@hue-run/sdk 0.2.2 → 0.3.1

package/dist/evals/simulation.js

@@ -1,56 +1,25 @@
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { HueEnvironmentError } from "../environment/client.js";
-import { bindEnvironmentTools } from "../environment/tools.js";
 import { HueApiError } from "./client.js";
 import { CheckpointStore } from "./checkpoint.js";
 import { MAX_ENVIRONMENT_STEPS } from "./environment-evidence.js";
 import { aggregateBounds, digest, json } from "./json.js";
 import { normalizeScorerDefinitionForPublication } from "./scorer-publication.js";
-import { actualAgentManifestV2, attemptBaselineV2, projectMcpConnectionV2, requestedAttemptProvidersV2, validateAttemptConnectionBundleV2, } from "./attempt.js";
-import { runExperiment, TargetCancelledError, TargetOutcomeUncertainError, } from "./runner.js";
+import { pinRequestedAttemptV2, requestedAttemptV2, runEnvironmentTarget, } from "./environment-target.js";
+import { runExperiment } from "./runner.js";
 const scorerDefinition = (entry) => "definition" in entry.scorer ? entry.scorer.definition : entry.scorer;
-function requestedAttempt(options) {
-    const requested = options.requestedProviders !== undefined;
-    const selected = options.mcpSurface !== undefined;
-    if (!requested && !selected) {
-        if (options.actualAgentManifest !== undefined)
-            throw new TypeError("actualAgentManifest requires requestedProviders and mcpSurface");
-        return undefined;
-    }
-    if (!requested || !selected)
-        throw new TypeError("requestedProviders and mcpSurface must be supplied together");
-    const requestedProviders = requestedAttemptProvidersV2.parse(options.requestedProviders);
-    const mcpSurface = options.mcpSurface;
-    const provider = requestedProviders.find((candidate) => candidate.providerInstanceKey === mcpSurface.providerInstanceKey);
-    if (!provider?.surfaceKeys.includes(mcpSurface.surfaceKey))
-        throw new TypeError("mcpSurface must identify an exactly requested MCP surface");
-    const actualAgentManifest = typeof options.actualAgentManifest === "function"
-        ? options.actualAgentManifest
-        : actualAgentManifestV2.parse(options.actualAgentManifest);
-    return {
-        actualAgentManifest,
-        requestedProviders,
-        mcpSurface: { ...mcpSurface },
-    };
-}
-function expectedManifestDigest(config) {
-    if (!config || typeof config !== "object" || Array.isArray(config))
-        throw new TypeError("Provider-profile simulations require an immutable V2 attempt baseline");
-    const source = config;
-    const baseline = attemptBaselineV2.safeParse(source.attemptBaselineV2);
-    if (!baseline.success) {
-        if (source.attemptBaselineV2 === undefined && source.attemptBaselineV1 !== undefined)
-            throw new TypeError("Legacy V1 attempts require a fresh experiment with a V2 baseline");
-        if (source.attemptBaselineV2 !== undefined)
-            throw new TypeError("The immutable V2 attempt baseline is invalid");
-        throw new TypeError("Provider-profile simulations require an immutable V2 attempt baseline");
-    }
-    return baseline.data.expectedAgentManifestDigest;
-}
 function normalizedEnvironmentDefinition(definition) {
     return json({
         ...definition,
+        ...(definition.schemaVersion === 2
+            ? {
+                providerInstances: definition.providerInstances.map((instance) => ({
+                    ...instance,
+                    syntheticPrincipalId: instance.syntheticPrincipalId.toLowerCase(),
+                })),
+            }
+            : {}),
         determinism: {
             clock: {
                 startNs: definition.determinism?.clock?.startNs ?? "0",
@@ -341,24 +310,11 @@ async function resolveExperiment(options, idempotencyKey) {
         bindings: [...scorers.bindings, ...(options.localScorers ?? [])],
     };
 }
-async function seal(client, runId, executionId, status) {
-    try {
-        await client.finishRun(runId, {
-            idempotencyKey: `execution:${executionId}:${status}`,
-            status,
-        });
-    }
-    catch (error) {
-        const recovered = await client.getRun(runId).catch(() => undefined);
-        if (recovered?.status !== status)
-            throw error;
-    }
-}
 /** Run an existing agent callback against one fresh hosted world per case. The helper
  * owns immutable resolution, execution linkage, finalization, scoring and resumable uploads.
  */
 export async function runSimulation(options) {
-    const requestedConfiguration = requestedAttempt(options);
+    const requestedConfiguration = requestedAttemptV2(options);
     if (options.maxSteps !== undefined &&
         (!Number.isInteger(options.maxSteps) ||
             options.maxSteps < 1 ||
@@ -408,10 +364,7 @@ export async function runSimulation(options) {
         const runUrl = new URL(`/experiments/${experimentId}`, options.client.baseUrl).toString();
         await options.onProgress?.({ type: "run_created", experimentId, runUrl });
         const requested = requestedConfiguration
-            ? {
-                ...requestedConfiguration,
-                expectedAgentManifestDigest: expectedManifestDigest((await options.client.getExperiment(experimentId)).config),
-            }
+            ? pinRequestedAttemptV2(requestedConfiguration, (await options.client.getExperiment(experimentId)).config)
             : undefined;
         const report = await runExperiment({
             client: options.client,
@@ -424,172 +377,42 @@ export async function runSimulation(options) {
             scorers: bindings,
             concurrency: options.concurrency,
             schemaTimeoutMillis: options.schemaTimeoutMillis,
-            target: async (inputs, context) => {
-                const environmentVersionId = context.item.environmentVersionId;
-                if (!environmentVersionId)
-                    throw new Error("The simulation case has no pinned environment version");
-                const run = await options.environmentClient.createRun({
-                    idempotencyKey: `execution:${context.executionId}`,
-                    environmentVersionId,
-                    executionId: context.executionId,
-                    maxSteps: options.maxSteps,
-                    ttlSeconds: options.ttlSeconds,
-                });
-                const progress = (type) => options.onProgress?.({
-                    type,
+            target: (inputs, context) => runEnvironmentTarget({
+                client: options.client,
+                environmentClient: options.environmentClient,
+                hue: options.hue,
+                inputs,
+                context,
+                requested,
+                maxSteps: options.maxSteps,
+                ttlSeconds: options.ttlSeconds,
+                signal: options.signal,
+                onProgress: (event) => options.onProgress?.({
+                    ...event,
                     experimentId,
                     executionId: context.executionId,
                     caseId: context.item.id,
-                    environmentRunId: run.id,
-                });
-                let finalized = false;
-                try {
-                    await progress("world_created");
-                    if (options.signal?.aborted)
-                        throw new TargetCancelledError();
-                    const tools = bindEnvironmentTools({
-                        hue: options.hue,
-                        client: options.environmentClient,
-                        run,
-                        parentContext: context.span.context,
-                    });
-                    let connectionBundle;
-                    let mcp;
-                    if (requested) {
-                        const actualManifest = actualAgentManifestV2.parse(typeof requested.actualAgentManifest === "function"
-                            ? await requested.actualAgentManifest({
-                                config: context.config,
-                                item: structuredClone(context.item),
-                                signal: options.signal,
-                            })
-                            : requested.actualAgentManifest);
-                        let prepared;
-                        try {
-                            prepared = await options.client.prepareAttempt({
-                                schemaVersion: 2,
-                                idempotencyKey: randomUUID(),
-                                executionId: context.executionId,
-                                environmentRunId: run.id,
-                                expectedAgentManifestDigest: requested.expectedAgentManifestDigest,
-                                actualManifest,
-                                requestedProviders: requested.requestedProviders,
-                            });
-                        }
-                        catch (error) {
-                            // A transport failure or malformed credential-bearing response may
-                            // follow a committed decision. Preserve the running checkpoint and
-                            // never reacquire credentials or replay the target on resume.
-                            throw new TargetOutcomeUncertainError(context.executionId, { cause: error });
-                        }
-                        await options.onProgress?.({
-                            type: "attempt_prepared",
-                            experimentId,
-                            executionId: context.executionId,
-                            caseId: context.item.id,
-                            environmentRunId: run.id,
-                            bindingId: prepared.status === "ready" ? prepared.bundle.bindingId : prepared.bindingId,
-                            status: prepared.status,
-                            findingCodes: prepared.preflightReport.findings.map((finding) => finding.code),
-                            ...(prepared.status === "ready"
-                                ? {
-                                    executionManifestDigest: prepared.bundle.parity.executionManifestDigest,
-                                }
-                                : {}),
-                        });
-                        if (prepared.status === "environment_incomplete") {
-                            try {
-                                await seal(options.environmentClient, run.id, context.executionId, "completed");
-                            }
-                            catch (error) {
-                                throw new TargetOutcomeUncertainError(context.executionId, { cause: error });
-                            }
-                            finalized = true;
-                            await Promise.resolve(progress("world_sealed")).catch(() => undefined);
-                            return undefined;
-                        }
-                        connectionBundle = validateAttemptConnectionBundleV2(prepared.bundle, {
-                            requireFresh: true,
-                        });
-                        const projected = projectMcpConnectionV2(connectionBundle, requested.mcpSurface.providerInstanceKey);
-                        if (!projected)
-                            throw new TypeError("The prepared attempt has no selected MCP surface");
-                        mcp = projected;
-                    }
-                    else {
-                        mcp = await options.client.createSimulationMcpCapability({
-                            runId: run.id,
-                            executionId: context.executionId,
-                        });
-                    }
-                    if (options.signal?.aborted)
-                        throw new TargetCancelledError();
-                    await progress("target_started");
-                    const output = await options.target(inputs, {
-                        config: context.config,
-                        item: context.item,
-                        executionId: context.executionId,
-                        environmentRunId: run.id,
-                        tools,
-                        mcp,
-                        ...(connectionBundle ? { connectionBundle } : {}),
-                        signal: options.signal,
-                    });
-                    try {
-                        await seal(options.environmentClient, run.id, context.executionId, "completed");
-                    }
-                    catch (error) {
-                        throw new TargetOutcomeUncertainError(context.executionId, { cause: error });
-                    }
-                    finalized = true;
-                    await Promise.resolve(progress("world_sealed")).catch(() => undefined);
-                    return output;
-                }
-                catch (error) {
-                    if (error instanceof TargetOutcomeUncertainError || finalized)
-                        throw error;
-                    let environmentIncomplete;
-                    try {
-                        environmentIncomplete =
-                            (await options.environmentClient.getRun(run.id)).validity ===
-                                "environment_incomplete";
-                    }
-                    catch (inspectionError) {
-                        // A target error can be the adapter surfacing a coverage gap. If the
-                        // authoritative run cannot be read, do not guess that it was an agent
-                        // failure or replay the target on resume.
-                        throw new TargetOutcomeUncertainError(context.executionId, {
-                            cause: new AggregateError([error, inspectionError]),
-                        });
-                    }
-                    // A durable coverage gap invalidates parity independently of caller timing;
-                    // do not let a racing local abort hide it as an ordinary cancellation.
-                    if (environmentIncomplete) {
-                        try {
-                            await seal(options.environmentClient, run.id, context.executionId, "completed");
-                        }
-                        catch (finalizationError) {
-                            throw new TargetOutcomeUncertainError(context.executionId, {
-                                cause: new AggregateError([error, finalizationError]),
-                            });
-                        }
-                        finalized = true;
-                        await Promise.resolve(progress("world_sealed")).catch(() => undefined);
-                        return undefined;
-                    }
-                    try {
-                        await seal(options.environmentClient, run.id, context.executionId, "abandoned");
-                    }
-                    catch (finalizationError) {
-                        throw new TargetOutcomeUncertainError(context.executionId, {
-                            cause: new AggregateError([error, finalizationError]),
-                        });
-                    }
-                    await Promise.resolve(progress("world_sealed")).catch(() => undefined);
-                    if (options.signal?.aborted && !(error instanceof TargetCancelledError))
-                        throw new TargetCancelledError();
-                    throw error;
-                }
-            },
+                }),
+                target: (targetInputs, targetContext) => options.target(structuredClone(targetInputs), {
+                    config: structuredClone(targetContext.config),
+                    item: {
+                        id: targetContext.item.id,
+                        externalKey: targetContext.item.externalKey,
+                    },
+                    executionId: targetContext.executionId,
+                    environmentRunId: targetContext.environmentRunId,
+                    tools: targetContext.tools,
+                    mcp: {
+                        url: targetContext.mcp.url,
+                        token: targetContext.mcp.token,
+                        expiresAt: targetContext.mcp.expiresAt,
+                    },
+                    ...(targetContext.connectionBundle
+                        ? { connectionBundle: structuredClone(targetContext.connectionBundle) }
+                        : {}),
+                    signal: targetContext.signal,
+                }),
+            }),
         });
         const complete = { ...report, experimentId, runUrl };
         attempt.stage = "completed";

package/dist/evals/types.d.ts

@@ -119,7 +119,7 @@ export type MetricDefinition = {
     /** Allowed values. */
     categories: string[];
 };
-/** A pinned scorer definition: a Hue built-in, trusted local code, a manual rubric or a hosted judge. */
+/** A pinned scorer definition executed locally, by a person, or by Hue. */
 export type ScorerDefinition = {
     /** Hue built-in scorer. */
     kind: "builtin";
@@ -158,6 +158,13 @@ export type ScorerDefinition = {
     sourceDigest: string;
     /** Metrics the callback reports. */
     metrics: MetricDefinition[];
+} | {
+    /** Scored inside Hue using immutable world evidence; the local runner defers it. */
+    kind: "world_outcome";
+    /** Pinned Hue-executed outcome evaluator. */
+    entry: "hue.conversion_outcome.v1";
+    /** The seven fixed boolean metrics defined by the entry. */
+    metrics: MetricDefinition[];
 } | {
     /** Scored by a person in Hue; the local runner defers it. */
     kind: "manual";
@@ -603,3 +610,34 @@ export interface SimulationMcpCapability {
     /** Credential expiry timestamp. */
     expiresAt: string;
 }
+/** Identity and capabilities of one fixed local agent entry point. */
+export interface LocalAgentRegistration {
+    /** Stable application-selected agent key. */
+    key: string;
+    /** Display name. */
+    name: string;
+    /** Application-selected revision of the agent configuration. */
+    revision: string;
+    /** Supported execution contracts; defaults to environment:v1 in the worker. */
+    capabilities?: string[];
+    /** Local scorer source digests available in this process. */
+    scorerDigests?: string[];
+}
+/** Server registration and heartbeat timestamps for a local agent. */
+export interface RegisteredLocalAgent extends Required<LocalAgentRegistration> {
+    /** Registered agent identity. */
+    id: string;
+    /** Whether Hue permits this registration to receive runs. */
+    enabled: boolean;
+    /** Latest registration heartbeat, as an ISO timestamp. */
+    lastSeenAt: string;
+    /** Registration creation timestamp. */
+    createdAt: string;
+}
+/** Queue claim connecting a local run to a pinned experiment. */
+export interface LocalAgentClaim {
+    /** Claimed queue-run identity. */
+    runId: string;
+    /** Pinned experiment to execute. */
+    experimentId: string;
+}

package/dist/evals.d.ts

@@ -9,3 +9,5 @@ export type { ActualAgentManifestInputV2, ActualAgentManifestV2, AttemptBaseline
 export { builtins, defineLocalScorer, scoreLocally } from "./evals/scorers.js";
 export { sourceDigest } from "./evals/json.js";
 export type * from "./evals/types.js";
+export { runLocalAgent } from "./evals/local-worker.js";
+export type { LocalAgentTargetContext, RunLocalAgentOptions } from "./evals/local-worker.js";

package/dist/evals.js

@@ -4,3 +4,4 @@ export { runSimulation } from "./evals/simulation.js";
 export { actualAgentManifestV2, agentManifestDigestV2, attemptBaselineV2, attemptBindingRead, attemptConnectionBundleV2, attemptIdentityV2, dependencyManifestV2, dependencyProviderV2, expectedAgentManifestV2, executionManifestDigestV2, parityEvidenceV2, preflightFindingV2, preflightReportV2, prepareAttemptInputV2, projectMcpConnectionV2, secretFreeBindingV2, surfaceBindingV2, } from "./evals/attempt.js";
 export { builtins, defineLocalScorer, scoreLocally } from "./evals/scorers.js";
 export { sourceDigest } from "./evals/json.js";
+export { runLocalAgent } from "./evals/local-worker.js";

package/dist/setup/checkpoint.d.ts

@@ -0,0 +1,14 @@
+import type { SetupCheckpointAdapter } from "./runner.js";
+import type { SetupMachineState } from "./machine.js";
+export declare function defaultSetupStateDirectory(env?: NodeJS.ProcessEnv): string;
+/** Stable installer-session identifier; it is not a Hue Run and reveals no path or file contents. */
+export declare function setupRunId(projectRoot: string): string;
+export declare class FileSetupCheckpointAdapter implements SetupCheckpointAdapter {
+    readonly directory: string;
+    private readonly runtimePlatform;
+    constructor(directory?: string, runtimePlatform?: NodeJS.Platform);
+    private get enforcesPosixPermissions();
+    private pathFor;
+    load(runId: string, projectRoot: string): Promise<SetupMachineState | undefined>;
+    save(state: SetupMachineState): Promise<void>;
+}

package/dist/setup/checkpoint.js

@@ -0,0 +1,186 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, realpath, rename } from "node:fs/promises";
+import { homedir, platform } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+const MAX_CHECKPOINT_BYTES = 256 * 1024;
+const STEPS = ["detect-project", "configure-telemetry", "verify-receipt", "claim-project"];
+function isInside(parent, child) {
+    const path = relative(parent, child);
+    return path === "" || (!path.startsWith("..") && !isAbsolute(path));
+}
+export function defaultSetupStateDirectory(env = process.env) {
+    if (platform() === "darwin")
+        return join(homedir(), "Library", "Application Support", "Hue", "setup");
+    if (platform() === "win32")
+        return join(env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"), "Hue", "setup");
+    return join(env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"), "hue", "setup");
+}
+/** Stable installer-session identifier; it is not a Hue Run and reveals no path or file contents. */
+export function setupRunId(projectRoot) {
+    return `setup_${createHash("sha256")
+        .update(`hue-setup-v1\0${resolve(projectRoot)}`)
+        .digest("hex")
+        .slice(0, 24)}`;
+}
+function digest(value) {
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function hasExactKeys(value, keys) {
+    return Object.keys(value).sort().join("\0") === [...keys].sort().join("\0");
+}
+function validDetection(value, projectRoot) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const item = value;
+    if (!hasExactKeys(item, [
+        "root",
+        "fingerprint",
+        "languages",
+        "packageManagers",
+        "frameworks",
+        "hue",
+        "openTelemetry",
+    ]))
+        return false;
+    const allowed = (items, values, maximum) => Array.isArray(items) &&
+        items.length <= maximum &&
+        new Set(items).size === items.length &&
+        items.every((entry) => typeof entry === "string" && values.includes(entry));
+    return (item.root === projectRoot &&
+        typeof item.fingerprint === "string" &&
+        /^[a-f0-9]{64}$/u.test(item.fingerprint) &&
+        allowed(item.languages, ["typescript", "python"], 2) &&
+        allowed(item.packageManagers, ["bun", "npm", "pnpm", "yarn", "uv", "poetry", "pip"], 7) &&
+        allowed(item.frameworks, ["nextjs", "nestjs", "express", "fastapi", "django", "flask", "vercel-ai-sdk"], 7) &&
+        ["absent", "typescript", "python", "multiple"].includes(item.hue) &&
+        ["absent", "typescript", "python", "multiple"].includes(item.openTelemetry));
+}
+function validState(value, runId, projectRoot) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const state = value;
+    if (state.format !== 1 || state.runId !== runId || state.projectRoot !== projectRoot)
+        return false;
+    if (state.phase === "created" || state.phase === "detecting")
+        return hasExactKeys(state, ["format", "phase", "runId", "projectRoot"]);
+    if (state.phase !== "local-ready" ||
+        !hasExactKeys(state, ["format", "phase", "runId", "projectRoot", "project", "plan"]) ||
+        !validDetection(state.project, projectRoot))
+        return false;
+    const plan = state.plan;
+    return (!!plan &&
+        typeof plan === "object" &&
+        !Array.isArray(plan) &&
+        hasExactKeys(plan, ["steps", "mutatesProject", "backendRequired"]) &&
+        JSON.stringify(plan.steps) === JSON.stringify(STEPS) &&
+        plan.mutatesProject === false &&
+        plan.backendRequired === true);
+}
+export class FileSetupCheckpointAdapter {
+    directory;
+    runtimePlatform;
+    constructor(directory = defaultSetupStateDirectory(), runtimePlatform = platform()) {
+        this.directory = directory;
+        this.runtimePlatform = runtimePlatform;
+    }
+    get enforcesPosixPermissions() {
+        return this.runtimePlatform !== "win32";
+    }
+    async pathFor(runId, projectRoot) {
+        if (!/^setup_[a-f0-9]{24}$/u.test(runId))
+            throw new Error("Invalid setup run identifier");
+        const root = resolve(this.directory);
+        const project = await realpath(projectRoot);
+        if (isInside(project, root))
+            throw new Error("Setup checkpoints must be outside the project repository");
+        let info;
+        try {
+            info = await lstat(root);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            await mkdir(root, { recursive: true, mode: 0o700 });
+            info = await lstat(root);
+        }
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new Error("Setup checkpoint directory must be private (mode 0700, no symlink)");
+        if (this.enforcesPosixPermissions) {
+            await chmod(root, 0o700);
+            info = await lstat(root);
+            if ((info.mode & 0o077) !== 0)
+                throw new Error("Setup checkpoint directory must be private (mode 0700, no symlink)");
+        }
+        return join(root, `${runId}.json`);
+    }
+    async load(runId, projectRoot) {
+        const path = await this.pathFor(runId, projectRoot);
+        let handle;
+        try {
+            if (this.runtimePlatform === "win32") {
+                const entry = await lstat(path);
+                if (entry.isSymbolicLink())
+                    throw new Error("Unsafe setup checkpoint symlink");
+            }
+            const noFollow = this.runtimePlatform === "win32" ? 0 : constants.O_NOFOLLOW;
+            handle = await open(path, constants.O_RDONLY | noFollow);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+        try {
+            const info = await handle.stat();
+            if (!info.isFile() ||
+                info.size > MAX_CHECKPOINT_BYTES ||
+                (this.enforcesPosixPermissions && (info.mode & 0o077) !== 0))
+                throw new Error("Unsafe or oversized setup checkpoint");
+            const envelope = JSON.parse(await handle.readFile("utf8"));
+            if (!envelope ||
+                typeof envelope !== "object" ||
+                Array.isArray(envelope) ||
+                !hasExactKeys(envelope, ["state", "digest"]))
+                throw new Error("Invalid setup checkpoint envelope");
+            const { state, digest: expected } = envelope;
+            if (typeof expected !== "string" || expected !== digest(state))
+                throw new Error("Setup checkpoint integrity check failed");
+            if (!validState(state, runId, await realpath(projectRoot)))
+                throw new Error("Setup checkpoint identity or shape does not match this project");
+            return state;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async save(state) {
+        const path = await this.pathFor(state.runId, state.projectRoot);
+        const encoded = `${JSON.stringify({ state, digest: digest(state) })}\n`;
+        if (Buffer.byteLength(encoded) > MAX_CHECKPOINT_BYTES)
+            throw new Error("Setup checkpoint exceeds 256 KiB");
+        const temporary = join(dirname(path), `.${state.runId}.${randomUUID()}.tmp`);
+        const handle = await open(temporary, "wx", 0o600);
+        try {
+            await handle.writeFile(encoded);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporary, path);
+        // Windows cannot open a directory as a file handle for fsync. The atomic rename and
+        // per-user state directory still provide resumability there; POSIX additionally fsyncs
+        // the containing directory so the rename survives a sudden interruption.
+        if (this.runtimePlatform !== "win32") {
+            await chmod(path, 0o600);
+            const directory = await open(dirname(path), "r");
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+        }
+    }
+}

package/dist/setup/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};