@illumiarq/lumis 1.2.8 → 1.2.10

package/dist/runtime/policy.js

@@ -0,0 +1,78 @@
+function isTruthy(value) {
+    if (!value) {
+        return false;
+    }
+    const normalized = value.trim().toLowerCase();
+    return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'y';
+}
+export function resolveRuntimePolicy(config) {
+    const mode = config.runtime?.policy?.mode ?? 'strict';
+    const requireApprovalForRemote = config.runtime?.policy?.requireApprovalForRemote !== false;
+    const approvalEnvVar = config.runtime?.policy?.approvalEnvVar ?? 'LUMIS_RUNTIME_APPROVED';
+    const commandAllowlist = config.runtime?.policy?.commandAllowlist ?? [];
+    return {
+        mode,
+        requireApprovalForRemote,
+        approvalEnvVar,
+        commandAllowlist,
+    };
+}
+/**
+ * Check whether `command` (the program name or full command string) is permitted
+ * by the allowlist in the resolved policy.
+ *
+ * Matching rules:
+ *  - Empty allowlist → all commands allowed.
+ *  - Exact entry (e.g. "pnpm") → matches when command starts with that token.
+ *  - Glob prefix entry ending in " *" (e.g. "pnpm *") → matches when the full
+ *    command string starts with the prefix before " *".
+ *
+ * In strict mode a mismatch returns `allowed: false`.
+ * In advisory mode a mismatch returns `allowed: true` with a warning.
+ */
+export function enforceCommandBoundary(command, policy) {
+    if (policy.commandAllowlist.length === 0) {
+        return { allowed: true };
+    }
+    const matched = policy.commandAllowlist.some((entry) => {
+        if (entry.endsWith(' *')) {
+            const prefix = entry.slice(0, -2);
+            return command === prefix || command.startsWith(prefix + ' ');
+        }
+        return command === entry || command.startsWith(entry + ' ');
+    });
+    if (matched) {
+        return { allowed: true };
+    }
+    const reason = `Command "${command}" is not in the runtime policy allowlist. Permitted: ${policy.commandAllowlist.join(', ')}.`;
+    if (policy.mode === 'advisory') {
+        return { allowed: true, advisory: true, warningReason: reason };
+    }
+    return { allowed: false, advisory: false, blockingReason: reason };
+}
+export function evaluateRuntimePolicy(input) {
+    const policy = resolveRuntimePolicy(input.config);
+    const isRemoteProfile = input.profile.kind !== 'local';
+    const requiresApproval = isRemoteProfile && policy.requireApprovalForRemote;
+    const env = input.processEnv ?? process.env;
+    const approvedByEnv = isTruthy(env[policy.approvalEnvVar]);
+    const approvedByFlag = input.approveRemote === true;
+    const approved = !requiresApproval || approvedByEnv || approvedByFlag;
+    if (!approved) {
+        return {
+            mode: policy.mode,
+            requiresApproval,
+            approved,
+            allowExecution: false,
+            blockingReason: `Runtime profile ${input.profile.id} (${input.profile.kind}) requires explicit approval. ` +
+                `Set ${policy.approvalEnvVar}=true or pass --approve-remote.`,
+        };
+    }
+    return {
+        mode: policy.mode,
+        requiresApproval,
+        approved,
+        allowExecution: true,
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/runtime/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/runtime/policy.ts"],"names":[],"mappings":"AA0BA,SAAS,QAAQ,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7C,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,GAAG,CAAA;AACjG,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,QAAQ,CAAA;IACrD,MAAM,wBAAwB,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,KAAK,KAAK,CAAA;IAC3F,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,IAAI,wBAAwB,CAAA;IACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,IAAI,EAAE,CAAA;IAEvE,OAAO;QACN,IAAI;QACJ,wBAAwB;QACxB,cAAc;QACd,gBAAgB;KAChB,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACrC,OAAe,EACf,MAA6B;IAE7B,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACtD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACjC,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,IAAI,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,OAAO,wDAAwD,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IAE/H,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA;IAChE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAKrC;IACA,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAA;IACtD,MAAM,gBAAgB,GAAG,eAAe,IAAI,MAAM,CAAC,wBAAwB,CAAA;IAE3E,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAA;IAC3C,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;IAC1D,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,KAAK,IAAI,CAAA;IACnD,MAAM,QAAQ,GAAG,CAAC,gBAAgB,IAAI,aAAa,IAAI,cAAc,CAAA;IAErE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB;YAChB,QAAQ;YACR,cAAc,EAAE,KAAK;YACrB,cAAc,EACb,mBAAmB,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,gCAAgC;gBAC1F,OAAO,MAAM,CAAC,cAAc,iCAAiC;SAC9D,CAAA;IACF,CAAC;IAED,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,gBAAgB;QAChB,QAAQ;QACR,cAAc,EAAE,IAAI;KACpB,CAAA;AACF,CAAC"}

package/dist/runtime/profiles.d.ts

@@ -0,0 +1,15 @@
+import type { RuntimeProfile, RuntimeProfileStore } from '@lumiarq/context';
+export type RuntimeProfileValidationResult = {
+    ok: true;
+    value: RuntimeProfileStore;
+} | {
+    ok: false;
+    errors: string[];
+};
+export declare function validateRuntimeProfileStore(input: unknown): RuntimeProfileValidationResult;
+export declare function createDefaultRuntimeProfileStore(projectRoot: string): RuntimeProfileStore;
+export declare function loadRuntimeProfileStore(projectRoot: string): RuntimeProfileStore;
+export declare function saveRuntimeProfileStore(projectRoot: string, store: RuntimeProfileStore): void;
+export declare function getRuntimeProfile(store: RuntimeProfileStore, profileId?: string): RuntimeProfile | null;
+export declare function redactRuntimeProfileForLogs(profile: RuntimeProfile): RuntimeProfile;
+//# sourceMappingURL=profiles.d.ts.map

package/dist/runtime/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/runtime/profiles.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,cAAc,EACd,mBAAmB,EAEpB,MAAM,kBAAkB,CAAA;AAIzB,MAAM,MAAM,8BAA8B,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAiDnC,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,8BAA8B,CAkC1F;AAED,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAazF;AAED,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAoBhF;AAED,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAI7F;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMvG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAWnF"}

package/dist/runtime/profiles.js

@@ -0,0 +1,131 @@
+import fs from 'node:fs';
+import path from 'node:path';
+const PROFILE_STORE_RELATIVE_PATH = path.join('.lumis', 'runtime-profiles.json');
+function isObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function asString(value) {
+    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;
+}
+function validateProfile(profile, index) {
+    if (!isObject(profile)) {
+        return [`profiles[${index}] must be an object`];
+    }
+    const id = asString(profile.id);
+    const name = asString(profile.name);
+    const kind = asString(profile.kind);
+    const errors = [];
+    if (!id)
+        errors.push(`profiles[${index}].id must be a non-empty string`);
+    if (!name)
+        errors.push(`profiles[${index}].name must be a non-empty string`);
+    if (!kind)
+        errors.push(`profiles[${index}].kind must be a non-empty string`);
+    if (kind === 'ssh') {
+        if (!asString(profile.host)) {
+            errors.push(`profiles[${index}].host is required for ssh profile`);
+        }
+        if (!asString(profile.user)) {
+            errors.push(`profiles[${index}].user is required for ssh profile`);
+        }
+    }
+    if (kind === 'container') {
+        if (!asString(profile.image)) {
+            errors.push(`profiles[${index}].image is required for container profile`);
+        }
+        if (!asString(profile.workspacePath)) {
+            errors.push(`profiles[${index}].workspacePath is required for container profile`);
+        }
+    }
+    if (kind === 'ci' && !asString(profile.provider)) {
+        errors.push(`profiles[${index}].provider is required for ci profile`);
+    }
+    return errors;
+}
+export function validateRuntimeProfileStore(input) {
+    if (!isObject(input)) {
+        return { ok: false, errors: ['profile store must be an object'] };
+    }
+    const version = asString(input.version);
+    const profiles = input.profiles;
+    const defaultProfileId = input.defaultProfileId;
+    const errors = [];
+    if (version !== '1.0') {
+        errors.push('profile store version must be "1.0"');
+    }
+    if (!Array.isArray(profiles)) {
+        errors.push('profiles must be an array');
+    }
+    else {
+        for (let index = 0; index < profiles.length; index += 1) {
+            errors.push(...validateProfile(profiles[index], index));
+        }
+    }
+    if (defaultProfileId !== undefined && asString(defaultProfileId) === null) {
+        errors.push('defaultProfileId must be a non-empty string when provided');
+    }
+    if (errors.length > 0) {
+        return { ok: false, errors };
+    }
+    return {
+        ok: true,
+        value: input,
+    };
+}
+export function createDefaultRuntimeProfileStore(projectRoot) {
+    return {
+        version: '1.0',
+        defaultProfileId: 'local',
+        profiles: [
+            {
+                id: 'local',
+                name: 'Local shell',
+                kind: 'local',
+                workingDirectory: projectRoot,
+            },
+        ],
+    };
+}
+export function loadRuntimeProfileStore(projectRoot) {
+    const storePath = path.join(projectRoot, PROFILE_STORE_RELATIVE_PATH);
+    if (!fs.existsSync(storePath)) {
+        return createDefaultRuntimeProfileStore(projectRoot);
+    }
+    const raw = fs.readFileSync(storePath, 'utf8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return createDefaultRuntimeProfileStore(projectRoot);
+    }
+    const validated = validateRuntimeProfileStore(parsed);
+    if (!validated.ok) {
+        return createDefaultRuntimeProfileStore(projectRoot);
+    }
+    return validated.value;
+}
+export function saveRuntimeProfileStore(projectRoot, store) {
+    const storePath = path.join(projectRoot, PROFILE_STORE_RELATIVE_PATH);
+    fs.mkdirSync(path.dirname(storePath), { recursive: true });
+    fs.writeFileSync(storePath, JSON.stringify(store, null, 2), 'utf8');
+}
+export function getRuntimeProfile(store, profileId) {
+    const id = profileId ?? store.defaultProfileId;
+    if (!id) {
+        return null;
+    }
+    return store.profiles.find((profile) => profile.id === id) ?? null;
+}
+export function redactRuntimeProfileForLogs(profile) {
+    if (profile.kind !== 'ssh') {
+        return profile;
+    }
+    const sshProfile = profile;
+    return {
+        ...sshProfile,
+        ...(sshProfile.privateKeyEnvVar ? { privateKeyEnvVar: '[REDACTED_ENV_VAR]' } : {}),
+        ...(sshProfile.passwordEnvVar ? { passwordEnvVar: '[REDACTED_ENV_VAR]' } : {}),
+    };
+}
+//# sourceMappingURL=profiles.js.map

package/dist/runtime/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/runtime/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAQ5B,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAA;AAMhF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB,EAAE,KAAa;IACtD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,YAAY,KAAK,qBAAqB,CAAC,CAAA;IACjD,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,iCAAiC,CAAC,CAAA;IACxE,IAAI,CAAC,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,mCAAmC,CAAC,CAAA;IAC5E,IAAI,CAAC,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,mCAAmC,CAAC,CAAA;IAE5E,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,oCAAoC,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,oCAAoC,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,2CAA2C,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,mDAAmD,CAAC,CAAA;QACnF,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,uCAAuC,CAAC,CAAA;IACvE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,iCAAiC,CAAC,EAAE,CAAA;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC/B,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAA;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;IAC1C,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,KAAK,SAAS,IAAI,QAAQ,CAAC,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,KAA4B;KACpC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO;QACL,OAAO,EAAE,KAAK;QACd,gBAAgB,EAAE,OAAO;QACzB,QAAQ,EAAE;YACR;gBACE,EAAE,EAAE,OAAO;gBACX,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,OAAO;gBACb,gBAAgB,EAAE,WAAW;aAC9B;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAA;IACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,gCAAgC,CAAC,WAAW,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC9C,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gCAAgC,CAAC,WAAW,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,SAAS,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;IACrD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,gCAAgC,CAAC,WAAW,CAAC,CAAA;IACtD,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,WAAmB,EAAE,KAA0B;IACrF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAA;IACrE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAA0B,EAAE,SAAkB;IAC9E,MAAM,EAAE,GAAG,SAAS,IAAI,KAAK,CAAC,gBAAgB,CAAA;IAC9C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAuB;IACjE,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,UAAU,GAAG,OAA4B,CAAA;IAC/C,OAAO;QACL,GAAG,UAAU;QACb,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAA;AACH,CAAC"}

package/dist/runtime/transcripts.d.ts

@@ -0,0 +1,59 @@
+import type { RuntimeExecutionResult } from './executor.js';
+export type PersistedRuntimeTranscript = {
+    version: '1.0';
+    createdAt: string;
+    command: string;
+    args: string[];
+    profileId: string;
+    profileKind: RuntimeExecutionResult['profileKind'];
+    success: boolean;
+    exitCode: number | null;
+    durationMs: number;
+    diagnostics: string[];
+    stdout: string;
+    stderr: string;
+    transcript: RuntimeExecutionResult['transcript'];
+    redactedProfile: RuntimeExecutionResult['redactedProfile'];
+};
+export type RuntimeTranscriptIndexEntry = {
+    id: string;
+    createdAt: string;
+    label: string;
+    profileId: string;
+    profileKind: RuntimeExecutionResult['profileKind'];
+    transcriptFile: string;
+    success: boolean;
+    exitCode: number | null;
+    durationMs: number;
+};
+export type RuntimeTranscriptIndex = {
+    version: '1.0';
+    updatedAt: string;
+    entries: RuntimeTranscriptIndexEntry[];
+};
+export type RuntimeTranscriptSummary = {
+    total: number;
+    successful: number;
+    failed: number;
+    latestEntry: RuntimeTranscriptIndexEntry | null;
+};
+export type PruneRuntimeTranscriptsOptions = {
+    keep?: number;
+    maxAgeDays?: number;
+    profileId?: string;
+    label?: string;
+    dryRun?: boolean;
+};
+export type PruneRuntimeTranscriptsResult = {
+    removedEntries: RuntimeTranscriptIndexEntry[];
+    keptEntries: RuntimeTranscriptIndexEntry[];
+    missingFilesRemoved: number;
+    indexPath: string;
+};
+export declare function persistRuntimeTranscript(projectRoot: string, label: string, result: RuntimeExecutionResult): string;
+export declare function loadRuntimeTranscriptIndex(projectRoot: string): RuntimeTranscriptIndex;
+export declare function saveRuntimeTranscriptIndex(projectRoot: string, index: RuntimeTranscriptIndex): void;
+export declare function appendRuntimeTranscriptIndex(projectRoot: string, entry: RuntimeTranscriptIndexEntry): void;
+export declare function summarizeRuntimeTranscripts(index: RuntimeTranscriptIndex): RuntimeTranscriptSummary;
+export declare function pruneRuntimeTranscripts(projectRoot: string, options?: PruneRuntimeTranscriptsOptions): PruneRuntimeTranscriptsResult;
+//# sourceMappingURL=transcripts.d.ts.map

package/dist/runtime/transcripts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcripts.d.ts","sourceRoot":"","sources":["../../src/runtime/transcripts.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACxC,OAAO,EAAE,KAAK,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,sBAAsB,CAAC,aAAa,CAAC,CAAA;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAA;IAChD,eAAe,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAA;CAC1D,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACzC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,sBAAsB,CAAC,aAAa,CAAC,CAAA;IAClD,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACpC,OAAO,EAAE,KAAK,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,2BAA2B,EAAE,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,2BAA2B,GAAG,IAAI,CAAA;CAC/C,CAAA;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC3C,cAAc,EAAE,2BAA2B,EAAE,CAAA;IAC7C,WAAW,EAAE,2BAA2B,EAAE,CAAA;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;CACjB,CAAA;AAiBD,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAsCnH;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,sBAAsB,CA4BtF;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAInG;AAED,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAU1G;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,sBAAsB,GAAG,wBAAwB,CAUnG;AAsBD,wBAAgB,uBAAuB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,8BAAmC,GAC1C,6BAA6B,CAyD/B"}

package/dist/runtime/transcripts.js

@@ -0,0 +1,172 @@
+import fs from 'node:fs';
+import path from 'node:path';
+const TRANSCRIPTS_RELATIVE_DIR = path.join('.lumis', 'transcripts');
+const TRANSCRIPT_INDEX_FILE = 'index.json';
+function getTranscriptPaths(projectRoot) {
+    const dir = path.join(projectRoot, TRANSCRIPTS_RELATIVE_DIR);
+    return {
+        dir,
+        indexPath: path.join(dir, TRANSCRIPT_INDEX_FILE),
+    };
+}
+function sanitizeFileToken(token) {
+    return token.replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 40);
+}
+export function persistRuntimeTranscript(projectRoot, label, result) {
+    const transcriptsDir = path.join(projectRoot, TRANSCRIPTS_RELATIVE_DIR);
+    fs.mkdirSync(transcriptsDir, { recursive: true });
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const fileName = `${timestamp}-${sanitizeFileToken(label)}-${sanitizeFileToken(result.profileId)}.json`;
+    const filePath = path.join(transcriptsDir, fileName);
+    const payload = {
+        version: '1.0',
+        createdAt: new Date().toISOString(),
+        command: result.command,
+        args: result.args,
+        profileId: result.profileId,
+        profileKind: result.profileKind,
+        success: result.success,
+        exitCode: result.exitCode,
+        durationMs: result.durationMs,
+        diagnostics: result.diagnostics,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        transcript: result.transcript,
+        redactedProfile: result.redactedProfile,
+    };
+    fs.writeFileSync(filePath, JSON.stringify(payload, null, 2), 'utf8');
+    appendRuntimeTranscriptIndex(projectRoot, {
+        id: `${Date.now()}-${Math.random().toString(16).slice(2, 10)}`,
+        createdAt: payload.createdAt,
+        label,
+        profileId: payload.profileId,
+        profileKind: payload.profileKind,
+        transcriptFile: path.relative(projectRoot, filePath).replaceAll('\\', '/'),
+        success: payload.success,
+        exitCode: payload.exitCode,
+        durationMs: payload.durationMs,
+    });
+    return filePath;
+}
+export function loadRuntimeTranscriptIndex(projectRoot) {
+    const { indexPath } = getTranscriptPaths(projectRoot);
+    if (!fs.existsSync(indexPath)) {
+        return {
+            version: '1.0',
+            updatedAt: new Date().toISOString(),
+            entries: [],
+        };
+    }
+    try {
+        const raw = fs.readFileSync(indexPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== '1.0' || !Array.isArray(parsed.entries)) {
+            return {
+                version: '1.0',
+                updatedAt: new Date().toISOString(),
+                entries: [],
+            };
+        }
+        return parsed;
+    }
+    catch {
+        return {
+            version: '1.0',
+            updatedAt: new Date().toISOString(),
+            entries: [],
+        };
+    }
+}
+export function saveRuntimeTranscriptIndex(projectRoot, index) {
+    const { dir: transcriptsDir, indexPath } = getTranscriptPaths(projectRoot);
+    fs.mkdirSync(transcriptsDir, { recursive: true });
+    fs.writeFileSync(indexPath, JSON.stringify(index, null, 2), 'utf8');
+}
+export function appendRuntimeTranscriptIndex(projectRoot, entry) {
+    const index = loadRuntimeTranscriptIndex(projectRoot);
+    index.entries.unshift(entry);
+    index.updatedAt = new Date().toISOString();
+    if (index.entries.length > 200) {
+        index.entries = index.entries.slice(0, 200);
+    }
+    saveRuntimeTranscriptIndex(projectRoot, index);
+}
+export function summarizeRuntimeTranscripts(index) {
+    const successful = index.entries.filter((entry) => entry.success).length;
+    const failed = index.entries.length - successful;
+    return {
+        total: index.entries.length,
+        successful,
+        failed,
+        latestEntry: index.entries[0] ?? null,
+    };
+}
+function shouldKeepEntry(entry, options, nowMs) {
+    if (options.profileId && entry.profileId !== options.profileId) {
+        return true;
+    }
+    if (options.label && !entry.label.startsWith(options.label)) {
+        return true;
+    }
+    if (options.maxAgeDays !== undefined) {
+        const createdAtMs = Date.parse(entry.createdAt);
+        const maxAgeMs = options.maxAgeDays * 24 * 60 * 60 * 1000;
+        if (!Number.isNaN(createdAtMs) && nowMs - createdAtMs <= maxAgeMs) {
+            return true;
+        }
+    }
+    return false;
+}
+export function pruneRuntimeTranscripts(projectRoot, options = {}) {
+    const index = loadRuntimeTranscriptIndex(projectRoot);
+    const { indexPath } = getTranscriptPaths(projectRoot);
+    const nowMs = Date.now();
+    const keepCount = options.keep ?? 20;
+    const filtered = index.entries.filter((entry) => {
+        if (options.profileId && entry.profileId !== options.profileId) {
+            return false;
+        }
+        if (options.label && !entry.label.startsWith(options.label)) {
+            return false;
+        }
+        return true;
+    });
+    const guaranteedKeepIds = new Set(filtered.slice(0, keepCount).map((entry) => entry.id));
+    const removedEntries = [];
+    const keptEntries = [];
+    let missingFilesRemoved = 0;
+    for (const entry of index.entries) {
+        const transcriptPath = path.join(projectRoot, entry.transcriptFile);
+        const fileExists = fs.existsSync(transcriptPath);
+        const matchesFilter = filtered.some((candidate) => candidate.id === entry.id);
+        const keepBecauseRecent = guaranteedKeepIds.has(entry.id);
+        const keepBecausePolicy = matchesFilter ? shouldKeepEntry(entry, options, nowMs) : true;
+        if (keepBecauseRecent || keepBecausePolicy) {
+            keptEntries.push(entry);
+            continue;
+        }
+        removedEntries.push(entry);
+        if (!options.dryRun) {
+            if (fileExists) {
+                fs.rmSync(transcriptPath, { force: true });
+            }
+            else {
+                missingFilesRemoved += 1;
+            }
+        }
+    }
+    if (!options.dryRun) {
+        saveRuntimeTranscriptIndex(projectRoot, {
+            version: '1.0',
+            updatedAt: new Date().toISOString(),
+            entries: keptEntries,
+        });
+    }
+    return {
+        removedEntries,
+        keptEntries,
+        missingFilesRemoved,
+        indexPath,
+    };
+}
+//# sourceMappingURL=transcripts.js.map

package/dist/runtime/transcripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcripts.js","sourceRoot":"","sources":["../../src/runtime/transcripts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AA6D5B,MAAM,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;AACnE,MAAM,qBAAqB,GAAG,YAAY,CAAA;AAE1C,SAAS,kBAAkB,CAAC,WAAmB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAA;IAC5D,OAAO;QACN,GAAG;QACH,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC;KAChD,CAAA;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,WAAmB,EAAE,KAAa,EAAE,MAA8B;IAC1G,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAA;IACvE,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEjD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAChE,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAA;IACvG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IAEpD,MAAM,OAAO,GAA+B;QAC3C,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;KACvC,CAAA;IAED,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACpE,4BAA4B,CAAC,WAAW,EAAE;QACzC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QAC9D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;QAC1E,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAA;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,EAAE;SACX,CAAA;IACF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAA;QACxD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,OAAO,EAAE,EAAE;aACX,CAAA;QACF,CAAC;QACD,OAAO,MAAM,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,EAAE;SACX,CAAA;IACF,CAAC;AACF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,WAAmB,EAAE,KAA6B;IAC5F,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAC1E,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,WAAmB,EAAE,KAAkC;IACnG,MAAM,KAAK,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAA;IACrD,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5B,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAE1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC;IAED,0BAA0B,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAA6B;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAA;IAEhD,OAAO;QACN,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC3B,UAAU;QACV,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI;KACrC,CAAA;AACF,CAAC;AAED,SAAS,eAAe,CAAC,KAAkC,EAAE,OAAuC,EAAE,KAAa;IAClH,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAChE,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,GAAG,WAAW,IAAI,QAAQ,EAAE,CAAC;YACnE,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAA;AACb,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,WAAmB,EACnB,UAA0C,EAAE;IAE5C,MAAM,KAAK,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAA;IACrD,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAEpC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/C,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAChE,OAAO,KAAK,CAAA;QACb,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAA;QACb,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC,CAAC,CAAA;IAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAChG,MAAM,cAAc,GAAkC,EAAE,CAAA;IACxD,MAAM,WAAW,GAAkC,EAAE,CAAA;IACrD,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAE3B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,CAAA;QACnE,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;QAChD,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAA;QAC7E,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACzD,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAEvF,IAAI,iBAAiB,IAAI,iBAAiB,EAAE,CAAC;YAC5C,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACvB,SAAQ;QACT,CAAC;QAED,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,UAAU,EAAE,CAAC;gBAChB,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3C,CAAC;iBAAM,CAAC;gBACP,mBAAmB,IAAI,CAAC,CAAA;YACzB,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACrB,0BAA0B,CAAC,WAAW,EAAE;YACvC,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,WAAW;SACpB,CAAC,CAAA;IACH,CAAC;IAED,OAAO;QACN,cAAc;QACd,WAAW;QACX,mBAAmB;QACnB,SAAS;KACT,CAAA;AACF,CAAC"}

package/dist/tools/git-diff.d.ts

@@ -0,0 +1,3 @@
+import type { ToolResult } from './types.js';
+export declare function gitDiffTool(projectRoot: string, base?: string, filePath?: string): Promise<ToolResult>;
+//# sourceMappingURL=git-diff.d.ts.map

package/dist/tools/git-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-diff.d.ts","sourceRoot":"","sources":["../../src/tools/git-diff.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAa5G"}

package/dist/tools/git-diff.js

@@ -0,0 +1,16 @@
+import { runCommandTool } from './run-command.js';
+export async function gitDiffTool(projectRoot, base, filePath) {
+    const cmd = ['git', 'diff'];
+    if (base)
+        cmd.push(base);
+    if (filePath)
+        cmd.push('--', filePath);
+    const result = await runCommandTool(cmd, projectRoot, 15_000);
+    const trimmed = result.output.trim();
+    return {
+        ...result,
+        tool: 'git-diff',
+        output: trimmed.length === 0 ? '(no changes)' : trimmed,
+    };
+}
+//# sourceMappingURL=git-diff.js.map

package/dist/tools/git-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-diff.js","sourceRoot":"","sources":["../../src/tools/git-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGjD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,WAAmB,EAAE,IAAa,EAAE,QAAiB;IACtF,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAC3B,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAEtC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;IAE7D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACpC,OAAO;QACN,GAAG,MAAM;QACT,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;KACvD,CAAA;AACF,CAAC"}

package/dist/tools/index.d.ts

@@ -0,0 +1,24 @@
+import type { ToolResult } from './types.js';
+import { type WriteRecord } from './write-file.js';
+import type { ToolCall } from './types.js';
+export type { ToolCall, ToolResult, Diagnostic, DiagnosticSeverity, ToolOutcome, ToolCallType } from './types.js';
+export { rollbackLastWrite, type WriteRecord } from './write-file.js';
+export type VerificationGateLevel = 'strict' | 'standard' | 'off';
+export type VerificationReport = {
+    passed: boolean;
+    typecheckOutcome?: 'pass' | 'fail' | 'skipped';
+    testOutcome?: 'pass' | 'fail' | 'skipped';
+    errorCount: number;
+    warningCount: number;
+    summary: string;
+    results: ToolResult[];
+};
+/**
+ * Run all verification gates (typecheck + tests) and return a structured report.
+ */
+export declare function runVerificationGates(projectRoot: string, gateLevel?: VerificationGateLevel, testPattern?: string): Promise<VerificationReport>;
+/**
+ * Execute a single ToolCall and return its ToolResult.
+ */
+export declare function executeToolCall(call: ToolCall, projectRoot: string, writeLog: WriteRecord[]): Promise<ToolResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,EAAoC,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAMpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACjH,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAErE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAA;AAEjE,MAAM,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,OAAO,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,UAAU,EAAE,CAAA;CACrB,CAAA;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACzC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,qBAAkC,EAC7C,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAoD7B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACpC,IAAI,EAAE,QAAQ,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,WAAW,EAAE,GACrB,OAAO,CAAC,UAAU,CAAC,CA+BrB"}

package/dist/tools/index.js

@@ -0,0 +1,88 @@
+import { readFileTool } from './read-file.js';
+import { writeFileTool } from './write-file.js';
+import { runCommandTool } from './run-command.js';
+import { typecheckTool } from './typecheck.js';
+import { runTestsTool } from './run-tests.js';
+import { lintTool } from './lint.js';
+import { gitDiffTool } from './git-diff.js';
+export { rollbackLastWrite } from './write-file.js';
+/**
+ * Run all verification gates (typecheck + tests) and return a structured report.
+ */
+export async function runVerificationGates(projectRoot, gateLevel = 'standard', testPattern) {
+    if (gateLevel === 'off') {
+        return {
+            passed: true,
+            typecheckOutcome: 'skipped',
+            testOutcome: 'skipped',
+            errorCount: 0,
+            warningCount: 0,
+            summary: 'Verification gates disabled.',
+            results: [],
+        };
+    }
+    const results = [];
+    const tcResult = await typecheckTool(projectRoot);
+    results.push(tcResult);
+    const testResult = await runTestsTool(projectRoot, testPattern);
+    results.push(testResult);
+    const allDiagnostics = results.flatMap((r) => r.diagnostics ?? []);
+    const errorCount = allDiagnostics.filter((d) => d.severity === 'error').length;
+    const warningCount = allDiagnostics.filter((d) => d.severity === 'warning').length;
+    const typecheckOutcome = tcResult.outcome === 'success' ? 'pass' : 'fail';
+    const testOutcome = testResult.outcome === 'success' ? 'pass' : 'fail';
+    const failedGates = [];
+    if (typecheckOutcome === 'fail')
+        failedGates.push('typecheck');
+    if (testOutcome === 'fail')
+        failedGates.push('tests');
+    const shouldFailOnWarnings = gateLevel === 'strict' && warningCount > 0;
+    const passed = failedGates.length === 0 && !shouldFailOnWarnings;
+    const summaryParts = [];
+    summaryParts.push(`Typecheck: ${typecheckOutcome}`);
+    summaryParts.push(`Tests: ${testOutcome}`);
+    if (errorCount > 0)
+        summaryParts.push(`${errorCount} error(s)`);
+    if (warningCount > 0)
+        summaryParts.push(`${warningCount} warning(s)`);
+    if (!passed)
+        summaryParts.push(`FAILED: ${failedGates.join(', ')}${shouldFailOnWarnings ? ', warnings (strict mode)' : ''}`);
+    return {
+        passed,
+        typecheckOutcome,
+        testOutcome,
+        errorCount,
+        warningCount,
+        summary: summaryParts.join(' | '),
+        results,
+    };
+}
+/**
+ * Execute a single ToolCall and return its ToolResult.
+ */
+export async function executeToolCall(call, projectRoot, writeLog) {
+    switch (call.tool) {
+        case 'read-file':
+            return readFileTool(call.path, projectRoot);
+        case 'write-file':
+            return writeFileTool(call.path, call.content, projectRoot, writeLog);
+        case 'run-command':
+            return runCommandTool(call.cmd, call.cwd ?? projectRoot, call.timeoutMs);
+        case 'typecheck':
+            return typecheckTool(call.cwd ?? projectRoot);
+        case 'run-tests':
+            return runTestsTool(call.cwd ?? projectRoot, call.pattern);
+        case 'lint':
+            return lintTool(call.cwd ?? projectRoot, call.paths, call.fix);
+        case 'git-diff':
+            return gitDiffTool(projectRoot, call.base, call.path);
+        case 'search-repo': {
+            // Lightweight text grep — wraps ripgrep/grep; full RAG search is handled at chat layer
+            const cmd = call.fileGlob
+                ? ['grep', '-rn', '--include', call.fileGlob, '-m', String(call.maxResults ?? 20), call.query, '.']
+                : ['grep', '-rn', '-m', String(call.maxResults ?? 20), call.query, '.'];
+            return runCommandTool(cmd, projectRoot, 15_000);
+        }
+    }
+}
+//# sourceMappingURL=index.js.map