@hexclave/shared-backend 1.0.36 → 1.0.37

package/dist/config-agent.d.ts

@@ -27,6 +27,27 @@ type RunClaudeAgentOptions = {
 type RunClaudeAgentResult = {
   resultText: string;
 };
+declare const CONFIG_AGENT_FILE_TOOLS: readonly ["Read", "Write", "Edit", "Glob", "Grep"];
+declare const CONFIG_AGENT_REPO_TOOLS: readonly ["Read", "Write", "Edit", "Glob", "Grep", "Bash"];
+type ConfigAgentPromptScope = {
+  mode: "known-file";
+  configFileName: string;
+} | {
+  mode: "repo";
+};
+declare function buildCompleteConfigAgentPrompt(options: {
+  scope: ConfigAgentPromptScope;
+  completeConfig: Record<string, unknown>;
+  commandPolicy: string;
+}): string;
+declare function buildPartialConfigAgentPrompt(options: {
+  configFileName: string;
+  changes: Array<{
+    path: string;
+    value: unknown;
+  }>;
+  commandPolicy: string;
+}): string;
 declare class ClaudeAgentTimeoutError extends Error {
   constructor(timeoutMs?: number);
 }
@@ -38,5 +59,5 @@ declare function runHeadlessClaudeAgent(options: RunClaudeAgentOptions): Promise
 declare function getToolWriteTargetPath(toolName: string, toolInput: unknown, cwd: string): string | null;
 declare function isPathInsideDir(dir: string, target: string): boolean;
 //#endregion
-export { ClaudeAgentFailureError, ClaudeAgentPreToolUseInput, ClaudeAgentTimeoutError, ClaudeAgentToolName, RunClaudeAgentOptions, RunClaudeAgentResult, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent, stripClaudeCodeEnv };
+export { CONFIG_AGENT_FILE_TOOLS, CONFIG_AGENT_REPO_TOOLS, ClaudeAgentFailureError, ClaudeAgentPreToolUseInput, ClaudeAgentTimeoutError, ClaudeAgentToolName, ConfigAgentPromptScope, RunClaudeAgentOptions, RunClaudeAgentResult, buildCompleteConfigAgentPrompt, buildPartialConfigAgentPrompt, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent, stripClaudeCodeEnv };
 //# sourceMappingURL=config-agent.d.ts.map

package/dist/config-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-agent.d.ts","names":[],"sources":["../src/config-agent.ts"],"mappings":";KAMY,mBAAA;AAAA,KAEP,qBAAA;EAA0B,QAAA;AAAA;EAC7B,kBAAA;IACE,aAAA;IACA,kBAAA;IACA,wBAAA;EAAA;AAAA;AAAA,KAIQ,0BAAA;EACV,eAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,KAGU,qBAAA;EACV,MAAA;EACA,GAAA;EACA,YAAA,EAAc,mBAAA;EACd,SAAA;EACA,eAAA;EACA,MAAA,IAAU,IAAA;EACV,SAAA,IAAa,OAAA;EACb,YAAA,IAAgB,KAAA,EAAO,0BAAA,KAA+B,OAAA,CAAQ,qBAAA,IAAyB,qBAAA;AAAA;AAAA,KAG7E,oBAAA;EACV,UAAA;AAAA;AAAA,cAGW,uBAAA,SAAgC,KAAA;cAC/B,SAAA;AAAA;AAAA,cAMD,uBAAA,SAAgC,KAAA;cAC/B,OAAA;AAAA;AAAA,iBAUE,kBAAA,CAAA,GAAsB,MAAA;AAAA,iBAOhB,sBAAA,CAAuB,OAAA,EAAS,qBAAA,GAAwB,OAAA,CAAQ,oBAAA;AAAA,iBA0EtE,sBAAA,CAAuB,QAAA,UAAkB,SAAA,WAAoB,GAAA;AAAA,iBAO7D,eAAA,CAAgB,GAAA,UAAa,MAAA"}
+{"version":3,"file":"config-agent.d.ts","names":[],"sources":["../src/config-agent.ts"],"mappings":";KAMY,mBAAA;AAAA,KAEP,qBAAA;EAA0B,QAAA;AAAA;EAC7B,kBAAA;IACE,aAAA;IACA,kBAAA;IACA,wBAAA;EAAA;AAAA;AAAA,KAIQ,0BAAA;EACV,eAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,KAGU,qBAAA;EACV,MAAA;EACA,GAAA;EACA,YAAA,EAAc,mBAAA;EACd,SAAA;EACA,eAAA;EACA,MAAA,IAAU,IAAA;EACV,SAAA,IAAa,OAAA;EACb,YAAA,IAAgB,KAAA,EAAO,0BAAA,KAA+B,OAAA,CAAQ,qBAAA,IAAyB,qBAAA;AAAA;AAAA,KAG7E,oBAAA;EACV,UAAA;AAAA;AAAA,cAGW,uBAAA;AAAA,cACA,uBAAA;AAAA,KAYD,sBAAA;EAER,IAAA;EACA,cAAA;AAAA;EAGA,IAAA;AAAA;AAAA,iBA+BY,8BAAA,CAA+B,OAAA;EAC7C,KAAA,EAAO,sBAAA;EACP,cAAA,EAAgB,MAAA;EAChB,aAAA;AAAA;AAAA,iBAYc,6BAAA,CAA8B,OAAA;EAC5C,cAAA;EACA,OAAA,EAAS,KAAA;IAAQ,IAAA;IAAc,KAAA;EAAA;EAC/B,aAAA;AAAA;AAAA,cAeW,uBAAA,SAAgC,KAAA;cAC/B,SAAA;AAAA;AAAA,cAMD,uBAAA,SAAgC,KAAA;cAC/B,OAAA;AAAA;AAAA,iBAUE,kBAAA,CAAA,GAAsB,MAAA;AAAA,iBAOhB,sBAAA,CAAuB,OAAA,EAAS,qBAAA,GAAwB,OAAA,CAAQ,oBAAA;AAAA,iBA0EtE,sBAAA,CAAuB,QAAA,UAAkB,SAAA,WAAoB,GAAA;AAAA,iBAO7D,eAAA,CAAgB,GAAA,UAAa,MAAA"}

package/dist/config-agent.js

@@ -5,7 +5,55 @@ let path = require("path");
 path = require_chunk.__toESM(path);
 
 //#region src/config-agent.ts
-const ANTHROPIC_PROXY_BASE_URL = process.env.STACK_CLAUDE_PROXY_URL ?? "https://api.hexclave.com/api/v1/integrations/ai-proxy";
+const ANTHROPIC_PROXY_BASE_URL = process.env.STACK_CLAUDE_PROXY_URL ?? "https://api.hexclave.com/api/latest/integrations/ai-proxy";
+const CONFIG_AGENT_FILE_TOOLS = [
+	"Read",
+	"Write",
+	"Edit",
+	"Glob",
+	"Grep"
+];
+const CONFIG_AGENT_REPO_TOOLS = [...CONFIG_AGENT_FILE_TOOLS, "Bash"];
+function buildConfigAgentPrompt(options) {
+	const targetSection = options.target.mode === "complete" ? `The exported config must end up deep-equal to this JSON value:\n\n${JSON.stringify(options.target.completeConfig, null, 2)}` : `Apply EXACTLY these config changes. Paths use dot notation, so \`a.b.c\` refers to \`config.a.b.c\`:\n\n${options.target.changes.map(({ path: path$2, value }) => `- ${JSON.stringify(path$2)}: set to ${JSON.stringify(value)}`).join("\n")}`;
+	return `You are updating a Hexclave / Stack Auth configuration file.
+
+${options.scope.mode === "known-file" ? `Config file: ${JSON.stringify(options.scope.configFileName)} in the current working directory.` : "Current working directory: the repository root. Find the Hexclave / Stack Auth config file. It is usually a `*.config.ts` file exporting `config`, often wrapped in `defineHexclaveConfig(...)` or a similar helper."}
+
+${targetSection}
+
+Rules:
+- Keep the file valid: it must still export \`config\`.
+- Preserve the existing authoring style where possible: imports, comments, helper wrappers, file header comments, and formatting.
+- If the config currently exports the placeholder string "show-onboarding" or is otherwise a stub, replace it with a real typed config object.
+- If a config value is conventionally sourced from an imported external file, you may keep that indirection as long as the evaluated config matches the requested value.
+- Do not touch unrelated files or application code.
+- ${options.commandPolicy}
+- Make the edits, then stop.`;
+}
+function buildCompleteConfigAgentPrompt(options) {
+	return buildConfigAgentPrompt({
+		scope: options.scope,
+		target: {
+			mode: "complete",
+			completeConfig: options.completeConfig
+		},
+		commandPolicy: options.commandPolicy
+	});
+}
+function buildPartialConfigAgentPrompt(options) {
+	return buildConfigAgentPrompt({
+		scope: {
+			mode: "known-file",
+			configFileName: options.configFileName
+		},
+		target: {
+			mode: "partial",
+			changes: options.changes
+		},
+		commandPolicy: options.commandPolicy
+	});
+}
 var ClaudeAgentTimeoutError = class extends Error {
 	constructor(timeoutMs) {
 		super(`Claude agent timed out${timeoutMs == null ? "" : ` after ${timeoutMs}ms`}.`);
@@ -36,7 +84,7 @@ async function runHeadlessClaudeAgent(options) {
 		for await (const message of (0, _anthropic_ai_claude_agent_sdk.query)({
 			prompt: options.prompt,
 			options: {
-				model: "nvidia/nemotron-3-super-120b-a12b:nitro",
+				model: "anthropic/claude-haiku-4.5",
 				...options.strictIsolation === true ? {
 					settingSources: [],
 					strictMcpConfig: true
@@ -87,8 +135,12 @@ function isPathInsideDir(dir, target) {
 }
 
 //#endregion
+exports.CONFIG_AGENT_FILE_TOOLS = CONFIG_AGENT_FILE_TOOLS;
+exports.CONFIG_AGENT_REPO_TOOLS = CONFIG_AGENT_REPO_TOOLS;
 exports.ClaudeAgentFailureError = ClaudeAgentFailureError;
 exports.ClaudeAgentTimeoutError = ClaudeAgentTimeoutError;
+exports.buildCompleteConfigAgentPrompt = buildCompleteConfigAgentPrompt;
+exports.buildPartialConfigAgentPrompt = buildPartialConfigAgentPrompt;
 exports.getToolWriteTargetPath = getToolWriteTargetPath;
 exports.isPathInsideDir = isPathInsideDir;
 exports.runHeadlessClaudeAgent = runHeadlessClaudeAgent;

package/dist/config-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-agent.js","names":[],"sources":["../src/config-agent.ts"],"sourcesContent":["import { query } from \"@anthropic-ai/claude-agent-sdk\";\nimport path from \"path\";\n\nconst DEFAULT_PROXY_URL = \"https://api.hexclave.com/api/v1/integrations/ai-proxy\";\nconst ANTHROPIC_PROXY_BASE_URL: string = process.env.STACK_CLAUDE_PROXY_URL ?? DEFAULT_PROXY_URL;\n\nexport type ClaudeAgentToolName = \"Read\" | \"Write\" | \"Edit\" | \"MultiEdit\" | \"NotebookEdit\" | \"Bash\" | \"Glob\" | \"Grep\";\n\ntype ClaudeAgentHookResult = { continue: true } | {\n  hookSpecificOutput: {\n    hookEventName: \"PreToolUse\",\n    permissionDecision: \"deny\",\n    permissionDecisionReason: string,\n  },\n};\n\nexport type ClaudeAgentPreToolUseInput = {\n  hook_event_name: \"PreToolUse\",\n  tool_name: string,\n  tool_input: unknown,\n};\n\nexport type RunClaudeAgentOptions = {\n  prompt: string,\n  cwd: string,\n  allowedTools: ClaudeAgentToolName[],\n  timeoutMs?: number,\n  strictIsolation?: boolean,\n  stderr?: (data: string) => void,\n  onMessage?: (message: unknown) => void,\n  onPreToolUse?: (input: ClaudeAgentPreToolUseInput) => Promise<ClaudeAgentHookResult> | ClaudeAgentHookResult,\n};\n\nexport type RunClaudeAgentResult = {\n  resultText: string,\n};\n\nexport class ClaudeAgentTimeoutError extends Error {\n  constructor(timeoutMs?: number) {\n    super(`Claude agent timed out${timeoutMs == null ? \"\" : ` after ${timeoutMs}ms`}.`);\n    this.name = \"ClaudeAgentTimeoutError\";\n  }\n}\n\nexport class ClaudeAgentFailureError extends Error {\n  constructor(subtype: string) {\n    super(`Claude agent failed (${subtype}).`);\n    this.name = \"ClaudeAgentFailureError\";\n  }\n}\n\nfunction isAbortError(error: unknown): boolean {\n  return error instanceof Error && error.name === \"AbortError\";\n}\n\nexport function stripClaudeCodeEnv(): Record<string, string | undefined> {\n  const env = { ...process.env };\n  // CLAUDECODE must be unset for nested agents; ANTHROPIC_API_KEY must be non-empty (proxy ignores it).\n  delete env.CLAUDECODE;\n  return env;\n}\n\nexport async function runHeadlessClaudeAgent(options: RunClaudeAgentOptions): Promise<RunClaudeAgentResult> {\n  const abortController = new AbortController();\n  const timeout = options.timeoutMs == null ? null : setTimeout(() => abortController.abort(), options.timeoutMs);\n  let sawResult = false;\n  let resultText = \"\";\n  const onPreToolUse = options.onPreToolUse;\n  try {\n    for await (const message of query({\n      prompt: options.prompt,\n      options: {\n        model: \"nvidia/nemotron-3-super-120b-a12b:nitro\",\n        ...(options.strictIsolation === true ? {\n          settingSources: [],\n          strictMcpConfig: true,\n        } : {}),\n        ...(onPreToolUse == null ? {} : {\n          hooks: {\n            PreToolUse: [{\n              hooks: [async (input) => {\n                if (input.hook_event_name !== \"PreToolUse\") {\n                  return { continue: true };\n                }\n                return await onPreToolUse(input);\n              }],\n            }],\n          },\n        }),\n        allowedTools: options.allowedTools,\n        permissionMode: \"dontAsk\",\n        cwd: options.cwd,\n        abortController,\n        env: {\n          ...stripClaudeCodeEnv(),\n          ...(options.strictIsolation === true ? { CLAUDE_CODE_DISABLE_AUTO_MEMORY: \"1\" } : {}),\n          ANTHROPIC_BASE_URL: ANTHROPIC_PROXY_BASE_URL,\n          ANTHROPIC_API_KEY: \"stack-auth-proxy\",\n        },\n        stderr: options.stderr,\n      },\n    })) {\n      options.onMessage?.(message);\n      if (message.type === \"result\") {\n        if (\"result\" in message) {\n          sawResult = true;\n          resultText = message.result;\n        } else {\n          throw new ClaudeAgentFailureError(message.subtype);\n        }\n      }\n    }\n  } catch (error) {\n    if (abortController.signal.aborted && isAbortError(error)) {\n      throw new ClaudeAgentTimeoutError(options.timeoutMs ?? undefined);\n    }\n    throw error;\n  } finally {\n    if (timeout != null) {\n      clearTimeout(timeout);\n    }\n  }\n  if (!sawResult) {\n    throw new Error(\"Claude agent ended without reporting a result.\");\n  }\n  return { resultText };\n}\n\n// Only the tools actually in the agent's allowedTools list; MultiEdit and\n// NotebookEdit are intentionally excluded from the agent's tool set.\nconst FILE_MUTATING_TOOLS = new Set([\"Write\", \"Edit\"]);\n\nfunction hasStringFilePath(input: unknown): input is { file_path: string } {\n  return typeof input === \"object\" && input !== null && \"file_path\" in input && typeof input.file_path === \"string\";\n}\n\nexport function getToolWriteTargetPath(toolName: string, toolInput: unknown, cwd: string): string | null {\n  if (!FILE_MUTATING_TOOLS.has(toolName) || !hasStringFilePath(toolInput)) {\n    return null;\n  }\n  return path.isAbsolute(toolInput.file_path) ? toolInput.file_path : path.resolve(cwd, toolInput.file_path);\n}\n\nexport function isPathInsideDir(dir: string, target: string): boolean {\n  const relative = path.relative(path.resolve(dir), path.resolve(target));\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n"],"mappings":";;;;;;;AAIA,MAAM,2BAAmC,QAAQ,IAAI,0BAD3B;AAkC1B,IAAa,0BAAb,cAA6C,MAAM;CACjD,YAAY,WAAoB;AAC9B,QAAM,yBAAyB,aAAa,OAAO,KAAK,UAAU,UAAU,IAAI,GAAG;AACnF,OAAK,OAAO;;;AAIhB,IAAa,0BAAb,cAA6C,MAAM;CACjD,YAAY,SAAiB;AAC3B,QAAM,wBAAwB,QAAQ,IAAI;AAC1C,OAAK,OAAO;;;AAIhB,SAAS,aAAa,OAAyB;AAC7C,QAAO,iBAAiB,SAAS,MAAM,SAAS;;AAGlD,SAAgB,qBAAyD;CACvE,MAAM,MAAM,EAAE,GAAG,QAAQ,KAAK;AAE9B,QAAO,IAAI;AACX,QAAO;;AAGT,eAAsB,uBAAuB,SAA+D;CAC1G,MAAM,kBAAkB,IAAI,iBAAiB;CAC7C,MAAM,UAAU,QAAQ,aAAa,OAAO,OAAO,iBAAiB,gBAAgB,OAAO,EAAE,QAAQ,UAAU;CAC/G,IAAI,YAAY;CAChB,IAAI,aAAa;CACjB,MAAM,eAAe,QAAQ;AAC7B,KAAI;AACF,aAAW,MAAM,qDAAiB;GAChC,QAAQ,QAAQ;GAChB,SAAS;IACP,OAAO;IACP,GAAI,QAAQ,oBAAoB,OAAO;KACrC,gBAAgB,EAAE;KAClB,iBAAiB;KAClB,GAAG,EAAE;IACN,GAAI,gBAAgB,OAAO,EAAE,GAAG,EAC9B,OAAO,EACL,YAAY,CAAC,EACX,OAAO,CAAC,OAAO,UAAU;AACvB,SAAI,MAAM,oBAAoB,aAC5B,QAAO,EAAE,UAAU,MAAM;AAE3B,YAAO,MAAM,aAAa,MAAM;MAChC,EACH,CAAC,EACH,EACF;IACD,cAAc,QAAQ;IACtB,gBAAgB;IAChB,KAAK,QAAQ;IACb;IACA,KAAK;KACH,GAAG,oBAAoB;KACvB,GAAI,QAAQ,oBAAoB,OAAO,EAAE,iCAAiC,KAAK,GAAG,EAAE;KACpF,oBAAoB;KACpB,mBAAmB;KACpB;IACD,QAAQ,QAAQ;IACjB;GACF,CAAC,EAAE;AACF,WAAQ,YAAY,QAAQ;AAC5B,OAAI,QAAQ,SAAS,SACnB,KAAI,YAAY,SAAS;AACvB,gBAAY;AACZ,iBAAa,QAAQ;SAErB,OAAM,IAAI,wBAAwB,QAAQ,QAAQ;;UAIjD,OAAO;AACd,MAAI,gBAAgB,OAAO,WAAW,aAAa,MAAM,CACvD,OAAM,IAAI,wBAAwB,QAAQ,aAAa,OAAU;AAEnE,QAAM;WACE;AACR,MAAI,WAAW,KACb,cAAa,QAAQ;;AAGzB,KAAI,CAAC,UACH,OAAM,IAAI,MAAM,iDAAiD;AAEnE,QAAO,EAAE,YAAY;;AAKvB,MAAM,sBAAsB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AAEtD,SAAS,kBAAkB,OAAgD;AACzE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAe,SAAS,OAAO,MAAM,cAAc;;AAG3G,SAAgB,uBAAuB,UAAkB,WAAoB,KAA4B;AACvG,KAAI,CAAC,oBAAoB,IAAI,SAAS,IAAI,CAAC,kBAAkB,UAAU,CACrE,QAAO;AAET,QAAO,aAAK,WAAW,UAAU,UAAU,GAAG,UAAU,YAAY,aAAK,QAAQ,KAAK,UAAU,UAAU;;AAG5G,SAAgB,gBAAgB,KAAa,QAAyB;CACpE,MAAM,WAAW,aAAK,SAAS,aAAK,QAAQ,IAAI,EAAE,aAAK,QAAQ,OAAO,CAAC;AACvE,QAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAK,IAAI,CAAC,aAAK,WAAW,SAAS"}
+{"version":3,"file":"config-agent.js","names":["path"],"sources":["../src/config-agent.ts"],"sourcesContent":["import { query } from \"@anthropic-ai/claude-agent-sdk\";\nimport path from \"path\";\n\nconst DEFAULT_PROXY_URL = \"https://api.hexclave.com/api/latest/integrations/ai-proxy\";\nconst ANTHROPIC_PROXY_BASE_URL: string = process.env.STACK_CLAUDE_PROXY_URL ?? DEFAULT_PROXY_URL;\n\nexport type ClaudeAgentToolName = \"Read\" | \"Write\" | \"Edit\" | \"MultiEdit\" | \"NotebookEdit\" | \"Bash\" | \"Glob\" | \"Grep\";\n\ntype ClaudeAgentHookResult = { continue: true } | {\n  hookSpecificOutput: {\n    hookEventName: \"PreToolUse\",\n    permissionDecision: \"deny\",\n    permissionDecisionReason: string,\n  },\n};\n\nexport type ClaudeAgentPreToolUseInput = {\n  hook_event_name: \"PreToolUse\",\n  tool_name: string,\n  tool_input: unknown,\n};\n\nexport type RunClaudeAgentOptions = {\n  prompt: string,\n  cwd: string,\n  allowedTools: ClaudeAgentToolName[],\n  timeoutMs?: number,\n  strictIsolation?: boolean,\n  stderr?: (data: string) => void,\n  onMessage?: (message: unknown) => void,\n  onPreToolUse?: (input: ClaudeAgentPreToolUseInput) => Promise<ClaudeAgentHookResult> | ClaudeAgentHookResult,\n};\n\nexport type RunClaudeAgentResult = {\n  resultText: string,\n};\n\nexport const CONFIG_AGENT_FILE_TOOLS = [\"Read\", \"Write\", \"Edit\", \"Glob\", \"Grep\"] as const;\nexport const CONFIG_AGENT_REPO_TOOLS = [...CONFIG_AGENT_FILE_TOOLS, \"Bash\"] as const;\n\ntype ConfigAgentPromptTarget =\n  | {\n    mode: \"complete\",\n    completeConfig: Record<string, unknown>,\n  }\n  | {\n    mode: \"partial\",\n    changes: Array<{ path: string, value: unknown }>,\n  };\n\nexport type ConfigAgentPromptScope =\n  | {\n    mode: \"known-file\",\n    configFileName: string,\n  }\n  | {\n    mode: \"repo\",\n  };\n\nfunction buildConfigAgentPrompt(options: {\n  scope: ConfigAgentPromptScope,\n  target: ConfigAgentPromptTarget,\n  commandPolicy: string,\n}): string {\n  const targetSection = options.target.mode === \"complete\"\n    ? `The exported config must end up deep-equal to this JSON value:\\n\\n${JSON.stringify(options.target.completeConfig, null, 2)}`\n    : `Apply EXACTLY these config changes. Paths use dot notation, so \\`a.b.c\\` refers to \\`config.a.b.c\\`:\\n\\n${options.target.changes.map(({ path, value }) => `- ${JSON.stringify(path)}: set to ${JSON.stringify(value)}`).join(\"\\n\")}`;\n  const scopeSection = options.scope.mode === \"known-file\"\n    ? `Config file: ${JSON.stringify(options.scope.configFileName)} in the current working directory.`\n    : \"Current working directory: the repository root. Find the Hexclave / Stack Auth config file. It is usually a `*.config.ts` file exporting `config`, often wrapped in `defineHexclaveConfig(...)` or a similar helper.\";\n\n  return `You are updating a Hexclave / Stack Auth configuration file.\n\n${scopeSection}\n\n${targetSection}\n\nRules:\n- Keep the file valid: it must still export \\`config\\`.\n- Preserve the existing authoring style where possible: imports, comments, helper wrappers, file header comments, and formatting.\n- If the config currently exports the placeholder string \"show-onboarding\" or is otherwise a stub, replace it with a real typed config object.\n- If a config value is conventionally sourced from an imported external file, you may keep that indirection as long as the evaluated config matches the requested value.\n- Do not touch unrelated files or application code.\n- ${options.commandPolicy}\n- Make the edits, then stop.`;\n}\n\nexport function buildCompleteConfigAgentPrompt(options: {\n  scope: ConfigAgentPromptScope,\n  completeConfig: Record<string, unknown>,\n  commandPolicy: string,\n}): string {\n  return buildConfigAgentPrompt({\n    scope: options.scope,\n    target: {\n      mode: \"complete\",\n      completeConfig: options.completeConfig,\n    },\n    commandPolicy: options.commandPolicy,\n  });\n}\n\nexport function buildPartialConfigAgentPrompt(options: {\n  configFileName: string,\n  changes: Array<{ path: string, value: unknown }>,\n  commandPolicy: string,\n}): string {\n  return buildConfigAgentPrompt({\n    scope: {\n      mode: \"known-file\",\n      configFileName: options.configFileName,\n    },\n    target: {\n      mode: \"partial\",\n      changes: options.changes,\n    },\n    commandPolicy: options.commandPolicy,\n  });\n}\n\nexport class ClaudeAgentTimeoutError extends Error {\n  constructor(timeoutMs?: number) {\n    super(`Claude agent timed out${timeoutMs == null ? \"\" : ` after ${timeoutMs}ms`}.`);\n    this.name = \"ClaudeAgentTimeoutError\";\n  }\n}\n\nexport class ClaudeAgentFailureError extends Error {\n  constructor(subtype: string) {\n    super(`Claude agent failed (${subtype}).`);\n    this.name = \"ClaudeAgentFailureError\";\n  }\n}\n\nfunction isAbortError(error: unknown): boolean {\n  return error instanceof Error && error.name === \"AbortError\";\n}\n\nexport function stripClaudeCodeEnv(): Record<string, string | undefined> {\n  const env = { ...process.env };\n  // CLAUDECODE must be unset for nested agents; ANTHROPIC_API_KEY must be non-empty (proxy ignores it).\n  delete env.CLAUDECODE;\n  return env;\n}\n\nexport async function runHeadlessClaudeAgent(options: RunClaudeAgentOptions): Promise<RunClaudeAgentResult> {\n  const abortController = new AbortController();\n  const timeout = options.timeoutMs == null ? null : setTimeout(() => abortController.abort(), options.timeoutMs);\n  let sawResult = false;\n  let resultText = \"\";\n  const onPreToolUse = options.onPreToolUse;\n  try {\n    for await (const message of query({\n      prompt: options.prompt,\n      options: {\n        model: \"anthropic/claude-haiku-4.5\",\n        ...(options.strictIsolation === true ? {\n          settingSources: [],\n          strictMcpConfig: true,\n        } : {}),\n        ...(onPreToolUse == null ? {} : {\n          hooks: {\n            PreToolUse: [{\n              hooks: [async (input) => {\n                if (input.hook_event_name !== \"PreToolUse\") {\n                  return { continue: true };\n                }\n                return await onPreToolUse(input);\n              }],\n            }],\n          },\n        }),\n        allowedTools: options.allowedTools,\n        permissionMode: \"dontAsk\",\n        cwd: options.cwd,\n        abortController,\n        env: {\n          ...stripClaudeCodeEnv(),\n          ...(options.strictIsolation === true ? { CLAUDE_CODE_DISABLE_AUTO_MEMORY: \"1\" } : {}),\n          ANTHROPIC_BASE_URL: ANTHROPIC_PROXY_BASE_URL,\n          ANTHROPIC_API_KEY: \"stack-auth-proxy\",\n        },\n        stderr: options.stderr,\n      },\n    })) {\n      options.onMessage?.(message);\n      if (message.type === \"result\") {\n        if (\"result\" in message) {\n          sawResult = true;\n          resultText = message.result;\n        } else {\n          throw new ClaudeAgentFailureError(message.subtype);\n        }\n      }\n    }\n  } catch (error) {\n    if (abortController.signal.aborted && isAbortError(error)) {\n      throw new ClaudeAgentTimeoutError(options.timeoutMs ?? undefined);\n    }\n    throw error;\n  } finally {\n    if (timeout != null) {\n      clearTimeout(timeout);\n    }\n  }\n  if (!sawResult) {\n    throw new Error(\"Claude agent ended without reporting a result.\");\n  }\n  return { resultText };\n}\n\n// Only the tools actually in the agent's allowedTools list; MultiEdit and\n// NotebookEdit are intentionally excluded from the agent's tool set.\nconst FILE_MUTATING_TOOLS = new Set([\"Write\", \"Edit\"]);\n\nfunction hasStringFilePath(input: unknown): input is { file_path: string } {\n  return typeof input === \"object\" && input !== null && \"file_path\" in input && typeof input.file_path === \"string\";\n}\n\nexport function getToolWriteTargetPath(toolName: string, toolInput: unknown, cwd: string): string | null {\n  if (!FILE_MUTATING_TOOLS.has(toolName) || !hasStringFilePath(toolInput)) {\n    return null;\n  }\n  return path.isAbsolute(toolInput.file_path) ? toolInput.file_path : path.resolve(cwd, toolInput.file_path);\n}\n\nexport function isPathInsideDir(dir: string, target: string): boolean {\n  const relative = path.relative(path.resolve(dir), path.resolve(target));\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n"],"mappings":";;;;;;;AAIA,MAAM,2BAAmC,QAAQ,IAAI,0BAD3B;AAkC1B,MAAa,0BAA0B;CAAC;CAAQ;CAAS;CAAQ;CAAQ;CAAO;AAChF,MAAa,0BAA0B,CAAC,GAAG,yBAAyB,OAAO;AAqB3E,SAAS,uBAAuB,SAIrB;CACT,MAAM,gBAAgB,QAAQ,OAAO,SAAS,aAC1C,qEAAqE,KAAK,UAAU,QAAQ,OAAO,gBAAgB,MAAM,EAAE,KAC3H,2GAA2G,QAAQ,OAAO,QAAQ,KAAK,EAAE,cAAM,YAAY,KAAK,KAAK,UAAUA,OAAK,CAAC,WAAW,KAAK,UAAU,MAAM,GAAG,CAAC,KAAK,KAAK;AAKvO,QAAO;;EAJc,QAAQ,MAAM,SAAS,eACxC,gBAAgB,KAAK,UAAU,QAAQ,MAAM,eAAe,CAAC,sCAC7D,uNAIS;;EAEb,cAAc;;;;;;;;IAQZ,QAAQ,cAAc;;;AAI1B,SAAgB,+BAA+B,SAIpC;AACT,QAAO,uBAAuB;EAC5B,OAAO,QAAQ;EACf,QAAQ;GACN,MAAM;GACN,gBAAgB,QAAQ;GACzB;EACD,eAAe,QAAQ;EACxB,CAAC;;AAGJ,SAAgB,8BAA8B,SAInC;AACT,QAAO,uBAAuB;EAC5B,OAAO;GACL,MAAM;GACN,gBAAgB,QAAQ;GACzB;EACD,QAAQ;GACN,MAAM;GACN,SAAS,QAAQ;GAClB;EACD,eAAe,QAAQ;EACxB,CAAC;;AAGJ,IAAa,0BAAb,cAA6C,MAAM;CACjD,YAAY,WAAoB;AAC9B,QAAM,yBAAyB,aAAa,OAAO,KAAK,UAAU,UAAU,IAAI,GAAG;AACnF,OAAK,OAAO;;;AAIhB,IAAa,0BAAb,cAA6C,MAAM;CACjD,YAAY,SAAiB;AAC3B,QAAM,wBAAwB,QAAQ,IAAI;AAC1C,OAAK,OAAO;;;AAIhB,SAAS,aAAa,OAAyB;AAC7C,QAAO,iBAAiB,SAAS,MAAM,SAAS;;AAGlD,SAAgB,qBAAyD;CACvE,MAAM,MAAM,EAAE,GAAG,QAAQ,KAAK;AAE9B,QAAO,IAAI;AACX,QAAO;;AAGT,eAAsB,uBAAuB,SAA+D;CAC1G,MAAM,kBAAkB,IAAI,iBAAiB;CAC7C,MAAM,UAAU,QAAQ,aAAa,OAAO,OAAO,iBAAiB,gBAAgB,OAAO,EAAE,QAAQ,UAAU;CAC/G,IAAI,YAAY;CAChB,IAAI,aAAa;CACjB,MAAM,eAAe,QAAQ;AAC7B,KAAI;AACF,aAAW,MAAM,qDAAiB;GAChC,QAAQ,QAAQ;GAChB,SAAS;IACP,OAAO;IACP,GAAI,QAAQ,oBAAoB,OAAO;KACrC,gBAAgB,EAAE;KAClB,iBAAiB;KAClB,GAAG,EAAE;IACN,GAAI,gBAAgB,OAAO,EAAE,GAAG,EAC9B,OAAO,EACL,YAAY,CAAC,EACX,OAAO,CAAC,OAAO,UAAU;AACvB,SAAI,MAAM,oBAAoB,aAC5B,QAAO,EAAE,UAAU,MAAM;AAE3B,YAAO,MAAM,aAAa,MAAM;MAChC,EACH,CAAC,EACH,EACF;IACD,cAAc,QAAQ;IACtB,gBAAgB;IAChB,KAAK,QAAQ;IACb;IACA,KAAK;KACH,GAAG,oBAAoB;KACvB,GAAI,QAAQ,oBAAoB,OAAO,EAAE,iCAAiC,KAAK,GAAG,EAAE;KACpF,oBAAoB;KACpB,mBAAmB;KACpB;IACD,QAAQ,QAAQ;IACjB;GACF,CAAC,EAAE;AACF,WAAQ,YAAY,QAAQ;AAC5B,OAAI,QAAQ,SAAS,SACnB,KAAI,YAAY,SAAS;AACvB,gBAAY;AACZ,iBAAa,QAAQ;SAErB,OAAM,IAAI,wBAAwB,QAAQ,QAAQ;;UAIjD,OAAO;AACd,MAAI,gBAAgB,OAAO,WAAW,aAAa,MAAM,CACvD,OAAM,IAAI,wBAAwB,QAAQ,aAAa,OAAU;AAEnE,QAAM;WACE;AACR,MAAI,WAAW,KACb,cAAa,QAAQ;;AAGzB,KAAI,CAAC,UACH,OAAM,IAAI,MAAM,iDAAiD;AAEnE,QAAO,EAAE,YAAY;;AAKvB,MAAM,sBAAsB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AAEtD,SAAS,kBAAkB,OAAgD;AACzE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAe,SAAS,OAAO,MAAM,cAAc;;AAG3G,SAAgB,uBAAuB,UAAkB,WAAoB,KAA4B;AACvG,KAAI,CAAC,oBAAoB,IAAI,SAAS,IAAI,CAAC,kBAAkB,UAAU,CACrE,QAAO;AAET,QAAO,aAAK,WAAW,UAAU,UAAU,GAAG,UAAU,YAAY,aAAK,QAAQ,KAAK,UAAU,UAAU;;AAG5G,SAAgB,gBAAgB,KAAa,QAAyB;CACpE,MAAM,WAAW,aAAK,SAAS,aAAK,QAAQ,IAAI,EAAE,aAAK,QAAQ,OAAO,CAAC;AACvE,QAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAK,IAAI,CAAC,aAAK,WAAW,SAAS"}

package/dist/config-file.d.ts

@@ -0,0 +1,15 @@
+import { Config } from "@hexclave/shared/dist/config/format";
+
+//#region src/config-file.d.ts
+declare function sha256String(value: string): string;
+declare function resolveConfigFilePath(inputPath: string): string;
+declare function ensureConfigFileExists(configFilePath: string): void;
+declare function readConfigObject(configFilePath: string): Promise<Config>;
+declare function readConfigFile(configFilePath: string): Promise<{
+  config: Config;
+  showOnboarding: boolean;
+}>;
+declare function replaceConfigObject(configFilePath: string, config: Config): Promise<void>;
+//#endregion
+export { ensureConfigFileExists, readConfigFile, readConfigObject, replaceConfigObject, resolveConfigFilePath, sha256String };
+//# sourceMappingURL=config-file.d.ts.map

package/dist/config-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file.d.ts","names":[],"sources":["../src/config-file.ts"],"mappings":";;;iBAUgB,YAAA,CAAa,KAAA;AAAA,iBAIb,qBAAA,CAAsB,SAAA;AAAA,iBAkBtB,sBAAA,CAAuB,cAAA;AAAA,iBAMjB,gBAAA,CAAiB,cAAA,WAAyB,OAAA,CAAQ,MAAA;AAAA,iBAIlD,cAAA,CAAe,cAAA,WAAyB,OAAA;EAAU,MAAA,EAAQ,MAAA;EAAQ,cAAA;AAAA;AAAA,iBAuClE,mBAAA,CAAoB,cAAA,UAAwB,MAAA,EAAQ,MAAA,GAAS,OAAA"}

package/dist/config-file.js

@@ -0,0 +1,90 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('./chunk-BE-pF4vm.js');
+let path = require("path");
+path = require_chunk.__toESM(path);
+let _hexclave_shared_dist_config_authoring = require("@hexclave/shared/dist/config-authoring");
+let _hexclave_shared_dist_config_eval = require("@hexclave/shared/dist/config-eval");
+let _hexclave_shared_dist_config_rendering = require("@hexclave/shared/dist/config-rendering");
+let _hexclave_shared_dist_config_format = require("@hexclave/shared/dist/config/format");
+let _hexclave_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
+let crypto = require("crypto");
+let fs = require("fs");
+
+//#region src/config-file.ts
+function sha256String(value) {
+	return (0, crypto.createHash)("sha256").update(value).digest("hex");
+}
+function resolveConfigFilePath(inputPath) {
+	const resolved = path.default.resolve(inputPath);
+	if (/\.(ts|js|mjs|cjs)$/i.test(resolved)) return resolved;
+	const hexclaveCandidate = path.default.join(resolved, "hexclave.config.ts");
+	const legacyCandidate = path.default.join(resolved, "stack.config.ts");
+	if ((0, fs.existsSync)(hexclaveCandidate)) return hexclaveCandidate;
+	if ((0, fs.existsSync)(legacyCandidate)) return legacyCandidate;
+	return hexclaveCandidate;
+}
+function ensureConfigFileExists(configFilePath) {
+	if ((0, fs.existsSync)(configFilePath)) return;
+	(0, fs.mkdirSync)(path.default.dirname(configFilePath), { recursive: true });
+	renderConfigObjectToFile(configFilePath, {});
+}
+async function readConfigObject(configFilePath) {
+	return (await readConfigFile(configFilePath)).config;
+}
+async function readConfigFile(configFilePath) {
+	ensureConfigFileExists(configFilePath);
+	const content = (0, fs.readFileSync)(configFilePath, "utf-8");
+	if (content.trim() === "") return {
+		config: {},
+		showOnboarding: false
+	};
+	let parsed;
+	try {
+		parsed = (0, _hexclave_shared_dist_config_eval.evalConfigFileContent)(content, configFilePath);
+	} catch (error) {
+		if (error instanceof _hexclave_shared_dist_config_eval.ConfigFileEvalError) throw new Error(`Invalid config in ${configFilePath}.`);
+		(0, _hexclave_shared_dist_utils_errors.captureError)("shared-backend/readConfigFile", error);
+		throw new Error(`Failed to load config file ${configFilePath}.`);
+	}
+	if (parsed === _hexclave_shared_dist_config_authoring.showOnboardingHexclaveConfigValue) return {
+		config: {},
+		showOnboarding: true
+	};
+	if (!(0, _hexclave_shared_dist_config_format.isValidConfig)(parsed)) throw new Error(`Invalid config in ${configFilePath}.`);
+	return {
+		config: parsed,
+		showOnboarding: false
+	};
+}
+async function replaceConfigObject(configFilePath, config) {
+	renderConfigObjectToFile(configFilePath, config);
+}
+function renderConfigObjectToString(configFilePath, config) {
+	return (0, _hexclave_shared_dist_config_rendering.renderConfigFileContent)(config, (0, _hexclave_shared_dist_config_eval.detectImportPackageFromDir)(path.default.dirname(configFilePath)));
+}
+function writeFileAtomic(configFilePath, content) {
+	const dir = path.default.dirname(configFilePath);
+	(0, fs.mkdirSync)(dir, { recursive: true });
+	const tempPath = path.default.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);
+	(0, fs.writeFileSync)(tempPath, content, "utf-8");
+	try {
+		(0, fs.renameSync)(tempPath, configFilePath);
+	} catch (error) {
+		try {
+			(0, fs.rmSync)(tempPath);
+		} catch {}
+		throw error;
+	}
+}
+function renderConfigObjectToFile(configFilePath, config) {
+	writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));
+}
+
+//#endregion
+exports.ensureConfigFileExists = ensureConfigFileExists;
+exports.readConfigFile = readConfigFile;
+exports.readConfigObject = readConfigObject;
+exports.replaceConfigObject = replaceConfigObject;
+exports.resolveConfigFilePath = resolveConfigFilePath;
+exports.sha256String = sha256String;
+//# sourceMappingURL=config-file.js.map

package/dist/config-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file.js","names":["ConfigFileEvalError","showOnboardingHexclaveConfigValue"],"sources":["../src/config-file.ts"],"sourcesContent":["import { showOnboardingHexclaveConfigValue } from \"@hexclave/shared/dist/config-authoring\";\nimport { ConfigFileEvalError, detectImportPackageFromDir, evalConfigFileContent } from \"@hexclave/shared/dist/config-eval\";\nimport { renderConfigFileContent } from \"@hexclave/shared/dist/config-rendering\";\nimport type { Config } from \"@hexclave/shared/dist/config/format\";\nimport { isValidConfig } from \"@hexclave/shared/dist/config/format\";\nimport { captureError } from \"@hexclave/shared/dist/utils/errors\";\nimport { createHash } from \"crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"fs\";\nimport path from \"path\";\n\nexport function sha256String(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nexport function resolveConfigFilePath(inputPath: string): string {\n  const resolved = path.resolve(inputPath);\n  const looksLikeConfigFile = /\\.(ts|js|mjs|cjs)$/i.test(resolved);\n  if (looksLikeConfigFile) {\n    return resolved;\n  }\n  // Prefer hexclave.config.ts, fall back to stack.config.ts, default to the new name.\n  const hexclaveCandidate = path.join(resolved, \"hexclave.config.ts\");\n  const legacyCandidate = path.join(resolved, \"stack.config.ts\");\n  if (existsSync(hexclaveCandidate)) {\n    return hexclaveCandidate;\n  }\n  if (existsSync(legacyCandidate)) {\n    return legacyCandidate;\n  }\n  return hexclaveCandidate;\n}\n\nexport function ensureConfigFileExists(configFilePath: string): void {\n  if (existsSync(configFilePath)) return;\n  mkdirSync(path.dirname(configFilePath), { recursive: true });\n  renderConfigObjectToFile(configFilePath, {});\n}\n\nexport async function readConfigObject(configFilePath: string): Promise<Config> {\n  return (await readConfigFile(configFilePath)).config;\n}\n\nexport async function readConfigFile(configFilePath: string): Promise<{ config: Config, showOnboarding: boolean }> {\n  ensureConfigFileExists(configFilePath);\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (content.trim() === \"\") {\n    return {\n      config: {},\n      showOnboarding: false,\n    };\n  }\n\n  // ConfigFileEvalError => \"Invalid config\"; any other loader error is captured\n  // for diagnostics but not attached as `cause` (the dashboard renders causes\n  // recursively and would leak framework internals).\n  let parsed: ReturnType<typeof evalConfigFileContent>;\n  try {\n    parsed = evalConfigFileContent(content, configFilePath);\n  } catch (error) {\n    if (error instanceof ConfigFileEvalError) {\n      throw new Error(`Invalid config in ${configFilePath}.`);\n    }\n    captureError(\"shared-backend/readConfigFile\", error);\n    throw new Error(`Failed to load config file ${configFilePath}.`);\n  }\n\n  if (parsed === showOnboardingHexclaveConfigValue) {\n    return {\n      config: {},\n      showOnboarding: true,\n    };\n  }\n  if (!isValidConfig(parsed)) {\n    throw new Error(`Invalid config in ${configFilePath}.`);\n  }\n  return {\n    config: parsed,\n    showOnboarding: false,\n  };\n}\n\nexport async function replaceConfigObject(configFilePath: string, config: Config): Promise<void> {\n  renderConfigObjectToFile(configFilePath, config);\n}\n\nfunction renderConfigObjectToString(configFilePath: string, config: Config): string {\n  const importPackage = detectImportPackageFromDir(path.dirname(configFilePath));\n  return renderConfigFileContent(config, importPackage);\n}\n\nfunction writeFileAtomic(configFilePath: string, content: string): void {\n  const dir = path.dirname(configFilePath);\n  mkdirSync(dir, { recursive: true });\n  const tempPath = path.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);\n  writeFileSync(tempPath, content, \"utf-8\");\n  try {\n    renameSync(tempPath, configFilePath);\n  } catch (error) {\n    try {\n      rmSync(tempPath);\n    } catch { /* best-effort cleanup */ }\n    throw error;\n  }\n}\n\nfunction renderConfigObjectToFile(configFilePath: string, config: Config): void {\n  writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));\n}\n"],"mappings":";;;;;;;;;;;;;AAUA,SAAgB,aAAa,OAAuB;AAClD,+BAAkB,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;AAGzD,SAAgB,sBAAsB,WAA2B;CAC/D,MAAM,WAAW,aAAK,QAAQ,UAAU;AAExC,KAD4B,sBAAsB,KAAK,SAAS,CAE9D,QAAO;CAGT,MAAM,oBAAoB,aAAK,KAAK,UAAU,qBAAqB;CACnE,MAAM,kBAAkB,aAAK,KAAK,UAAU,kBAAkB;AAC9D,wBAAe,kBAAkB,CAC/B,QAAO;AAET,wBAAe,gBAAgB,CAC7B,QAAO;AAET,QAAO;;AAGT,SAAgB,uBAAuB,gBAA8B;AACnE,wBAAe,eAAe,CAAE;AAChC,mBAAU,aAAK,QAAQ,eAAe,EAAE,EAAE,WAAW,MAAM,CAAC;AAC5D,0BAAyB,gBAAgB,EAAE,CAAC;;AAG9C,eAAsB,iBAAiB,gBAAyC;AAC9E,SAAQ,MAAM,eAAe,eAAe,EAAE;;AAGhD,eAAsB,eAAe,gBAA8E;AACjH,wBAAuB,eAAe;CACtC,MAAM,+BAAuB,gBAAgB,QAAQ;AACrD,KAAI,QAAQ,MAAM,KAAK,GACrB,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;CAMH,IAAI;AACJ,KAAI;AACF,wEAA+B,SAAS,eAAe;UAChD,OAAO;AACd,MAAI,iBAAiBA,sDACnB,OAAM,IAAI,MAAM,qBAAqB,eAAe,GAAG;AAEzD,uDAAa,iCAAiC,MAAM;AACpD,QAAM,IAAI,MAAM,8BAA8B,eAAe,GAAG;;AAGlE,KAAI,WAAWC,yEACb,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;AAEH,KAAI,wDAAe,OAAO,CACxB,OAAM,IAAI,MAAM,qBAAqB,eAAe,GAAG;AAEzD,QAAO;EACL,QAAQ;EACR,gBAAgB;EACjB;;AAGH,eAAsB,oBAAoB,gBAAwB,QAA+B;AAC/F,0BAAyB,gBAAgB,OAAO;;AAGlD,SAAS,2BAA2B,gBAAwB,QAAwB;AAElF,4EAA+B,0EADkB,aAAK,QAAQ,eAAe,CAAC,CACzB;;AAGvD,SAAS,gBAAgB,gBAAwB,SAAuB;CACtE,MAAM,MAAM,aAAK,QAAQ,eAAe;AACxC,mBAAU,KAAK,EAAE,WAAW,MAAM,CAAC;CACnC,MAAM,WAAW,aAAK,KAAK,KAAK,iBAAiB,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM;AAC3F,uBAAc,UAAU,SAAS,QAAQ;AACzC,KAAI;AACF,qBAAW,UAAU,eAAe;UAC7B,OAAO;AACd,MAAI;AACF,kBAAO,SAAS;UACV;AACR,QAAM;;;AAIV,SAAS,yBAAyB,gBAAwB,QAAsB;AAC9E,iBAAgB,gBAAgB,2BAA2B,gBAAgB,OAAO,CAAC"}

package/dist/config-updater.d.ts

@@ -0,0 +1,7 @@
+import { Config } from "@hexclave/shared/dist/config/format";
+
+//#region src/config-updater.d.ts
+declare function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void>;
+//#endregion
+export { updateConfigObject };
+//# sourceMappingURL=config-updater.d.ts.map

package/dist/config-updater.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-updater.d.ts","names":[],"sources":["../src/config-updater.ts"],"mappings":";;;iBA+DsB,kBAAA,CAAmB,cAAA,UAAwB,YAAA,EAAc,MAAA,GAAS,OAAA"}

package/dist/config-updater.js

@@ -0,0 +1,330 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('./chunk-BE-pF4vm.js');
+let __config_agent_js = require("./config-agent.js");
+let path = require("path");
+path = require_chunk.__toESM(path);
+let _hexclave_shared_dist_config_eval = require("@hexclave/shared/dist/config-eval");
+let _hexclave_shared_dist_config_format = require("@hexclave/shared/dist/config/format");
+let fs = require("fs");
+let __config_file_js = require("./config-file.js");
+
+//#region src/config-updater.ts
+const LOG_PREFIX = "[Hexclave config updater]";
+const DEFAULT_AGENT_TIMEOUT_MS = 12e4;
+const CONFIG_UPDATE_LOG_PATH_LIMIT = 40;
+const AGENT_OUTPUT_LOG_MAX_LENGTH = 2e4;
+function formatConfigUpdaterErrorForLog(error) {
+	if (error instanceof Error) return {
+		errorName: error.name,
+		errorMessage: error.message,
+		errorStack: error.stack
+	};
+	return { errorMessage: String(error) };
+}
+function configUpdatePathDetailsForLog(changes) {
+	const paths = changes.map(({ path: configPath }) => configPath).sort();
+	return {
+		configUpdatePathCount: paths.length,
+		configUpdatePaths: paths.slice(0, CONFIG_UPDATE_LOG_PATH_LIMIT),
+		configUpdatePathsTruncated: paths.length > CONFIG_UPDATE_LOG_PATH_LIMIT
+	};
+}
+function appendBoundedAgentOutput(current, chunk) {
+	const next = `${current}${chunk}`;
+	if (next.length <= AGENT_OUTPUT_LOG_MAX_LENGTH) return next;
+	return next.slice(next.length - AGENT_OUTPUT_LOG_MAX_LENGTH);
+}
+function stringifyAgentMessageForLog(message) {
+	try {
+		return `${JSON.stringify(message)}\n`;
+	} catch {
+		return `${String(message)}\n`;
+	}
+}
+function agentOutputDetailsForLog(agentStdout, agentStderr) {
+	return {
+		agentStdout,
+		agentStdoutTruncated: agentStdout.length >= AGENT_OUTPUT_LOG_MAX_LENGTH,
+		agentStderr,
+		agentStderrTruncated: agentStderr.length >= AGENT_OUTPUT_LOG_MAX_LENGTH
+	};
+}
+async function updateConfigObject(configFilePath, configUpdate) {
+	const startedAtMs = performance.now();
+	(0, __config_file_js.ensureConfigFileExists)(configFilePath);
+	const changes = flattenConfigUpdate(configUpdate);
+	if (changes.length === 0) {
+		console.log(`${LOG_PREFIX} Skipping config update because it contains no changes`, { configFilePath });
+		return;
+	}
+	const updateLogDetails = {
+		configFilePath,
+		...configUpdatePathDetailsForLog(changes)
+	};
+	console.log(`${LOG_PREFIX} Starting config file update`, updateLogDetails);
+	const content = (0, fs.readFileSync)(configFilePath, "utf-8");
+	console.log(`${LOG_PREFIX} Applying config update with agent-assisted rewrite`, {
+		...updateLogDetails,
+		configDirectory: path.default.dirname(configFilePath)
+	});
+	const baselineConfig = await tryReadConfigForValidation(configFilePath);
+	const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);
+	try {
+		await runConfigUpdateAgent({
+			prompt: buildConfigUpdatePrompt(path.default.basename(configFilePath), configUpdate, baselineConfig),
+			cwd: path.default.dirname(configFilePath),
+			onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen)
+		});
+		await validateAgentUpdate(configFilePath, baselineConfig, configUpdate);
+	} catch (error) {
+		console.warn(`${LOG_PREFIX} Config update failed; restoring files from snapshots`, {
+			...updateLogDetails,
+			snapshotCount: snapshots.length,
+			elapsedMs: Math.round(performance.now() - startedAtMs),
+			...formatConfigUpdaterErrorForLog(error)
+		});
+		try {
+			restoreConfigFiles(snapshots);
+			console.warn(`${LOG_PREFIX} Restored files after failed config update`, {
+				...updateLogDetails,
+				snapshotCount: snapshots.length
+			});
+		} catch (restoreError) {
+			console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {
+				configFilePath,
+				...formatConfigUpdaterErrorForLog(restoreError)
+			});
+		}
+		throw error;
+	}
+	console.log(`${LOG_PREFIX} Finished config update with agent-assisted rewrite`, {
+		...updateLogDetails,
+		elapsedMs: Math.round(performance.now() - startedAtMs),
+		snapshotCount: snapshots.length
+	});
+}
+async function runConfigUpdateAgent(options) {
+	const timeoutMs = parseAgentTimeoutMs();
+	const deniedOutOfBoundsWrites = /* @__PURE__ */ new Set();
+	const startedAtMs = performance.now();
+	let agentStdout = "";
+	let agentStderr = "";
+	console.log(`${LOG_PREFIX} Starting config update agent`, {
+		cwd: options.cwd,
+		timeoutMs
+	});
+	try {
+		await (0, __config_agent_js.runHeadlessClaudeAgent)({
+			prompt: options.prompt,
+			cwd: options.cwd,
+			allowedTools: [...__config_agent_js.CONFIG_AGENT_FILE_TOOLS],
+			strictIsolation: true,
+			timeoutMs,
+			stderr: (data) => {
+				agentStderr = appendBoundedAgentOutput(agentStderr, data);
+				console.warn(`${LOG_PREFIX} [agent] ${data}`);
+			},
+			onMessage: (message) => {
+				agentStdout = appendBoundedAgentOutput(agentStdout, stringifyAgentMessageForLog(message));
+			},
+			onPreToolUse: (input) => {
+				const target = (0, __config_agent_js.getToolWriteTargetPath)(input.tool_name, input.tool_input, options.cwd);
+				if (target == null) return { continue: true };
+				if (!(0, __config_agent_js.isPathInsideDir)(options.cwd, target)) {
+					deniedOutOfBoundsWrites.add(target);
+					return { hookSpecificOutput: {
+						hookEventName: "PreToolUse",
+						permissionDecision: "deny",
+						permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`
+					} };
+				}
+				options.onFileWillChange?.(target);
+				return { continue: true };
+			}
+		});
+	} catch (error) {
+		if (error instanceof __config_agent_js.ClaudeAgentTimeoutError) {
+			console.warn(`${LOG_PREFIX} Config update agent timed out`, {
+				cwd: options.cwd,
+				timeoutMs,
+				elapsedMs: Math.round(performance.now() - startedAtMs),
+				...formatConfigUpdaterErrorForLog(error),
+				...agentOutputDetailsForLog(agentStdout, agentStderr)
+			});
+			throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);
+		}
+		if (error instanceof __config_agent_js.ClaudeAgentFailureError) {
+			console.warn(`${LOG_PREFIX} Config update agent failed`, {
+				cwd: options.cwd,
+				timeoutMs,
+				elapsedMs: Math.round(performance.now() - startedAtMs),
+				...formatConfigUpdaterErrorForLog(error),
+				...agentOutputDetailsForLog(agentStdout, agentStderr)
+			});
+			throw new Error(`${error.message} It was unable to apply the config changes to the file.`);
+		}
+		console.warn(`${LOG_PREFIX} Config update agent failed unexpectedly`, {
+			cwd: options.cwd,
+			timeoutMs,
+			elapsedMs: Math.round(performance.now() - startedAtMs),
+			...formatConfigUpdaterErrorForLog(error),
+			...agentOutputDetailsForLog(agentStdout, agentStderr)
+		});
+		throw error;
+	}
+	console.log(`${LOG_PREFIX} Finished config update agent`, {
+		cwd: options.cwd,
+		timeoutMs,
+		elapsedMs: Math.round(performance.now() - startedAtMs),
+		deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size
+	});
+	if (deniedOutOfBoundsWrites.size > 0) {
+		console.warn(`${LOG_PREFIX} Config update agent attempted out-of-bounds writes`, {
+			cwd: options.cwd,
+			deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,
+			deniedOutOfBoundsWrites: [...deniedOutOfBoundsWrites]
+		});
+		throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(", ")}. The config was not updated.`);
+	}
+}
+function parseAgentTimeoutMs() {
+	const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;
+	if (raw == null || raw.trim() === "") return DEFAULT_AGENT_TIMEOUT_MS;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed <= 0) throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);
+	return parsed;
+}
+function captureSnapshotIfAbsent(snapshots, filePath, seen) {
+	const resolved = path.default.resolve(filePath);
+	if (seen.has(resolved)) return;
+	seen.add(resolved);
+	snapshots.push({
+		path: resolved,
+		content: (0, fs.existsSync)(resolved) ? (0, fs.readFileSync)(resolved, "utf-8") : null
+	});
+}
+function snapshotConfigFiles(configFilePath, configContent) {
+	const dir = path.default.dirname(configFilePath);
+	const resolvedConfig = path.default.resolve(configFilePath);
+	const snapshots = [{
+		path: resolvedConfig,
+		content: configContent
+	}];
+	const seen = new Set([resolvedConfig]);
+	for (const specifier of getRelativeImportSpecifiers(configContent)) {
+		const resolved = path.default.resolve(dir, specifier);
+		if (!(0, __config_agent_js.isPathInsideDir)(dir, resolved)) continue;
+		captureSnapshotIfAbsent(snapshots, resolved, seen);
+	}
+	return {
+		snapshots,
+		seen
+	};
+}
+function restoreConfigFiles(snapshots) {
+	const failures = [];
+	for (const { path: filePath, content } of snapshots) try {
+		if (content === null) {
+			if ((0, fs.existsSync)(filePath)) (0, fs.rmSync)(filePath);
+		} else (0, fs.writeFileSync)(filePath, content, "utf-8");
+	} catch (error) {
+		failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (failures.length > 0) throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join("; ")}`);
+}
+async function tryReadConfigForValidation(configFilePath) {
+	try {
+		return (await (0, __config_file_js.readConfigFile)(configFilePath)).config;
+	} catch (error) {
+		console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {
+			configFilePath,
+			error: error instanceof Error ? error.message : String(error)
+		});
+		return null;
+	}
+}
+async function validateAgentUpdate(configFilePath, baselineConfig, configUpdate) {
+	if (baselineConfig != null) {
+		const target = canonicalizeConfig((0, _hexclave_shared_dist_config_format.override)(baselineConfig, configUpdate));
+		if (!configsEqual(canonicalizeConfig((await (0, __config_file_js.readConfigFile)(configFilePath)).config), target)) throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);
+		return;
+	}
+	if (!configFileExportsConfig((0, fs.readFileSync)(configFilePath, "utf-8"), configFilePath)) throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \`config\`.`);
+}
+function configFileExportsConfig(content, configFilePath) {
+	try {
+		(0, _hexclave_shared_dist_config_eval.evalConfigFileContent)(content, configFilePath);
+		return true;
+	} catch {
+		return /\bexport\s+const\s+config\b/.test(content);
+	}
+}
+function getRelativeImportSpecifiers(content) {
+	const specifiers = [];
+	const importPattern = /\bimport\b(?:[^'"]*?\bfrom\s*)?["'](\.{1,2}\/[^"']+)["']/g;
+	let match;
+	while ((match = importPattern.exec(content)) !== null) specifiers.push(match[1]);
+	return specifiers;
+}
+function flattenConfigUpdate(update) {
+	const changes = [];
+	const walk = (prefix, obj) => {
+		for (const [key, value] of Object.entries(obj)) {
+			const fullPath = prefix === "" ? key : `${prefix}.${key}`;
+			if (value === void 0) continue;
+			if (value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length > 0) walk(fullPath, value);
+			else changes.push({
+				path: fullPath,
+				value
+			});
+		}
+	};
+	walk("", update);
+	return changes;
+}
+function buildConfigUpdatePrompt(configFileName, configUpdate, baselineConfig) {
+	const changes = flattenConfigUpdate(configUpdate);
+	const commandPolicy = "Do not run shell commands and do not create files other than what is required to apply the config changes.";
+	if (baselineConfig != null) return (0, __config_agent_js.buildCompleteConfigAgentPrompt)({
+		scope: {
+			mode: "known-file",
+			configFileName
+		},
+		completeConfig: canonicalizeConfig((0, _hexclave_shared_dist_config_format.override)(baselineConfig, configUpdate)),
+		commandPolicy
+	});
+	return (0, __config_agent_js.buildPartialConfigAgentPrompt)({
+		configFileName,
+		changes,
+		commandPolicy
+	});
+}
+function canonicalizeConfig(config) {
+	const droppedKeys = [];
+	const normalized = (0, _hexclave_shared_dist_config_format.normalize)(config, {
+		onDotIntoNonObject: "ignore",
+		onDotIntoNull: "empty-object",
+		droppedKeys
+	});
+	if (droppedKeys.length > 0) throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")}`);
+	return normalized;
+}
+function configsEqual(a, b) {
+	if (a === b) return true;
+	if (a === null || b === null) return a === b;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((value, index) => configsEqual(value, b[index]));
+	}
+	if (typeof a === "object" && typeof b === "object") {
+		const aEntries = Object.entries(a);
+		const bMap = new Map(Object.entries(b));
+		if (aEntries.length !== bMap.size) return false;
+		return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));
+	}
+	return false;
+}
+
+//#endregion
+exports.updateConfigObject = updateConfigObject;
+//# sourceMappingURL=config-updater.js.map