@hexclave/shared-backend 1.0.36 → 1.0.37

package/dist/esm/config-updater.js

@@ -0,0 +1,327 @@
+import { CONFIG_AGENT_FILE_TOOLS, ClaudeAgentFailureError, ClaudeAgentTimeoutError, buildCompleteConfigAgentPrompt, buildPartialConfigAgentPrompt, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent } from "./config-agent.js";
+import path from "path";
+import { evalConfigFileContent } from "@hexclave/shared/dist/config-eval";
+import { normalize, override } from "@hexclave/shared/dist/config/format";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { ensureConfigFileExists, readConfigFile } from "./config-file.js";
+
+//#region src/config-updater.ts
+const LOG_PREFIX = "[Hexclave config updater]";
+const DEFAULT_AGENT_TIMEOUT_MS = 12e4;
+const CONFIG_UPDATE_LOG_PATH_LIMIT = 40;
+const AGENT_OUTPUT_LOG_MAX_LENGTH = 2e4;
+function formatConfigUpdaterErrorForLog(error) {
+	if (error instanceof Error) return {
+		errorName: error.name,
+		errorMessage: error.message,
+		errorStack: error.stack
+	};
+	return { errorMessage: String(error) };
+}
+function configUpdatePathDetailsForLog(changes) {
+	const paths = changes.map(({ path: configPath }) => configPath).sort();
+	return {
+		configUpdatePathCount: paths.length,
+		configUpdatePaths: paths.slice(0, CONFIG_UPDATE_LOG_PATH_LIMIT),
+		configUpdatePathsTruncated: paths.length > CONFIG_UPDATE_LOG_PATH_LIMIT
+	};
+}
+function appendBoundedAgentOutput(current, chunk) {
+	const next = `${current}${chunk}`;
+	if (next.length <= AGENT_OUTPUT_LOG_MAX_LENGTH) return next;
+	return next.slice(next.length - AGENT_OUTPUT_LOG_MAX_LENGTH);
+}
+function stringifyAgentMessageForLog(message) {
+	try {
+		return `${JSON.stringify(message)}\n`;
+	} catch {
+		return `${String(message)}\n`;
+	}
+}
+function agentOutputDetailsForLog(agentStdout, agentStderr) {
+	return {
+		agentStdout,
+		agentStdoutTruncated: agentStdout.length >= AGENT_OUTPUT_LOG_MAX_LENGTH,
+		agentStderr,
+		agentStderrTruncated: agentStderr.length >= AGENT_OUTPUT_LOG_MAX_LENGTH
+	};
+}
+async function updateConfigObject(configFilePath, configUpdate) {
+	const startedAtMs = performance.now();
+	ensureConfigFileExists(configFilePath);
+	const changes = flattenConfigUpdate(configUpdate);
+	if (changes.length === 0) {
+		console.log(`${LOG_PREFIX} Skipping config update because it contains no changes`, { configFilePath });
+		return;
+	}
+	const updateLogDetails = {
+		configFilePath,
+		...configUpdatePathDetailsForLog(changes)
+	};
+	console.log(`${LOG_PREFIX} Starting config file update`, updateLogDetails);
+	const content = readFileSync(configFilePath, "utf-8");
+	console.log(`${LOG_PREFIX} Applying config update with agent-assisted rewrite`, {
+		...updateLogDetails,
+		configDirectory: path.dirname(configFilePath)
+	});
+	const baselineConfig = await tryReadConfigForValidation(configFilePath);
+	const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);
+	try {
+		await runConfigUpdateAgent({
+			prompt: buildConfigUpdatePrompt(path.basename(configFilePath), configUpdate, baselineConfig),
+			cwd: path.dirname(configFilePath),
+			onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen)
+		});
+		await validateAgentUpdate(configFilePath, baselineConfig, configUpdate);
+	} catch (error) {
+		console.warn(`${LOG_PREFIX} Config update failed; restoring files from snapshots`, {
+			...updateLogDetails,
+			snapshotCount: snapshots.length,
+			elapsedMs: Math.round(performance.now() - startedAtMs),
+			...formatConfigUpdaterErrorForLog(error)
+		});
+		try {
+			restoreConfigFiles(snapshots);
+			console.warn(`${LOG_PREFIX} Restored files after failed config update`, {
+				...updateLogDetails,
+				snapshotCount: snapshots.length
+			});
+		} catch (restoreError) {
+			console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {
+				configFilePath,
+				...formatConfigUpdaterErrorForLog(restoreError)
+			});
+		}
+		throw error;
+	}
+	console.log(`${LOG_PREFIX} Finished config update with agent-assisted rewrite`, {
+		...updateLogDetails,
+		elapsedMs: Math.round(performance.now() - startedAtMs),
+		snapshotCount: snapshots.length
+	});
+}
+async function runConfigUpdateAgent(options) {
+	const timeoutMs = parseAgentTimeoutMs();
+	const deniedOutOfBoundsWrites = /* @__PURE__ */ new Set();
+	const startedAtMs = performance.now();
+	let agentStdout = "";
+	let agentStderr = "";
+	console.log(`${LOG_PREFIX} Starting config update agent`, {
+		cwd: options.cwd,
+		timeoutMs
+	});
+	try {
+		await runHeadlessClaudeAgent({
+			prompt: options.prompt,
+			cwd: options.cwd,
+			allowedTools: [...CONFIG_AGENT_FILE_TOOLS],
+			strictIsolation: true,
+			timeoutMs,
+			stderr: (data) => {
+				agentStderr = appendBoundedAgentOutput(agentStderr, data);
+				console.warn(`${LOG_PREFIX} [agent] ${data}`);
+			},
+			onMessage: (message) => {
+				agentStdout = appendBoundedAgentOutput(agentStdout, stringifyAgentMessageForLog(message));
+			},
+			onPreToolUse: (input) => {
+				const target = getToolWriteTargetPath(input.tool_name, input.tool_input, options.cwd);
+				if (target == null) return { continue: true };
+				if (!isPathInsideDir(options.cwd, target)) {
+					deniedOutOfBoundsWrites.add(target);
+					return { hookSpecificOutput: {
+						hookEventName: "PreToolUse",
+						permissionDecision: "deny",
+						permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`
+					} };
+				}
+				options.onFileWillChange?.(target);
+				return { continue: true };
+			}
+		});
+	} catch (error) {
+		if (error instanceof ClaudeAgentTimeoutError) {
+			console.warn(`${LOG_PREFIX} Config update agent timed out`, {
+				cwd: options.cwd,
+				timeoutMs,
+				elapsedMs: Math.round(performance.now() - startedAtMs),
+				...formatConfigUpdaterErrorForLog(error),
+				...agentOutputDetailsForLog(agentStdout, agentStderr)
+			});
+			throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);
+		}
+		if (error instanceof ClaudeAgentFailureError) {
+			console.warn(`${LOG_PREFIX} Config update agent failed`, {
+				cwd: options.cwd,
+				timeoutMs,
+				elapsedMs: Math.round(performance.now() - startedAtMs),
+				...formatConfigUpdaterErrorForLog(error),
+				...agentOutputDetailsForLog(agentStdout, agentStderr)
+			});
+			throw new Error(`${error.message} It was unable to apply the config changes to the file.`);
+		}
+		console.warn(`${LOG_PREFIX} Config update agent failed unexpectedly`, {
+			cwd: options.cwd,
+			timeoutMs,
+			elapsedMs: Math.round(performance.now() - startedAtMs),
+			...formatConfigUpdaterErrorForLog(error),
+			...agentOutputDetailsForLog(agentStdout, agentStderr)
+		});
+		throw error;
+	}
+	console.log(`${LOG_PREFIX} Finished config update agent`, {
+		cwd: options.cwd,
+		timeoutMs,
+		elapsedMs: Math.round(performance.now() - startedAtMs),
+		deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size
+	});
+	if (deniedOutOfBoundsWrites.size > 0) {
+		console.warn(`${LOG_PREFIX} Config update agent attempted out-of-bounds writes`, {
+			cwd: options.cwd,
+			deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,
+			deniedOutOfBoundsWrites: [...deniedOutOfBoundsWrites]
+		});
+		throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(", ")}. The config was not updated.`);
+	}
+}
+function parseAgentTimeoutMs() {
+	const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;
+	if (raw == null || raw.trim() === "") return DEFAULT_AGENT_TIMEOUT_MS;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed <= 0) throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);
+	return parsed;
+}
+function captureSnapshotIfAbsent(snapshots, filePath, seen) {
+	const resolved = path.resolve(filePath);
+	if (seen.has(resolved)) return;
+	seen.add(resolved);
+	snapshots.push({
+		path: resolved,
+		content: existsSync(resolved) ? readFileSync(resolved, "utf-8") : null
+	});
+}
+function snapshotConfigFiles(configFilePath, configContent) {
+	const dir = path.dirname(configFilePath);
+	const resolvedConfig = path.resolve(configFilePath);
+	const snapshots = [{
+		path: resolvedConfig,
+		content: configContent
+	}];
+	const seen = new Set([resolvedConfig]);
+	for (const specifier of getRelativeImportSpecifiers(configContent)) {
+		const resolved = path.resolve(dir, specifier);
+		if (!isPathInsideDir(dir, resolved)) continue;
+		captureSnapshotIfAbsent(snapshots, resolved, seen);
+	}
+	return {
+		snapshots,
+		seen
+	};
+}
+function restoreConfigFiles(snapshots) {
+	const failures = [];
+	for (const { path: filePath, content } of snapshots) try {
+		if (content === null) {
+			if (existsSync(filePath)) rmSync(filePath);
+		} else writeFileSync(filePath, content, "utf-8");
+	} catch (error) {
+		failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (failures.length > 0) throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join("; ")}`);
+}
+async function tryReadConfigForValidation(configFilePath) {
+	try {
+		return (await readConfigFile(configFilePath)).config;
+	} catch (error) {
+		console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {
+			configFilePath,
+			error: error instanceof Error ? error.message : String(error)
+		});
+		return null;
+	}
+}
+async function validateAgentUpdate(configFilePath, baselineConfig, configUpdate) {
+	if (baselineConfig != null) {
+		const target = canonicalizeConfig(override(baselineConfig, configUpdate));
+		if (!configsEqual(canonicalizeConfig((await readConfigFile(configFilePath)).config), target)) throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);
+		return;
+	}
+	if (!configFileExportsConfig(readFileSync(configFilePath, "utf-8"), configFilePath)) throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \`config\`.`);
+}
+function configFileExportsConfig(content, configFilePath) {
+	try {
+		evalConfigFileContent(content, configFilePath);
+		return true;
+	} catch {
+		return /\bexport\s+const\s+config\b/.test(content);
+	}
+}
+function getRelativeImportSpecifiers(content) {
+	const specifiers = [];
+	const importPattern = /\bimport\b(?:[^'"]*?\bfrom\s*)?["'](\.{1,2}\/[^"']+)["']/g;
+	let match;
+	while ((match = importPattern.exec(content)) !== null) specifiers.push(match[1]);
+	return specifiers;
+}
+function flattenConfigUpdate(update) {
+	const changes = [];
+	const walk = (prefix, obj) => {
+		for (const [key, value] of Object.entries(obj)) {
+			const fullPath = prefix === "" ? key : `${prefix}.${key}`;
+			if (value === void 0) continue;
+			if (value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length > 0) walk(fullPath, value);
+			else changes.push({
+				path: fullPath,
+				value
+			});
+		}
+	};
+	walk("", update);
+	return changes;
+}
+function buildConfigUpdatePrompt(configFileName, configUpdate, baselineConfig) {
+	const changes = flattenConfigUpdate(configUpdate);
+	const commandPolicy = "Do not run shell commands and do not create files other than what is required to apply the config changes.";
+	if (baselineConfig != null) return buildCompleteConfigAgentPrompt({
+		scope: {
+			mode: "known-file",
+			configFileName
+		},
+		completeConfig: canonicalizeConfig(override(baselineConfig, configUpdate)),
+		commandPolicy
+	});
+	return buildPartialConfigAgentPrompt({
+		configFileName,
+		changes,
+		commandPolicy
+	});
+}
+function canonicalizeConfig(config) {
+	const droppedKeys = [];
+	const normalized = normalize(config, {
+		onDotIntoNonObject: "ignore",
+		onDotIntoNull: "empty-object",
+		droppedKeys
+	});
+	if (droppedKeys.length > 0) throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")}`);
+	return normalized;
+}
+function configsEqual(a, b) {
+	if (a === b) return true;
+	if (a === null || b === null) return a === b;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((value, index) => configsEqual(value, b[index]));
+	}
+	if (typeof a === "object" && typeof b === "object") {
+		const aEntries = Object.entries(a);
+		const bMap = new Map(Object.entries(b));
+		if (aEntries.length !== bMap.size) return false;
+		return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));
+	}
+	return false;
+}
+
+//#endregion
+export { updateConfigObject };
+//# sourceMappingURL=config-updater.js.map

package/dist/esm/config-updater.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-updater.js","names":[],"sources":["../../src/config-updater.ts"],"sourcesContent":["import { evalConfigFileContent } from \"@hexclave/shared/dist/config-eval\";\nimport type { Config, ConfigValue, NormalizedConfig } from \"@hexclave/shared/dist/config/format\";\nimport { normalize, override } from \"@hexclave/shared/dist/config/format\";\nimport { existsSync, readFileSync, rmSync, writeFileSync } from \"fs\";\nimport path from \"path\";\nimport { buildCompleteConfigAgentPrompt, buildPartialConfigAgentPrompt, ClaudeAgentFailureError, ClaudeAgentTimeoutError, CONFIG_AGENT_FILE_TOOLS, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent } from \"./config-agent\";\nimport { ensureConfigFileExists, readConfigFile } from \"./config-file\";\n\nconst LOG_PREFIX = \"[Hexclave config updater]\";\nconst DEFAULT_AGENT_TIMEOUT_MS = 120_000;\nconst CONFIG_UPDATE_LOG_PATH_LIMIT = 40;\nconst AGENT_OUTPUT_LOG_MAX_LENGTH = 20_000;\n\ntype ConfigFileSnapshot = { path: string, content: string | null };\ntype ConfigChange = { path: string, value: ConfigValue };\n\nfunction formatConfigUpdaterErrorForLog(error: unknown): Record<string, unknown> {\n  if (error instanceof Error) {\n    return {\n      errorName: error.name,\n      errorMessage: error.message,\n      errorStack: error.stack,\n    };\n  }\n  return {\n    errorMessage: String(error),\n  };\n}\n\nfunction configUpdatePathDetailsForLog(changes: ConfigChange[]): Record<string, unknown> {\n  const paths = changes.map(({ path: configPath }) => configPath).sort();\n  return {\n    configUpdatePathCount: paths.length,\n    configUpdatePaths: paths.slice(0, CONFIG_UPDATE_LOG_PATH_LIMIT),\n    configUpdatePathsTruncated: paths.length > CONFIG_UPDATE_LOG_PATH_LIMIT,\n  };\n}\n\nfunction appendBoundedAgentOutput(current: string, chunk: string): string {\n  const next = `${current}${chunk}`;\n  if (next.length <= AGENT_OUTPUT_LOG_MAX_LENGTH) {\n    return next;\n  }\n  return next.slice(next.length - AGENT_OUTPUT_LOG_MAX_LENGTH);\n}\n\nfunction stringifyAgentMessageForLog(message: unknown): string {\n  try {\n    return `${JSON.stringify(message)}\\n`;\n  } catch {\n    return `${String(message)}\\n`;\n  }\n}\n\nfunction agentOutputDetailsForLog(agentStdout: string, agentStderr: string): Record<string, unknown> {\n  return {\n    agentStdout,\n    agentStdoutTruncated: agentStdout.length >= AGENT_OUTPUT_LOG_MAX_LENGTH,\n    agentStderr,\n    agentStderrTruncated: agentStderr.length >= AGENT_OUTPUT_LOG_MAX_LENGTH,\n  };\n}\n\nexport async function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void> {\n  const startedAtMs = performance.now();\n  ensureConfigFileExists(configFilePath);\n\n  const changes = flattenConfigUpdate(configUpdate);\n  if (changes.length === 0) {\n    console.log(`${LOG_PREFIX} Skipping config update because it contains no changes`, {\n      configFilePath,\n    });\n    return;\n  }\n  const updateLogDetails = {\n    configFilePath,\n    ...configUpdatePathDetailsForLog(changes),\n  };\n  console.log(`${LOG_PREFIX} Starting config file update`, updateLogDetails);\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n\n  // One write path, always: hand the change to the AI agent so it edits the file\n  // in place and preserves its authoring (helper wrappers, imports, comments,\n  // layout). There is deliberately no deterministic \"fast path\" — re-rendering a\n  // config would flatten and destroy hand-authored files. Reads use jiti\n  // (see readConfigFile); writes go through the agent.\n  console.log(`${LOG_PREFIX} Applying config update with agent-assisted rewrite`, {\n    ...updateLogDetails,\n    configDirectory: path.dirname(configFilePath),\n  });\n  const baselineConfig = await tryReadConfigForValidation(configFilePath);\n  const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);\n  try {\n    await runConfigUpdateAgent({\n      prompt: buildConfigUpdatePrompt(path.basename(configFilePath), configUpdate, baselineConfig),\n      cwd: path.dirname(configFilePath),\n      onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen),\n    });\n    await validateAgentUpdate(configFilePath, baselineConfig, configUpdate);\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Config update failed; restoring files from snapshots`, {\n      ...updateLogDetails,\n      snapshotCount: snapshots.length,\n      elapsedMs: Math.round(performance.now() - startedAtMs),\n      ...formatConfigUpdaterErrorForLog(error),\n    });\n    try {\n      restoreConfigFiles(snapshots);\n      console.warn(`${LOG_PREFIX} Restored files after failed config update`, {\n        ...updateLogDetails,\n        snapshotCount: snapshots.length,\n      });\n    } catch (restoreError) {\n      console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {\n        configFilePath,\n        ...formatConfigUpdaterErrorForLog(restoreError),\n      });\n    }\n    throw error;\n  }\n  console.log(`${LOG_PREFIX} Finished config update with agent-assisted rewrite`, {\n    ...updateLogDetails,\n    elapsedMs: Math.round(performance.now() - startedAtMs),\n    snapshotCount: snapshots.length,\n  });\n}\n\nasync function runConfigUpdateAgent(options: {\n  prompt: string,\n  cwd: string,\n  onFileWillChange?: (filePath: string) => void,\n}): Promise<void> {\n  const timeoutMs = parseAgentTimeoutMs();\n  const deniedOutOfBoundsWrites = new Set<string>();\n  const startedAtMs = performance.now();\n  let agentStdout = \"\";\n  let agentStderr = \"\";\n  console.log(`${LOG_PREFIX} Starting config update agent`, {\n    cwd: options.cwd,\n    timeoutMs,\n  });\n  try {\n    await runHeadlessClaudeAgent({\n      prompt: options.prompt,\n      cwd: options.cwd,\n      allowedTools: [...CONFIG_AGENT_FILE_TOOLS],\n      strictIsolation: true,\n      timeoutMs,\n      stderr: (data) => {\n        agentStderr = appendBoundedAgentOutput(agentStderr, data);\n        console.warn(`${LOG_PREFIX} [agent] ${data}`);\n      },\n      onMessage: (message) => {\n        agentStdout = appendBoundedAgentOutput(agentStdout, stringifyAgentMessageForLog(message));\n      },\n      onPreToolUse: (input) => {\n        const target = getToolWriteTargetPath(input.tool_name, input.tool_input, options.cwd);\n        if (target == null) return { continue: true };\n        if (!isPathInsideDir(options.cwd, target)) {\n          deniedOutOfBoundsWrites.add(target);\n          return {\n            hookSpecificOutput: {\n              hookEventName: \"PreToolUse\",\n              permissionDecision: \"deny\",\n              permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`,\n            },\n          };\n        }\n        options.onFileWillChange?.(target);\n        return { continue: true };\n      },\n    });\n  } catch (error) {\n    if (error instanceof ClaudeAgentTimeoutError) {\n      console.warn(`${LOG_PREFIX} Config update agent timed out`, {\n        cwd: options.cwd,\n        timeoutMs,\n        elapsedMs: Math.round(performance.now() - startedAtMs),\n        ...formatConfigUpdaterErrorForLog(error),\n        ...agentOutputDetailsForLog(agentStdout, agentStderr),\n      });\n      throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);\n    }\n    if (error instanceof ClaudeAgentFailureError) {\n      console.warn(`${LOG_PREFIX} Config update agent failed`, {\n        cwd: options.cwd,\n        timeoutMs,\n        elapsedMs: Math.round(performance.now() - startedAtMs),\n        ...formatConfigUpdaterErrorForLog(error),\n        ...agentOutputDetailsForLog(agentStdout, agentStderr),\n      });\n      throw new Error(`${error.message} It was unable to apply the config changes to the file.`);\n    }\n    console.warn(`${LOG_PREFIX} Config update agent failed unexpectedly`, {\n      cwd: options.cwd,\n      timeoutMs,\n      elapsedMs: Math.round(performance.now() - startedAtMs),\n      ...formatConfigUpdaterErrorForLog(error),\n      ...agentOutputDetailsForLog(agentStdout, agentStderr),\n    });\n    throw error;\n  }\n  console.log(`${LOG_PREFIX} Finished config update agent`, {\n    cwd: options.cwd,\n    timeoutMs,\n    elapsedMs: Math.round(performance.now() - startedAtMs),\n    deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,\n  });\n  if (deniedOutOfBoundsWrites.size > 0) {\n    console.warn(`${LOG_PREFIX} Config update agent attempted out-of-bounds writes`, {\n      cwd: options.cwd,\n      deniedOutOfBoundsWriteCount: deniedOutOfBoundsWrites.size,\n      deniedOutOfBoundsWrites: [...deniedOutOfBoundsWrites],\n    });\n    throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(\", \")}. The config was not updated.`);\n  }\n}\n\nfunction parseAgentTimeoutMs(): number {\n  const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;\n  if (raw == null || raw.trim() === \"\") return DEFAULT_AGENT_TIMEOUT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);\n  }\n  return parsed;\n}\n\nfunction captureSnapshotIfAbsent(snapshots: ConfigFileSnapshot[], filePath: string, seen: Set<string>): void {\n  const resolved = path.resolve(filePath);\n  if (seen.has(resolved)) return;\n  seen.add(resolved);\n  snapshots.push({ path: resolved, content: existsSync(resolved) ? readFileSync(resolved, \"utf-8\") : null });\n}\n\nfunction snapshotConfigFiles(configFilePath: string, configContent: string): { snapshots: ConfigFileSnapshot[]; seen: Set<string> } {\n  const dir = path.dirname(configFilePath);\n  const resolvedConfig = path.resolve(configFilePath);\n  const snapshots: ConfigFileSnapshot[] = [{ path: resolvedConfig, content: configContent }];\n  const seen = new Set<string>([resolvedConfig]);\n  for (const specifier of getRelativeImportSpecifiers(configContent)) {\n    const resolved = path.resolve(dir, specifier);\n    if (!isPathInsideDir(dir, resolved)) continue;\n    captureSnapshotIfAbsent(snapshots, resolved, seen);\n  }\n  return { snapshots, seen };\n}\n\nfunction restoreConfigFiles(snapshots: ConfigFileSnapshot[]): void {\n  const failures: string[] = [];\n  for (const { path: filePath, content } of snapshots) {\n    try {\n      if (content === null) {\n        if (existsSync(filePath)) rmSync(filePath);\n      } else {\n        writeFileSync(filePath, content, \"utf-8\");\n      }\n    } catch (error) {\n      failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n  if (failures.length > 0) {\n    throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join(\"; \")}`);\n  }\n}\n\nasync function tryReadConfigForValidation(configFilePath: string): Promise<Config | null> {\n  try {\n    return (await readConfigFile(configFilePath)).config;\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {\n      configFilePath,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return null;\n  }\n}\n\nasync function validateAgentUpdate(configFilePath: string, baselineConfig: Config | null, configUpdate: Config): Promise<void> {\n  if (baselineConfig != null) {\n    const target = canonicalizeConfig(override(baselineConfig, configUpdate));\n    const result = canonicalizeConfig((await readConfigFile(configFilePath)).config);\n    if (!configsEqual(result, target)) {\n      throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);\n    }\n    return;\n  }\n\n  // Structural-only fallback when jiti can't evaluate the config (e.g. import-with\n  // assets): we can't verify values, only that the file still exports `config`.\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (!configFileExportsConfig(content, configFilePath)) {\n    throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \\`config\\`.`);\n  }\n}\n\nfunction configFileExportsConfig(content: string, configFilePath: string): boolean {\n  try {\n    evalConfigFileContent(content, configFilePath);\n    return true;\n  } catch {\n    // jiti may fail to resolve imports valid in the user's project but absent\n    // here (relative assets, workspace packages). For the structural check we\n    // only need a runtime `config` binding to still exist; the agent always\n    // authors `export const config`.\n    return /\\bexport\\s+const\\s+config\\b/.test(content);\n  }\n}\n\nfunction getRelativeImportSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n  const importPattern = /\\bimport\\b(?:[^'\"]*?\\bfrom\\s*)?[\"'](\\.{1,2}\\/[^\"']+)[\"']/g;\n  let match: RegExpExecArray | null;\n  while ((match = importPattern.exec(content)) !== null) {\n    specifiers.push(match[1]);\n  }\n  return specifiers;\n}\n\nfunction flattenConfigUpdate(update: Config): ConfigChange[] {\n  const changes: ConfigChange[] = [];\n  const walk = (prefix: string, obj: Config): void => {\n    for (const [key, value] of Object.entries(obj)) {\n      const fullPath = prefix === \"\" ? key : `${prefix}.${key}`;\n      if (value === undefined) continue;\n      if (value !== null && typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length > 0) {\n        walk(fullPath, value);\n      } else {\n        changes.push({ path: fullPath, value });\n      }\n    }\n  };\n  walk(\"\", update);\n  return changes;\n}\n\nfunction buildConfigUpdatePrompt(configFileName: string, configUpdate: Config, baselineConfig: Config | null): string {\n  const changes = flattenConfigUpdate(configUpdate);\n  const commandPolicy = \"Do not run shell commands and do not create files other than what is required to apply the config changes.\";\n  if (baselineConfig != null) {\n    return buildCompleteConfigAgentPrompt({\n      scope: { mode: \"known-file\", configFileName },\n      completeConfig: canonicalizeConfig(override(baselineConfig, configUpdate)),\n      commandPolicy,\n    });\n  }\n  return buildPartialConfigAgentPrompt({\n    configFileName,\n    changes,\n    commandPolicy,\n  });\n}\n\nfunction canonicalizeConfig(config: Config): NormalizedConfig {\n  const droppedKeys: string[] = [];\n  const normalized = normalize(config, {\n    onDotIntoNonObject: \"ignore\",\n    onDotIntoNull: \"empty-object\",\n    droppedKeys,\n  });\n  if (droppedKeys.length > 0) {\n    throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(\", \")}`);\n  }\n  return normalized;\n}\n\nfunction configsEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true;\n  if (a === null || b === null) return a === b;\n  if (Array.isArray(a) || Array.isArray(b)) {\n    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;\n    return a.every((value, index) => configsEqual(value, b[index]));\n  }\n  if (typeof a === \"object\" && typeof b === \"object\") {\n    const aEntries = Object.entries(a);\n    const bMap = new Map(Object.entries(b));\n    if (aEntries.length !== bMap.size) return false;\n    return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;AAQA,MAAM,aAAa;AACnB,MAAM,2BAA2B;AACjC,MAAM,+BAA+B;AACrC,MAAM,8BAA8B;AAKpC,SAAS,+BAA+B,OAAyC;AAC/E,KAAI,iBAAiB,MACnB,QAAO;EACL,WAAW,MAAM;EACjB,cAAc,MAAM;EACpB,YAAY,MAAM;EACnB;AAEH,QAAO,EACL,cAAc,OAAO,MAAM,EAC5B;;AAGH,SAAS,8BAA8B,SAAkD;CACvF,MAAM,QAAQ,QAAQ,KAAK,EAAE,MAAM,iBAAiB,WAAW,CAAC,MAAM;AACtE,QAAO;EACL,uBAAuB,MAAM;EAC7B,mBAAmB,MAAM,MAAM,GAAG,6BAA6B;EAC/D,4BAA4B,MAAM,SAAS;EAC5C;;AAGH,SAAS,yBAAyB,SAAiB,OAAuB;CACxE,MAAM,OAAO,GAAG,UAAU;AAC1B,KAAI,KAAK,UAAU,4BACjB,QAAO;AAET,QAAO,KAAK,MAAM,KAAK,SAAS,4BAA4B;;AAG9D,SAAS,4BAA4B,SAA0B;AAC7D,KAAI;AACF,SAAO,GAAG,KAAK,UAAU,QAAQ,CAAC;SAC5B;AACN,SAAO,GAAG,OAAO,QAAQ,CAAC;;;AAI9B,SAAS,yBAAyB,aAAqB,aAA8C;AACnG,QAAO;EACL;EACA,sBAAsB,YAAY,UAAU;EAC5C;EACA,sBAAsB,YAAY,UAAU;EAC7C;;AAGH,eAAsB,mBAAmB,gBAAwB,cAAqC;CACpG,MAAM,cAAc,YAAY,KAAK;AACrC,wBAAuB,eAAe;CAEtC,MAAM,UAAU,oBAAoB,aAAa;AACjD,KAAI,QAAQ,WAAW,GAAG;AACxB,UAAQ,IAAI,GAAG,WAAW,yDAAyD,EACjF,gBACD,CAAC;AACF;;CAEF,MAAM,mBAAmB;EACvB;EACA,GAAG,8BAA8B,QAAQ;EAC1C;AACD,SAAQ,IAAI,GAAG,WAAW,+BAA+B,iBAAiB;CAE1E,MAAM,UAAU,aAAa,gBAAgB,QAAQ;AAOrD,SAAQ,IAAI,GAAG,WAAW,sDAAsD;EAC9E,GAAG;EACH,iBAAiB,KAAK,QAAQ,eAAe;EAC9C,CAAC;CACF,MAAM,iBAAiB,MAAM,2BAA2B,eAAe;CACvE,MAAM,EAAE,WAAW,SAAS,oBAAoB,gBAAgB,QAAQ;AACxE,KAAI;AACF,QAAM,qBAAqB;GACzB,QAAQ,wBAAwB,KAAK,SAAS,eAAe,EAAE,cAAc,eAAe;GAC5F,KAAK,KAAK,QAAQ,eAAe;GACjC,mBAAmB,aAAa,wBAAwB,WAAW,UAAU,KAAK;GACnF,CAAC;AACF,QAAM,oBAAoB,gBAAgB,gBAAgB,aAAa;UAChE,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,wDAAwD;GACjF,GAAG;GACH,eAAe,UAAU;GACzB,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;GACtD,GAAG,+BAA+B,MAAM;GACzC,CAAC;AACF,MAAI;AACF,sBAAmB,UAAU;AAC7B,WAAQ,KAAK,GAAG,WAAW,6CAA6C;IACtE,GAAG;IACH,eAAe,UAAU;IAC1B,CAAC;WACK,cAAc;AACrB,WAAQ,MAAM,GAAG,WAAW,mEAAmE,eAAe,yDAAyD;IACrK;IACA,GAAG,+BAA+B,aAAa;IAChD,CAAC;;AAEJ,QAAM;;AAER,SAAQ,IAAI,GAAG,WAAW,sDAAsD;EAC9E,GAAG;EACH,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;EACtD,eAAe,UAAU;EAC1B,CAAC;;AAGJ,eAAe,qBAAqB,SAIlB;CAChB,MAAM,YAAY,qBAAqB;CACvC,MAAM,0CAA0B,IAAI,KAAa;CACjD,MAAM,cAAc,YAAY,KAAK;CACrC,IAAI,cAAc;CAClB,IAAI,cAAc;AAClB,SAAQ,IAAI,GAAG,WAAW,gCAAgC;EACxD,KAAK,QAAQ;EACb;EACD,CAAC;AACF,KAAI;AACF,QAAM,uBAAuB;GAC3B,QAAQ,QAAQ;GAChB,KAAK,QAAQ;GACb,cAAc,CAAC,GAAG,wBAAwB;GAC1C,iBAAiB;GACjB;GACA,SAAS,SAAS;AAChB,kBAAc,yBAAyB,aAAa,KAAK;AACzD,YAAQ,KAAK,GAAG,WAAW,WAAW,OAAO;;GAE/C,YAAY,YAAY;AACtB,kBAAc,yBAAyB,aAAa,4BAA4B,QAAQ,CAAC;;GAE3F,eAAe,UAAU;IACvB,MAAM,SAAS,uBAAuB,MAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AACrF,QAAI,UAAU,KAAM,QAAO,EAAE,UAAU,MAAM;AAC7C,QAAI,CAAC,gBAAgB,QAAQ,KAAK,OAAO,EAAE;AACzC,6BAAwB,IAAI,OAAO;AACnC,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,oBAAoB;MACpB,0BAA0B,sBAAsB,OAAO;MACxD,EACF;;AAEH,YAAQ,mBAAmB,OAAO;AAClC,WAAO,EAAE,UAAU,MAAM;;GAE5B,CAAC;UACK,OAAO;AACd,MAAI,iBAAiB,yBAAyB;AAC5C,WAAQ,KAAK,GAAG,WAAW,iCAAiC;IAC1D,KAAK,QAAQ;IACb;IACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;IACtD,GAAG,+BAA+B,MAAM;IACxC,GAAG,yBAAyB,aAAa,YAAY;IACtD,CAAC;AACF,SAAM,IAAI,MAAM,uCAAuC,UAAU,4DAA4D;;AAE/H,MAAI,iBAAiB,yBAAyB;AAC5C,WAAQ,KAAK,GAAG,WAAW,8BAA8B;IACvD,KAAK,QAAQ;IACb;IACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;IACtD,GAAG,+BAA+B,MAAM;IACxC,GAAG,yBAAyB,aAAa,YAAY;IACtD,CAAC;AACF,SAAM,IAAI,MAAM,GAAG,MAAM,QAAQ,yDAAyD;;AAE5F,UAAQ,KAAK,GAAG,WAAW,2CAA2C;GACpE,KAAK,QAAQ;GACb;GACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;GACtD,GAAG,+BAA+B,MAAM;GACxC,GAAG,yBAAyB,aAAa,YAAY;GACtD,CAAC;AACF,QAAM;;AAER,SAAQ,IAAI,GAAG,WAAW,gCAAgC;EACxD,KAAK,QAAQ;EACb;EACA,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,YAAY;EACtD,6BAA6B,wBAAwB;EACtD,CAAC;AACF,KAAI,wBAAwB,OAAO,GAAG;AACpC,UAAQ,KAAK,GAAG,WAAW,sDAAsD;GAC/E,KAAK,QAAQ;GACb,6BAA6B,wBAAwB;GACrD,yBAAyB,CAAC,GAAG,wBAAwB;GACtD,CAAC;AACF,QAAM,IAAI,MAAM,uCAAuC,wBAAwB,KAAK,+DAA+D,CAAC,GAAG,wBAAwB,CAAC,KAAK,KAAK,CAAC,+BAA+B;;;AAI9N,SAAS,sBAA8B;CACrC,MAAM,MAAM,QAAQ,IAAI;AACxB,KAAI,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAI,QAAO;CAC7C,MAAM,SAAS,OAAO,IAAI;AAC1B,KAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACxC,OAAM,IAAI,MAAM,iDAAiD,KAAK,UAAU,IAAI,CAAC,+CAA+C;AAEtI,QAAO;;AAGT,SAAS,wBAAwB,WAAiC,UAAkB,MAAyB;CAC3G,MAAM,WAAW,KAAK,QAAQ,SAAS;AACvC,KAAI,KAAK,IAAI,SAAS,CAAE;AACxB,MAAK,IAAI,SAAS;AAClB,WAAU,KAAK;EAAE,MAAM;EAAU,SAAS,WAAW,SAAS,GAAG,aAAa,UAAU,QAAQ,GAAG;EAAM,CAAC;;AAG5G,SAAS,oBAAoB,gBAAwB,eAA+E;CAClI,MAAM,MAAM,KAAK,QAAQ,eAAe;CACxC,MAAM,iBAAiB,KAAK,QAAQ,eAAe;CACnD,MAAM,YAAkC,CAAC;EAAE,MAAM;EAAgB,SAAS;EAAe,CAAC;CAC1F,MAAM,OAAO,IAAI,IAAY,CAAC,eAAe,CAAC;AAC9C,MAAK,MAAM,aAAa,4BAA4B,cAAc,EAAE;EAClE,MAAM,WAAW,KAAK,QAAQ,KAAK,UAAU;AAC7C,MAAI,CAAC,gBAAgB,KAAK,SAAS,CAAE;AACrC,0BAAwB,WAAW,UAAU,KAAK;;AAEpD,QAAO;EAAE;EAAW;EAAM;;AAG5B,SAAS,mBAAmB,WAAuC;CACjE,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,EAAE,MAAM,UAAU,aAAa,UACxC,KAAI;AACF,MAAI,YAAY,MACd;OAAI,WAAW,SAAS,CAAE,QAAO,SAAS;QAE1C,eAAc,UAAU,SAAS,QAAQ;UAEpC,OAAO;AACd,WAAS,KAAK,GAAG,SAAS,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAAG;;AAG3F,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,MAAM,qBAAqB,SAAS,OAAO,4BAA4B,SAAS,KAAK,KAAK,GAAG;;AAI3G,eAAe,2BAA2B,gBAAgD;AACxF,KAAI;AACF,UAAQ,MAAM,eAAe,eAAe,EAAE;UACvC,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,2FAA2F;GACpH;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC9D,CAAC;AACF,SAAO;;;AAIX,eAAe,oBAAoB,gBAAwB,gBAA+B,cAAqC;AAC7H,KAAI,kBAAkB,MAAM;EAC1B,MAAM,SAAS,mBAAmB,SAAS,gBAAgB,aAAa,CAAC;AAEzE,MAAI,CAAC,aADU,oBAAoB,MAAM,eAAe,eAAe,EAAE,OAAO,EACtD,OAAO,CAC/B,OAAM,IAAI,MAAM,uCAAuC,eAAe,qEAAqE;AAE7I;;AAMF,KAAI,CAAC,wBADW,aAAa,gBAAgB,QAAQ,EACf,eAAe,CACnD,OAAM,IAAI,MAAM,uCAAuC,eAAe,0DAA0D;;AAIpI,SAAS,wBAAwB,SAAiB,gBAAiC;AACjF,KAAI;AACF,wBAAsB,SAAS,eAAe;AAC9C,SAAO;SACD;AAKN,SAAO,8BAA8B,KAAK,QAAQ;;;AAItD,SAAS,4BAA4B,SAA2B;CAC9D,MAAM,aAAuB,EAAE;CAC/B,MAAM,gBAAgB;CACtB,IAAI;AACJ,SAAQ,QAAQ,cAAc,KAAK,QAAQ,MAAM,KAC/C,YAAW,KAAK,MAAM,GAAG;AAE3B,QAAO;;AAGT,SAAS,oBAAoB,QAAgC;CAC3D,MAAM,UAA0B,EAAE;CAClC,MAAM,QAAQ,QAAgB,QAAsB;AAClD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;GAC9C,MAAM,WAAW,WAAW,KAAK,MAAM,GAAG,OAAO,GAAG;AACpD,OAAI,UAAU,OAAW;AACzB,OAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EACtG,MAAK,UAAU,MAAM;OAErB,SAAQ,KAAK;IAAE,MAAM;IAAU;IAAO,CAAC;;;AAI7C,MAAK,IAAI,OAAO;AAChB,QAAO;;AAGT,SAAS,wBAAwB,gBAAwB,cAAsB,gBAAuC;CACpH,MAAM,UAAU,oBAAoB,aAAa;CACjD,MAAM,gBAAgB;AACtB,KAAI,kBAAkB,KACpB,QAAO,+BAA+B;EACpC,OAAO;GAAE,MAAM;GAAc;GAAgB;EAC7C,gBAAgB,mBAAmB,SAAS,gBAAgB,aAAa,CAAC;EAC1E;EACD,CAAC;AAEJ,QAAO,8BAA8B;EACnC;EACA;EACA;EACD,CAAC;;AAGJ,SAAS,mBAAmB,QAAkC;CAC5D,MAAM,cAAwB,EAAE;CAChC,MAAM,aAAa,UAAU,QAAQ;EACnC,oBAAoB;EACpB,eAAe;EACf;EACD,CAAC;AACF,KAAI,YAAY,SAAS,EACvB,OAAM,IAAI,MAAM,kFAAkF,YAAY,KAAK,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG;AAE/J,QAAO;;AAGT,SAAS,aAAa,GAAY,GAAqB;AACrD,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,MAAM,QAAQ,MAAM,KAAM,QAAO,MAAM;AAC3C,KAAI,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,EAAE,EAAE;AACxC,MAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAC5E,SAAO,EAAE,OAAO,OAAO,UAAU,aAAa,OAAO,EAAE,OAAO,CAAC;;AAEjE,KAAI,OAAO,MAAM,YAAY,OAAO,MAAM,UAAU;EAClD,MAAM,WAAW,OAAO,QAAQ,EAAE;EAClC,MAAM,OAAO,IAAI,IAAI,OAAO,QAAQ,EAAE,CAAC;AACvC,MAAI,SAAS,WAAW,KAAK,KAAM,QAAO;AAC1C,SAAO,SAAS,OAAO,CAAC,KAAK,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC;;AAE9F,QAAO"}

package/dist/esm/index.d.ts

@@ -1,16 +1,2 @@
-import { Config } from "@hexclave/shared/dist/config/format";
-
-//#region src/index.d.ts
-declare function sha256String(value: string): string;
-declare function resolveConfigFilePath(inputPath: string): string;
-declare function ensureConfigFileExists(configFilePath: string): void;
-declare function readConfigObject(configFilePath: string): Promise<Config>;
-declare function readConfigFile(configFilePath: string): Promise<{
-  config: Config;
-  showOnboarding: boolean;
-}>;
-declare function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void>;
-declare function replaceConfigObject(configFilePath: string, config: Config): Promise<void>;
-//#endregion
-export { ensureConfigFileExists, readConfigFile, readConfigObject, replaceConfigObject, resolveConfigFilePath, sha256String, updateConfigObject };
-//# sourceMappingURL=index.d.ts.map
+export * from "./config-file";
+export * from "./config-updater";