@greppleai/grip 0.0.0-stage → 0.1.3

package/dist/daemon/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/daemon/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAEN,KAAK,6BAA6B,EAElC,MAAM,+CAA+C,CAAC;AAEvD,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AACvD,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,6BAA6B,CAAC;CACvD;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACD;AAmND,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEhE;AA2LD,wBAAsB,kBAAkB,CACvC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,UAAU,SAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,CA2FxB","sourcesContent":["import { readFile, realpath, stat } from \"node:fs/promises\";\nimport { isAbsolute, join, resolve } from \"node:path\";\nimport {\n\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS,\n\ttype RemoteWorkspaceProtocolLimits,\n\tvalidateRemoteWorkspaceProtocolLimits,\n} from \"../core/remote-workspace-protocol/contract.ts\";\n\nexport const DAEMON_WEBSOCKET_PATH = \"/grip/workspace\";\nexport const DAEMON_WEBSOCKET_PROTOCOL = \"grip.workspace.v1\";\n\nexport interface DaemonTlsConfiguration {\n\treadonly cert: Buffer;\n\treadonly key: Buffer;\n\treadonly passphrase?: string;\n}\n\nexport interface DaemonConfiguration {\n\treadonly host: string;\n\treadonly port: number;\n\treadonly workspaceRoot: string;\n\t/** Canonical fixed parent mount for explicitly enabled shared-channel mode. */\n\treadonly sharedParentRoot?: string;\n\treadonly temporaryRoot?: string;\n\treadonly token?: string;\n\treadonly allowedOrigins: readonly string[];\n\treadonly tls?: DaemonTlsConfiguration;\n\treadonly allowInsecureTransport: boolean;\n\treadonly allowProcessExec: boolean;\n\treadonly allowRoot: boolean;\n\treadonly forwardedEnvironment: readonly string[];\n\treadonly lspConfigPath?: string;\n\treadonly sandboxInstructionsPath?: string;\n\treadonly userAgentsPath?: string;\n\treadonly trustProjectLsp: boolean;\n\treadonly maxConnections: number;\n\treadonly maxGlobalRequests: number;\n\treadonly maxGlobalTransfers: number;\n\treadonly maxBufferedOutputBytes: number;\n\treadonly maxPendingConnections: number;\n\treadonly handshakeTimeoutMs: number;\n\treadonly shutdownTimeoutMs: number;\n\treadonly protocolLimits: RemoteWorkspaceProtocolLimits;\n}\n\nexport interface DaemonCommand {\n\treadonly help: boolean;\n\treadonly configuration?: DaemonConfiguration;\n}\n\nexport class DaemonConfigurationError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"DaemonConfigurationError\";\n\t}\n}\n\ninterface ParsedDaemonInputs {\n\thelp: boolean;\n\thost?: string;\n\tport?: string;\n\tcwd?: string;\n\tsharedParent?: string;\n\torigins: string[];\n\ttlsCertPath?: string;\n\ttlsKeyPath?: string;\n\tallowInsecureTransport?: boolean;\n\tallowProcessExec?: boolean;\n\tallowRoot?: boolean;\n\tforwardedEnvironment: string[];\n\tlspConfigPath?: string;\n\ttrustProjectLsp?: boolean;\n\tmaxConnections?: string;\n\tmaxPendingConnections?: string;\n\thandshakeTimeoutMs?: string;\n\tshutdownTimeoutMs?: string;\n}\n\nconst BOOLEAN_VALUES = new Map<string, boolean>([\n\t[\"1\", true],\n\t[\"true\", true],\n\t[\"yes\", true],\n\t[\"0\", false],\n\t[\"false\", false],\n\t[\"no\", false],\n]);\n\nconst VALUE_FLAGS = new Map<string, keyof ParsedDaemonInputs>([\n\t[\"--daemon-host\", \"host\"],\n\t[\"--daemon-port\", \"port\"],\n\t[\"--daemon-cwd\", \"cwd\"],\n\t[\"--daemon-shared-parent\", \"sharedParent\"],\n\t[\"--daemon-tls-cert\", \"tlsCertPath\"],\n\t[\"--daemon-tls-key\", \"tlsKeyPath\"],\n\t[\"--daemon-lsp-config\", \"lspConfigPath\"],\n\t[\"--daemon-max-connections\", \"maxConnections\"],\n\t[\"--daemon-max-pending-connections\", \"maxPendingConnections\"],\n\t[\"--daemon-handshake-timeout-ms\", \"handshakeTimeoutMs\"],\n\t[\"--daemon-shutdown-timeout-ms\", \"shutdownTimeoutMs\"],\n]);\n\nconst BOOLEAN_FLAGS = new Map<string, keyof ParsedDaemonInputs>([\n\t[\"--daemon-allow-insecure-transport\", \"allowInsecureTransport\"],\n\t[\"--daemon-allow-process-exec\", \"allowProcessExec\"],\n\t[\"--daemon-allow-root\", \"allowRoot\"],\n\t[\"--daemon-trust-project-lsp\", \"trustProjectLsp\"],\n]);\n\nfunction parseBoolean(value: string | undefined, name: string, fallback = false): boolean {\n\tif (value === undefined) return fallback;\n\tconst parsed = BOOLEAN_VALUES.get(value.toLowerCase());\n\tif (parsed === undefined) throw new DaemonConfigurationError(`${name} must be one of 1, 0, true, false, yes, or no`);\n\treturn parsed;\n}\n\nfunction parseInteger(\n\tvalue: string | undefined,\n\tname: string,\n\tminimum: number,\n\tmaximum: number,\n\tfallback: number,\n): number {\n\tif (value === undefined) return fallback;\n\tif (!/^(0|[1-9][0-9]*)$/.test(value)) {\n\t\tthrow new DaemonConfigurationError(`${name} must be a decimal integer from ${minimum} to ${maximum}`);\n\t}\n\tconst parsed = Number(value);\n\tif (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum) {\n\t\tthrow new DaemonConfigurationError(`${name} must be a decimal integer from ${minimum} to ${maximum}`);\n\t}\n\treturn parsed;\n}\n\nfunction setSingleton(\n\tinputs: ParsedDaemonInputs,\n\tkey: keyof ParsedDaemonInputs,\n\tvalue: string | boolean,\n\tflag: string,\n): void {\n\tif (inputs[key] !== undefined) throw new DaemonConfigurationError(`${flag} may only be specified once`);\n\t(inputs as Record<keyof ParsedDaemonInputs, unknown>)[key] = value;\n}\n\nfunction requireFlagValue(args: readonly string[], index: number, flag: string): string {\n\tconst value = args[index + 1];\n\tif (value === undefined || value.startsWith(\"-\")) throw new DaemonConfigurationError(`${flag} requires a value`);\n\treturn value;\n}\n\nfunction parseInputs(args: readonly string[]): ParsedDaemonInputs {\n\tif (args[0] !== \"--daemon\") throw new DaemonConfigurationError(\"Daemon command must start with --daemon\");\n\tconst inputs: ParsedDaemonInputs = { help: false, origins: [], forwardedEnvironment: [] };\n\tfor (let index = 1; index < args.length; index++) {\n\t\tconst argument = args[index];\n\t\tif (argument === \"--help\" || argument === \"-h\") {\n\t\t\tinputs.help = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (argument === \"--daemon-origin\" || argument === \"--daemon-env\") {\n\t\t\tconst value = requireFlagValue(args, index, argument);\n\t\t\tif (argument === \"--daemon-origin\") inputs.origins.push(value);\n\t\t\telse inputs.forwardedEnvironment.push(value);\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tconst valueKey = VALUE_FLAGS.get(argument);\n\t\tif (valueKey) {\n\t\t\tsetSingleton(inputs, valueKey, requireFlagValue(args, index, argument), argument);\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tconst booleanKey = BOOLEAN_FLAGS.get(argument);\n\t\tif (booleanKey) {\n\t\t\tsetSingleton(inputs, booleanKey, true, argument);\n\t\t\tcontinue;\n\t\t}\n\t\tthrow new DaemonConfigurationError(\n\t\t\targument.startsWith(\"-\")\n\t\t\t\t? `Unknown or incompatible option in daemon mode: ${argument}`\n\t\t\t\t: `Daemon mode does not accept positional arguments: ${argument}`,\n\t\t);\n\t}\n\treturn inputs;\n}\n\nfunction parseOrigin(value: string): string {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(value);\n\t} catch {\n\t\tthrow new DaemonConfigurationError(`Invalid daemon Origin: ${value}`);\n\t}\n\tif (\n\t\t(url.protocol !== \"http:\" && url.protocol !== \"https:\") ||\n\t\turl.username !== \"\" ||\n\t\turl.password !== \"\" ||\n\t\turl.pathname !== \"/\" ||\n\t\turl.search !== \"\" ||\n\t\turl.hash !== \"\" ||\n\t\tvalue !== url.origin\n\t) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Daemon origins must be exact HTTP(S) origins without paths or wildcards: ${value}`,\n\t\t);\n\t}\n\treturn url.origin;\n}\n\nfunction parseEnvironmentNames(values: readonly string[]): string[] {\n\tconst names = values\n\t\t.flatMap((value) => value.split(\",\"))\n\t\t.map((value) => value.trim())\n\t\t.filter(Boolean);\n\tconst seen = new Set<string>();\n\tfor (const name of names) {\n\t\tif (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))\n\t\t\tthrow new DaemonConfigurationError(`Invalid daemon environment name: ${name}`);\n\t\tconst identity = process.platform === \"win32\" ? name.toLowerCase() : name;\n\t\tif (seen.has(identity)) throw new DaemonConfigurationError(`Duplicate daemon environment name: ${name}`);\n\t\tseen.add(identity);\n\t}\n\treturn names;\n}\n\nasync function resolveConfinedRoot(value: string, startupCwd: string, label: string): Promise<string> {\n\tconst candidate = isAbsolute(value) ? value : resolve(startupCwd, value);\n\tlet canonical: string;\n\ttry {\n\t\tcanonical = await realpath(candidate);\n\t\tif (!(await stat(canonical)).isDirectory()) throw new Error(\"not a directory\");\n\t} catch (error) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Daemon ${label} must be an existing directory: ${candidate} (${error instanceof Error ? error.message : String(error)})`,\n\t\t);\n\t}\n\treturn canonical;\n}\n\nasync function readTlsFile(path: string, label: string, startupCwd: string): Promise<Buffer> {\n\tconst resolvedPath = isAbsolute(path) ? path : resolve(startupCwd, path);\n\ttry {\n\t\tconst content = await readFile(resolvedPath);\n\t\tif (content.byteLength === 0) throw new Error(\"file is empty\");\n\t\treturn content;\n\t} catch (error) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Unable to read daemon TLS ${label} file ${resolvedPath}: ${error instanceof Error ? error.message : String(error)}`,\n\t\t);\n\t}\n}\n\nfunction validateToken(token: string | undefined): string | undefined {\n\tif (token === undefined) return undefined;\n\tconst bytes = Buffer.byteLength(token, \"utf8\");\n\tif (bytes < 32 || bytes > 1024 || !/\\S/u.test(token) || /[\\r\\n]/u.test(token)) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t\"GRIP_DAEMON_TOKEN must contain 32 to 1024 UTF-8 bytes, include a non-whitespace character, and contain no line breaks\",\n\t\t);\n\t}\n\treturn token;\n}\n\nfunction isRootProcess(): boolean {\n\treturn process.platform !== \"win32\" && typeof process.getuid === \"function\" && process.getuid() === 0;\n}\n\nexport function isDaemonCommand(args: readonly string[]): boolean {\n\treturn args[0] === \"--daemon\";\n}\ninterface DaemonEndpointConfiguration {\n\thost: string;\n\tport: number;\n}\n\ninterface DaemonWorkspaceRootsConfiguration {\n\tallowRoot: boolean;\n\tworkspaceRoot: string;\n\ttemporaryRoot: string | undefined;\n}\n\ninterface DaemonTransportSecurityConfiguration {\n\ttoken: string | undefined;\n\tallowedOrigins: string[];\n\ttls: DaemonTlsConfiguration | undefined;\n}\n\ninterface DaemonCapacityConfiguration {\n\tmaxGlobalRequests: number;\n\tmaxGlobalTransfers: number;\n\tmaxBufferedOutputBytes: number;\n\tprotocolLimits: RemoteWorkspaceProtocolLimits;\n}\n\nfunction resolveDaemonEndpoint(\n\tinputs: ParsedDaemonInputs,\n\tenvironment: NodeJS.ProcessEnv,\n): DaemonEndpointConfiguration {\n\tconst host = inputs.host ?? environment.GRIP_DAEMON_HOST ?? \"127.0.0.1\";\n\tif (host.length === 0 || /\\s/u.test(host)) {\n\t\tthrow new DaemonConfigurationError(\"Daemon host must be a non-empty IP address\");\n\t}\n\tconst port = parseInteger(\n\t\tinputs.port ?? environment.GRIP_DAEMON_PORT,\n\t\t\"GRIP_DAEMON_PORT/--daemon-port\",\n\t\t1,\n\t\t65535,\n\t\t8787,\n\t);\n\treturn { host, port };\n}\n\nasync function resolveDaemonWorkspaceRoots(\n\tinputs: ParsedDaemonInputs,\n\tenvironment: NodeJS.ProcessEnv,\n\tstartupCwd: string,\n): Promise<DaemonWorkspaceRootsConfiguration> {\n\tconst allowRoot = inputs.allowRoot ?? parseBoolean(environment.GRIP_DAEMON_ALLOW_ROOT, \"GRIP_DAEMON_ALLOW_ROOT\");\n\tif (isRootProcess() && !allowRoot) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t\"Refusing to run the workspace daemon as root; use --daemon-allow-root only inside an intentional OS sandbox\",\n\t\t);\n\t}\n\tconst workspaceRoot = await resolveConfinedRoot(\n\t\tinputs.cwd ?? environment.GRIP_DAEMON_CWD ?? startupCwd,\n\t\tstartupCwd,\n\t\t\"workspace root\",\n\t);\n\tconst temporaryRoot = environment.GRIP_DAEMON_TEMP_ROOT\n\t\t? await resolveConfinedRoot(environment.GRIP_DAEMON_TEMP_ROOT, startupCwd, \"temporary root\")\n\t\t: undefined;\n\treturn { allowRoot, workspaceRoot, temporaryRoot };\n}\n\nasync function resolveSharedParentRoot(\n\tinputs: ParsedDaemonInputs,\n\tenvironment: NodeJS.ProcessEnv,\n\tstartupCwd: string,\n\tworkspaceRoot: string,\n): Promise<string | undefined> {\n\tconst value = inputs.sharedParent ?? environment.GRIP_DAEMON_SHARED_PARENT;\n\tif (value === undefined) return undefined;\n\tif (value === \"\") throw new DaemonConfigurationError(\"Shared parent mount must not be empty\");\n\tconst root = await resolveConfinedRoot(value, startupCwd, \"shared parent mount\");\n\tif (root !== workspaceRoot) {\n\t\tthrow new DaemonConfigurationError(\"Shared parent mount must equal --daemon-cwd (the fixed mounted parent)\");\n\t}\n\treturn root;\n}\n\nasync function resolveDaemonTransportSecurity(\n\tinputs: ParsedDaemonInputs,\n\tenvironment: NodeJS.ProcessEnv,\n\tstartupCwd: string,\n): Promise<DaemonTransportSecurityConfiguration> {\n\tconst token = validateToken(environment.GRIP_DAEMON_TOKEN);\n\tconst allowedOrigins = [\n\t\t...(environment.GRIP_DAEMON_ORIGINS?.split(\",\")\n\t\t\t.map((value) => value.trim())\n\t\t\t.filter(Boolean) ?? []),\n\t\t...inputs.origins,\n\t].map(parseOrigin);\n\tif (new Set(allowedOrigins).size !== allowedOrigins.length) {\n\t\tthrow new DaemonConfigurationError(\"Daemon origins must be unique\");\n\t}\n\tconst tlsCertPath = inputs.tlsCertPath ?? environment.GRIP_DAEMON_TLS_CERT;\n\tconst tlsKeyPath = inputs.tlsKeyPath ?? environment.GRIP_DAEMON_TLS_KEY;\n\tif ((tlsCertPath === undefined) !== (tlsKeyPath === undefined)) {\n\t\tthrow new DaemonConfigurationError(\"Daemon TLS requires both a certificate and private key\");\n\t}\n\tconst tls =\n\t\ttlsCertPath && tlsKeyPath\n\t\t\t? Object.freeze({\n\t\t\t\t\tcert: await readTlsFile(tlsCertPath, \"certificate\", startupCwd),\n\t\t\t\t\tkey: await readTlsFile(tlsKeyPath, \"private key\", startupCwd),\n\t\t\t\t\tpassphrase: environment.GRIP_DAEMON_TLS_PASSPHRASE,\n\t\t\t\t})\n\t\t\t: undefined;\n\treturn { token, allowedOrigins, tls };\n}\n\nfunction resolveDaemonCapacity(environment: NodeJS.ProcessEnv): DaemonCapacityConfiguration {\n\tconst maxConnectionRequests = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_CONNECTION_REQUESTS,\n\t\t\"GRIP_DAEMON_MAX_CONNECTION_REQUESTS\",\n\t\t1,\n\t\t10_000_000,\n\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxActiveRequests,\n\t);\n\tconst maxGlobalRequests = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_GLOBAL_REQUESTS,\n\t\t\"GRIP_DAEMON_MAX_GLOBAL_REQUESTS\",\n\t\t1,\n\t\t10_000_000,\n\t\tmaxConnectionRequests,\n\t);\n\tif (maxGlobalRequests < maxConnectionRequests) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t\"GRIP_DAEMON_MAX_GLOBAL_REQUESTS must be at least GRIP_DAEMON_MAX_CONNECTION_REQUESTS\",\n\t\t);\n\t}\n\tconst maxConnectionTransfers = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_CONNECTION_UPLOADS,\n\t\t\"GRIP_DAEMON_MAX_CONNECTION_UPLOADS\",\n\t\t1,\n\t\t10_000,\n\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxActiveTransfers,\n\t);\n\tconst maxGlobalTransfers = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_GLOBAL_UPLOADS,\n\t\t\"GRIP_DAEMON_MAX_GLOBAL_UPLOADS\",\n\t\t1,\n\t\t10_000,\n\t\tmaxConnectionTransfers,\n\t);\n\tif (maxGlobalTransfers < maxConnectionTransfers) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t\"GRIP_DAEMON_MAX_GLOBAL_UPLOADS must be at least GRIP_DAEMON_MAX_CONNECTION_UPLOADS\",\n\t\t);\n\t}\n\tconst maxMessageBytes = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_FRAME_BYTES,\n\t\t\"GRIP_DAEMON_MAX_FRAME_BYTES\",\n\t\t1024,\n\t\t64 * 1024 * 1024,\n\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxMessageBytes,\n\t);\n\tconst maxTransferBytes = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_UPLOAD_BYTES,\n\t\t\"GRIP_DAEMON_MAX_UPLOAD_BYTES\",\n\t\t1,\n\t\tNumber.MAX_SAFE_INTEGER,\n\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxTransferBytes,\n\t);\n\tconst maxBufferedOutputBytes = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_BUFFERED_OUTPUT_BYTES,\n\t\t\"GRIP_DAEMON_MAX_BUFFERED_OUTPUT_BYTES\",\n\t\t1024,\n\t\t64 * 1024 * 1024,\n\t\t8 * 1024 * 1024,\n\t);\n\tconst protocolLimits = validateRemoteWorkspaceProtocolLimits({\n\t\t...DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS,\n\t\tmaxMessageBytes,\n\t\tmaxStringBytes: Math.min(DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxStringBytes, maxMessageBytes),\n\t\tmaxPendingInboundBytes: Math.max(\n\t\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxPendingInboundBytes,\n\t\t\tmaxMessageBytes,\n\t\t),\n\t\tmaxTransferBytes,\n\t\tmaxActiveRequests: maxConnectionRequests,\n\t\tmaxActiveTransfers: Math.min(maxConnectionTransfers, maxGlobalTransfers),\n\t});\n\treturn { maxGlobalRequests, maxGlobalTransfers, maxBufferedOutputBytes, protocolLimits };\n}\n\nexport async function parseDaemonCommand(\n\targs: readonly string[],\n\tenvironment: NodeJS.ProcessEnv = process.env,\n\tstartupCwd = process.cwd(),\n): Promise<DaemonCommand> {\n\tconst inputs = parseInputs(args);\n\tif (inputs.help) return { help: true };\n\n\tconst { host, port } = resolveDaemonEndpoint(inputs, environment);\n\tconst { allowRoot, workspaceRoot, temporaryRoot } = await resolveDaemonWorkspaceRoots(\n\t\tinputs,\n\t\tenvironment,\n\t\tstartupCwd,\n\t);\n\tconst sharedParentRoot = await resolveSharedParentRoot(inputs, environment, startupCwd, workspaceRoot);\n\tconst { token, allowedOrigins, tls } = await resolveDaemonTransportSecurity(inputs, environment, startupCwd);\n\tconst { maxGlobalRequests, maxGlobalTransfers, maxBufferedOutputBytes, protocolLimits } =\n\t\tresolveDaemonCapacity(environment);\n\n\tconst allowInsecureTransport =\n\t\tinputs.allowInsecureTransport ??\n\t\tparseBoolean(environment.GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT, \"GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT\");\n\tconst allowProcessExec =\n\t\tinputs.allowProcessExec ??\n\t\tparseBoolean(environment.GRIP_DAEMON_ALLOW_PROCESS_EXEC, \"GRIP_DAEMON_ALLOW_PROCESS_EXEC\");\n\tconst trustProjectLsp =\n\t\tinputs.trustProjectLsp ??\n\t\tparseBoolean(environment.GRIP_DAEMON_TRUST_PROJECT_LSP, \"GRIP_DAEMON_TRUST_PROJECT_LSP\");\n\tconst forwardedEnvironment = parseEnvironmentNames([\n\t\t...(environment.GRIP_DAEMON_ENV?.split(\",\") ?? []),\n\t\t...inputs.forwardedEnvironment,\n\t]);\n\tconst maxConnections = parseInteger(\n\t\tinputs.maxConnections ?? environment.GRIP_DAEMON_MAX_CONNECTIONS,\n\t\t\"GRIP_DAEMON_MAX_CONNECTIONS/--daemon-max-connections\",\n\t\t1,\n\t\t100_000,\n\t\t64,\n\t);\n\tconst maxPendingConnections = parseInteger(\n\t\tinputs.maxPendingConnections ?? environment.GRIP_DAEMON_MAX_PENDING_CONNECTIONS,\n\t\t\"GRIP_DAEMON_MAX_PENDING_CONNECTIONS/--daemon-max-pending-connections\",\n\t\t1,\n\t\t100_000,\n\t\t64,\n\t);\n\tconst handshakeTimeoutMs = parseInteger(\n\t\tinputs.handshakeTimeoutMs ?? environment.GRIP_DAEMON_HANDSHAKE_TIMEOUT_MS,\n\t\t\"GRIP_DAEMON_HANDSHAKE_TIMEOUT_MS/--daemon-handshake-timeout-ms\",\n\t\t100,\n\t\t5 * 60_000,\n\t\t10_000,\n\t);\n\tconst shutdownTimeoutMs = parseInteger(\n\t\tinputs.shutdownTimeoutMs ?? environment.GRIP_DAEMON_SHUTDOWN_TIMEOUT_MS,\n\t\t\"GRIP_DAEMON_SHUTDOWN_TIMEOUT_MS/--daemon-shutdown-timeout-ms\",\n\t\t100,\n\t\t5 * 60_000,\n\t\t10_000,\n\t);\n\n\treturn {\n\t\thelp: false,\n\t\tconfiguration: Object.freeze({\n\t\t\thost,\n\t\t\tport,\n\t\t\tworkspaceRoot,\n\t\t\tsharedParentRoot,\n\t\t\ttemporaryRoot,\n\t\t\ttoken,\n\t\t\tallowedOrigins: Object.freeze(allowedOrigins),\n\t\t\ttls,\n\t\t\tallowInsecureTransport,\n\t\t\tallowProcessExec,\n\t\t\tallowRoot,\n\t\t\tforwardedEnvironment: Object.freeze(forwardedEnvironment),\n\t\t\tlspConfigPath:\n\t\t\t\tinputs.lspConfigPath || environment.GRIP_DAEMON_LSP_CONFIG\n\t\t\t\t\t? resolve(startupCwd, inputs.lspConfigPath ?? environment.GRIP_DAEMON_LSP_CONFIG!)\n\t\t\t\t\t: undefined,\n\t\t\ttrustProjectLsp,\n\t\t\tsandboxInstructionsPath: environment.GRIP_DAEMON_SANDBOX_INSTRUCTIONS\n\t\t\t\t? resolve(startupCwd, environment.GRIP_DAEMON_SANDBOX_INSTRUCTIONS)\n\t\t\t\t: undefined,\n\t\t\tuserAgentsPath: environment.HOME ? join(environment.HOME, \".grip\", \"AGENTS.md\") : undefined,\n\t\t\tmaxConnections,\n\t\t\tmaxGlobalRequests,\n\t\t\tmaxGlobalTransfers,\n\t\t\tmaxBufferedOutputBytes,\n\t\t\tmaxPendingConnections,\n\t\t\thandshakeTimeoutMs,\n\t\t\tshutdownTimeoutMs,\n\t\t\tprotocolLimits: Object.freeze({ ...protocolLimits }),\n\t\t}),\n\t};\n}\n"]}

package/dist/daemon/config.js

@@ -0,0 +1,319 @@
+import { readFile, realpath, stat } from "node:fs/promises";
+import { isAbsolute, join, resolve } from "node:path";
+import { DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS, validateRemoteWorkspaceProtocolLimits, } from "../core/remote-workspace-protocol/contract.js";
+export const DAEMON_WEBSOCKET_PATH = "/grip/workspace";
+export const DAEMON_WEBSOCKET_PROTOCOL = "grip.workspace.v1";
+export class DaemonConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DaemonConfigurationError";
+    }
+}
+const BOOLEAN_VALUES = new Map([
+    ["1", true],
+    ["true", true],
+    ["yes", true],
+    ["0", false],
+    ["false", false],
+    ["no", false],
+]);
+const VALUE_FLAGS = new Map([
+    ["--daemon-host", "host"],
+    ["--daemon-port", "port"],
+    ["--daemon-cwd", "cwd"],
+    ["--daemon-shared-parent", "sharedParent"],
+    ["--daemon-tls-cert", "tlsCertPath"],
+    ["--daemon-tls-key", "tlsKeyPath"],
+    ["--daemon-lsp-config", "lspConfigPath"],
+    ["--daemon-max-connections", "maxConnections"],
+    ["--daemon-max-pending-connections", "maxPendingConnections"],
+    ["--daemon-handshake-timeout-ms", "handshakeTimeoutMs"],
+    ["--daemon-shutdown-timeout-ms", "shutdownTimeoutMs"],
+]);
+const BOOLEAN_FLAGS = new Map([
+    ["--daemon-allow-insecure-transport", "allowInsecureTransport"],
+    ["--daemon-allow-process-exec", "allowProcessExec"],
+    ["--daemon-allow-root", "allowRoot"],
+    ["--daemon-trust-project-lsp", "trustProjectLsp"],
+]);
+function parseBoolean(value, name, fallback = false) {
+    if (value === undefined)
+        return fallback;
+    const parsed = BOOLEAN_VALUES.get(value.toLowerCase());
+    if (parsed === undefined)
+        throw new DaemonConfigurationError(`${name} must be one of 1, 0, true, false, yes, or no`);
+    return parsed;
+}
+function parseInteger(value, name, minimum, maximum, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (!/^(0|[1-9][0-9]*)$/.test(value)) {
+        throw new DaemonConfigurationError(`${name} must be a decimal integer from ${minimum} to ${maximum}`);
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum) {
+        throw new DaemonConfigurationError(`${name} must be a decimal integer from ${minimum} to ${maximum}`);
+    }
+    return parsed;
+}
+function setSingleton(inputs, key, value, flag) {
+    if (inputs[key] !== undefined)
+        throw new DaemonConfigurationError(`${flag} may only be specified once`);
+    inputs[key] = value;
+}
+function requireFlagValue(args, index, flag) {
+    const value = args[index + 1];
+    if (value === undefined || value.startsWith("-"))
+        throw new DaemonConfigurationError(`${flag} requires a value`);
+    return value;
+}
+function parseInputs(args) {
+    if (args[0] !== "--daemon")
+        throw new DaemonConfigurationError("Daemon command must start with --daemon");
+    const inputs = { help: false, origins: [], forwardedEnvironment: [] };
+    for (let index = 1; index < args.length; index++) {
+        const argument = args[index];
+        if (argument === "--help" || argument === "-h") {
+            inputs.help = true;
+            continue;
+        }
+        if (argument === "--daemon-origin" || argument === "--daemon-env") {
+            const value = requireFlagValue(args, index, argument);
+            if (argument === "--daemon-origin")
+                inputs.origins.push(value);
+            else
+                inputs.forwardedEnvironment.push(value);
+            index++;
+            continue;
+        }
+        const valueKey = VALUE_FLAGS.get(argument);
+        if (valueKey) {
+            setSingleton(inputs, valueKey, requireFlagValue(args, index, argument), argument);
+            index++;
+            continue;
+        }
+        const booleanKey = BOOLEAN_FLAGS.get(argument);
+        if (booleanKey) {
+            setSingleton(inputs, booleanKey, true, argument);
+            continue;
+        }
+        throw new DaemonConfigurationError(argument.startsWith("-")
+            ? `Unknown or incompatible option in daemon mode: ${argument}`
+            : `Daemon mode does not accept positional arguments: ${argument}`);
+    }
+    return inputs;
+}
+function parseOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new DaemonConfigurationError(`Invalid daemon Origin: ${value}`);
+    }
+    if ((url.protocol !== "http:" && url.protocol !== "https:") ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.pathname !== "/" ||
+        url.search !== "" ||
+        url.hash !== "" ||
+        value !== url.origin) {
+        throw new DaemonConfigurationError(`Daemon origins must be exact HTTP(S) origins without paths or wildcards: ${value}`);
+    }
+    return url.origin;
+}
+function parseEnvironmentNames(values) {
+    const names = values
+        .flatMap((value) => value.split(","))
+        .map((value) => value.trim())
+        .filter(Boolean);
+    const seen = new Set();
+    for (const name of names) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+            throw new DaemonConfigurationError(`Invalid daemon environment name: ${name}`);
+        const identity = process.platform === "win32" ? name.toLowerCase() : name;
+        if (seen.has(identity))
+            throw new DaemonConfigurationError(`Duplicate daemon environment name: ${name}`);
+        seen.add(identity);
+    }
+    return names;
+}
+async function resolveConfinedRoot(value, startupCwd, label) {
+    const candidate = isAbsolute(value) ? value : resolve(startupCwd, value);
+    let canonical;
+    try {
+        canonical = await realpath(candidate);
+        if (!(await stat(canonical)).isDirectory())
+            throw new Error("not a directory");
+    }
+    catch (error) {
+        throw new DaemonConfigurationError(`Daemon ${label} must be an existing directory: ${candidate} (${error instanceof Error ? error.message : String(error)})`);
+    }
+    return canonical;
+}
+async function readTlsFile(path, label, startupCwd) {
+    const resolvedPath = isAbsolute(path) ? path : resolve(startupCwd, path);
+    try {
+        const content = await readFile(resolvedPath);
+        if (content.byteLength === 0)
+            throw new Error("file is empty");
+        return content;
+    }
+    catch (error) {
+        throw new DaemonConfigurationError(`Unable to read daemon TLS ${label} file ${resolvedPath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function validateToken(token) {
+    if (token === undefined)
+        return undefined;
+    const bytes = Buffer.byteLength(token, "utf8");
+    if (bytes < 32 || bytes > 1024 || !/\S/u.test(token) || /[\r\n]/u.test(token)) {
+        throw new DaemonConfigurationError("GRIP_DAEMON_TOKEN must contain 32 to 1024 UTF-8 bytes, include a non-whitespace character, and contain no line breaks");
+    }
+    return token;
+}
+function isRootProcess() {
+    return process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0;
+}
+export function isDaemonCommand(args) {
+    return args[0] === "--daemon";
+}
+function resolveDaemonEndpoint(inputs, environment) {
+    const host = inputs.host ?? environment.GRIP_DAEMON_HOST ?? "127.0.0.1";
+    if (host.length === 0 || /\s/u.test(host)) {
+        throw new DaemonConfigurationError("Daemon host must be a non-empty IP address");
+    }
+    const port = parseInteger(inputs.port ?? environment.GRIP_DAEMON_PORT, "GRIP_DAEMON_PORT/--daemon-port", 1, 65535, 8787);
+    return { host, port };
+}
+async function resolveDaemonWorkspaceRoots(inputs, environment, startupCwd) {
+    const allowRoot = inputs.allowRoot ?? parseBoolean(environment.GRIP_DAEMON_ALLOW_ROOT, "GRIP_DAEMON_ALLOW_ROOT");
+    if (isRootProcess() && !allowRoot) {
+        throw new DaemonConfigurationError("Refusing to run the workspace daemon as root; use --daemon-allow-root only inside an intentional OS sandbox");
+    }
+    const workspaceRoot = await resolveConfinedRoot(inputs.cwd ?? environment.GRIP_DAEMON_CWD ?? startupCwd, startupCwd, "workspace root");
+    const temporaryRoot = environment.GRIP_DAEMON_TEMP_ROOT
+        ? await resolveConfinedRoot(environment.GRIP_DAEMON_TEMP_ROOT, startupCwd, "temporary root")
+        : undefined;
+    return { allowRoot, workspaceRoot, temporaryRoot };
+}
+async function resolveSharedParentRoot(inputs, environment, startupCwd, workspaceRoot) {
+    const value = inputs.sharedParent ?? environment.GRIP_DAEMON_SHARED_PARENT;
+    if (value === undefined)
+        return undefined;
+    if (value === "")
+        throw new DaemonConfigurationError("Shared parent mount must not be empty");
+    const root = await resolveConfinedRoot(value, startupCwd, "shared parent mount");
+    if (root !== workspaceRoot) {
+        throw new DaemonConfigurationError("Shared parent mount must equal --daemon-cwd (the fixed mounted parent)");
+    }
+    return root;
+}
+async function resolveDaemonTransportSecurity(inputs, environment, startupCwd) {
+    const token = validateToken(environment.GRIP_DAEMON_TOKEN);
+    const allowedOrigins = [
+        ...(environment.GRIP_DAEMON_ORIGINS?.split(",")
+            .map((value) => value.trim())
+            .filter(Boolean) ?? []),
+        ...inputs.origins,
+    ].map(parseOrigin);
+    if (new Set(allowedOrigins).size !== allowedOrigins.length) {
+        throw new DaemonConfigurationError("Daemon origins must be unique");
+    }
+    const tlsCertPath = inputs.tlsCertPath ?? environment.GRIP_DAEMON_TLS_CERT;
+    const tlsKeyPath = inputs.tlsKeyPath ?? environment.GRIP_DAEMON_TLS_KEY;
+    if ((tlsCertPath === undefined) !== (tlsKeyPath === undefined)) {
+        throw new DaemonConfigurationError("Daemon TLS requires both a certificate and private key");
+    }
+    const tls = tlsCertPath && tlsKeyPath
+        ? Object.freeze({
+            cert: await readTlsFile(tlsCertPath, "certificate", startupCwd),
+            key: await readTlsFile(tlsKeyPath, "private key", startupCwd),
+            passphrase: environment.GRIP_DAEMON_TLS_PASSPHRASE,
+        })
+        : undefined;
+    return { token, allowedOrigins, tls };
+}
+function resolveDaemonCapacity(environment) {
+    const maxConnectionRequests = parseInteger(environment.GRIP_DAEMON_MAX_CONNECTION_REQUESTS, "GRIP_DAEMON_MAX_CONNECTION_REQUESTS", 1, 10_000_000, DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxActiveRequests);
+    const maxGlobalRequests = parseInteger(environment.GRIP_DAEMON_MAX_GLOBAL_REQUESTS, "GRIP_DAEMON_MAX_GLOBAL_REQUESTS", 1, 10_000_000, maxConnectionRequests);
+    if (maxGlobalRequests < maxConnectionRequests) {
+        throw new DaemonConfigurationError("GRIP_DAEMON_MAX_GLOBAL_REQUESTS must be at least GRIP_DAEMON_MAX_CONNECTION_REQUESTS");
+    }
+    const maxConnectionTransfers = parseInteger(environment.GRIP_DAEMON_MAX_CONNECTION_UPLOADS, "GRIP_DAEMON_MAX_CONNECTION_UPLOADS", 1, 10_000, DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxActiveTransfers);
+    const maxGlobalTransfers = parseInteger(environment.GRIP_DAEMON_MAX_GLOBAL_UPLOADS, "GRIP_DAEMON_MAX_GLOBAL_UPLOADS", 1, 10_000, maxConnectionTransfers);
+    if (maxGlobalTransfers < maxConnectionTransfers) {
+        throw new DaemonConfigurationError("GRIP_DAEMON_MAX_GLOBAL_UPLOADS must be at least GRIP_DAEMON_MAX_CONNECTION_UPLOADS");
+    }
+    const maxMessageBytes = parseInteger(environment.GRIP_DAEMON_MAX_FRAME_BYTES, "GRIP_DAEMON_MAX_FRAME_BYTES", 1024, 64 * 1024 * 1024, DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxMessageBytes);
+    const maxTransferBytes = parseInteger(environment.GRIP_DAEMON_MAX_UPLOAD_BYTES, "GRIP_DAEMON_MAX_UPLOAD_BYTES", 1, Number.MAX_SAFE_INTEGER, DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxTransferBytes);
+    const maxBufferedOutputBytes = parseInteger(environment.GRIP_DAEMON_MAX_BUFFERED_OUTPUT_BYTES, "GRIP_DAEMON_MAX_BUFFERED_OUTPUT_BYTES", 1024, 64 * 1024 * 1024, 8 * 1024 * 1024);
+    const protocolLimits = validateRemoteWorkspaceProtocolLimits({
+        ...DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS,
+        maxMessageBytes,
+        maxStringBytes: Math.min(DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxStringBytes, maxMessageBytes),
+        maxPendingInboundBytes: Math.max(DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxPendingInboundBytes, maxMessageBytes),
+        maxTransferBytes,
+        maxActiveRequests: maxConnectionRequests,
+        maxActiveTransfers: Math.min(maxConnectionTransfers, maxGlobalTransfers),
+    });
+    return { maxGlobalRequests, maxGlobalTransfers, maxBufferedOutputBytes, protocolLimits };
+}
+export async function parseDaemonCommand(args, environment = process.env, startupCwd = process.cwd()) {
+    const inputs = parseInputs(args);
+    if (inputs.help)
+        return { help: true };
+    const { host, port } = resolveDaemonEndpoint(inputs, environment);
+    const { allowRoot, workspaceRoot, temporaryRoot } = await resolveDaemonWorkspaceRoots(inputs, environment, startupCwd);
+    const sharedParentRoot = await resolveSharedParentRoot(inputs, environment, startupCwd, workspaceRoot);
+    const { token, allowedOrigins, tls } = await resolveDaemonTransportSecurity(inputs, environment, startupCwd);
+    const { maxGlobalRequests, maxGlobalTransfers, maxBufferedOutputBytes, protocolLimits } = resolveDaemonCapacity(environment);
+    const allowInsecureTransport = inputs.allowInsecureTransport ??
+        parseBoolean(environment.GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT, "GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT");
+    const allowProcessExec = inputs.allowProcessExec ??
+        parseBoolean(environment.GRIP_DAEMON_ALLOW_PROCESS_EXEC, "GRIP_DAEMON_ALLOW_PROCESS_EXEC");
+    const trustProjectLsp = inputs.trustProjectLsp ??
+        parseBoolean(environment.GRIP_DAEMON_TRUST_PROJECT_LSP, "GRIP_DAEMON_TRUST_PROJECT_LSP");
+    const forwardedEnvironment = parseEnvironmentNames([
+        ...(environment.GRIP_DAEMON_ENV?.split(",") ?? []),
+        ...inputs.forwardedEnvironment,
+    ]);
+    const maxConnections = parseInteger(inputs.maxConnections ?? environment.GRIP_DAEMON_MAX_CONNECTIONS, "GRIP_DAEMON_MAX_CONNECTIONS/--daemon-max-connections", 1, 100_000, 64);
+    const maxPendingConnections = parseInteger(inputs.maxPendingConnections ?? environment.GRIP_DAEMON_MAX_PENDING_CONNECTIONS, "GRIP_DAEMON_MAX_PENDING_CONNECTIONS/--daemon-max-pending-connections", 1, 100_000, 64);
+    const handshakeTimeoutMs = parseInteger(inputs.handshakeTimeoutMs ?? environment.GRIP_DAEMON_HANDSHAKE_TIMEOUT_MS, "GRIP_DAEMON_HANDSHAKE_TIMEOUT_MS/--daemon-handshake-timeout-ms", 100, 5 * 60_000, 10_000);
+    const shutdownTimeoutMs = parseInteger(inputs.shutdownTimeoutMs ?? environment.GRIP_DAEMON_SHUTDOWN_TIMEOUT_MS, "GRIP_DAEMON_SHUTDOWN_TIMEOUT_MS/--daemon-shutdown-timeout-ms", 100, 5 * 60_000, 10_000);
+    return {
+        help: false,
+        configuration: Object.freeze({
+            host,
+            port,
+            workspaceRoot,
+            sharedParentRoot,
+            temporaryRoot,
+            token,
+            allowedOrigins: Object.freeze(allowedOrigins),
+            tls,
+            allowInsecureTransport,
+            allowProcessExec,
+            allowRoot,
+            forwardedEnvironment: Object.freeze(forwardedEnvironment),
+            lspConfigPath: inputs.lspConfigPath || environment.GRIP_DAEMON_LSP_CONFIG
+                ? resolve(startupCwd, inputs.lspConfigPath ?? environment.GRIP_DAEMON_LSP_CONFIG)
+                : undefined,
+            trustProjectLsp,
+            sandboxInstructionsPath: environment.GRIP_DAEMON_SANDBOX_INSTRUCTIONS
+                ? resolve(startupCwd, environment.GRIP_DAEMON_SANDBOX_INSTRUCTIONS)
+                : undefined,
+            userAgentsPath: environment.HOME ? join(environment.HOME, ".grip", "AGENTS.md") : undefined,
+            maxConnections,
+            maxGlobalRequests,
+            maxGlobalTransfers,
+            maxBufferedOutputBytes,
+            maxPendingConnections,
+            handshakeTimeoutMs,
+            shutdownTimeoutMs,
+            protocolLimits: Object.freeze({ ...protocolLimits }),
+        }),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/daemon/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/daemon/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACN,wCAAwC,EAExC,qCAAqC,GACrC,MAAM,+CAA+C,CAAC;AAEvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAyC7D,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE;QAC5B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAAA,CACvC;CACD;AAuBD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAkB;IAC/C,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,MAAM,EAAE,IAAI,CAAC;IACd,CAAC,KAAK,EAAE,IAAI,CAAC;IACb,CAAC,GAAG,EAAE,KAAK,CAAC;IACZ,CAAC,OAAO,EAAE,KAAK,CAAC;IAChB,CAAC,IAAI,EAAE,KAAK,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAmC;IAC7D,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,cAAc,EAAE,KAAK,CAAC;IACvB,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1C,CAAC,mBAAmB,EAAE,aAAa,CAAC;IACpC,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAClC,CAAC,qBAAqB,EAAE,eAAe,CAAC;IACxC,CAAC,0BAA0B,EAAE,gBAAgB,CAAC;IAC9C,CAAC,kCAAkC,EAAE,uBAAuB,CAAC;IAC7D,CAAC,+BAA+B,EAAE,oBAAoB,CAAC;IACvD,CAAC,8BAA8B,EAAE,mBAAmB,CAAC;CACrD,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAmC;IAC/D,CAAC,mCAAmC,EAAE,wBAAwB,CAAC;IAC/D,CAAC,6BAA6B,EAAE,kBAAkB,CAAC;IACnD,CAAC,qBAAqB,EAAE,WAAW,CAAC;IACpC,CAAC,4BAA4B,EAAE,iBAAiB,CAAC;CACjD,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,KAAyB,EAAE,IAAY,EAAE,QAAQ,GAAG,KAAK,EAAW;IACzF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,+CAA+C,CAAC,CAAC;IACrH,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,YAAY,CACpB,KAAyB,EACzB,IAAY,EACZ,OAAe,EACf,OAAe,EACf,QAAgB,EACP;IACT,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,mCAAmC,OAAO,OAAO,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,OAAO,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;QAC3E,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,mCAAmC,OAAO,OAAO,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,YAAY,CACpB,MAA0B,EAC1B,GAA6B,EAC7B,KAAuB,EACvB,IAAY,EACL;IACP,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACvG,MAAoD,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAAA,CACnE;AAED,SAAS,gBAAgB,CAAC,IAAuB,EAAE,KAAa,EAAE,IAAY,EAAU;IACvF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IACjH,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,WAAW,CAAC,IAAuB,EAAsB;IACjE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;QAAE,MAAM,IAAI,wBAAwB,CAAC,yCAAyC,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAuB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC;IAC1F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;YACnB,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACtD,IAAI,QAAQ,KAAK,iBAAiB;gBAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;gBAC1D,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7C,KAAK,EAAE,CAAC;YACR,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACd,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;YAClF,KAAK,EAAE,CAAC;YACR,SAAS;QACV,CAAC;QACD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,UAAU,EAAE,CAAC;YAChB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACjD,SAAS;QACV,CAAC;QACD,MAAM,IAAI,wBAAwB,CACjC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,CAAC,CAAC,kDAAkD,QAAQ,EAAE;YAC9D,CAAC,CAAC,qDAAqD,QAAQ,EAAE,CAClE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,WAAW,CAAC,KAAa,EAAU;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,wBAAwB,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IACC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE;QACf,KAAK,KAAK,GAAG,CAAC,MAAM,EACnB,CAAC;QACF,MAAM,IAAI,wBAAwB,CACjC,4EAA4E,KAAK,EAAE,CACnF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AAAA,CAClB;AAED,SAAS,qBAAqB,CAAC,MAAyB,EAAY;IACnE,MAAM,KAAK,GAAG,MAAM;SAClB,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,MAAM,IAAI,wBAAwB,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,UAAkB,EAAE,KAAa,EAAmB;IACrG,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,wBAAwB,CACjC,UAAU,KAAK,mCAAmC,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CACzH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,UAAkB,EAAmB;IAC5F,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,wBAAwB,CACjC,6BAA6B,KAAK,SAAS,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpH,CAAC;IACH,CAAC;AAAA,CACD;AAED,SAAS,aAAa,CAAC,KAAyB,EAAsB;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,wBAAwB,CACjC,uHAAuH,CACvH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,aAAa,GAAY;IACjC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAAA,CACtG;AAED,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAW;IACjE,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;AAAA,CAC9B;AAyBD,SAAS,qBAAqB,CAC7B,MAA0B,EAC1B,WAA8B,EACA;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,gBAAgB,IAAI,WAAW,CAAC;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,wBAAwB,CAAC,4CAA4C,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CACxB,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,gBAAgB,EAC3C,gCAAgC,EAChC,CAAC,EACD,KAAK,EACL,IAAI,CACJ,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAAA,CACtB;AAED,KAAK,UAAU,2BAA2B,CACzC,MAA0B,EAC1B,WAA8B,EAC9B,UAAkB,EAC2B;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,YAAY,CAAC,WAAW,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC;IACjH,IAAI,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,wBAAwB,CACjC,6GAA6G,CAC7G,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAC9C,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,eAAe,IAAI,UAAU,EACvD,UAAU,EACV,gBAAgB,CAChB,CAAC;IACF,MAAM,aAAa,GAAG,WAAW,CAAC,qBAAqB;QACtD,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,qBAAqB,EAAE,UAAU,EAAE,gBAAgB,CAAC;QAC5F,CAAC,CAAC,SAAS,CAAC;IACb,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AAAA,CACnD;AAED,KAAK,UAAU,uBAAuB,CACrC,MAA0B,EAC1B,WAA8B,EAC9B,UAAkB,EAClB,aAAqB,EACS;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,IAAI,WAAW,CAAC,yBAAyB,CAAC;IAC3E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,wBAAwB,CAAC,uCAAuC,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;IACjF,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,wBAAwB,CAAC,wEAAwE,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,KAAK,UAAU,8BAA8B,CAC5C,MAA0B,EAC1B,WAA8B,EAC9B,UAAkB,EAC8B;IAChD,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG;QACtB,GAAG,CAAC,WAAW,CAAC,mBAAmB,EAAE,KAAK,CAAC,GAAG,CAAC;aAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,GAAG,MAAM,CAAC,OAAO;KACjB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnB,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,wBAAwB,CAAC,+BAA+B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,WAAW,CAAC,oBAAoB,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,WAAW,CAAC,mBAAmB,CAAC;IACxE,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,wBAAwB,CAAC,wDAAwD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GACR,WAAW,IAAI,UAAU;QACxB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,WAAW,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC;YAC/D,GAAG,EAAE,MAAM,WAAW,CAAC,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC;YAC7D,UAAU,EAAE,WAAW,CAAC,0BAA0B;SAClD,CAAC;QACH,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;AAAA,CACtC;AAED,SAAS,qBAAqB,CAAC,WAA8B,EAA+B;IAC3F,MAAM,qBAAqB,GAAG,YAAY,CACzC,WAAW,CAAC,mCAAmC,EAC/C,qCAAqC,EACrC,CAAC,EACD,UAAU,EACV,wCAAwC,CAAC,iBAAiB,CAC1D,CAAC;IACF,MAAM,iBAAiB,GAAG,YAAY,CACrC,WAAW,CAAC,+BAA+B,EAC3C,iCAAiC,EACjC,CAAC,EACD,UAAU,EACV,qBAAqB,CACrB,CAAC;IACF,IAAI,iBAAiB,GAAG,qBAAqB,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CACjC,sFAAsF,CACtF,CAAC;IACH,CAAC;IACD,MAAM,sBAAsB,GAAG,YAAY,CAC1C,WAAW,CAAC,kCAAkC,EAC9C,oCAAoC,EACpC,CAAC,EACD,MAAM,EACN,wCAAwC,CAAC,kBAAkB,CAC3D,CAAC;IACF,MAAM,kBAAkB,GAAG,YAAY,CACtC,WAAW,CAAC,8BAA8B,EAC1C,gCAAgC,EAChC,CAAC,EACD,MAAM,EACN,sBAAsB,CACtB,CAAC;IACF,IAAI,kBAAkB,GAAG,sBAAsB,EAAE,CAAC;QACjD,MAAM,IAAI,wBAAwB,CACjC,oFAAoF,CACpF,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,YAAY,CACnC,WAAW,CAAC,2BAA2B,EACvC,6BAA6B,EAC7B,IAAI,EACJ,EAAE,GAAG,IAAI,GAAG,IAAI,EAChB,wCAAwC,CAAC,eAAe,CACxD,CAAC;IACF,MAAM,gBAAgB,GAAG,YAAY,CACpC,WAAW,CAAC,4BAA4B,EACxC,8BAA8B,EAC9B,CAAC,EACD,MAAM,CAAC,gBAAgB,EACvB,wCAAwC,CAAC,gBAAgB,CACzD,CAAC;IACF,MAAM,sBAAsB,GAAG,YAAY,CAC1C,WAAW,CAAC,qCAAqC,EACjD,uCAAuC,EACvC,IAAI,EACJ,EAAE,GAAG,IAAI,GAAG,IAAI,EAChB,CAAC,GAAG,IAAI,GAAG,IAAI,CACf,CAAC;IACF,MAAM,cAAc,GAAG,qCAAqC,CAAC;QAC5D,GAAG,wCAAwC;QAC3C,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,wCAAwC,CAAC,cAAc,EAAE,eAAe,CAAC;QAClG,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAC/B,wCAAwC,CAAC,sBAAsB,EAC/D,eAAe,CACf;QACD,gBAAgB;QAChB,iBAAiB,EAAE,qBAAqB;QACxC,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;KACxE,CAAC,CAAC;IACH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,cAAc,EAAE,CAAC;AAAA,CACzF;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,IAAuB,EACvB,WAAW,GAAsB,OAAO,CAAC,GAAG,EAC5C,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,EACD;IACzB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,2BAA2B,CACpF,MAAM,EACN,WAAW,EACX,UAAU,CACV,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACvG,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,8BAA8B,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC7G,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,cAAc,EAAE,GACtF,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAEpC,MAAM,sBAAsB,GAC3B,MAAM,CAAC,sBAAsB;QAC7B,YAAY,CAAC,WAAW,CAAC,oCAAoC,EAAE,sCAAsC,CAAC,CAAC;IACxG,MAAM,gBAAgB,GACrB,MAAM,CAAC,gBAAgB;QACvB,YAAY,CAAC,WAAW,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC;IAC5F,MAAM,eAAe,GACpB,MAAM,CAAC,eAAe;QACtB,YAAY,CAAC,WAAW,CAAC,6BAA6B,EAAE,+BAA+B,CAAC,CAAC;IAC1F,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;QAClD,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAClD,GAAG,MAAM,CAAC,oBAAoB;KAC9B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,YAAY,CAClC,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC,2BAA2B,EAChE,sDAAsD,EACtD,CAAC,EACD,OAAO,EACP,EAAE,CACF,CAAC;IACF,MAAM,qBAAqB,GAAG,YAAY,CACzC,MAAM,CAAC,qBAAqB,IAAI,WAAW,CAAC,mCAAmC,EAC/E,sEAAsE,EACtE,CAAC,EACD,OAAO,EACP,EAAE,CACF,CAAC;IACF,MAAM,kBAAkB,GAAG,YAAY,CACtC,MAAM,CAAC,kBAAkB,IAAI,WAAW,CAAC,gCAAgC,EACzE,gEAAgE,EAChE,GAAG,EACH,CAAC,GAAG,MAAM,EACV,MAAM,CACN,CAAC;IACF,MAAM,iBAAiB,GAAG,YAAY,CACrC,MAAM,CAAC,iBAAiB,IAAI,WAAW,CAAC,+BAA+B,EACvE,8DAA8D,EAC9D,GAAG,EACH,CAAC,GAAG,MAAM,EACV,MAAM,CACN,CAAC;IAEF,OAAO;QACN,IAAI,EAAE,KAAK;QACX,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;YAC5B,IAAI;YACJ,IAAI;YACJ,aAAa;YACb,gBAAgB;YAChB,aAAa;YACb,KAAK;YACL,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;YAC7C,GAAG;YACH,sBAAsB;YACtB,gBAAgB;YAChB,SAAS;YACT,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;YACzD,aAAa,EACZ,MAAM,CAAC,aAAa,IAAI,WAAW,CAAC,sBAAsB;gBACzD,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,IAAI,WAAW,CAAC,sBAAuB,CAAC;gBAClF,CAAC,CAAC,SAAS;YACb,eAAe;YACf,uBAAuB,EAAE,WAAW,CAAC,gCAAgC;gBACpE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,gCAAgC,CAAC;gBACnE,CAAC,CAAC,SAAS;YACZ,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,cAAc;YACd,iBAAiB;YACjB,kBAAkB;YAClB,sBAAsB;YACtB,qBAAqB;YACrB,kBAAkB;YAClB,iBAAiB;YACjB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;SACpD,CAAC;KACF,CAAC;AAAA,CACF","sourcesContent":["import { readFile, realpath, stat } from \"node:fs/promises\";\nimport { isAbsolute, join, resolve } from \"node:path\";\nimport {\n\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS,\n\ttype RemoteWorkspaceProtocolLimits,\n\tvalidateRemoteWorkspaceProtocolLimits,\n} from \"../core/remote-workspace-protocol/contract.ts\";\n\nexport const DAEMON_WEBSOCKET_PATH = \"/grip/workspace\";\nexport const DAEMON_WEBSOCKET_PROTOCOL = \"grip.workspace.v1\";\n\nexport interface DaemonTlsConfiguration {\n\treadonly cert: Buffer;\n\treadonly key: Buffer;\n\treadonly passphrase?: string;\n}\n\nexport interface DaemonConfiguration {\n\treadonly host: string;\n\treadonly port: number;\n\treadonly workspaceRoot: string;\n\t/** Canonical fixed parent mount for explicitly enabled shared-channel mode. */\n\treadonly sharedParentRoot?: string;\n\treadonly temporaryRoot?: string;\n\treadonly token?: string;\n\treadonly allowedOrigins: readonly string[];\n\treadonly tls?: DaemonTlsConfiguration;\n\treadonly allowInsecureTransport: boolean;\n\treadonly allowProcessExec: boolean;\n\treadonly allowRoot: boolean;\n\treadonly forwardedEnvironment: readonly string[];\n\treadonly lspConfigPath?: string;\n\treadonly sandboxInstructionsPath?: string;\n\treadonly userAgentsPath?: string;\n\treadonly trustProjectLsp: boolean;\n\treadonly maxConnections: number;\n\treadonly maxGlobalRequests: number;\n\treadonly maxGlobalTransfers: number;\n\treadonly maxBufferedOutputBytes: number;\n\treadonly maxPendingConnections: number;\n\treadonly handshakeTimeoutMs: number;\n\treadonly shutdownTimeoutMs: number;\n\treadonly protocolLimits: RemoteWorkspaceProtocolLimits;\n}\n\nexport interface DaemonCommand {\n\treadonly help: boolean;\n\treadonly configuration?: DaemonConfiguration;\n}\n\nexport class DaemonConfigurationError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"DaemonConfigurationError\";\n\t}\n}\n\ninterface ParsedDaemonInputs {\n\thelp: boolean;\n\thost?: string;\n\tport?: string;\n\tcwd?: string;\n\tsharedParent?: string;\n\torigins: string[];\n\ttlsCertPath?: string;\n\ttlsKeyPath?: string;\n\tallowInsecureTransport?: boolean;\n\tallowProcessExec?: boolean;\n\tallowRoot?: boolean;\n\tforwardedEnvironment: string[];\n\tlspConfigPath?: string;\n\ttrustProjectLsp?: boolean;\n\tmaxConnections?: string;\n\tmaxPendingConnections?: string;\n\thandshakeTimeoutMs?: string;\n\tshutdownTimeoutMs?: string;\n}\n\nconst BOOLEAN_VALUES = new Map<string, boolean>([\n\t[\"1\", true],\n\t[\"true\", true],\n\t[\"yes\", true],\n\t[\"0\", false],\n\t[\"false\", false],\n\t[\"no\", false],\n]);\n\nconst VALUE_FLAGS = new Map<string, keyof ParsedDaemonInputs>([\n\t[\"--daemon-host\", \"host\"],\n\t[\"--daemon-port\", \"port\"],\n\t[\"--daemon-cwd\", \"cwd\"],\n\t[\"--daemon-shared-parent\", \"sharedParent\"],\n\t[\"--daemon-tls-cert\", \"tlsCertPath\"],\n\t[\"--daemon-tls-key\", \"tlsKeyPath\"],\n\t[\"--daemon-lsp-config\", \"lspConfigPath\"],\n\t[\"--daemon-max-connections\", \"maxConnections\"],\n\t[\"--daemon-max-pending-connections\", \"maxPendingConnections\"],\n\t[\"--daemon-handshake-timeout-ms\", \"handshakeTimeoutMs\"],\n\t[\"--daemon-shutdown-timeout-ms\", \"shutdownTimeoutMs\"],\n]);\n\nconst BOOLEAN_FLAGS = new Map<string, keyof ParsedDaemonInputs>([\n\t[\"--daemon-allow-insecure-transport\", \"allowInsecureTransport\"],\n\t[\"--daemon-allow-process-exec\", \"allowProcessExec\"],\n\t[\"--daemon-allow-root\", \"allowRoot\"],\n\t[\"--daemon-trust-project-lsp\", \"trustProjectLsp\"],\n]);\n\nfunction parseBoolean(value: string | undefined, name: string, fallback = false): boolean {\n\tif (value === undefined) return fallback;\n\tconst parsed = BOOLEAN_VALUES.get(value.toLowerCase());\n\tif (parsed === undefined) throw new DaemonConfigurationError(`${name} must be one of 1, 0, true, false, yes, or no`);\n\treturn parsed;\n}\n\nfunction parseInteger(\n\tvalue: string | undefined,\n\tname: string,\n\tminimum: number,\n\tmaximum: number,\n\tfallback: number,\n): number {\n\tif (value === undefined) return fallback;\n\tif (!/^(0|[1-9][0-9]*)$/.test(value)) {\n\t\tthrow new DaemonConfigurationError(`${name} must be a decimal integer from ${minimum} to ${maximum}`);\n\t}\n\tconst parsed = Number(value);\n\tif (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum) {\n\t\tthrow new DaemonConfigurationError(`${name} must be a decimal integer from ${minimum} to ${maximum}`);\n\t}\n\treturn parsed;\n}\n\nfunction setSingleton(\n\tinputs: ParsedDaemonInputs,\n\tkey: keyof ParsedDaemonInputs,\n\tvalue: string | boolean,\n\tflag: string,\n): void {\n\tif (inputs[key] !== undefined) throw new DaemonConfigurationError(`${flag} may only be specified once`);\n\t(inputs as Record<keyof ParsedDaemonInputs, unknown>)[key] = value;\n}\n\nfunction requireFlagValue(args: readonly string[], index: number, flag: string): string {\n\tconst value = args[index + 1];\n\tif (value === undefined || value.startsWith(\"-\")) throw new DaemonConfigurationError(`${flag} requires a value`);\n\treturn value;\n}\n\nfunction parseInputs(args: readonly string[]): ParsedDaemonInputs {\n\tif (args[0] !== \"--daemon\") throw new DaemonConfigurationError(\"Daemon command must start with --daemon\");\n\tconst inputs: ParsedDaemonInputs = { help: false, origins: [], forwardedEnvironment: [] };\n\tfor (let index = 1; index < args.length; index++) {\n\t\tconst argument = args[index];\n\t\tif (argument === \"--help\" || argument === \"-h\") {\n\t\t\tinputs.help = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (argument === \"--daemon-origin\" || argument === \"--daemon-env\") {\n\t\t\tconst value = requireFlagValue(args, index, argument);\n\t\t\tif (argument === \"--daemon-origin\") inputs.origins.push(value);\n\t\t\telse inputs.forwardedEnvironment.push(value);\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tconst valueKey = VALUE_FLAGS.get(argument);\n\t\tif (valueKey) {\n\t\t\tsetSingleton(inputs, valueKey, requireFlagValue(args, index, argument), argument);\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tconst booleanKey = BOOLEAN_FLAGS.get(argument);\n\t\tif (booleanKey) {\n\t\t\tsetSingleton(inputs, booleanKey, true, argument);\n\t\t\tcontinue;\n\t\t}\n\t\tthrow new DaemonConfigurationError(\n\t\t\targument.startsWith(\"-\")\n\t\t\t\t? `Unknown or incompatible option in daemon mode: ${argument}`\n\t\t\t\t: `Daemon mode does not accept positional arguments: ${argument}`,\n\t\t);\n\t}\n\treturn inputs;\n}\n\nfunction parseOrigin(value: string): string {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(value);\n\t} catch {\n\t\tthrow new DaemonConfigurationError(`Invalid daemon Origin: ${value}`);\n\t}\n\tif (\n\t\t(url.protocol !== \"http:\" && url.protocol !== \"https:\") ||\n\t\turl.username !== \"\" ||\n\t\turl.password !== \"\" ||\n\t\turl.pathname !== \"/\" ||\n\t\turl.search !== \"\" ||\n\t\turl.hash !== \"\" ||\n\t\tvalue !== url.origin\n\t) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Daemon origins must be exact HTTP(S) origins without paths or wildcards: ${value}`,\n\t\t);\n\t}\n\treturn url.origin;\n}\n\nfunction parseEnvironmentNames(values: readonly string[]): string[] {\n\tconst names = values\n\t\t.flatMap((value) => value.split(\",\"))\n\t\t.map((value) => value.trim())\n\t\t.filter(Boolean);\n\tconst seen = new Set<string>();\n\tfor (const name of names) {\n\t\tif (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))\n\t\t\tthrow new DaemonConfigurationError(`Invalid daemon environment name: ${name}`);\n\t\tconst identity = process.platform === \"win32\" ? name.toLowerCase() : name;\n\t\tif (seen.has(identity)) throw new DaemonConfigurationError(`Duplicate daemon environment name: ${name}`);\n\t\tseen.add(identity);\n\t}\n\treturn names;\n}\n\nasync function resolveConfinedRoot(value: string, startupCwd: string, label: string): Promise<string> {\n\tconst candidate = isAbsolute(value) ? value : resolve(startupCwd, value);\n\tlet canonical: string;\n\ttry {\n\t\tcanonical = await realpath(candidate);\n\t\tif (!(await stat(canonical)).isDirectory()) throw new Error(\"not a directory\");\n\t} catch (error) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Daemon ${label} must be an existing directory: ${candidate} (${error instanceof Error ? error.message : String(error)})`,\n\t\t);\n\t}\n\treturn canonical;\n}\n\nasync function readTlsFile(path: string, label: string, startupCwd: string): Promise<Buffer> {\n\tconst resolvedPath = isAbsolute(path) ? path : resolve(startupCwd, path);\n\ttry {\n\t\tconst content = await readFile(resolvedPath);\n\t\tif (content.byteLength === 0) throw new Error(\"file is empty\");\n\t\treturn content;\n\t} catch (error) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Unable to read daemon TLS ${label} file ${resolvedPath}: ${error instanceof Error ? error.message : String(error)}`,\n\t\t);\n\t}\n}\n\nfunction validateToken(token: string | undefined): string | undefined {\n\tif (token === undefined) return undefined;\n\tconst bytes = Buffer.byteLength(token, \"utf8\");\n\tif (bytes < 32 || bytes > 1024 || !/\\S/u.test(token) || /[\\r\\n]/u.test(token)) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t\"GRIP_DAEMON_TOKEN must contain 32 to 1024 UTF-8 bytes, include a non-whitespace character, and contain no line breaks\",\n\t\t);\n\t}\n\treturn token;\n}\n\nfunction isRootProcess(): boolean {\n\treturn process.platform !== \"win32\" && typeof process.getuid === \"function\" && process.getuid() === 0;\n}\n\nexport function isDaemonCommand(args: readonly string[]): boolean {\n\treturn args[0] === \"--daemon\";\n}\ninterface DaemonEndpointConfiguration {\n\thost: string;\n\tport: number;\n}\n\ninterface DaemonWorkspaceRootsConfiguration {\n\tallowRoot: boolean;\n\tworkspaceRoot: string;\n\ttemporaryRoot: string | undefined;\n}\n\ninterface DaemonTransportSecurityConfiguration {\n\ttoken: string | undefined;\n\tallowedOrigins: string[];\n\ttls: DaemonTlsConfiguration | undefined;\n}\n\ninterface DaemonCapacityConfiguration {\n\tmaxGlobalRequests: number;\n\tmaxGlobalTransfers: number;\n\tmaxBufferedOutputBytes: number;\n\tprotocolLimits: RemoteWorkspaceProtocolLimits;\n}\n\nfunction resolveDaemonEndpoint(\n\tinputs: ParsedDaemonInputs,\n\tenvironment: NodeJS.ProcessEnv,\n): DaemonEndpointConfiguration {\n\tconst host = inputs.host ?? environment.GRIP_DAEMON_HOST ?? \"127.0.0.1\";\n\tif (host.length === 0 || /\\s/u.test(host)) {\n\t\tthrow new DaemonConfigurationError(\"Daemon host must be a non-empty IP address\");\n\t}\n\tconst port = parseInteger(\n\t\tinputs.port ?? environment.GRIP_DAEMON_PORT,\n\t\t\"GRIP_DAEMON_PORT/--daemon-port\",\n\t\t1,\n\t\t65535,\n\t\t8787,\n\t);\n\treturn { host, port };\n}\n\nasync function resolveDaemonWorkspaceRoots(\n\tinputs: ParsedDaemonInputs,\n\tenvironment: NodeJS.ProcessEnv,\n\tstartupCwd: string,\n): Promise<DaemonWorkspaceRootsConfiguration> {\n\tconst allowRoot = inputs.allowRoot ?? parseBoolean(environment.GRIP_DAEMON_ALLOW_ROOT, \"GRIP_DAEMON_ALLOW_ROOT\");\n\tif (isRootProcess() && !allowRoot) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t\"Refusing to run the workspace daemon as root; use --daemon-allow-root only inside an intentional OS sandbox\",\n\t\t);\n\t}\n\tconst workspaceRoot = await resolveConfinedRoot(\n\t\tinputs.cwd ?? environment.GRIP_DAEMON_CWD ?? startupCwd,\n\t\tstartupCwd,\n\t\t\"workspace root\",\n\t);\n\tconst temporaryRoot = environment.GRIP_DAEMON_TEMP_ROOT\n\t\t? await resolveConfinedRoot(environment.GRIP_DAEMON_TEMP_ROOT, startupCwd, \"temporary root\")\n\t\t: undefined;\n\treturn { allowRoot, workspaceRoot, temporaryRoot };\n}\n\nasync function resolveSharedParentRoot(\n\tinputs: ParsedDaemonInputs,\n\tenvironment: NodeJS.ProcessEnv,\n\tstartupCwd: string,\n\tworkspaceRoot: string,\n): Promise<string | undefined> {\n\tconst value = inputs.sharedParent ?? environment.GRIP_DAEMON_SHARED_PARENT;\n\tif (value === undefined) return undefined;\n\tif (value === \"\") throw new DaemonConfigurationError(\"Shared parent mount must not be empty\");\n\tconst root = await resolveConfinedRoot(value, startupCwd, \"shared parent mount\");\n\tif (root !== workspaceRoot) {\n\t\tthrow new DaemonConfigurationError(\"Shared parent mount must equal --daemon-cwd (the fixed mounted parent)\");\n\t}\n\treturn root;\n}\n\nasync function resolveDaemonTransportSecurity(\n\tinputs: ParsedDaemonInputs,\n\tenvironment: NodeJS.ProcessEnv,\n\tstartupCwd: string,\n): Promise<DaemonTransportSecurityConfiguration> {\n\tconst token = validateToken(environment.GRIP_DAEMON_TOKEN);\n\tconst allowedOrigins = [\n\t\t...(environment.GRIP_DAEMON_ORIGINS?.split(\",\")\n\t\t\t.map((value) => value.trim())\n\t\t\t.filter(Boolean) ?? []),\n\t\t...inputs.origins,\n\t].map(parseOrigin);\n\tif (new Set(allowedOrigins).size !== allowedOrigins.length) {\n\t\tthrow new DaemonConfigurationError(\"Daemon origins must be unique\");\n\t}\n\tconst tlsCertPath = inputs.tlsCertPath ?? environment.GRIP_DAEMON_TLS_CERT;\n\tconst tlsKeyPath = inputs.tlsKeyPath ?? environment.GRIP_DAEMON_TLS_KEY;\n\tif ((tlsCertPath === undefined) !== (tlsKeyPath === undefined)) {\n\t\tthrow new DaemonConfigurationError(\"Daemon TLS requires both a certificate and private key\");\n\t}\n\tconst tls =\n\t\ttlsCertPath && tlsKeyPath\n\t\t\t? Object.freeze({\n\t\t\t\t\tcert: await readTlsFile(tlsCertPath, \"certificate\", startupCwd),\n\t\t\t\t\tkey: await readTlsFile(tlsKeyPath, \"private key\", startupCwd),\n\t\t\t\t\tpassphrase: environment.GRIP_DAEMON_TLS_PASSPHRASE,\n\t\t\t\t})\n\t\t\t: undefined;\n\treturn { token, allowedOrigins, tls };\n}\n\nfunction resolveDaemonCapacity(environment: NodeJS.ProcessEnv): DaemonCapacityConfiguration {\n\tconst maxConnectionRequests = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_CONNECTION_REQUESTS,\n\t\t\"GRIP_DAEMON_MAX_CONNECTION_REQUESTS\",\n\t\t1,\n\t\t10_000_000,\n\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxActiveRequests,\n\t);\n\tconst maxGlobalRequests = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_GLOBAL_REQUESTS,\n\t\t\"GRIP_DAEMON_MAX_GLOBAL_REQUESTS\",\n\t\t1,\n\t\t10_000_000,\n\t\tmaxConnectionRequests,\n\t);\n\tif (maxGlobalRequests < maxConnectionRequests) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t\"GRIP_DAEMON_MAX_GLOBAL_REQUESTS must be at least GRIP_DAEMON_MAX_CONNECTION_REQUESTS\",\n\t\t);\n\t}\n\tconst maxConnectionTransfers = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_CONNECTION_UPLOADS,\n\t\t\"GRIP_DAEMON_MAX_CONNECTION_UPLOADS\",\n\t\t1,\n\t\t10_000,\n\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxActiveTransfers,\n\t);\n\tconst maxGlobalTransfers = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_GLOBAL_UPLOADS,\n\t\t\"GRIP_DAEMON_MAX_GLOBAL_UPLOADS\",\n\t\t1,\n\t\t10_000,\n\t\tmaxConnectionTransfers,\n\t);\n\tif (maxGlobalTransfers < maxConnectionTransfers) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t\"GRIP_DAEMON_MAX_GLOBAL_UPLOADS must be at least GRIP_DAEMON_MAX_CONNECTION_UPLOADS\",\n\t\t);\n\t}\n\tconst maxMessageBytes = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_FRAME_BYTES,\n\t\t\"GRIP_DAEMON_MAX_FRAME_BYTES\",\n\t\t1024,\n\t\t64 * 1024 * 1024,\n\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxMessageBytes,\n\t);\n\tconst maxTransferBytes = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_UPLOAD_BYTES,\n\t\t\"GRIP_DAEMON_MAX_UPLOAD_BYTES\",\n\t\t1,\n\t\tNumber.MAX_SAFE_INTEGER,\n\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxTransferBytes,\n\t);\n\tconst maxBufferedOutputBytes = parseInteger(\n\t\tenvironment.GRIP_DAEMON_MAX_BUFFERED_OUTPUT_BYTES,\n\t\t\"GRIP_DAEMON_MAX_BUFFERED_OUTPUT_BYTES\",\n\t\t1024,\n\t\t64 * 1024 * 1024,\n\t\t8 * 1024 * 1024,\n\t);\n\tconst protocolLimits = validateRemoteWorkspaceProtocolLimits({\n\t\t...DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS,\n\t\tmaxMessageBytes,\n\t\tmaxStringBytes: Math.min(DEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxStringBytes, maxMessageBytes),\n\t\tmaxPendingInboundBytes: Math.max(\n\t\t\tDEFAULT_REMOTE_WORKSPACE_PROTOCOL_LIMITS.maxPendingInboundBytes,\n\t\t\tmaxMessageBytes,\n\t\t),\n\t\tmaxTransferBytes,\n\t\tmaxActiveRequests: maxConnectionRequests,\n\t\tmaxActiveTransfers: Math.min(maxConnectionTransfers, maxGlobalTransfers),\n\t});\n\treturn { maxGlobalRequests, maxGlobalTransfers, maxBufferedOutputBytes, protocolLimits };\n}\n\nexport async function parseDaemonCommand(\n\targs: readonly string[],\n\tenvironment: NodeJS.ProcessEnv = process.env,\n\tstartupCwd = process.cwd(),\n): Promise<DaemonCommand> {\n\tconst inputs = parseInputs(args);\n\tif (inputs.help) return { help: true };\n\n\tconst { host, port } = resolveDaemonEndpoint(inputs, environment);\n\tconst { allowRoot, workspaceRoot, temporaryRoot } = await resolveDaemonWorkspaceRoots(\n\t\tinputs,\n\t\tenvironment,\n\t\tstartupCwd,\n\t);\n\tconst sharedParentRoot = await resolveSharedParentRoot(inputs, environment, startupCwd, workspaceRoot);\n\tconst { token, allowedOrigins, tls } = await resolveDaemonTransportSecurity(inputs, environment, startupCwd);\n\tconst { maxGlobalRequests, maxGlobalTransfers, maxBufferedOutputBytes, protocolLimits } =\n\t\tresolveDaemonCapacity(environment);\n\n\tconst allowInsecureTransport =\n\t\tinputs.allowInsecureTransport ??\n\t\tparseBoolean(environment.GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT, \"GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT\");\n\tconst allowProcessExec =\n\t\tinputs.allowProcessExec ??\n\t\tparseBoolean(environment.GRIP_DAEMON_ALLOW_PROCESS_EXEC, \"GRIP_DAEMON_ALLOW_PROCESS_EXEC\");\n\tconst trustProjectLsp =\n\t\tinputs.trustProjectLsp ??\n\t\tparseBoolean(environment.GRIP_DAEMON_TRUST_PROJECT_LSP, \"GRIP_DAEMON_TRUST_PROJECT_LSP\");\n\tconst forwardedEnvironment = parseEnvironmentNames([\n\t\t...(environment.GRIP_DAEMON_ENV?.split(\",\") ?? []),\n\t\t...inputs.forwardedEnvironment,\n\t]);\n\tconst maxConnections = parseInteger(\n\t\tinputs.maxConnections ?? environment.GRIP_DAEMON_MAX_CONNECTIONS,\n\t\t\"GRIP_DAEMON_MAX_CONNECTIONS/--daemon-max-connections\",\n\t\t1,\n\t\t100_000,\n\t\t64,\n\t);\n\tconst maxPendingConnections = parseInteger(\n\t\tinputs.maxPendingConnections ?? environment.GRIP_DAEMON_MAX_PENDING_CONNECTIONS,\n\t\t\"GRIP_DAEMON_MAX_PENDING_CONNECTIONS/--daemon-max-pending-connections\",\n\t\t1,\n\t\t100_000,\n\t\t64,\n\t);\n\tconst handshakeTimeoutMs = parseInteger(\n\t\tinputs.handshakeTimeoutMs ?? environment.GRIP_DAEMON_HANDSHAKE_TIMEOUT_MS,\n\t\t\"GRIP_DAEMON_HANDSHAKE_TIMEOUT_MS/--daemon-handshake-timeout-ms\",\n\t\t100,\n\t\t5 * 60_000,\n\t\t10_000,\n\t);\n\tconst shutdownTimeoutMs = parseInteger(\n\t\tinputs.shutdownTimeoutMs ?? environment.GRIP_DAEMON_SHUTDOWN_TIMEOUT_MS,\n\t\t\"GRIP_DAEMON_SHUTDOWN_TIMEOUT_MS/--daemon-shutdown-timeout-ms\",\n\t\t100,\n\t\t5 * 60_000,\n\t\t10_000,\n\t);\n\n\treturn {\n\t\thelp: false,\n\t\tconfiguration: Object.freeze({\n\t\t\thost,\n\t\t\tport,\n\t\t\tworkspaceRoot,\n\t\t\tsharedParentRoot,\n\t\t\ttemporaryRoot,\n\t\t\ttoken,\n\t\t\tallowedOrigins: Object.freeze(allowedOrigins),\n\t\t\ttls,\n\t\t\tallowInsecureTransport,\n\t\t\tallowProcessExec,\n\t\t\tallowRoot,\n\t\t\tforwardedEnvironment: Object.freeze(forwardedEnvironment),\n\t\t\tlspConfigPath:\n\t\t\t\tinputs.lspConfigPath || environment.GRIP_DAEMON_LSP_CONFIG\n\t\t\t\t\t? resolve(startupCwd, inputs.lspConfigPath ?? environment.GRIP_DAEMON_LSP_CONFIG!)\n\t\t\t\t\t: undefined,\n\t\t\ttrustProjectLsp,\n\t\t\tsandboxInstructionsPath: environment.GRIP_DAEMON_SANDBOX_INSTRUCTIONS\n\t\t\t\t? resolve(startupCwd, environment.GRIP_DAEMON_SANDBOX_INSTRUCTIONS)\n\t\t\t\t: undefined,\n\t\t\tuserAgentsPath: environment.HOME ? join(environment.HOME, \".grip\", \"AGENTS.md\") : undefined,\n\t\t\tmaxConnections,\n\t\t\tmaxGlobalRequests,\n\t\t\tmaxGlobalTransfers,\n\t\t\tmaxBufferedOutputBytes,\n\t\t\tmaxPendingConnections,\n\t\t\thandshakeTimeoutMs,\n\t\t\tshutdownTimeoutMs,\n\t\t\tprotocolLimits: Object.freeze({ ...protocolLimits }),\n\t\t}),\n\t};\n}\n"]}

package/dist/daemon/help.d.ts

@@ -0,0 +1,2 @@
+export declare function printDaemonHelp(write?: (message: string) => void): void;
+//# sourceMappingURL=help.d.ts.map

package/dist/daemon/help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/daemon/help.ts"],"names":[],"mappings":"AAEA,wBAAgB,eAAe,CAAC,KAAK,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAkB,GAAG,IAAI,CAuCpF","sourcesContent":["import { APP_NAME } from \"../config.ts\";\n\nexport function printDaemonHelp(write: (message: string) => void = console.log): void {\n\twrite(`${APP_NAME} --daemon - remote workspace runtime\n\nUsage:\n  ${APP_NAME} --daemon [options]\n\nOptions:\n  --daemon-host <ip>                    Bind IP (default: 127.0.0.1)\n  --daemon-port <port>                  Bind port (default: 8787)\n  --daemon-cwd <directory>              Confined workspace root (default: current directory)\n  --daemon-origin <origin>              Allow an exact browser Origin (repeatable)\n  --daemon-tls-cert <file>              Native TLS certificate\n  --daemon-tls-key <file>               Native TLS private key\n  --daemon-allow-insecure-transport     Acknowledge non-loopback transport without native TLS\n  --daemon-allow-process-exec           Enable the unsafe process-execution capability\n  --daemon-allow-root                   Allow running as root inside an intentional OS sandbox\n  --daemon-env <NAME>                   Forward an approved environment name (repeatable)\n  --daemon-lsp-config <file>            Operator-owned daemon LSP configuration\n  --daemon-trust-project-lsp            Trust the confined project LSP layer\n  --daemon-max-connections <count>      Maximum authenticated clients\n  --daemon-max-pending-connections <n>  Maximum incomplete HTTP/WebSocket handshakes\n  --daemon-handshake-timeout-ms <ms>    Protocol handshake deadline\n  --daemon-shutdown-timeout-ms <ms>     Graceful shutdown deadline\n  --help, -h                            Show daemon help\n\nEnvironment:\n  GRIP_DAEMON_HOST, GRIP_DAEMON_PORT, GRIP_DAEMON_CWD\n  GRIP_DAEMON_TEMP_ROOT                   Optional additional confined temporary directory\n  GRIP_DAEMON_TOKEN                     Server bearer token (32-1024 UTF-8 bytes)\n  GRIP_DAEMON_ORIGINS                   Comma-separated exact browser origins\n  GRIP_DAEMON_TLS_CERT, GRIP_DAEMON_TLS_KEY, GRIP_DAEMON_TLS_PASSPHRASE\n  GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT, GRIP_DAEMON_ALLOW_PROCESS_EXEC, GRIP_DAEMON_ALLOW_ROOT\n  GRIP_DAEMON_ENV, GRIP_DAEMON_LSP_CONFIG, GRIP_DAEMON_TRUST_PROJECT_LSP\n  GRIP_DAEMON_MAX_CONNECTIONS, GRIP_DAEMON_MAX_PENDING_CONNECTIONS\n  GRIP_DAEMON_HANDSHAKE_TIMEOUT_MS, GRIP_DAEMON_SHUTDOWN_TIMEOUT_MS\n\nSecurity:\n  Non-loopback binds require GRIP_DAEMON_TOKEN and TLS unless insecure transport is explicitly acknowledged.\n  Process execution is an RCE capability and requires OS-level isolation.`);\n}\n"]}

package/dist/daemon/help.js

@@ -0,0 +1,42 @@
+import { APP_NAME } from "../config.js";
+export function printDaemonHelp(write = console.log) {
+    write(`${APP_NAME} --daemon - remote workspace runtime
+
+Usage:
+  ${APP_NAME} --daemon [options]
+
+Options:
+  --daemon-host <ip>                    Bind IP (default: 127.0.0.1)
+  --daemon-port <port>                  Bind port (default: 8787)
+  --daemon-cwd <directory>              Confined workspace root (default: current directory)
+  --daemon-origin <origin>              Allow an exact browser Origin (repeatable)
+  --daemon-tls-cert <file>              Native TLS certificate
+  --daemon-tls-key <file>               Native TLS private key
+  --daemon-allow-insecure-transport     Acknowledge non-loopback transport without native TLS
+  --daemon-allow-process-exec           Enable the unsafe process-execution capability
+  --daemon-allow-root                   Allow running as root inside an intentional OS sandbox
+  --daemon-env <NAME>                   Forward an approved environment name (repeatable)
+  --daemon-lsp-config <file>            Operator-owned daemon LSP configuration
+  --daemon-trust-project-lsp            Trust the confined project LSP layer
+  --daemon-max-connections <count>      Maximum authenticated clients
+  --daemon-max-pending-connections <n>  Maximum incomplete HTTP/WebSocket handshakes
+  --daemon-handshake-timeout-ms <ms>    Protocol handshake deadline
+  --daemon-shutdown-timeout-ms <ms>     Graceful shutdown deadline
+  --help, -h                            Show daemon help
+
+Environment:
+  GRIP_DAEMON_HOST, GRIP_DAEMON_PORT, GRIP_DAEMON_CWD
+  GRIP_DAEMON_TEMP_ROOT                   Optional additional confined temporary directory
+  GRIP_DAEMON_TOKEN                     Server bearer token (32-1024 UTF-8 bytes)
+  GRIP_DAEMON_ORIGINS                   Comma-separated exact browser origins
+  GRIP_DAEMON_TLS_CERT, GRIP_DAEMON_TLS_KEY, GRIP_DAEMON_TLS_PASSPHRASE
+  GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT, GRIP_DAEMON_ALLOW_PROCESS_EXEC, GRIP_DAEMON_ALLOW_ROOT
+  GRIP_DAEMON_ENV, GRIP_DAEMON_LSP_CONFIG, GRIP_DAEMON_TRUST_PROJECT_LSP
+  GRIP_DAEMON_MAX_CONNECTIONS, GRIP_DAEMON_MAX_PENDING_CONNECTIONS
+  GRIP_DAEMON_HANDSHAKE_TIMEOUT_MS, GRIP_DAEMON_SHUTDOWN_TIMEOUT_MS
+
+Security:
+  Non-loopback binds require GRIP_DAEMON_TOKEN and TLS unless insecure transport is explicitly acknowledged.
+  Process execution is an RCE capability and requires OS-level isolation.`);
+}
+//# sourceMappingURL=help.js.map

package/dist/daemon/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/daemon/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,MAAM,UAAU,eAAe,CAAC,KAAK,GAA8B,OAAO,CAAC,GAAG,EAAQ;IACrF,KAAK,CAAC,GAAG,QAAQ;;;IAGd,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAkC8D,CAAC,CAAC;AAAA,CAC3E","sourcesContent":["import { APP_NAME } from \"../config.ts\";\n\nexport function printDaemonHelp(write: (message: string) => void = console.log): void {\n\twrite(`${APP_NAME} --daemon - remote workspace runtime\n\nUsage:\n  ${APP_NAME} --daemon [options]\n\nOptions:\n  --daemon-host <ip>                    Bind IP (default: 127.0.0.1)\n  --daemon-port <port>                  Bind port (default: 8787)\n  --daemon-cwd <directory>              Confined workspace root (default: current directory)\n  --daemon-origin <origin>              Allow an exact browser Origin (repeatable)\n  --daemon-tls-cert <file>              Native TLS certificate\n  --daemon-tls-key <file>               Native TLS private key\n  --daemon-allow-insecure-transport     Acknowledge non-loopback transport without native TLS\n  --daemon-allow-process-exec           Enable the unsafe process-execution capability\n  --daemon-allow-root                   Allow running as root inside an intentional OS sandbox\n  --daemon-env <NAME>                   Forward an approved environment name (repeatable)\n  --daemon-lsp-config <file>            Operator-owned daemon LSP configuration\n  --daemon-trust-project-lsp            Trust the confined project LSP layer\n  --daemon-max-connections <count>      Maximum authenticated clients\n  --daemon-max-pending-connections <n>  Maximum incomplete HTTP/WebSocket handshakes\n  --daemon-handshake-timeout-ms <ms>    Protocol handshake deadline\n  --daemon-shutdown-timeout-ms <ms>     Graceful shutdown deadline\n  --help, -h                            Show daemon help\n\nEnvironment:\n  GRIP_DAEMON_HOST, GRIP_DAEMON_PORT, GRIP_DAEMON_CWD\n  GRIP_DAEMON_TEMP_ROOT                   Optional additional confined temporary directory\n  GRIP_DAEMON_TOKEN                     Server bearer token (32-1024 UTF-8 bytes)\n  GRIP_DAEMON_ORIGINS                   Comma-separated exact browser origins\n  GRIP_DAEMON_TLS_CERT, GRIP_DAEMON_TLS_KEY, GRIP_DAEMON_TLS_PASSPHRASE\n  GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT, GRIP_DAEMON_ALLOW_PROCESS_EXEC, GRIP_DAEMON_ALLOW_ROOT\n  GRIP_DAEMON_ENV, GRIP_DAEMON_LSP_CONFIG, GRIP_DAEMON_TRUST_PROJECT_LSP\n  GRIP_DAEMON_MAX_CONNECTIONS, GRIP_DAEMON_MAX_PENDING_CONNECTIONS\n  GRIP_DAEMON_HANDSHAKE_TIMEOUT_MS, GRIP_DAEMON_SHUTDOWN_TIMEOUT_MS\n\nSecurity:\n  Non-loopback binds require GRIP_DAEMON_TOKEN and TLS unless insecure transport is explicitly acknowledged.\n  Process execution is an RCE capability and requires OS-level isolation.`);\n}\n"]}

package/dist/daemon/lsp-config.d.ts

@@ -0,0 +1,4 @@
+import { type ResolvedLspConfiguration } from "../core/lsp/config.ts";
+import { type DaemonConfiguration } from "./config.ts";
+export declare function loadDaemonLspConfiguration(configuration: DaemonConfiguration): ResolvedLspConfiguration;
+//# sourceMappingURL=lsp-config.d.ts.map

package/dist/daemon/lsp-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lsp-config.d.ts","sourceRoot":"","sources":["../../src/daemon/lsp-config.ts"],"names":[],"mappings":"AAEA,OAAO,EAMN,KAAK,wBAAwB,EAE7B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,KAAK,mBAAmB,EAA4B,MAAM,aAAa,CAAC;AA+JjF,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,mBAAmB,GAAG,wBAAwB,CAoBvG","sourcesContent":["import { lstatSync, readFileSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport {\n\ttype LspConfigurationLayer,\n\ttype LspConfiguredServer,\n\ttype LspTransport,\n\ttype LspWorkspaceRoot,\n\tparseLspConfiguration,\n\ttype ResolvedLspConfiguration,\n\tresolveLspConfiguration,\n} from \"../core/lsp/config.ts\";\nimport { resolveLspConfigurationLayerPaths } from \"../core/lsp/config-loader.ts\";\nimport { relativeWithin } from \"../core/lsp/portable-path.ts\";\nimport { type DaemonConfiguration, DaemonConfigurationError } from \"./config.ts\";\n\nconst DISABLED_LSP_CONFIGURATION: ResolvedLspConfiguration = { enabled: false, servers: [] };\n\nfunction readJson(path: string, optional = false): unknown | undefined {\n\ttry {\n\t\treturn JSON.parse(readFileSync(path, \"utf8\")) as unknown;\n\t} catch (error) {\n\t\tif (optional && error instanceof Error && \"code\" in error && error.code === \"ENOENT\") return undefined;\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Unable to load daemon LSP configuration ${path}: ${error instanceof Error ? error.message : String(error)}`,\n\t\t);\n\t}\n}\n\nfunction parseLayer(value: unknown, source: string, baseDir: string): LspConfigurationLayer {\n\tconst parsed = parseLspConfiguration(value);\n\tif (!parsed.configuration) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Invalid daemon LSP configuration ${source}: ${parsed.diagnostics.map((item) => `${item.path}: ${item.message}`).join(\"; \")}`,\n\t\t);\n\t}\n\tconst resolved = parseLspConfiguration(resolveLspConfigurationLayerPaths(parsed.configuration, baseDir));\n\tif (!resolved.configuration) {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Invalid resolved daemon LSP configuration ${source}: ${resolved.diagnostics.map((item) => `${item.path}: ${item.message}`).join(\"; \")}`,\n\t\t);\n\t}\n\treturn resolved.configuration;\n}\n\nfunction isMissingPathError(error: unknown): boolean {\n\treturn error instanceof Error && \"code\" in error && error.code === \"ENOENT\";\n}\n\nfunction validateExistingLspPath(path: string, requestedPath: string, label: string): boolean {\n\tlet isSymbolicLink: boolean;\n\ttry {\n\t\tisSymbolicLink = lstatSync(path).isSymbolicLink();\n\t} catch (error) {\n\t\tif (isMissingPathError(error)) return false;\n\t\tthrow error;\n\t}\n\tif (!isSymbolicLink) return true;\n\ttry {\n\t\trealpathSync(path);\n\t} catch {\n\t\tthrow new DaemonConfigurationError(`${label} uses a broken symbolic link: ${requestedPath}`);\n\t}\n\treturn true;\n}\n\nfunction findExistingLspPathAncestor(path: string, label: string): string {\n\tlet existing = path;\n\twhile (!validateExistingLspPath(existing, path, label)) {\n\t\tconst parent = dirname(existing);\n\t\tif (parent === existing) break;\n\t\texisting = parent;\n\t}\n\treturn existing;\n}\n\nfunction requireConfinedPath(path: string, configuration: DaemonConfiguration, label: string): string {\n\tconst existing = findExistingLspPathAncestor(path, label);\n\tconst canonicalExisting = realpathSync(existing);\n\tif (relativeWithin(configuration.workspaceRoot, canonicalExisting) === undefined) {\n\t\tthrow new DaemonConfigurationError(`${label} escapes the daemon workspace: ${path}`);\n\t}\n\tif (existing === path) return canonicalExisting;\n\treturn resolve(canonicalExisting, relative(existing, path));\n}\n\nfunction canonicalizeDaemonLspServer(\n\tserver: LspConfiguredServer,\n\tconfiguration: DaemonConfiguration,\n\ttransport: LspTransport,\n\tworkspace: LspWorkspaceRoot,\n): LspConfiguredServer {\n\treturn {\n\t\t...server,\n\t\ttransport,\n\t\tworkspace,\n\t\t...(server.pathMappings\n\t\t\t? {\n\t\t\t\t\tpathMappings: server.pathMappings.map((mapping) => ({\n\t\t\t\t\t\t...mapping,\n\t\t\t\t\t\tagentRoot: requireConfinedPath(mapping.agentRoot, configuration, `LSP path mapping for ${server.id}`),\n\t\t\t\t\t})),\n\t\t\t\t}\n\t\t\t: {}),\n\t};\n}\nfunction canonicalizeDaemonLspTransport(server: LspConfiguredServer, configuration: DaemonConfiguration): LspTransport {\n\tif (server.transport.type === \"connection\") {\n\t\tthrow new DaemonConfigurationError(\n\t\t\t`Daemon LSP server ${JSON.stringify(server.id)} cannot use a host-provided connection transport`,\n\t\t);\n\t}\n\tif (server.transport.type === \"spawn\") {\n\t\tif (!configuration.allowProcessExec) {\n\t\t\tthrow new DaemonConfigurationError(\n\t\t\t\t`Daemon LSP server ${JSON.stringify(server.id)} requires --daemon-allow-process-exec`,\n\t\t\t);\n\t\t}\n\t\treturn {\n\t\t\t...server.transport,\n\t\t\t...(server.transport.cwd\n\t\t\t\t? { cwd: requireConfinedPath(server.transport.cwd, configuration, `LSP cwd for ${server.id}`) }\n\t\t\t\t: {}),\n\t\t\t...(isAbsolute(server.transport.command)\n\t\t\t\t? {\n\t\t\t\t\t\tcommand: requireConfinedPath(server.transport.command, configuration, `LSP command for ${server.id}`),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t};\n\t}\n\tif (server.transport.type === \"unix\") {\n\t\treturn {\n\t\t\t...server.transport,\n\t\t\tpath: requireConfinedPath(server.transport.path, configuration, `LSP socket for ${server.id}`),\n\t\t};\n\t}\n\treturn server.transport;\n}\n\nfunction canonicalizeDaemonLspWorkspace(\n\tserver: LspConfiguredServer,\n\tconfiguration: DaemonConfiguration,\n): LspWorkspaceRoot {\n\tif (server.workspace.type === \"fixed\") {\n\t\treturn {\n\t\t\t...server.workspace,\n\t\t\tpath: requireConfinedPath(server.workspace.path, configuration, `LSP workspace for ${server.id}`),\n\t\t};\n\t}\n\tif (server.workspace.type === \"markers\" && server.workspace.stopAt) {\n\t\treturn {\n\t\t\t...server.workspace,\n\t\t\tstopAt: requireConfinedPath(server.workspace.stopAt, configuration, `LSP marker boundary for ${server.id}`),\n\t\t};\n\t}\n\treturn server.workspace;\n}\n\nfunction canonicalizeDaemonPolicy(\n\tconfiguration: DaemonConfiguration,\n\tresolved: ResolvedLspConfiguration,\n): ResolvedLspConfiguration {\n\tconst servers = resolved.servers.map((server) =>\n\t\tcanonicalizeDaemonLspServer(\n\t\t\tserver,\n\t\t\tconfiguration,\n\t\t\tcanonicalizeDaemonLspTransport(server, configuration),\n\t\t\tcanonicalizeDaemonLspWorkspace(server, configuration),\n\t\t),\n\t);\n\treturn { enabled: resolved.enabled, servers };\n}\n\nexport function loadDaemonLspConfiguration(configuration: DaemonConfiguration): ResolvedLspConfiguration {\n\tconst layers: LspConfigurationLayer[] = [];\n\tif (configuration.trustProjectLsp) {\n\t\tconst projectSettingsPath = resolve(configuration.workspaceRoot, \".grip\", \"settings.json\");\n\t\tconst settings = readJson(projectSettingsPath, true);\n\t\tif (settings !== undefined) {\n\t\t\tif (typeof settings !== \"object\" || settings === null || Array.isArray(settings)) {\n\t\t\t\tthrow new DaemonConfigurationError(`Invalid project settings for daemon LSP: ${projectSettingsPath}`);\n\t\t\t}\n\t\t\tconst lsp = (settings as { lsp?: unknown }).lsp;\n\t\t\tif (lsp !== undefined)\n\t\t\t\tlayers.push(parseLayer(lsp, projectSettingsPath, resolve(configuration.workspaceRoot, \".grip\")));\n\t\t}\n\t}\n\tif (configuration.lspConfigPath) {\n\t\tconst value = readJson(configuration.lspConfigPath);\n\t\tlayers.push(parseLayer(value, configuration.lspConfigPath, resolve(configuration.lspConfigPath, \"..\")));\n\t}\n\tconst resolved = layers.length === 0 ? DISABLED_LSP_CONFIGURATION : resolveLspConfiguration(layers);\n\treturn canonicalizeDaemonPolicy(configuration, resolved);\n}\n"]}