@harness-control/runner 0.1.0

package/dist/mcp/redaction.js

@@ -0,0 +1,40 @@
+const REDACTED = "[redacted]";
+const SENSITIVE_KEY_PATTERN = /(^|[-_.])(authorization|cookie|token|access[-_.]?token|refresh[-_.]?token|api[-_.]?key|secret|password|passwd|credential|session)([-_.]|$)/i;
+const AUTH_VALUE_PATTERN = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi;
+const ASSIGNMENT_VALUE_PATTERN = /\b(token|access_token|refresh_token|api_key|apikey|secret|password)=([^&\s]+)/gi;
+export function redactHeaders(headers) {
+    if (!headers) {
+        return undefined;
+    }
+    const redacted = {};
+    for (const [key, value] of Object.entries(headers)) {
+        redacted[key] = isSensitiveKey(key) ? REDACTED : redactString(value);
+    }
+    return redacted;
+}
+export function redactValue(value) {
+    if (typeof value === "string") {
+        return redactString(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item));
+    }
+    if (isPlainRecord(value)) {
+        const redacted = {};
+        for (const [key, nestedValue] of Object.entries(value)) {
+            redacted[key] = isSensitiveKey(key) ? REDACTED : redactValue(nestedValue);
+        }
+        return redacted;
+    }
+    return value;
+}
+function redactString(value) {
+    return value.replace(AUTH_VALUE_PATTERN, `$1 ${REDACTED}`).replace(ASSIGNMENT_VALUE_PATTERN, `$1=${REDACTED}`);
+}
+function isSensitiveKey(key) {
+    return SENSITIVE_KEY_PATTERN.test(key);
+}
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=redaction.js.map

package/dist/pairing/index.d.ts

@@ -0,0 +1,38 @@
+import { runnerCredentialSchema, type PairingCodeResponse } from "@harness-control/protocol";
+import { z } from "zod";
+import type { RunnerConfig } from "../config/index.js";
+declare const runnerCredentialsFileSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    credentials: z.ZodArray<z.ZodObject<{
+        credential_id: z.ZodString;
+        credential_secret: z.ZodString;
+        runner_id: z.ZodString;
+        host_id: z.ZodString;
+        control_plane_url: z.ZodString;
+        issued_at: z.ZodString;
+        mcp_proof_secret: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type RunnerCredential = z.infer<typeof runnerCredentialSchema>;
+export type RunnerCredentialsFile = z.infer<typeof runnerCredentialsFileSchema>;
+export type ReferencePairingOptions = {
+    controlPlaneUrl: string;
+    runnerId: string;
+    hostId: string;
+    onPairingCode: (code: PairingCodeResponse) => void | Promise<void>;
+    signal?: AbortSignal;
+};
+export type ReferencePairingResult = {
+    controlPlaneUrl: string;
+    credential: RunnerCredential;
+    pairingCode: string;
+    pairingUrl?: string;
+};
+export declare function defaultCredentialsPath(): string;
+export declare function pairWithReferenceControlPlane(options: ReferencePairingOptions): Promise<ReferencePairingResult>;
+export declare function writeRunnerCredentials(path: string, credential: RunnerCredential): Promise<void>;
+export declare function loadRunnerCredential(config: RunnerConfig): Promise<RunnerCredential | undefined>;
+export declare function requestConnectionToken(config: RunnerConfig, credential: RunnerCredential): Promise<string>;
+export declare function normalizeControlPlaneUrl(value: string): string;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/pairing/index.js

@@ -0,0 +1,180 @@
+import { createHash, randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { setTimeout as delay } from "node:timers/promises";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { HCP_VERSION, runnerCredentialSchema, pairingCodeResponseSchema, pairingExchangeResponseSchema, connectionTokenResponseSchema } from "@harness-control/protocol";
+import { z } from "zod";
+const CREDENTIALS_FILE_VERSION = 1;
+const DEFAULT_CONFIG_DIR = ".hcp-runner";
+const DEFAULT_CREDENTIALS_FILE = "credentials.json";
+const runnerCredentialsFileSchema = z
+    .object({
+    version: z.literal(CREDENTIALS_FILE_VERSION),
+    credentials: z.array(runnerCredentialSchema),
+})
+    .strict();
+export function defaultCredentialsPath() {
+    return join(homedir(), DEFAULT_CONFIG_DIR, DEFAULT_CREDENTIALS_FILE);
+}
+export async function pairWithReferenceControlPlane(options) {
+    const baseUrl = toHttpControlPlaneUrl(options.controlPlaneUrl);
+    const exchangeSecret = randomBytes(32).toString("base64url");
+    const codeResponse = await postJson(new URL("/pairing-codes", baseUrl), {
+        runner_id: options.runnerId,
+        host_id: options.hostId,
+        protocol_version: HCP_VERSION,
+        exchange_secret_hash: createHash("sha256").update(exchangeSecret).digest("hex"),
+    }, pairingCodeResponseSchema, options.signal);
+    await options.onPairingCode(codeResponse);
+    const deadline = Math.min(Date.parse(codeResponse.expires_at), Date.now() + 10 * 60_000);
+    while (Date.now() < deadline) {
+        const timeout = AbortSignal.timeout(Math.max(1, deadline - Date.now()));
+        const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+        const exchange = await postJson(new URL("/pairing-exchange", baseUrl), {
+            request_id: codeResponse.request_id,
+            exchange_secret: exchangeSecret,
+            runner_id: options.runnerId,
+            host_id: options.hostId,
+            protocol_version: HCP_VERSION,
+        }, pairingExchangeResponseSchema, signal);
+        if (exchange.status === "approved") {
+            if (exchange.credential.runner_id !== options.runnerId || exchange.credential.host_id !== options.hostId
+                || normalizeControlPlaneUrl(exchange.control_plane_url) !== normalizeControlPlaneUrl(options.controlPlaneUrl)
+                || normalizeControlPlaneUrl(exchange.credential.control_plane_url) !== normalizeControlPlaneUrl(options.controlPlaneUrl)) {
+                throw new Error("Pairing credential does not match the requested runner, host, or control plane.");
+            }
+            return {
+                controlPlaneUrl: exchange.control_plane_url,
+                credential: exchange.credential,
+                pairingCode: codeResponse.pairing_code,
+                pairingUrl: codeResponse.pairing_url,
+            };
+        }
+        await delay(Math.min(codeResponse.poll_interval_seconds * 1000, Math.max(1, deadline - Date.now())), undefined, { signal: options.signal });
+    }
+    throw new Error("Pairing request expired. Start a new pairing request.");
+}
+export async function writeRunnerCredentials(path, credential) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const existing = await readRunnerCredentialsFileIfPresent(path);
+    const credentials = existing.credentials.filter((candidate) => !(candidate.control_plane_url === credential.control_plane_url &&
+        candidate.runner_id === credential.runner_id &&
+        candidate.host_id === credential.host_id));
+    credentials.push(credential);
+    const file = {
+        version: CREDENTIALS_FILE_VERSION,
+        credentials,
+    };
+    const temporaryPath = `${path}.${randomBytes(12).toString("hex")}.tmp`;
+    try {
+        await writeFile(temporaryPath, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+        await rename(temporaryPath, path);
+    }
+    finally {
+        await rm(temporaryPath, { force: true });
+    }
+}
+export async function loadRunnerCredential(config) {
+    const path = config.credentials_path;
+    if (!path) {
+        return undefined;
+    }
+    const file = await readRunnerCredentialsFileIfPresent(path);
+    const hostId = config.host_id ?? config.runner_id;
+    return file.credentials.find((credential) => credential.control_plane_url === config.control_plane_url &&
+        credential.runner_id === config.runner_id &&
+        credential.host_id === hostId);
+}
+export async function requestConnectionToken(config, credential) {
+    const response = await postJson(new URL("/runner-connection-token", toHttpControlPlaneUrl(config.control_plane_url)), {
+        credential_id: credential.credential_id,
+        credential_secret: credential.credential_secret,
+        runner_id: config.runner_id,
+        host_id: config.host_id ?? config.runner_id,
+        protocol_version: HCP_VERSION,
+        protocol_schema_sha256: createHash("sha256").update(readFileSync(createRequire(import.meta.url).resolve("@harness-control/protocol/schema.json"))).digest("hex"),
+    }, connectionTokenResponseSchema);
+    return response.connection_token;
+}
+export function normalizeControlPlaneUrl(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash) {
+        throw new Error("Control plane URL must not contain credentials, query parameters, or a fragment.");
+    }
+    if (url.protocol === "http:") {
+        url.protocol = "ws:";
+    }
+    else if (url.protocol === "https:") {
+        url.protocol = "wss:";
+    }
+    else if (url.protocol !== "ws:" && url.protocol !== "wss:") {
+        throw new Error("Control plane URL must use http, https, ws, or wss.");
+    }
+    if (url.protocol === "ws:" && !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) {
+        throw new Error("Remote control planes require HTTPS/WSS. Plain HTTP is allowed only on loopback.");
+    }
+    return url.toString();
+}
+function toHttpControlPlaneUrl(value) {
+    const url = new URL(normalizeControlPlaneUrl(value));
+    if (url.protocol === "ws:") {
+        url.protocol = "http:";
+    }
+    else if (url.protocol === "wss:") {
+        url.protocol = "https:";
+    }
+    else if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error("Control plane URL must use http, https, ws, or wss.");
+    }
+    return url;
+}
+async function readRunnerCredentialsFileIfPresent(path) {
+    try {
+        const raw = await readFile(path, "utf8");
+        return runnerCredentialsFileSchema.parse(JSON.parse(raw));
+    }
+    catch (error) {
+        if (isFileMissingError(error)) {
+            return {
+                version: CREDENTIALS_FILE_VERSION,
+                credentials: [],
+            };
+        }
+        throw error;
+    }
+}
+async function postJson(url, body, schema, signal) {
+    const response = await fetch(url, {
+        method: "POST",
+        redirect: "error",
+        signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15_000)]) : AbortSignal.timeout(15_000),
+        headers: {
+            "content-type": "application/json",
+        },
+        body: JSON.stringify(body),
+    });
+    const raw = await response.text();
+    const parsed = raw.length > 0 ? JSON.parse(raw) : {};
+    if (!response.ok) {
+        const message = errorMessageFromJson(parsed) ?? `${url.pathname} returned HTTP ${response.status}.`;
+        throw new Error(message);
+    }
+    return schema.parse(parsed);
+}
+function errorMessageFromJson(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const message = value.error;
+    return typeof message === "string" && message.length > 0 ? message : undefined;
+}
+function isFileMissingError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+//# sourceMappingURL=index.js.map

package/dist/state/index.d.ts

@@ -0,0 +1,76 @@
+import { type HcpHarnessEventPayload, type HcpNackPayload, type HcpSessionSnapshotPayload, type HostRetainedEventRanges, type LocalActionErrorPayload, type LocalActionRequestPayload, type LocalActionResponsePayload } from "@harness-control/protocol";
+export type PersistedCommandReceipt = {
+    payloadHash: string;
+    outcome: "ack";
+    settledAt: string;
+    snapshotPayload?: HcpSessionSnapshotPayload;
+} | {
+    payloadHash: string;
+    outcome: "nack";
+    settledAt: string;
+    nackPayload: HcpNackPayload;
+};
+export type PersistedLocalActionReceipt = {
+    payloadHash: string;
+    requestPayload: LocalActionRequestPayload;
+    outcome: "response";
+    settledAt: string;
+    payload: LocalActionResponsePayload;
+} | {
+    payloadHash: string;
+    requestPayload: LocalActionRequestPayload;
+    outcome: "error";
+    settledAt: string;
+    payload: LocalActionErrorPayload;
+};
+type RunnerStateData = {
+    version: 1;
+    events: Record<string, HcpHarnessEventPayload[]>;
+    commandReceipts: Record<string, PersistedCommandReceipt>;
+    localActionReceipts: Record<string, PersistedLocalActionReceipt>;
+};
+export type RunnerStateStoreOptions = {
+    eventRetentionPerSession?: number;
+    receiptRetentionMs?: number;
+    now?: () => Date;
+};
+export interface RunnerStateStore {
+    nextEventSequence(sessionId: string): number;
+    appendEvent(event: HcpHarnessEventPayload): void;
+    hasSessionEvents(sessionId: string): boolean;
+    retainedEventRanges(): HostRetainedEventRanges | undefined;
+    replayEventsAfter(sessionId: string, lastEventSequence: number): HcpHarnessEventPayload[] | undefined;
+    sessionSnapshot(commandId: string, sessionId: string): HcpSessionSnapshotPayload | undefined;
+    getCommandReceipt(commandId: string): PersistedCommandReceipt | undefined;
+    setCommandReceipt(commandId: string, receipt: PersistedCommandReceipt): void;
+    getLocalActionReceipt(requestId: string): PersistedLocalActionReceipt | undefined;
+    setLocalActionReceipt(requestId: string, receipt: PersistedLocalActionReceipt): void;
+}
+declare abstract class BaseRunnerStateStore implements RunnerStateStore {
+    #private;
+    protected data: RunnerStateData;
+    constructor(data: RunnerStateData, options: RunnerStateStoreOptions);
+    abstract persist(): void;
+    nextEventSequence(sessionId: string): number;
+    appendEvent(event: HcpHarnessEventPayload): void;
+    hasSessionEvents(sessionId: string): boolean;
+    retainedEventRanges(): HostRetainedEventRanges | undefined;
+    replayEventsAfter(sessionId: string, lastEventSequence: number): HcpHarnessEventPayload[] | undefined;
+    sessionSnapshot(commandId: string, sessionId: string): HcpSessionSnapshotPayload | undefined;
+    getCommandReceipt(commandId: string): PersistedCommandReceipt | undefined;
+    setCommandReceipt(commandId: string, receipt: PersistedCommandReceipt): void;
+    getLocalActionReceipt(requestId: string): PersistedLocalActionReceipt | undefined;
+    setLocalActionReceipt(requestId: string, receipt: PersistedLocalActionReceipt): void;
+}
+export declare class MemoryRunnerStateStore extends BaseRunnerStateStore {
+    constructor(options?: RunnerStateStoreOptions);
+    persist(): void;
+}
+export declare class JsonRunnerStateStore extends BaseRunnerStateStore {
+    #private;
+    constructor(path: string, options?: RunnerStateStoreOptions);
+    persist(): void;
+}
+export declare function defaultRunnerStatePath(runnerId: string): string;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/state/index.js

@@ -0,0 +1,242 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { HCP_PAYLOAD_MAX_ENCODED_BYTES, hcpCommandNackPayloadSchema, hcpHarnessEventPayloadSchema, hcpSessionSnapshotPayloadSchema, localActionErrorPayloadSchema, localActionRequestPayloadSchema, localActionResponsePayloadSchema, } from "@harness-control/protocol";
+import { z } from "zod";
+const DEFAULT_RECEIPT_RETENTION_MS = 24 * 60 * 60 * 1000;
+const DEFAULT_EVENT_RETENTION_PER_SESSION = 512;
+const persistedCommandReceiptSchema = z.discriminatedUnion("outcome", [
+    z
+        .object({
+        payloadHash: z.string().min(1),
+        outcome: z.literal("ack"),
+        settledAt: z.string().datetime({ offset: true }),
+        snapshotPayload: hcpSessionSnapshotPayloadSchema.optional(),
+    })
+        .strict(),
+    z
+        .object({
+        payloadHash: z.string().min(1),
+        outcome: z.literal("nack"),
+        settledAt: z.string().datetime({ offset: true }),
+        nackPayload: hcpCommandNackPayloadSchema,
+    })
+        .strict(),
+]);
+const persistedLocalActionReceiptSchema = z.discriminatedUnion("outcome", [
+    z
+        .object({
+        payloadHash: z.string().min(1),
+        requestPayload: localActionRequestPayloadSchema,
+        outcome: z.literal("response"),
+        settledAt: z.string().datetime({ offset: true }),
+        payload: localActionResponsePayloadSchema,
+    })
+        .strict(),
+    z
+        .object({
+        payloadHash: z.string().min(1),
+        requestPayload: localActionRequestPayloadSchema,
+        outcome: z.literal("error"),
+        settledAt: z.string().datetime({ offset: true }),
+        payload: localActionErrorPayloadSchema,
+    })
+        .strict(),
+]);
+const runnerStateDataSchema = z
+    .object({
+    version: z.literal(1),
+    events: z.record(z.string(), z.array(hcpHarnessEventPayloadSchema)),
+    commandReceipts: z.record(z.string(), persistedCommandReceiptSchema),
+    localActionReceipts: z.record(z.string(), persistedLocalActionReceiptSchema),
+})
+    .strict();
+class BaseRunnerStateStore {
+    #eventRetentionPerSession;
+    #receiptRetentionMs;
+    #now;
+    data;
+    constructor(data, options) {
+        this.data = data;
+        this.#eventRetentionPerSession = options.eventRetentionPerSession ?? DEFAULT_EVENT_RETENTION_PER_SESSION;
+        this.#receiptRetentionMs = options.receiptRetentionMs ?? DEFAULT_RECEIPT_RETENTION_MS;
+        this.#now = options.now ?? (() => new Date());
+        if (!Number.isInteger(this.#eventRetentionPerSession) || this.#eventRetentionPerSession < 1) {
+            throw new Error("eventRetentionPerSession must be a positive integer.");
+        }
+        if (!Number.isFinite(this.#receiptRetentionMs) || this.#receiptRetentionMs <= 0) {
+            throw new Error("receiptRetentionMs must be positive.");
+        }
+        this.#pruneExpiredReceipts();
+    }
+    nextEventSequence(sessionId) {
+        return (this.data.events[sessionId]?.at(-1)?.sequence ?? 0) + 1;
+    }
+    appendEvent(event) {
+        const expectedSequence = this.nextEventSequence(event.session_id);
+        if (event.sequence !== expectedSequence) {
+            throw new Error(`Event sequence ${event.sequence} for session '${event.session_id}' does not match expected sequence ${expectedSequence}.`);
+        }
+        const events = this.data.events[event.session_id] ?? [];
+        events.push(event);
+        while (events.length > this.#eventRetentionPerSession) {
+            events.shift();
+        }
+        this.data.events[event.session_id] = events;
+        this.persist();
+    }
+    hasSessionEvents(sessionId) {
+        return (this.data.events[sessionId]?.length ?? 0) > 0;
+    }
+    retainedEventRanges() {
+        const sessions = Object.entries(this.data.events)
+            .map(([sessionId, events]) => {
+            const firstEvent = events[0];
+            const lastEvent = events.at(-1);
+            return firstEvent && lastEvent
+                ? {
+                    session_id: sessionId,
+                    first_event_sequence: firstEvent.sequence,
+                    last_event_sequence: lastEvent.sequence,
+                }
+                : undefined;
+        })
+            .filter((range) => range !== undefined)
+            .sort((left, right) => left.session_id.localeCompare(right.session_id));
+        return sessions.length > 0 ? { sessions } : undefined;
+    }
+    replayEventsAfter(sessionId, lastEventSequence) {
+        const events = this.data.events[sessionId];
+        const firstSequence = events?.[0]?.sequence;
+        const finalSequence = events?.at(-1)?.sequence;
+        if (!events ||
+            firstSequence === undefined ||
+            finalSequence === undefined ||
+            lastEventSequence < firstSequence - 1 ||
+            lastEventSequence > finalSequence) {
+            return undefined;
+        }
+        return events.filter((event) => event.sequence > lastEventSequence);
+    }
+    sessionSnapshot(commandId, sessionId) {
+        const events = this.data.events[sessionId];
+        if (!events || events.length === 0) {
+            return undefined;
+        }
+        const generatedAt = this.#now().toISOString();
+        const retainedStartsAtOne = events[0]?.sequence === 1;
+        const selectedEvents = [...events];
+        while (selectedEvents.length > 0) {
+            const firstEvent = selectedEvents[0];
+            const finalEvent = selectedEvents.at(-1);
+            const base = {
+                command_id: commandId,
+                session_id: sessionId,
+                generated_at: generatedAt,
+                from_sequence: firstEvent.sequence,
+                through_sequence: finalEvent.sequence,
+                events: [...selectedEvents],
+                tombstones: [],
+            };
+            const complete = retainedStartsAtOne && selectedEvents.length === events.length;
+            const snapshot = complete
+                ? { ...base, completeness: "complete", omission_semantics: "replace", from_sequence: 1 }
+                : {
+                    ...base,
+                    completeness: "partial",
+                    omission_semantics: "preserve",
+                    reason: retainedStartsAtOne ? "size_limit" : "retention_gap",
+                };
+            if (Buffer.byteLength(JSON.stringify(snapshot), "utf8") <= HCP_PAYLOAD_MAX_ENCODED_BYTES) {
+                return snapshot;
+            }
+            selectedEvents.shift();
+        }
+        return undefined;
+    }
+    getCommandReceipt(commandId) {
+        if (this.#pruneExpiredReceipts()) {
+            this.persist();
+        }
+        return this.data.commandReceipts[commandId];
+    }
+    setCommandReceipt(commandId, receipt) {
+        this.data.commandReceipts[commandId] = receipt;
+        this.#pruneExpiredReceipts();
+        this.persist();
+    }
+    getLocalActionReceipt(requestId) {
+        if (this.#pruneExpiredReceipts()) {
+            this.persist();
+        }
+        return this.data.localActionReceipts[requestId];
+    }
+    setLocalActionReceipt(requestId, receipt) {
+        this.data.localActionReceipts[requestId] = receipt;
+        this.#pruneExpiredReceipts();
+        this.persist();
+    }
+    #pruneExpiredReceipts() {
+        const cutoff = this.#now().getTime() - this.#receiptRetentionMs;
+        let changed = false;
+        for (const [commandId, receipt] of Object.entries(this.data.commandReceipts)) {
+            if (new Date(receipt.settledAt).getTime() < cutoff) {
+                delete this.data.commandReceipts[commandId];
+                changed = true;
+            }
+        }
+        for (const [requestId, receipt] of Object.entries(this.data.localActionReceipts)) {
+            if (new Date(receipt.settledAt).getTime() < cutoff) {
+                delete this.data.localActionReceipts[requestId];
+                changed = true;
+            }
+        }
+        return changed;
+    }
+}
+export class MemoryRunnerStateStore extends BaseRunnerStateStore {
+    constructor(options = {}) {
+        super(emptyRunnerState(), options);
+    }
+    persist() { }
+}
+export class JsonRunnerStateStore extends BaseRunnerStateStore {
+    #path;
+    constructor(path, options = {}) {
+        super(readRunnerState(path), options);
+        this.#path = path;
+    }
+    persist() {
+        mkdirSync(dirname(this.#path), { recursive: true, mode: 0o700 });
+        const temporaryPath = `${this.#path}.${process.pid}.tmp`;
+        writeFileSync(temporaryPath, `${JSON.stringify(this.data, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+        renameSync(temporaryPath, this.#path);
+    }
+}
+export function defaultRunnerStatePath(runnerId) {
+    const safeRunnerId = runnerId.replace(/[^A-Za-z0-9_-]/g, "-");
+    return join(homedir(), ".hcp-runner", "state", `${safeRunnerId}.json`);
+}
+function emptyRunnerState() {
+    return {
+        version: 1,
+        events: {},
+        commandReceipts: {},
+        localActionReceipts: {},
+    };
+}
+function readRunnerState(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+            return emptyRunnerState();
+        }
+        throw error;
+    }
+    const parsed = JSON.parse(raw);
+    return runnerStateDataSchema.parse(parsed);
+}
+//# sourceMappingURL=index.js.map

package/dist/workspaces/index.d.ts

@@ -0,0 +1,13 @@
+import type { HcpWorkspaceManagement, HcpWorkspacesRequestPayload, HcpWorkspacesResultPayload } from "@harness-control/protocol";
+import { type RunnerConfig } from "../config/index.js";
+import type { HarnessSessionManager } from "../harnesses/index.js";
+export declare class WorkspaceManager {
+    private readonly config;
+    private readonly configPath;
+    private readonly sessions;
+    constructor(config: RunnerConfig, configPath: string | undefined, sessions: Pick<HarnessSessionManager, "updateWorkspaceConfiguration">);
+    snapshot(): HcpWorkspaceManagement;
+    execute(requestId: string, request: HcpWorkspacesRequestPayload): Promise<HcpWorkspacesResultPayload>;
+    private change;
+}
+//# sourceMappingURL=index.d.ts.map