@h-rig/core 0.0.6-alpha.17 → 0.0.6-alpha.170

package/dist/src/runtime-provisioning-env.js

@@ -0,0 +1,217 @@
+// @bun
+// packages/core/src/runtime-provisioning-env.ts
+import { delimiter, resolve as resolve2 } from "path";
+
+// packages/core/src/runtime-paths.ts
+import { existsSync, readdirSync, realpathSync } from "fs";
+import { resolve } from "path";
+function uniq(values) {
+  return [...new Set(values)];
+}
+function resolveBunBinaryPath() {
+  const explicit = normalizeExecutablePath(process.env.RIG_BUN_PATH?.trim());
+  if (explicit) {
+    return explicit;
+  }
+  const pathBun = normalizeExecutablePath(Bun.which("bun")?.trim());
+  if (pathBun && !looksLikeRuntimeGateway(pathBun)) {
+    return pathBun;
+  }
+  const home = process.env.HOME?.trim();
+  const fallbackCandidates = [
+    home ? resolve(home, ".bun/bin/bun") : "",
+    "/opt/homebrew/bin/bun",
+    "/usr/local/bin/bun",
+    "/usr/bin/bun"
+  ];
+  for (const candidate of fallbackCandidates) {
+    const normalized = normalizeExecutablePath(candidate);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  const execPath = normalizeExecutablePath(process.execPath?.trim());
+  if (execPath && !looksLikeRuntimeGateway(execPath)) {
+    return execPath;
+  }
+  throw new Error("bun not found in PATH");
+}
+function resolveClaudeBinaryPath() {
+  const explicit = normalizeExecutablePath(process.env.RIG_CLAUDE_PATH?.trim());
+  if (explicit) {
+    return explicit;
+  }
+  const pathClaude = normalizeExecutablePath(Bun.which("claude")?.trim());
+  if (pathClaude && !looksLikeRuntimeGateway(pathClaude)) {
+    return pathClaude;
+  }
+  const home = process.env.HOME?.trim();
+  const fallbackCandidates = [
+    home ? resolve(home, ".local/bin/claude") : "",
+    home ? resolve(home, ".local/share/claude/local/claude") : "",
+    "/opt/homebrew/bin/claude",
+    "/usr/local/bin/claude",
+    "/usr/bin/claude"
+  ];
+  for (const candidate of fallbackCandidates) {
+    const normalized = normalizeExecutablePath(candidate);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  throw new Error("claude not found in PATH");
+}
+function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
+  return resolve(bunBinaryPath, "../..");
+}
+function resolveClaudeInstallDir() {
+  const realPath = resolveClaudeBinaryPath();
+  return resolve(realPath, "..");
+}
+function resolveNodeInstallDir() {
+  const preferredNode = resolvePreferredNodeBinary();
+  if (!preferredNode)
+    return null;
+  const explicitNode = process.env.RIG_NODE_BIN?.trim();
+  if (explicitNode && resolve(explicitNode) === resolve(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve(preferredNode, "../..") : resolve(preferredNode, "..");
+  }
+  try {
+    const realPath = realpathSync(preferredNode);
+    if (realPath.endsWith("/bin/node")) {
+      return resolve(realPath, "../..");
+    }
+    return resolve(realPath, "..");
+  } catch {
+    return resolve(preferredNode, "..");
+  }
+}
+function resolvePreferredNodeBinary() {
+  const candidates = [];
+  const envNode = process.env.RIG_NODE_BIN?.trim();
+  if (envNode) {
+    const explicit = resolve(envNode);
+    if (existsSync(explicit)) {
+      return explicit;
+    }
+  }
+  const nvmBin = process.env.NVM_BIN?.trim();
+  if (nvmBin) {
+    candidates.push(resolve(nvmBin, "node"));
+  }
+  const home = process.env.HOME?.trim();
+  if (home) {
+    const nvmVersionsDir = resolve(home, ".nvm/versions/node");
+    if (existsSync(nvmVersionsDir)) {
+      try {
+        const versionDirs = readdirSync(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
+        for (const versionDir of versionDirs) {
+          candidates.push(resolve(nvmVersionsDir, versionDir, "bin/node"));
+        }
+      } catch {}
+    }
+  }
+  const whichNode = Bun.which("node");
+  if (whichNode) {
+    candidates.push(whichNode);
+  }
+  const deduped = uniq(candidates.map((candidate) => resolve(candidate)));
+  const existing = deduped.filter((candidate) => existsSync(candidate));
+  if (existing.length === 0) {
+    return null;
+  }
+  const stable = existing.find((candidate) => {
+    const major = inferNodeMajor(candidate);
+    return typeof major === "number" && major >= 18 && major <= 24;
+  });
+  if (stable) {
+    return stable;
+  }
+  return existing[0] ?? null;
+}
+function inferNodeMajor(nodeBinaryPath) {
+  const normalized = resolve(nodeBinaryPath).replace(/\\/g, "/");
+  const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
+  if (!match) {
+    return null;
+  }
+  const major = Number.parseInt(match[1], 10);
+  return Number.isFinite(major) ? major : null;
+}
+function normalizeExecutablePath(candidate) {
+  if (!candidate) {
+    return "";
+  }
+  const normalized = resolve(candidate);
+  if (!existsSync(normalized)) {
+    return "";
+  }
+  try {
+    return realpathSync(normalized);
+  } catch {
+    return normalized;
+  }
+}
+function looksLikeRuntimeGateway(candidate) {
+  const normalized = resolve(candidate).replace(/\\/g, "/");
+  return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
+}
+
+// packages/core/src/runtime-provisioning-env.ts
+function runtimeProvisioningEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  const realBash = baseEnv.RIG_REAL_BASH?.trim() || "/bin/bash";
+  const bunBinary = baseEnv.RIG_BUN_PATH?.trim() || resolveBunBinaryPath();
+  const bunDir = resolveBunInstallDir(bunBinary);
+  const claudeBinary = baseEnv.RIG_CLAUDE_PATH?.trim() || (() => {
+    try {
+      return resolveClaudeBinaryPath();
+    } catch {
+      return "";
+    }
+  })();
+  const claudeDir = claudeBinary ? (() => {
+    try {
+      return resolveClaudeInstallDir();
+    } catch {
+      return resolve2(claudeBinary, "..");
+    }
+  })() : "";
+  const nodeDir = resolveNodeInstallDir();
+  const realHome = baseEnv.HOME?.trim();
+  const inheritedPath = (baseEnv.PATH ?? "").split(delimiter).map((entry) => entry.trim()).filter(Boolean).filter((entry) => !entry.endsWith("/.rig/bin") && !entry.endsWith("/rig/tools"));
+  const pathEntries = [
+    `${bunDir}/bin`,
+    claudeDir,
+    nodeDir ? `${nodeDir}/bin` : "",
+    realHome ? resolve2(realHome, ".local/bin") : "",
+    realHome ? resolve2(realHome, ".cargo/bin") : "",
+    ...inheritedPath,
+    "/usr/local/bin",
+    "/usr/local/sbin",
+    "/opt/homebrew/bin",
+    "/opt/homebrew/sbin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ].filter(Boolean);
+  env.BASH = realBash;
+  env.SHELL = baseEnv.SHELL?.trim() || realBash;
+  env.PATH = [...new Set(pathEntries)].join(delimiter);
+  env.RIG_BUN_PATH = bunBinary;
+  if (claudeBinary) {
+    env.RIG_CLAUDE_PATH = claudeBinary;
+  }
+  env.PYTHON = env.PYTHON?.trim() || "python3";
+  const nodeGypPath = Bun.which("node-gyp");
+  if (nodeGypPath) {
+    env.npm_config_node_gyp = nodeGypPath;
+  }
+  delete env.RIG_BASH_ACTIVE;
+  delete env.RIG_BASH_MODE;
+  return env;
+}
+export {
+  runtimeProvisioningEnv
+};

package/dist/src/runtime-runner-context.d.ts

@@ -0,0 +1,12 @@
+import type { CommandExecutionResult, HarnessEventType, OutputMode, PolicyMode } from "@rig/contracts";
+import type { EventBusLike } from "./runtime-events";
+export type RunnerContext = {
+    projectRoot: string;
+    dryRun: boolean;
+    outputMode: OutputMode;
+    runId: string;
+    policyMode?: PolicyMode;
+    eventBus: EventBusLike;
+    emitEvent: <TPayload extends Record<string, unknown>>(type: HarnessEventType, payload: TPayload) => Promise<void>;
+    runCommand: (parts: string[]) => Promise<CommandExecutionResult>;
+};

package/dist/src/runtime-runner-context.js

@@ -0,0 +1 @@
+// @bun

package/dist/src/safe-identifiers.d.ts

@@ -0,0 +1,44 @@
+export type SafePathSegment = string & {
+    readonly __rigSafePathSegment: unique symbol;
+};
+export type SafeGitRefComponent = string & {
+    readonly __rigSafeGitRefComponent: unique symbol;
+};
+export type SafeRunId = string & {
+    readonly __rigSafeRunId: unique symbol;
+};
+/**
+ * Convert an external/display identifier into one deterministic filesystem
+ * segment. The original identifier remains available for UI/source APIs; this
+ * value is only for paths and receives a hash suffix to avoid slug collisions.
+ */
+export declare function safePathSegment(value: string, options?: {
+    fallback?: string;
+    maxLength?: number;
+}): SafePathSegment;
+/**
+ * Derive the canonical runtime id for a task. Floor-neutral because it is shared
+ * by the isolation plugin (provisioning) AND the runtime substrate (agent-wrapper,
+ * task-runtime-start hook) — a `safePathSegment`-based id derive with no domain deps.
+ */
+export declare function taskRuntimeId(taskId: string): string;
+/**
+ * Mint an ephemeral, unique agent/runtime id. Floor-neutral (shared by the
+ * isolation plugin and the runtime substrate's queue) — a random suffix derive.
+ */
+export declare function agentId(prefix?: string): string;
+/**
+ * Convert an arbitrary external identifier into a single git ref component.
+ * This is for constructed refs such as `rig/<component>`, not for accepting an
+ * operator-supplied complete branch name.
+ */
+export declare function safeGitRefComponent(value: string, options?: {
+    fallback?: string;
+    maxLength?: number;
+}): SafeGitRefComponent;
+export declare function isSafeRunId(value: string): boolean;
+export declare function assertSafeRunId(value: string): SafeRunId;
+export declare function isSafeGitBranchName(value: string): boolean;
+export declare function assertSafeGitBranchName(value: string, label?: string): string;
+export declare function isPathInsideRoot(root: string, candidate: string): boolean;
+export declare function assertPathInsideRoot(root: string, candidate: string, label?: string): string;

package/dist/src/safe-identifiers.js

@@ -0,0 +1,96 @@
+// @bun
+// packages/core/src/safe-identifiers.ts
+import { createHash, randomUUID } from "crypto";
+import { isAbsolute, relative, resolve } from "path";
+var MAX_SEGMENT_LENGTH = 80;
+var MAX_RUN_ID_LENGTH = 128;
+function hashSuffix(value, length = 10) {
+  return createHash("sha256").update(value).digest("hex").slice(0, length);
+}
+function asciiSlug(value, fallback) {
+  return value.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").trim().replace(/[^A-Za-z0-9._-]+/g, "-").replace(/[.]{2,}/g, ".").replace(/^[.-]+|[.-]+$/g, "") || fallback;
+}
+function trimWithHash(base, original, maxLength) {
+  const suffix = hashSuffix(original);
+  const prefixLength = Math.max(1, maxLength - suffix.length - 1);
+  const prefix = base.slice(0, prefixLength).replace(/[.-]+$/g, "") || "id";
+  return `${prefix}-${suffix}`;
+}
+function safePathSegment(value, options = {}) {
+  const original = String(value);
+  const trimmed = original.trim();
+  const fallback = asciiSlug(options.fallback ?? "id", "id");
+  const slug = asciiSlug(original, fallback);
+  const maxLength = Math.max(24, Math.trunc(options.maxLength ?? MAX_SEGMENT_LENGTH));
+  if (trimmed === slug && slug.length <= maxLength && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(slug) && slug !== "." && slug !== "..") {
+    return slug;
+  }
+  return trimWithHash(slug, original, maxLength);
+}
+function taskRuntimeId(taskId) {
+  return `task-${safePathSegment(taskId, { fallback: "task", maxLength: 72 })}`;
+}
+function agentId(prefix = "agent") {
+  return `${prefix}-${randomUUID().slice(0, 8)}`;
+}
+function safeGitRefComponent(value, options = {}) {
+  const segment = safePathSegment(value, { fallback: options.fallback ?? "ref", maxLength: options.maxLength ?? MAX_SEGMENT_LENGTH });
+  const safe = String(segment).replace(/\.lock$/i, "-lock").replace(/@\{/g, "-").replace(/^[.-]+|[.-]+$/g, "") || `ref-${hashSuffix(value)}`;
+  return safe.slice(0, Math.max(24, Math.trunc(options.maxLength ?? MAX_SEGMENT_LENGTH)));
+}
+function isSafeRunId(value) {
+  const trimmed = value.trim();
+  return trimmed.length > 0 && trimmed.length <= MAX_RUN_ID_LENGTH && trimmed !== "." && trimmed !== ".." && !trimmed.startsWith("-") && !trimmed.includes("/") && !trimmed.includes("\\") && !trimmed.includes("\x00") && !/[\x00-\x1F\x7F]/.test(trimmed) && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(trimmed);
+}
+function assertSafeRunId(value) {
+  if (!isSafeRunId(value)) {
+    throw new Error("Invalid runId: expected a single safe identifier segment.");
+  }
+  return value.trim();
+}
+function isSafeGitBranchName(value) {
+  const ref = value.trim();
+  if (!ref || ref.length > 255)
+    return false;
+  if (ref.startsWith("-") || ref.startsWith("/") || ref.endsWith("/") || ref.endsWith("."))
+    return false;
+  if (ref.includes("..") || ref.includes("@{") || ref.includes("\\") || ref.includes("//"))
+    return false;
+  if (/[\x00-\x20\x7F~^:?*[\]]/.test(ref))
+    return false;
+  if (ref.split("/").some((part) => !part || part === "." || part === ".." || part.startsWith(".") || part.endsWith(".lock")))
+    return false;
+  return true;
+}
+function assertSafeGitBranchName(value, label = "git branch") {
+  const ref = value.trim();
+  if (!isSafeGitBranchName(ref)) {
+    throw new Error(`${label} is not a safe git branch name.`);
+  }
+  return ref;
+}
+function isPathInsideRoot(root, candidate) {
+  const safeRoot = resolve(root);
+  const resolvedCandidate = resolve(candidate);
+  const relativeToRoot = relative(safeRoot, resolvedCandidate);
+  return relativeToRoot === "" || !relativeToRoot.startsWith("..") && !isAbsolute(relativeToRoot);
+}
+function assertPathInsideRoot(root, candidate, label = "path") {
+  const resolvedCandidate = resolve(candidate);
+  if (!isPathInsideRoot(root, resolvedCandidate)) {
+    throw new Error(`${label} escapes root.`);
+  }
+  return resolvedCandidate;
+}
+export {
+  taskRuntimeId,
+  safePathSegment,
+  safeGitRefComponent,
+  isSafeRunId,
+  isSafeGitBranchName,
+  isPathInsideRoot,
+  assertSafeRunId,
+  assertSafeGitBranchName,
+  assertPathInsideRoot,
+  agentId
+};

package/dist/src/scope-rules.d.ts

@@ -0,0 +1,4 @@
+import type { ScopeNormalizationRules } from "@rig/contracts";
+export declare function setScopeRules(rules: ScopeNormalizationRules | undefined | null): void;
+export declare function getScopeRules(): ScopeNormalizationRules | null;
+export declare function clearScopeRules(): void;

package/dist/src/scope-rules.js

@@ -0,0 +1,21 @@
+// @bun
+// packages/core/src/scope-rules.ts
+var SCOPE_RULES_KEY = Symbol.for("rig.scope-normalization-rules");
+function scopeRulesState() {
+  const global = globalThis;
+  return global[SCOPE_RULES_KEY] ??= { rules: null };
+}
+function setScopeRules(rules) {
+  scopeRulesState().rules = rules ?? null;
+}
+function getScopeRules() {
+  return scopeRulesState().rules;
+}
+function clearScopeRules() {
+  scopeRulesState().rules = null;
+}
+export {
+  setScopeRules,
+  getScopeRules,
+  clearScopeRules
+};

package/dist/src/server-paths.d.ts

@@ -0,0 +1,26 @@
+export { normalizeOptionalString, normalizeOptionalBoolean, resolveAuthorityPaths, resolveAuthorityStateRoot, resolveAuthorityStateDir, resolveAuthorityProjectStateDir, } from "./authority-paths";
+export type { AuthorityPaths } from "./authority-paths";
+export type RigStatePaths = {
+    readonly stateRoot: string;
+    readonly stateDir: string;
+    readonly logsDir: string;
+    readonly controlPlaneEventsFile: string;
+    readonly taskConfigPath: string;
+    readonly notificationsFile: string;
+    readonly keybindingsPath: string;
+};
+declare function isPathWithin(root: string, candidate: string): boolean;
+export declare function resolveRigStatePaths(projectRoot: string): RigStatePaths;
+export declare function resolveRigProjectRoot(input?: {
+    readonly envProjectRoot?: string | null;
+    readonly cwd?: string;
+    readonly fallbackRoot?: string;
+}): string;
+export declare function resolveAuthorityArtifactsRoot(projectRoot: string): string;
+export declare function resolveAuthorityRuntimeDir(projectRoot: string): string;
+export declare function listAuthorityRunRoots(projectRoot: string): string[];
+export declare function listAuthorityArtifactRoots(projectRoot: string): string[];
+export declare function listAuthorityRuntimeAgentsRoots(projectRoot: string): string[];
+export declare function resolveAuthorityRunDir(projectRoot: string, runId: string): string;
+export declare function resolveTaskArtifactDirs(projectRoot: string, taskId: string): string[];
+export { isPathWithin };