationMs: Date.now() - context.startedAt,
                 reason: this.killedWith !== undefined ? 'signal' : 'exit',
                 timestamp: new Date().toISOString(),
+                severity: processEventSeverity(this.killedWith !== undefined ? 'signal' : 'exit', exitCode),
                 ...(context.label !== undefined ? { label: context.label } : {}),
             });
             return exitCode;

package/dist/schema-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validation.d.ts","sourceRoot":"","sources":["../src/schema-validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAOhD,4GAA4G;AAC5G,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,oBAAoB,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACtC;AAED,oGAAoG;AACpG,MAAM,WAAW,2BAA2B;IACxC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACtD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;CAC7C;AAED,+GAA+G;AAC/G,qBAAa,2BAA4B,SAAQ,KAAK;IAG9C,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE;gBADnD,OAAO,EAAE,MAAM,EACN,UAAU,GAAE,SAAS,mBAAmB,EAAO;CAK/D;AAED,6GAA6G;AAC7G,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpH;AAED,qGAAqG;AACrG,wBAAsB,qBAAqB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED,qHAAqH;AACrH,wBAAsB,0BAA0B,CAC5C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,wHAAwH;AACxH,wBAAgB,kBAAkB,CAC9B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,UAAU,EAClB,IAAI,SAAK,EACT,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAM,EACrC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GAC1C,mBAAmB,EAAE,CAwDvB"}
+{"version":3,"file":"schema-validation.d.ts","sourceRoot":"","sources":["../src/schema-validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAOhD,4GAA4G;AAC5G,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,oBAAoB,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACtC;AAED,oGAAoG;AACpG,MAAM,WAAW,2BAA2B;IACxC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACtD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;CAC7C;AAED,+GAA+G;AAC/G,qBAAa,2BAA4B,SAAQ,KAAK;IAG9C,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE;gBADnD,OAAO,EAAE,MAAM,EACN,UAAU,GAAE,SAAS,mBAAmB,EAAO;CAK/D;AAED,6GAA6G;AAC7G,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpH;AAED,qGAAqG;AACrG,wBAAsB,qBAAqB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,OAAO,CAAC,CAMlB;AAWD,qHAAqH;AACrH,wBAAsB,0BAA0B,CAC5C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,wHAAwH;AACxH,wBAAgB,kBAAkB,CAC9B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,UAAU,EAClB,IAAI,SAAK,EACT,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAM,EACrC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GAC1C,mBAAmB,EAAE,CAwDvB"}

package/dist/schema-validation.js

@@ -19,12 +19,21 @@ export async function loadStructuredConfig(path, options = {}) {
 }
 /** Parses a config string (YAML or JSON) and validates against its declared `$schema` if present. */
 export async function parseStructuredConfig(content, source, options = {}) {
-    const parsed = source.endsWith('.json') ? JSON.parse(content) : parseYaml(content);
+    const parsed = source.endsWith('.json') ? parseJsonContent(content, source) : parseYaml(content);
     if (options.validateSchema !== false) {
         await validateDeclaredJsonSchema(parsed, source, options);
     }
     return parsed;
 }
+/** Strict JSON parse that rethrows with the offending source named; config parse failures stay fail-loud. */
+function parseJsonContent(content, source) {
+    try {
+        return JSON.parse(content);
+    }
+    catch (error) {
+        throw new StructuredConfigSchemaError(`Failed to parse JSON config "${source}": ${error.message}`);
+    }
+}
 /** Extracts the `$schema` reference from a parsed config object, resolves and fetches the schema, then validates. */
 export async function validateDeclaredJsonSchema(value, source, options = {}) {
     if (!isObject(value))
@@ -204,11 +213,14 @@ function splitPackageSpecifier(specifier) {
 }
 async function readSchema(schemaLocation, options) {
     if (isRemoteRef(schemaLocation)) {
-        const fetchFn = options.fetch;
-        if (fetchFn === undefined) {
-            throw new StructuredConfigSchemaError(`Refusing to fetch remote JSON schema "${schemaLocation}": pass a fetch implementation to opt in`);
+        // Dual gate (task 0060 F2): remote fetch requires BOTH the explicit allowRemote opt-in
+        // AND an injected fetch implementation. `allowRemote` alone must not imply a built-in
+        // fetch (that path never existed and would be an unbounded SSRF/DoS surface); `fetch`
+        // alone must not silently enable network I/O the caller never authorised.
+        if (options.allowRemote !== true || options.fetch === undefined) {
+            throw new StructuredConfigSchemaError(`Refusing to fetch remote JSON schema "${schemaLocation}": pass both allowRemote: true and a fetch implementation to opt in`);
         }
-        const response = await fetchFn(schemaLocation);
+        const response = await options.fetch(schemaLocation);
         if (!response.ok) {
             throw new StructuredConfigSchemaError(`Failed to fetch JSON schema "${schemaLocation}": HTTP ${response.status}`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/ts-runtime",
-    "version": "0.4.28",
+    "version": "0.4.31",
     "description": "@gobing-ai/ts-runtime — Runtime abstractions for Bun, Node, and Cloudflare Workers.",
     "keywords": [
         "typescript",
@@ -58,17 +58,17 @@
         "release": "echo 'Manual publish is disabled. Releases go through GitHub Actions via Trusted Publishing — push a tag: git tag @gobing-ai/ts-runtime-v<version> && git push --tags' && exit 1"
     },
     "dependencies": {
-        "@gobing-ai/ts-utils": "^0.4.28",
+        "@gobing-ai/ts-utils": "^0.4.31",
         "execa": "^9.5.0",
         "yaml": "^2.7.0",
         "zod": "^4.1.0"
     },
     "devDependencies": {
-        "@gobing-ai/ts-db": "^0.4.28",
+        "@gobing-ai/ts-db": "^0.4.31",
         "@types/bun": "1.3.14"
     },
     "peerDependencies": {
-        "@gobing-ai/ts-db": "^0.4.28"
+        "@gobing-ai/ts-db": "^0.4.31"
     },
     "peerDependenciesMeta": {
         "@gobing-ai/ts-db": {

package/src/fs.ts

@@ -27,12 +27,17 @@ export async function atomicWriteJson(
     await atomicWriteFile(path, `${JSON.stringify(value, null, 2)}\n`, fs);
 }
 
-/** Reads and parses a JSON file. */
+/** Reads and parses a JSON file. Throws with the file named when the content is not valid JSON. */
 export async function readJsonFile<T = unknown>(
     path: string,
     fs: CanonicalFileSystem = createNodeFileSystem(),
 ): Promise<T> {
-    return JSON.parse(await fs.readFile(path)) as T;
+    const content = await fs.readFile(path);
+    try {
+        return JSON.parse(content) as T;
+    } catch (error) {
+        throw new Error(`Failed to parse JSON file "${path}": ${(error as Error).message}`);
+    }
 }
 
 /** Writes a value as JSON with 2-space indentation and trailing newline. */
@@ -47,25 +52,57 @@ export async function writeJsonFile(
 /**
  * Recursively walks a directory, returning sorted paths to all files,
  * optionally excluding entries by name.
+ *
+ * Cycle-safe and root-confined (task 0060 F3): directory symlinks are tracked
+ * by their canonical real path, so a link back to an ancestor (or the start
+ * root itself) is walked once at most, and a link escaping the start root is
+ * skipped. In-root directory symlinks are still traversed — importer and
+ * rule-engine walk `$HOME/...` trees that are often symlinks into a dotfiles
+ * repo. When the filesystem has no `realPath` (in-memory / CF stubs), today's
+ * follow-`stat` behaviour is kept (no ambient capability).
  */
 export async function walkDir(
     path: string,
     fs: CanonicalFileSystem = createNodeFileSystem(),
     exclude?: Set<string>,
 ): Promise<string[]> {
-    const entries = (await fs.readDir(path)).sort();
+    const startReal = fs.realPath?.(path) ?? path;
+    const visited = new Set<string>([startReal]);
     const result: string[] = [];
+    await walkDirInto(path, fs, exclude, startReal, visited, result);
+    return result;
+}
+
+async function walkDirInto(
+    path: string,
+    fs: CanonicalFileSystem,
+    exclude: Set<string> | undefined,
+    startReal: string,
+    visited: Set<string>,
+    result: string[],
+): Promise<void> {
+    const entries = (await fs.readDir(path)).sort();
     for (const entry of entries) {
         if (exclude?.has(entry)) continue;
         const fullPath = joinPath(path, entry);
         const entryStat = await fs.stat(fullPath);
         if (entryStat?.isDirectory()) {
-            result.push(...(await walkDir(fullPath, fs, exclude)));
+            const entryReal = fs.realPath?.(fullPath) ?? fullPath;
+            if (visited.has(entryReal)) continue; // cycle or already-walked real dir
+            if (
+                fs.realPath !== undefined &&
+                entryReal !== startReal &&
+                !entryReal.startsWith(`${startReal}/`) &&
+                !entryReal.startsWith(`${startReal}\\`)
+            ) {
+                continue; // symlink escapes the start root
+            }
+            visited.add(entryReal);
+            await walkDirInto(fullPath, fs, exclude, startReal, visited, result);
         } else if (entryStat?.isFile()) {
             result.push(fullPath);
         }
     }
-    return result;
 }
 
 /**

package/src/process-executor.ts

@@ -1,5 +1,6 @@
 import { isatty } from 'node:tty';
 import { type Options as ExecaOptions, execa } from 'execa';
+import { getProcessEnv } from './config';
 import type { ProcessExecutionSource, ProcessRegistry } from './process-registry';
 import type { RuntimePaths } from './runtime-paths';
 
@@ -48,6 +49,13 @@ export interface ProcessOptions {
     args?: string[];
     cwd?: string;
     env?: Record<string, string>;
+    /**
+     * `'merge'` (default): a partial `env` extends the parent environment (execa
+     * `extendEnv: true` semantics). `'replace'`: the child gets exactly `env` and
+     * none of the parent variables. Task 0060 R5 unified the default to merge so
+     * `run` and `runStreaming` share one contract.
+     */
+    envMode?: 'merge' | 'replace';
     timeout?: number;
     maxOutput?: number;
     label?: string;
@@ -107,6 +115,13 @@ export interface ProcessResult {
 /** Reason a process completion event was emitted. */
 export type ProcessExitReason = 'exit' | 'signal' | 'timeout' | 'error';
 
+function processEventSeverity(reason: ProcessExitReason, exitCode: number | null): ProcessEventDetail['severity'] {
+    if (reason === 'error') return 'error';
+    if (reason === 'timeout') return 'warning';
+    if (exitCode !== null && exitCode !== 0) return 'warning';
+    return 'info';
+}
+
 /** Payload emitted for process execution observability. */
 export interface ProcessEventDetail {
     command: string;
@@ -118,6 +133,8 @@ export interface ProcessEventDetail {
     timestamp: string;
     label?: string;
     error?: string;
+    /** Producer-owned observability severity. */
+    severity: 'info' | 'warning' | 'error';
 }
 
 /** Zero-dependency structural event sink for process observability. */
@@ -142,6 +159,12 @@ export interface PipeProcessOptions {
     args?: string[];
     cwd?: string;
     env?: Record<string, string>;
+    /**
+     * `'merge'` (default): a partial `env` extends the parent environment, matching
+     * {@link ProcessExecutor.run}. `'replace'`: the child gets exactly `env`.
+     * Previously `runStreaming` always replaced; task 0060 R5 made merge the default.
+     */
+    envMode?: 'merge' | 'replace';
     label?: string;
     /**
      * Registry metadata (spur#0264). Defaults: source `'other'` for streaming.
@@ -155,6 +178,23 @@ export interface PipeProcessOptions {
 /** Signal values accepted by subprocess kill. */
 type BunSubprocess = ReturnType<typeof Bun.spawn>;
 
+/**
+ * Resolve the child env per the unified contract (task 0060 R5): a partial env
+ * extends the parent environment unless `envMode: 'replace'` opts out. Parent
+ * values can be `undefined` (deleted keys) — Bun's env is string-only, so filter them.
+ */
+function resolveChildEnv(
+    env: Record<string, string>,
+    envMode: 'merge' | 'replace' | undefined,
+): Record<string, string> {
+    if (envMode === 'replace') return env;
+    const merged: Record<string, string> = {};
+    for (const [key, value] of Object.entries(getProcessEnv())) {
+        if (value !== undefined) merged[key] = value;
+    }
+    return { ...merged, ...env };
+}
+
 /** Signal values accepted by subprocess kill (e.g. 'SIGTERM', 'SIGKILL'). */
 export type ProcessSignal = Parameters<BunSubprocess['kill']>[0];
 
@@ -249,6 +289,7 @@ export class NodeProcessExecutor implements ProcessExecutor {
             durationMs: 0,
             reason: 'exit',
             timestamp: startedIso,
+            severity: 'info',
             ...(options.label !== undefined ? { label: options.label } : {}),
         });
 
@@ -341,6 +382,7 @@ export class NodeProcessExecutor implements ProcessExecutor {
                 durationMs: 0,
                 reason: 'exit',
                 timestamp: startedIso,
+                severity: 'info',
                 ...(options.label !== undefined ? { label: options.label } : {}),
             });
             const subprocess = Bun.spawn({
@@ -349,7 +391,7 @@ export class NodeProcessExecutor implements ProcessExecutor {
                 stdout: 'pipe',
                 stderr: 'pipe',
                 ...(options.cwd !== undefined ? { cwd: options.cwd } : {}),
-                ...(options.env !== undefined ? { env: options.env } : {}),
+                ...(options.env !== undefined ? { env: resolveChildEnv(options.env, options.envMode) } : {}),
             });
             const pipe = new BunPipeProcess(subprocess);
             if (pipe.pid !== null) {
@@ -372,6 +414,7 @@ export class NodeProcessExecutor implements ProcessExecutor {
                 durationMs: 0,
                 reason: 'error',
                 timestamp: new Date().toISOString(),
+                severity: processEventSeverity('error', null),
                 ...(options.label !== undefined ? { label: options.label } : {}),
                 error: errorMessage(error),
             });
@@ -437,6 +480,7 @@ export class NodeProcessExecutor implements ProcessExecutor {
             durationMs: result.durationMs,
             reason,
             timestamp: new Date().toISOString(),
+            severity: processEventSeverity(reason, result.exitCode),
             ...(options.label !== undefined ? { label: options.label } : {}),
             ...(error !== undefined ? { error: errorMessage(error) } : {}),
         });
@@ -479,6 +523,7 @@ class ObservedPipeProcess implements PipeProcess {
                 durationMs: Date.now() - context.startedAt,
                 reason: this.killedWith !== undefined ? 'signal' : 'exit',
                 timestamp: new Date().toISOString(),
+                severity: processEventSeverity(this.killedWith !== undefined ? 'signal' : 'exit', exitCode),
                 ...(context.label !== undefined ? { label: context.label } : {}),
             });
             return exitCode;

package/src/schema-validation.ts

@@ -76,13 +76,22 @@ export async function parseStructuredConfig(
     source: string,
     options: StructuredConfigLoadOptions = {},
 ): Promise<unknown> {
-    const parsed = source.endsWith('.json') ? JSON.parse(content) : parseYaml(content);
+    const parsed = source.endsWith('.json') ? parseJsonContent(content, source) : parseYaml(content);
     if (options.validateSchema !== false) {
         await validateDeclaredJsonSchema(parsed, source, options);
     }
     return parsed;
 }
 
+/** Strict JSON parse that rethrows with the offending source named; config parse failures stay fail-loud. */
+function parseJsonContent(content: string, source: string): unknown {
+    try {
+        return JSON.parse(content);
+    } catch (error) {
+        throw new StructuredConfigSchemaError(`Failed to parse JSON config "${source}": ${(error as Error).message}`);
+    }
+}
+
 /** Extracts the `$schema` reference from a parsed config object, resolves and fetches the schema, then validates. */
 export async function validateDeclaredJsonSchema(
     value: unknown,
@@ -344,13 +353,16 @@ function splitPackageSpecifier(specifier: string): { pkg: string; subpath: strin
 
 async function readSchema(schemaLocation: string, options: StructuredConfigLoadOptions): Promise<string> {
     if (isRemoteRef(schemaLocation)) {
-        const fetchFn = options.fetch;
-        if (fetchFn === undefined) {
+        // Dual gate (task 0060 F2): remote fetch requires BOTH the explicit allowRemote opt-in
+        // AND an injected fetch implementation. `allowRemote` alone must not imply a built-in
+        // fetch (that path never existed and would be an unbounded SSRF/DoS surface); `fetch`
+        // alone must not silently enable network I/O the caller never authorised.
+        if (options.allowRemote !== true || options.fetch === undefined) {
             throw new StructuredConfigSchemaError(
-                `Refusing to fetch remote JSON schema "${schemaLocation}": pass a fetch implementation to opt in`,
+                `Refusing to fetch remote JSON schema "${schemaLocation}": pass both allowRemote: true and a fetch implementation to opt in`,
             );
         }
-        const response = await fetchFn(schemaLocation);
+        const response = await options.fetch(schemaLocation);
         if (!response.ok) {
             throw new StructuredConfigSchemaError(
                 `Failed to fetch JSON schema "${schemaLocation}": HTTP ${response.status}`,