@grackle-ai/core 0.75.4

package/dist/test-utils/mock-database.js

@@ -0,0 +1,147 @@
+/**
+ * Shared mock factory for `@grackle-ai/database` used by server test files.
+ *
+ * Usage in test files:
+ * ```typescript
+ * import { createDatabaseMock } from "./test-utils/mock-database.js";
+ * vi.mock("@grackle-ai/database", () => createDatabaseMock());
+ * ```
+ *
+ * All store namespaces are provided with vi.fn() stubs that return safe defaults
+ * (empty arrays, undefined, etc.). Individual tests can override specific functions
+ * via `vi.mocked(store.someMethod).mockReturnValue(...)`.
+ */
+import { vi } from "vitest";
+/** Create a complete mock of the `@grackle-ai/database` barrel export. */
+// eslint-disable-next-line @typescript-eslint/explicit-function-return-type
+export function createDatabaseMock() {
+    return {
+        db: {},
+        sqlite: undefined,
+        openDatabase: vi.fn(),
+        initDatabase: vi.fn(),
+        seedDatabase: vi.fn(),
+        schema: {},
+        sessionStore: {
+            createSession: vi.fn(),
+            getSession: vi.fn(() => undefined),
+            listSessions: vi.fn(() => []),
+            listByEnv: vi.fn(() => []),
+            listSessionsForTask: vi.fn(() => []),
+            listSessionsByTaskIds: vi.fn(() => []),
+            getLatestSessionForTask: vi.fn(() => undefined),
+            getActiveForEnv: vi.fn(() => undefined),
+            getActiveSessionsForTask: vi.fn(() => []),
+            getSuspendedForEnv: vi.fn(() => []),
+            getChildSessions: vi.fn(() => []),
+            updateSession: vi.fn(),
+            updateSessionStatus: vi.fn(),
+            updateSessionUsage: vi.fn(),
+            updateRuntimeSessionId: vi.fn(),
+            incrementTurns: vi.fn(),
+            suspendSession: vi.fn(),
+            reanimateSession: vi.fn(),
+            setSessionTask: vi.fn(),
+            deleteByEnvironment: vi.fn(),
+            aggregateUsage: vi.fn(() => ({ inputTokens: 0, outputTokens: 0, costUsd: 0, sessionCount: 0 })),
+        },
+        taskStore: {
+            createTask: vi.fn(),
+            insertTask: vi.fn(),
+            getTask: vi.fn(() => undefined),
+            listTasks: vi.fn(() => []),
+            updateTask: vi.fn(),
+            updateTaskStatus: vi.fn(),
+            markTaskComplete: vi.fn(),
+            deleteTask: vi.fn(),
+            setTaskWorkspace: vi.fn(),
+            setTaskDependsOn: vi.fn(),
+            getUnblockedTasks: vi.fn(() => []),
+            checkAndUnblock: vi.fn(() => []),
+            areDependenciesMet: vi.fn(() => true),
+            buildChildIdsMap: vi.fn(() => new Map()),
+            getChildren: vi.fn(() => []),
+            getDescendants: vi.fn(() => []),
+            getAncestors: vi.fn(() => []),
+            getChildStatusCounts: vi.fn(() => ({})),
+        },
+        workspaceStore: {
+            createWorkspace: vi.fn(),
+            getWorkspace: vi.fn(() => undefined),
+            listWorkspaces: vi.fn(() => []),
+            updateWorkspace: vi.fn(),
+            archiveWorkspace: vi.fn(),
+            countWorkspacesByEnvironment: vi.fn(() => 0),
+        },
+        personaStore: {
+            createPersona: vi.fn(),
+            getPersona: vi.fn(() => undefined),
+            getPersonaByName: vi.fn(() => undefined),
+            listPersonas: vi.fn(() => []),
+            updatePersona: vi.fn(),
+            deletePersona: vi.fn(),
+        },
+        findingStore: {
+            postFinding: vi.fn(),
+            queryFindings: vi.fn(() => []),
+        },
+        settingsStore: {
+            getSetting: vi.fn(() => undefined),
+            setSetting: vi.fn(),
+            isAllowedSettingKey: vi.fn(() => true),
+            WRITABLE_SETTING_KEYS: new Set(["default_persona_id", "onboarding_completed"]),
+        },
+        envRegistry: {
+            listEnvironments: vi.fn(() => []),
+            getEnvironment: vi.fn(() => undefined),
+            addEnvironment: vi.fn(),
+            removeEnvironment: vi.fn(),
+            updateEnvironmentStatus: vi.fn(),
+            markBootstrapped: vi.fn(),
+            setEnvInfo: vi.fn(),
+            updateAdapterConfig: vi.fn(),
+            updateEnvironment: vi.fn(),
+            resetAllStatuses: vi.fn(),
+        },
+        tokenStore: {
+            setToken: vi.fn(),
+            deleteToken: vi.fn(),
+            listTokens: vi.fn(() => []),
+            getBundle: vi.fn(() => ({ tokens: [] })),
+        },
+        credentialProviders: {
+            getCredentialProviders: vi.fn(() => ({ claude: "off", github: "off", copilot: "off", codex: "off", goose: "off" })),
+            setCredentialProviders: vi.fn(),
+            parseCredentialProviderConfig: vi.fn(),
+            isValidCredentialProviderConfig: vi.fn(() => true),
+            VALID_PROVIDERS: ["claude", "github", "copilot", "codex", "goose"],
+            VALID_CLAUDE_VALUES: new Set(["off", "subscription", "api_key"]),
+            VALID_TOGGLE_VALUES: new Set(["off", "on"]),
+        },
+        // Direct barrel exports
+        isAllowedSettingKey: vi.fn(() => true),
+        WRITABLE_SETTING_KEYS: new Set(["default_persona_id", "onboarding_completed"]),
+        VALID_PROVIDERS: ["claude", "github", "copilot", "codex", "goose"],
+        VALID_CLAUDE_VALUES: new Set(["off", "subscription", "api_key"]),
+        VALID_TOGGLE_VALUES: new Set(["off", "on"]),
+        persistEvent: vi.fn(),
+        // Utilities
+        grackleHome: "/tmp/test-grackle",
+        safeParseJsonArray: (value) => {
+            if (!value) {
+                return [];
+            }
+            try {
+                const p = JSON.parse(value);
+                return Array.isArray(p) ? p.filter((i) => typeof i === "string") : [];
+            }
+            catch {
+                return [];
+            }
+        },
+        slugify: (text) => text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 40),
+        encrypt: vi.fn((x) => x),
+        decrypt: vi.fn((x) => x),
+    };
+}
+//# sourceMappingURL=mock-database.js.map

package/dist/test-utils/mock-database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-database.js","sourceRoot":"","sources":["../../src/test-utils/mock-database.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE5B,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,EAAE,EAAE,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;QACrB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;QACrB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,EAAE;QAEV,YAAY,EAAE;YACZ,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;YACtB,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAClC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC7B,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1B,mBAAmB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACpC,qBAAqB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACtC,uBAAuB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACvC,wBAAwB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACzC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACjC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;YACtB,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;YAC5B,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;YAC3B,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;YAC/B,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;YACvB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;YACvB,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;YACvB,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;YAC5B,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;SAChG;QAED,SAAS,EAAE;YACT,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;YACnB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;YACnB,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1B,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;YACnB,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;YACnB,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAClC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAChC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;YACxC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC5B,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/B,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC7B,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;SACxC;QAED,cAAc,EAAE;YACd,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;YACxB,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACpC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/B,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;YACxB,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,4BAA4B,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;SAC7C;QAED,YAAY,EAAE;YACZ,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;YACtB,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAClC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACxC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC7B,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;YACtB,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB;QAED,YAAY,EAAE;YACZ,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;YACpB,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SAC/B;QAED,aAAa,EAAE;YACb,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAClC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;YACnB,mBAAmB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACtC,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;SAC/E;QAED,WAAW,EAAE;YACX,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACjC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACtC,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;YACvB,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;YAC1B,uBAAuB,EAAE,EAAE,CAAC,EAAE,EAAE;YAChC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;YACnB,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;YAC5B,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;YAC1B,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;SAC1B;QAED,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;YACjB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;YACpB,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC3B,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;SACzC;QAED,mBAAmB,EAAE;YACnB,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;YAC/B,6BAA6B,EAAE,EAAE,CAAC,EAAE,EAAE;YACtC,+BAA+B,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YAClD,eAAe,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;YAChE,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;SAC5C;QAED,wBAAwB;QACxB,mBAAmB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACtC,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;QAC9E,eAAe,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;QAClE,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QAChE,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3C,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;QAErB,YAAY;QACZ,WAAW,EAAE,mBAAmB;QAChC,kBAAkB,EAAE,CAAC,KAAc,EAAY,EAAE;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,KAAe,CAAC,CAAC;gBAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACpH,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QACjC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC;KAClC,CAAC;AACJ,CAAC"}

package/dist/token-push.d.ts

@@ -0,0 +1,22 @@
+/** Options for {@link pushToEnv}. */
+export interface PushToEnvOptions {
+    /** When true, filter out file-type tokens (only push env vars). */
+    excludeFileTokens?: boolean;
+}
+/** Push the current token bundle to a single connected environment. */
+export declare function pushToEnv(environmentId: string, options?: PushToEnvOptions): Promise<void>;
+/** Push the current token bundle to all connected environments in parallel. */
+export declare function pushToAll(): Promise<void>;
+/**
+ * Push enabled provider credentials to a single connected environment.
+ * When `runtime` is specified, only providers relevant to that runtime are included.
+ * Reads fresh values from `process.env` / disk based on the credential provider config.
+ */
+export declare function pushProviderCredentialsToEnv(environmentId: string, runtime?: string, options?: PushToEnvOptions): Promise<void>;
+/**
+ * Best-effort push of stored tokens and provider credentials before a task spawn.
+ * When `runtime` is specified, only providers relevant to that runtime are pushed.
+ * Both pushes run concurrently; failures are logged as warnings and do not block.
+ */
+export declare function refreshTokensForTask(environmentId: string, runtime?: string, options?: PushToEnvOptions): Promise<void>;
+//# sourceMappingURL=token-push.d.ts.map

package/dist/token-push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-push.d.ts","sourceRoot":"","sources":["../src/token-push.ts"],"names":[],"mappings":"AAcA,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,uEAAuE;AACvE,wBAAsB,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhG;AAED,+EAA+E;AAC/E,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAc/C;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBrI;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAY7H"}

package/dist/token-push.js

@@ -0,0 +1,78 @@
+/**
+ * Token push orchestration — distributes stored tokens and credential
+ * provider bundles to connected PowerLine environments.
+ *
+ * This is service-level logic that depends on adapter-manager (network) and
+ * env-registry (lookup). The pure persistence layer lives in
+ * `@grackle-ai/database` (tokenStore), and credential bundle building lives in
+ * {@link ./credential-bundle.ts}.
+ */
+import * as adapterManager from "./adapter-manager.js";
+import { envRegistry, tokenStore } from "@grackle-ai/database";
+import { buildProviderTokenBundle } from "./credential-bundle.js";
+import { logger } from "./logger.js";
+/** Push the current token bundle to a single connected environment. */
+export async function pushToEnv(environmentId, options) {
+    const conn = adapterManager.getConnection(environmentId);
+    if (!conn) {
+        return;
+    }
+    const bundle = tokenStore.getBundle();
+    if (options?.excludeFileTokens) {
+        bundle.tokens = bundle.tokens.filter((t) => t.type !== "file");
+    }
+    if (bundle.tokens.length === 0) {
+        return;
+    }
+    await conn.client.pushTokens(bundle);
+}
+/** Push the current token bundle to all connected environments in parallel. */
+export async function pushToAll() {
+    const connections = adapterManager.listConnections();
+    const promises = [];
+    for (const [environmentId] of connections) {
+        const env = envRegistry.getEnvironment(environmentId);
+        const opts = env?.adapterType === "local" ? { excludeFileTokens: true } : undefined;
+        promises.push(pushToEnv(environmentId, opts).catch((err) => {
+            logger.error({ environmentId, err }, "Failed to push tokens");
+        }));
+    }
+    await Promise.all(promises);
+}
+/**
+ * Push enabled provider credentials to a single connected environment.
+ * When `runtime` is specified, only providers relevant to that runtime are included.
+ * Reads fresh values from `process.env` / disk based on the credential provider config.
+ */
+export async function pushProviderCredentialsToEnv(environmentId, runtime, options) {
+    const conn = adapterManager.getConnection(environmentId);
+    if (!conn) {
+        return;
+    }
+    const bundle = buildProviderTokenBundle(runtime);
+    if (options?.excludeFileTokens) {
+        bundle.tokens = bundle.tokens.filter((t) => t.type !== "file");
+    }
+    if (bundle.tokens.length === 0) {
+        return;
+    }
+    await conn.client.pushTokens(bundle);
+}
+/**
+ * Best-effort push of stored tokens and provider credentials before a task spawn.
+ * When `runtime` is specified, only providers relevant to that runtime are pushed.
+ * Both pushes run concurrently; failures are logged as warnings and do not block.
+ */
+export async function refreshTokensForTask(environmentId, runtime, options) {
+    const results = await Promise.allSettled([
+        pushToEnv(environmentId, options),
+        pushProviderCredentialsToEnv(environmentId, runtime, options),
+    ]);
+    if (results[0].status === "rejected") {
+        logger.warn({ environmentId, err: results[0].reason }, "Failed to push tokens before task start");
+    }
+    if (results[1].status === "rejected") {
+        logger.warn({ environmentId, err: results[1].reason }, "Failed to push provider credentials before task start");
+    }
+}
+//# sourceMappingURL=token-push.js.map

package/dist/token-push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-push.js","sourceRoot":"","sources":["../src/token-push.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAQrC,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,aAAqB,EAAE,OAA0B;IAC/E,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;IAEtC,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,WAAW,GAAG,cAAc,CAAC,eAAe,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,CAAC,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,IAAI,GACR,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACzD,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,aAAqB,EAAE,OAAgB,EAAE,OAA0B;IACpH,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB,EAAE,OAAgB,EAAE,OAA0B;IAC5G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QACvC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC;QACjC,4BAA4B,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC;KAC9D,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,yCAAyC,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uDAAuD,CAAC,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/transcript.d.ts

@@ -0,0 +1,5 @@
+/** Generate a Markdown transcript from a session's JSONL log. */
+export declare function generateTranscript(logPath: string): string;
+/** Generate and write a Markdown transcript file alongside the session log. */
+export declare function writeTranscript(logPath: string): void;
+//# sourceMappingURL=transcript.d.ts.map

package/dist/transcript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcript.d.ts","sourceRoot":"","sources":["../src/transcript.ts"],"names":[],"mappings":"AAkDA,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAKrD"}

package/dist/transcript.js

@@ -0,0 +1,71 @@
+import { readLog } from "./log-writer.js";
+import { writeFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+function renderEntry(entry) {
+    switch (entry.type) {
+        case "system": {
+            // System context events contain the full system prompt — render as a
+            // collapsible details block instead of an inline italic line.
+            if (entry.raw) {
+                try {
+                    const raw = JSON.parse(entry.raw);
+                    if (raw.systemContext === true) {
+                        return `<details>\n<summary>System Prompt</summary>\n\n\`\`\`\n${entry.content}\n\`\`\`\n</details>\n`;
+                    }
+                }
+                catch { /* not JSON, render as normal */ }
+            }
+            return `> _${entry.content}_\n`;
+        }
+        case "text":
+            return `${entry.content}\n`;
+        case "tool_use": {
+            try {
+                const parsed = JSON.parse(entry.content);
+                return `\`\`\`\n${parsed.tool}: ${JSON.stringify(parsed.args, null, 2)}\n\`\`\`\n`;
+            }
+            catch {
+                return `\`\`\`\n${entry.content}\n\`\`\`\n`;
+            }
+        }
+        case "tool_result":
+            return `<details>\n<summary>Tool output</summary>\n\n\`\`\`\n${entry.content}\n\`\`\`\n</details>\n`;
+        case "error":
+            return `**Error:** ${entry.content}\n`;
+        case "status":
+            return `---\n*Status: ${entry.content}*\n`;
+        case "signal": {
+            if (!entry.content) {
+                return `> **[SIGNAL]**\n`;
+            }
+            const lines = entry.content.split("\n");
+            const renderedLines = lines.map((line, index) => index === 0 ? `> **[SIGNAL]** ${line}` : `> ${line}`);
+            return renderedLines.join("\n") + "\n";
+        }
+        default:
+            return `${entry.content}\n`;
+    }
+}
+/** Generate a Markdown transcript from a session's JSONL log. */
+export function generateTranscript(logPath) {
+    const entries = readLog(logPath);
+    if (entries.length === 0)
+        return "*(empty session)*\n";
+    const lines = [];
+    lines.push(`# Session Transcript\n`);
+    lines.push(`*Started: ${entries[0].timestamp}*\n`);
+    for (const entry of entries) {
+        lines.push(renderEntry(entry));
+    }
+    const last = entries[entries.length - 1];
+    lines.push(`\n*Ended: ${last.timestamp}*\n`);
+    return lines.join("\n");
+}
+/** Generate and write a Markdown transcript file alongside the session log. */
+export function writeTranscript(logPath) {
+    const md = generateTranscript(logPath);
+    const transcriptPath = join(logPath, "transcript.md");
+    mkdirSync(dirname(transcriptPath), { recursive: true });
+    writeFileSync(transcriptPath, md, "utf8");
+}
+//# sourceMappingURL=transcript.js.map

package/dist/transcript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcript.js","sourceRoot":"","sources":["../src/transcript.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,SAAS,WAAW,CAAC,KAAe;IAClC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,qEAAqE;YACrE,8DAA8D;YAC9D,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;oBAC7D,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;wBAC/B,OAAO,0DAA0D,KAAK,CAAC,OAAO,wBAAwB,CAAC;oBACzG,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,MAAM,KAAK,CAAC,OAAO,KAAK,CAAC;QAClC,CAAC;QACD,KAAK,MAAM;YACT,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC;QAC9B,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAoC,CAAC;gBAC5E,OAAO,WAAW,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,WAAW,KAAK,CAAC,OAAO,YAAY,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,KAAK,aAAa;YAChB,OAAO,wDAAwD,KAAK,CAAC,OAAO,wBAAwB,CAAC;QACvG,KAAK,OAAO;YACV,OAAO,cAAc,KAAK,CAAC,OAAO,IAAI,CAAC;QACzC,KAAK,QAAQ;YACX,OAAO,iBAAiB,KAAK,CAAC,OAAO,KAAK,CAAC;QAC7C,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9C,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CACrD,CAAC;YACF,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACzC,CAAC;QACD;YACE,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC;IAChC,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAEvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC;IAEnD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC;IAE7C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACtD,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,aAAa,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC"}

package/dist/utils/exec.d.ts

@@ -0,0 +1,17 @@
+/** Trimmed stdout/stderr from a child process execution. */
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+}
+/**
+ * Execute a command as a child process and return its trimmed output.
+ * @param cmd - Executable name or path.
+ * @param args - Arguments to pass to the executable.
+ * @param opts - Optional timeout, cwd, and env overrides.
+ */
+export declare function exec(cmd: string, args: string[], opts?: {
+    timeout?: number;
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<ExecResult>;
+//# sourceMappingURL=exec.d.ts.map

package/dist/utils/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/utils/exec.ts"],"names":[],"mappings":"AAQA,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,IAAI,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACjE,OAAO,CAAC,UAAU,CAAC,CAQrB"}

package/dist/utils/exec.js

@@ -0,0 +1,21 @@
+import { execFile as _execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(_execFile);
+const DEFAULT_EXEC_TIMEOUT_MS = 60_000;
+const EXEC_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
+/**
+ * Execute a command as a child process and return its trimmed output.
+ * @param cmd - Executable name or path.
+ * @param args - Arguments to pass to the executable.
+ * @param opts - Optional timeout, cwd, and env overrides.
+ */
+export async function exec(cmd, args, opts) {
+    const { stdout, stderr } = await execFileAsync(cmd, args, {
+        timeout: opts?.timeout ?? DEFAULT_EXEC_TIMEOUT_MS,
+        cwd: opts?.cwd,
+        env: opts?.env ?? process.env,
+        maxBuffer: EXEC_MAX_BUFFER_BYTES,
+    });
+    return { stdout: stdout.trim(), stderr: stderr.trim() };
+}
+//# sourceMappingURL=exec.js.map

package/dist/utils/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/utils/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAmC,SAAS,CAAC,SAAS,CAAC,CAAC;AAE3E,MAAM,uBAAuB,GAAW,MAAM,CAAC;AAC/C,MAAM,qBAAqB,GAAW,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAQvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,GAAW,EACX,IAAc,EACd,IAAkE;IAElE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE;QACxD,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,uBAAuB;QACjD,GAAG,EAAE,IAAI,EAAE,GAAG;QACd,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG;QAC7B,SAAS,EAAE,qBAAqB;KACjC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC1D,CAAC"}

package/dist/utils/format-gh-error.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Translate a raw `gh` CLI error into a user-friendly message.
+ * The raw error is still logged server-side for diagnostics.
+ */
+export declare function formatGhError(err: unknown, operation: string): string;
+//# sourceMappingURL=format-gh-error.d.ts.map

package/dist/utils/format-gh-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-gh-error.d.ts","sourceRoot":"","sources":["../../src/utils/format-gh-error.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CA4BrE"}

package/dist/utils/format-gh-error.js

@@ -0,0 +1,30 @@
+/**
+ * Translate a raw `gh` CLI error into a user-friendly message.
+ * The raw error is still logged server-side for diagnostics.
+ */
+export function formatGhError(err, operation) {
+    const message = err instanceof Error ? err.message : String(err);
+    const rawStderr = err instanceof Error && "stderr" in err
+        ? err.stderr
+        : undefined;
+    const stderr = typeof rawStderr === "string" && rawStderr.length > 0
+        ? rawStderr
+        : Buffer.isBuffer(rawStderr) && rawStderr.length > 0
+            ? rawStderr.toString()
+            : "";
+    const code = err instanceof Error && "code" in err
+        ? String(err.code)
+        : "";
+    if (code === "ENOENT" || message.includes("ENOENT")) {
+        return "Could not find the `gh` CLI. Ensure GitHub CLI is installed and available on your system PATH, then restart the Grackle server.";
+    }
+    if (code === "EACCES" || message.includes("EACCES")) {
+        return "`gh` CLI found but not executable. Check file permissions.";
+    }
+    const combined = `${stderr} ${message}`.toLowerCase();
+    if (combined.includes("auth") || combined.includes("login")) {
+        return "GitHub CLI is not authenticated. Run `gh auth login` and restart.";
+    }
+    return `Failed to ${operation}: ${stderr || message}`;
+}
+//# sourceMappingURL=format-gh-error.js.map

package/dist/utils/format-gh-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-gh-error.js","sourceRoot":"","sources":["../../src/utils/format-gh-error.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,SAAiB;IAC3D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,SAAS,GACb,GAAG,YAAY,KAAK,IAAI,QAAQ,IAAI,GAAG;QACrC,CAAC,CAAE,GAAmC,CAAC,MAAM;QAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,MAAM,GACV,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACnD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE;YACtB,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,IAAI,GACR,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG;QACnC,CAAC,CAAC,MAAM,CAAE,GAAiC,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,iIAAiI,CAAC;IAC3I,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,4DAA4D,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,mEAAmE,CAAC;IAC7E,CAAC;IACD,OAAO,aAAa,SAAS,KAAK,MAAM,IAAI,OAAO,EAAE,CAAC;AACxD,CAAC"}

package/dist/utils/network.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Detect the first non-internal IPv4 address on the machine (LAN IP).
+ *
+ * Returns `undefined` when no suitable interface is found.
+ */
+export declare function detectLanIp(): string | undefined;
+//# sourceMappingURL=network.d.ts.map

package/dist/utils/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/utils/network.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,MAAM,GAAG,SAAS,CAahD"}

package/dist/utils/network.js

@@ -0,0 +1,21 @@
+import { networkInterfaces } from "node:os";
+/**
+ * Detect the first non-internal IPv4 address on the machine (LAN IP).
+ *
+ * Returns `undefined` when no suitable interface is found.
+ */
+export function detectLanIp() {
+    const interfaces = networkInterfaces();
+    for (const entries of Object.values(interfaces)) {
+        if (!entries) {
+            continue;
+        }
+        for (const entry of entries) {
+            if (entry.family === "IPv4" && !entry.internal) {
+                return entry.address;
+            }
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=network.js.map

package/dist/utils/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../src/utils/network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC/C,OAAO,KAAK,CAAC,OAAO,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/utils/ports.d.ts

@@ -0,0 +1,3 @@
+/** Find and return an available TCP port by briefly binding to port 0. */
+export declare function findFreePort(): Promise<number>;
+//# sourceMappingURL=ports.d.ts.map

package/dist/utils/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../src/utils/ports.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAc9C"}

package/dist/utils/ports.js

@@ -0,0 +1,19 @@
+import { createServer } from "node:net";
+/** Find and return an available TCP port by briefly binding to port 0. */
+export function findFreePort() {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.listen(0, () => {
+            const addr = server.address();
+            if (addr && typeof addr === "object") {
+                const port = addr.port;
+                server.close(() => resolve(port));
+            }
+            else {
+                server.close(() => reject(new Error("Failed to get port")));
+            }
+        });
+        server.on("error", reject);
+    });
+}
+//# sourceMappingURL=ports.js.map

package/dist/utils/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../src/utils/ports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,0EAA0E;AAC1E,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE;YACpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/sleep.d.ts

@@ -0,0 +1,3 @@
+/** Return a promise that resolves after the specified number of milliseconds. */
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=sleep.d.ts.map

package/dist/utils/sleep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sleep.d.ts","sourceRoot":"","sources":["../../src/utils/sleep.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}

package/dist/utils/sleep.js

@@ -0,0 +1,5 @@
+/** Return a promise that resolves after the specified number of milliseconds. */
+export function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=sleep.js.map

package/dist/utils/sleep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sleep.js","sourceRoot":"","sources":["../../src/utils/sleep.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,UAAU,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/ws-bridge.d.ts

@@ -0,0 +1,30 @@
+import { WebSocketServer, WebSocket } from "ws";
+import type { Server as HttpServer } from "node:http";
+import { taskStore } from "@grackle-ai/database";
+/**
+ * Check whether a WebSocket Origin header is allowed.
+ *
+ * Rules:
+ * - Missing origin (non-browser clients, extensions) → always allowed
+ * - Origin port must match the web server port
+ * - In local mode (`allowNetwork === false`), hostname must be loopback
+ * - In network mode (`allowNetwork === true`), any hostname on the right port is allowed
+ */
+export declare function isAllowedOrigin(origin: string | undefined, webPort: number, allowNetwork: boolean): boolean;
+/** Options for creating the WebSocket bridge. */
+interface WsBridgeOptions {
+    verifyApiKey: (token: string) => boolean;
+    validateCookie?: (cookieHeader: string) => boolean;
+    webPort?: number;
+    allowNetwork?: boolean;
+}
+/** Create a WebSocket server on top of an HTTP server for real-time event streaming. */
+export declare function createWsBridge(httpServer: HttpServer, options: WsBridgeOptions): WebSocketServer;
+/** Start a new agent session for a task. Returns an error message string on failure, undefined on success. */
+export declare function startTaskSession(ws: WebSocket | undefined, task: taskStore.TaskRow, options?: {
+    personaId?: string;
+    environmentId?: string;
+    notes?: string;
+}): Promise<string | undefined>;
+export {};
+//# sourceMappingURL=ws-bridge.d.ts.map

package/dist/ws-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-bridge.d.ts","sourceRoot":"","sources":["../src/ws-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAItD,OAAO,EAA6C,SAAS,EAAe,MAAM,sBAAsB,CAAC;AAqCzG;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,GACpB,OAAO,CAyBT;AAQD,iDAAiD;AACjD,UAAU,eAAe;IACvB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAC5B,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,eAAe,GACvB,eAAe,CAiDjB;AA6HD,8GAA8G;AAC9G,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,GAAG,SAAS,EACzB,IAAI,EAAE,SAAS,CAAC,OAAO,EACvB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACvE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA6I7B"}