@inbrowser/agent 0.0.0-placeholder → 0.1.0

package/dist/cli/commands/serve.js

@@ -0,0 +1,65 @@
+/**
+ * `agent serve` — inverse-mode MCP server entrypoint.
+ *
+ * Boots a stdio MCP server exposing every injected agent's tools as
+ * one flat catalog to an external host (Claude Code, Claude Desktop,
+ * Cursor, ...). Tool-surface minimization is the host's concern
+ * (allowlists in Claude Code settings, etc.); this command doesn't
+ * filter.
+ *
+ * The process holds stdin/stdout for the MCP transport, so:
+ *   - no events go to stdout outside of --dry-run
+ *   - the function never returns under normal operation; it resolves
+ *     when the parent closes the transport.
+ *
+ * Agents come from `io.agents`. The CLI itself ships zero built-in
+ * agents — host packages (e.g. `firebase-agent-sdk`) wire their own
+ * agent definitions and call this command as a library.
+ */
+import { serveAgentsOverStdio } from '../../mcp/serve.js';
+import { UsageError } from '../parse.js';
+export async function serveCommand(args, io) {
+    const emit = io.emit;
+    const now = io.now ?? (() => new Date().toISOString());
+    const projectId = args.options['project'];
+    if (!projectId) {
+        throw new UsageError('missing --project: pass the Firebase project id for log routing', 'Example: --project my-app');
+    }
+    const eventsDir = args.options['events-dir'];
+    const agents = io.agents ?? [];
+    if (agents.length === 0) {
+        throw new UsageError('no agents wired into this serve command', 'Host packages compose `@inbrowser/agent` and call serveCommand with their own AgentDefinitions. The bare `agent serve` CLI ships zero built-ins.');
+    }
+    const agentApp = io.agentApp;
+    if (args.options['dry-run']) {
+        emit.event({
+            type: 'dry_run_plan',
+            ts: now(),
+            command: 'serve',
+            projectId,
+            liveMode: agentApp ? { projectId: agentApp.projectId } : null,
+            agents: agents.map((a) => ({
+                name: a.name,
+                tools: a.tools.map((t) => t.name),
+            })),
+            ...(eventsDir ? { eventsDir } : {}),
+        }, () => `[plan] serve · project=${projectId} · live=${agentApp ? agentApp.projectId : 'off'} · agents=${agents.map((a) => `${a.name}(${a.tools.length})`).join(',')}`);
+        emit.finish();
+        return 0;
+    }
+    const serve = io.serve ?? serveAgentsOverStdio;
+    const handle = await serve({
+        agents,
+        projectId,
+        ...(eventsDir ? { eventsDir } : {}),
+        ...(agentApp ? { agentApp } : {}),
+    });
+    // Wait until stdin closes (parent host disconnects).
+    await new Promise((resolve) => {
+        process.stdin.on('end', () => resolve());
+        process.stdin.on('close', () => resolve());
+    });
+    await handle.close();
+    return 0;
+}
+//# sourceMappingURL=serve.js.map

package/dist/cli/commands/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiBzC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAgB,EAAE,EAAkB;IACrE,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAuB,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAClB,iEAAiE,EACjE,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;IACnE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAClB,yCAAyC,EACzC,kJAAkJ,CACnJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC;IAE7B,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CACR;YACE,IAAI,EAAE,cAAc;YACpB,EAAE,EAAE,GAAG,EAAE;YACT,OAAO,EAAE,OAAO;YAChB,SAAS;YACT,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI;YAC7D,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClC,CAAC,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,EACD,GAAG,EAAE,CACH,0BAA0B,SAAS,WACjC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAClC,aAAa,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,IAAI,oBAAoB,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,MAAM;QACN,SAAS;QACT,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC,CAAC;IAEH,qDAAqD;IACrD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/undo.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `agent undo` — reverse a previously-committed mutation.
+ *
+ * Lookup flow:
+ *   1. Open the project's event log.
+ *   2. Find the `commit`-phase event with id === --event.
+ *   3. Refuse if `reversible: false` or `reverseOp` is missing.
+ *   4. Refuse if a `rollback`-phase event already references this id
+ *      (already undone — idempotent).
+ *   5. Otherwise emit either:
+ *      - A `undo_plan` event (when --dry-run is set), or
+ *      - An `undo_invocation` plan describing the recorded reverseOp.
+ *
+ * **This subcommand does NOT actually invoke the reverseOp tool.**
+ * That requires a `ToolRegistry` + `ToolContext` (LLM provider,
+ * sandbox, etc.) which the headless CLI doesn't have — those live in
+ * the host (the playground, or a specialized-agent process). The CLI
+ * surfaces the plan + appends a `rollback` event to the log; the host
+ * dispatches the actual reverse op when it re-reads the log.
+ *
+ * This split matches the rest of the CLI: it's a controller surface,
+ * not a Firebase admin tool. Hosting the dispatch in-CLI would force
+ * us to import @pyric/sandbox + @pyric/admin runtime deps just to
+ * run an undo, which doesn't fit the "small, scriptable, headless"
+ * design point.
+ */
+import { openEventLog } from '../../events/log.js';
+import type { Emitter } from '../output.js';
+import type { ParsedArgs } from '../parse.js';
+export interface UndoCommandIO {
+    emit: Emitter;
+    openLog?: typeof openEventLog;
+    now?: () => string;
+}
+export declare function undoCommand(args: ParsedArgs, io: UndoCommandIO): number;
+//# sourceMappingURL=undo.d.ts.map

package/dist/cli/commands/undo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"undo.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/undo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,YAAY,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,aAAa,GAAG,MAAM,CA0HvE"}

package/dist/cli/commands/undo.js

@@ -0,0 +1,132 @@
+/**
+ * `agent undo` — reverse a previously-committed mutation.
+ *
+ * Lookup flow:
+ *   1. Open the project's event log.
+ *   2. Find the `commit`-phase event with id === --event.
+ *   3. Refuse if `reversible: false` or `reverseOp` is missing.
+ *   4. Refuse if a `rollback`-phase event already references this id
+ *      (already undone — idempotent).
+ *   5. Otherwise emit either:
+ *      - A `undo_plan` event (when --dry-run is set), or
+ *      - An `undo_invocation` plan describing the recorded reverseOp.
+ *
+ * **This subcommand does NOT actually invoke the reverseOp tool.**
+ * That requires a `ToolRegistry` + `ToolContext` (LLM provider,
+ * sandbox, etc.) which the headless CLI doesn't have — those live in
+ * the host (the playground, or a specialized-agent process). The CLI
+ * surfaces the plan + appends a `rollback` event to the log; the host
+ * dispatches the actual reverse op when it re-reads the log.
+ *
+ * This split matches the rest of the CLI: it's a controller surface,
+ * not a Firebase admin tool. Hosting the dispatch in-CLI would force
+ * us to import @pyric/sandbox + @pyric/admin runtime deps just to
+ * run an undo, which doesn't fit the "small, scriptable, headless"
+ * design point.
+ */
+import { buildRollbackEvent } from '../../events/log-core.js';
+import { openEventLog } from '../../events/log.js';
+export function undoCommand(args, io) {
+    const projectId = args.options['project'];
+    const eventId = args.options['event'];
+    if (!projectId)
+        throw new Error('agent undo: --project is required');
+    if (!eventId)
+        throw new Error('agent undo: --event is required');
+    const eventsDir = args.options['events-dir'];
+    const dryRun = Boolean(args.options['dry-run']);
+    const openLog = io.openLog ?? openEventLog;
+    const now = io.now ?? (() => new Date().toISOString());
+    const log = openLog({
+        projectId,
+        ...(eventsDir ? { logDir: eventsDir } : {}),
+    });
+    try {
+        const all = log.read();
+        const target = all.find((e) => e.id === eventId);
+        if (!target) {
+            io.emit.event({
+                type: 'error',
+                name: 'NotFound',
+                message: `event ${eventId} not found in project ${projectId}`,
+            }, () => `error: event ${eventId} not found`);
+            io.emit.finish();
+            return 64;
+        }
+        if (target.phase !== 'commit') {
+            io.emit.event({
+                type: 'error',
+                name: 'NotCommit',
+                message: `event ${eventId} is phase=${target.phase}; only commit events can be undone`,
+            }, () => `error: event ${eventId} is phase=${target.phase}; not a commit`);
+            io.emit.finish();
+            return 64;
+        }
+        if (!target.reversible || !target.reverseOp) {
+            io.emit.event({
+                type: 'error',
+                name: 'Irreversible',
+                message: `event ${eventId} is marked reversible:false`,
+                reason: target.irreversibleReason ?? '(no reason recorded)',
+            }, () => `error: event ${eventId} is irreversible (${target.irreversibleReason ?? 'no reason recorded'})`);
+            io.emit.finish();
+            return 64;
+        }
+        const alreadyUndone = all.find((e) => e.phase === 'rollback' &&
+            typeof e.metadata?.['originalEventId'] === 'string' &&
+            e.metadata['originalEventId'] === eventId);
+        if (alreadyUndone) {
+            io.emit.event({
+                type: 'error',
+                name: 'AlreadyUndone',
+                message: `event ${eventId} was already undone by ${alreadyUndone.id}`,
+            }, () => `error: event ${eventId} was already undone by ${alreadyUndone.id}`);
+            io.emit.finish();
+            return 64;
+        }
+        const plan = buildUndoPlan(target, now);
+        if (dryRun) {
+            io.emit.event({ type: 'undo_plan', ...plan }, () => `[plan] undo · event=${eventId} · tool=${target.tool} → reverse with ${target.reverseOp?.tool}\n` +
+                `  target: ${target.target.kind}:${target.target.path}\n` +
+                `  args:   ${JSON.stringify(target.reverseOp?.args)}`);
+            io.emit.finish();
+            return 0;
+        }
+        // Append a rollback event so the host (or the auditor) can see
+        // that the undo was *requested*. The host is responsible for
+        // actually invoking the reverseOp.tool against its dispatch.
+        const rollback = log.append(buildRollbackEvent({
+            original: target,
+            reason: 'undo',
+            reverseOp: target.reverseOp,
+            agent: target.agent,
+            sessionId: target.sessionId,
+        }));
+        io.emit.event({
+            type: 'undo_recorded',
+            rollbackEventId: rollback.id,
+            ...plan,
+            nextStep: `Invoke ${target.reverseOp.tool} via your host's ToolDispatch with the recorded args. ` +
+                `The CLI cannot invoke tools directly — see undo.ts header for rationale.`,
+        }, () => `[recorded] rollback ${rollback.id} for event ${eventId}\n` +
+            `  reverseOp: ${target.reverseOp?.tool}(${JSON.stringify(target.reverseOp?.args)})\n` +
+            `  next: invoke that tool via your host's ToolDispatch.`);
+        io.emit.finish();
+        return 0;
+    }
+    finally {
+        log.close();
+    }
+}
+function buildUndoPlan(target, now) {
+    return {
+        ts: now(),
+        eventId: target.id,
+        originalTool: target.tool,
+        originalAgent: target.agent,
+        originalSessionId: target.sessionId,
+        target: target.target,
+        reverseOp: target.reverseOp,
+    };
+}
+//# sourceMappingURL=undo.js.map

package/dist/cli/commands/undo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"undo.js","sourceRoot":"","sources":["../../../src/cli/commands/undo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAWnD,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,EAAiB;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAuB,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAuB,CAAC;IAC5D,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAEjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,IAAI,YAAY,CAAC;IAC3C,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvD,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,SAAS;QACT,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,EAAE,CAAC,IAAI,CAAC,KAAK,CACX;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,SAAS,OAAO,yBAAyB,SAAS,EAAE;aAC9D,EACD,GAAG,EAAE,CAAC,gBAAgB,OAAO,YAAY,CAC1C,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,EAAE,CAAC,IAAI,CAAC,KAAK,CACX;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,SAAS,OAAO,aAAa,MAAM,CAAC,KAAK,oCAAoC;aACvF,EACD,GAAG,EAAE,CAAC,gBAAgB,OAAO,aAAa,MAAM,CAAC,KAAK,gBAAgB,CACvE,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,EAAE,CAAC,IAAI,CAAC,KAAK,CACX;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,SAAS,OAAO,6BAA6B;gBACtD,MAAM,EAAE,MAAM,CAAC,kBAAkB,IAAI,sBAAsB;aAC5D,EACD,GAAG,EAAE,CACH,gBAAgB,OAAO,qBAAqB,MAAM,CAAC,kBAAkB,IAAI,oBAAoB,GAAG,CACnG,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,KAAK,KAAK,UAAU;YACtB,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,CAAC,KAAK,QAAQ;YACnD,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,OAAO,CAC5C,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,EAAE,CAAC,IAAI,CAAC,KAAK,CACX;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,SAAS,OAAO,0BAA0B,aAAa,CAAC,EAAE,EAAE;aACtE,EACD,GAAG,EAAE,CAAC,gBAAgB,OAAO,0BAA0B,aAAa,CAAC,EAAE,EAAE,CAC1E,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAExC,IAAI,MAAM,EAAE,CAAC;YACX,EAAE,CAAC,IAAI,CAAC,KAAK,CACX,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,EAC9B,GAAG,EAAE,CACH,uBAAuB,OAAO,WAAW,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,SAAS,EAAE,IAAI,IAAI;gBACjG,aAAa,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI;gBACzD,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CACxD,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,+DAA+D;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CACzB,kBAAkB,CAAC;YACjB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CACH,CAAC;QAEF,EAAE,CAAC,IAAI,CAAC,KAAK,CACX;YACE,IAAI,EAAE,eAAe;YACrB,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,GAAG,IAAI;YACP,QAAQ,EACN,UAAU,MAAM,CAAC,SAAS,CAAC,IAAI,wDAAwD;gBACvF,0EAA0E;SAC7E,EACD,GAAG,EAAE,CACH,uBAAuB,QAAQ,CAAC,EAAE,cAAc,OAAO,IAAI;YAC3D,gBAAgB,MAAM,CAAC,SAAS,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrF,wDAAwD,CAC3D,CAAC;QACF,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAqB,EAAE,GAAiB;IAC7D,OAAO;QACL,EAAE,EAAE,GAAG,EAAE;QACT,OAAO,EAAE,MAAM,CAAC,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,aAAa,EAAE,MAAM,CAAC,KAAK;QAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/cli/fixtures.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Scripted LLM fixtures + fake sandbox used by the headless CLI. Real
+ * provider wiring lives in the host (the playground UI). These live
+ * here so `agent run` and `agent fleet` can run end-to-end without
+ * any API credentials.
+ */
+import type { LlmClient, SandboxHandle, ToolHandler } from '../index.js';
+export type ScenarioId = 'echo' | 'write-rules';
+export declare function scriptedLlm(scenario: ScenarioId, marker?: string): LlmClient;
+export declare function fakeSandbox(): SandboxHandle;
+export declare const writeRulesTool: ToolHandler<{
+    source: string;
+}>;
+export declare const writeCodeTool: ToolHandler<{
+    code: string;
+}>;
+//# sourceMappingURL=fixtures.d.ts.map

package/dist/cli/fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures.d.ts","sourceRoot":"","sources":["../../src/cli/fixtures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAa,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEpF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,CAAC;AAEhD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAK,GAAG,SAAS,CAuDxE;AAED,wBAAgB,WAAW,IAAI,aAAa,CAc3C;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAgB1D,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAWvD,CAAC"}

package/dist/cli/fixtures.js

@@ -0,0 +1,107 @@
+/**
+ * Scripted LLM fixtures + fake sandbox used by the headless CLI. Real
+ * provider wiring lives in the host (the playground UI). These live
+ * here so `agent run` and `agent fleet` can run end-to-end without
+ * any API credentials.
+ */
+export function scriptedLlm(scenario, marker = '') {
+    let callCount = 0;
+    return {
+        id: `fixture-${scenario}`,
+        supportsTools: true,
+        chat(req) {
+            const turn = callCount++;
+            return (async function* () {
+                if (scenario === 'write-rules') {
+                    if (turn === 0) {
+                        yield { kind: 'thinking', chunk: 'Planning a minimal owner-only rule.\n' };
+                        yield {
+                            kind: 'tool_call',
+                            id: `c1${marker ? `-${marker}` : ''}`,
+                            name: 'writeRules',
+                            args: {
+                                source: `// ${marker || 'default'} rules\nrules_version='2';\nservice cloud.firestore {\n  match /{path=**} {\n    allow read, write: if request.auth != null;\n  }\n}\n`,
+                            },
+                        };
+                        yield {
+                            kind: 'turn_complete',
+                            usage: { promptTokens: 200, completionTokens: 50 },
+                            details: { requestedModel: 'fixture-1' },
+                        };
+                        return;
+                    }
+                    yield { kind: 'text', chunk: 'Rules deployed. Read/write is gated on request.auth.' };
+                    yield {
+                        kind: 'turn_complete',
+                        usage: { promptTokens: 250, completionTokens: 12 },
+                        details: { requestedModel: 'fixture-1' },
+                    };
+                    return;
+                }
+                // echo — scan backward for the latest user message.
+                let userMsg = req.messages[req.messages.length - 1];
+                for (let i = req.messages.length - 1; i >= 0; i--) {
+                    const m = req.messages[i];
+                    if (m?.role === 'user') {
+                        userMsg = m;
+                        break;
+                    }
+                }
+                const text = `[echo] ${userMsg?.text ?? '(no input)'}`;
+                for (const word of text.split(' ')) {
+                    yield { kind: 'text', chunk: word + ' ' };
+                }
+                yield {
+                    kind: 'turn_complete',
+                    usage: { promptTokens: 12, completionTokens: text.split(' ').length },
+                    details: { requestedModel: 'fixture-1' },
+                };
+            })();
+        },
+    };
+}
+export function fakeSandbox() {
+    return {
+        async run() {
+            return { ok: true, durationMs: 0, docsTouched: 0, errors: 0, entries: [] };
+        },
+        async deployRules() {
+            return { ok: true, messages: [] };
+        },
+        async readState() {
+            return {};
+        },
+        reseed() { },
+        dispose() { },
+    };
+}
+export const writeRulesTool = {
+    name: 'writeRules',
+    description: 'Write the Firestore rules source.',
+    parameters: {
+        type: 'object',
+        properties: { source: { type: 'string', description: 'Rules text' } },
+        required: ['source'],
+    },
+    async execute({ source }) {
+        return {
+            ok: true,
+            summary: `wrote ${source.length} chars of rules`,
+            data: { source },
+            workspacePatch: { rules: source },
+        };
+    },
+};
+export const writeCodeTool = {
+    name: 'writeCode',
+    description: 'Write the JS code source.',
+    parameters: {
+        type: 'object',
+        properties: { code: { type: 'string' } },
+        required: ['code'],
+    },
+    async execute({ code }) {
+        return { ok: true, summary: `wrote ${code.length} chars of code`, workspacePatch: { code } };
+    },
+};
+//# sourceMappingURL=fixtures.js.map

package/dist/cli/fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures.js","sourceRoot":"","sources":["../../src/cli/fixtures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,UAAU,WAAW,CAAC,QAAoB,EAAE,MAAM,GAAG,EAAE;IAC3D,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO;QACL,EAAE,EAAE,WAAW,QAAQ,EAAE;QACzB,aAAa,EAAE,IAAI;QACnB,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,SAAS,CAAC;gBACrB,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;oBAC/B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;wBACf,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;wBAC3E,MAAM;4BACJ,IAAI,EAAE,WAAW;4BACjB,EAAE,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;4BACrC,IAAI,EAAE,YAAY;4BAClB,IAAI,EAAE;gCACJ,MAAM,EAAE,MAAM,MAAM,IAAI,SAAS,wIAAwI;6BAC1K;yBACF,CAAC;wBACF,MAAM;4BACJ,IAAI,EAAE,eAAe;4BACrB,KAAK,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE;4BAClD,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;yBACzC,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;oBACtF,MAAM;wBACJ,IAAI,EAAE,eAAe;wBACrB,KAAK,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE;wBAClD,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;qBACzC,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,oDAAoD;gBACpD,IAAI,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACpD,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAClD,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;oBAC1B,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;wBACvB,OAAO,GAAG,CAAC,CAAC;wBACZ,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,GAAG,UAAU,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,CAAC;gBACvD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,GAAG,EAAE,CAAC;gBAC5C,CAAC;gBACD,MAAM;oBACJ,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;oBACrE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;iBACzC,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,KAAK,CAAC,GAAG;YACP,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,WAAW;YACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,SAAS;YACb,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAI,CAAC;QACX,OAAO,KAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAoC;IAC7D,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,mCAAmC;IAChD,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;QACrE,QAAQ,EAAE,CAAC,QAAQ,CAAC;KACrB;IACD,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE;QACtB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,SAAS,MAAM,CAAC,MAAM,iBAAiB;YAChD,IAAI,EAAE,EAAE,MAAM,EAAE;YAChB,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAClC,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAkC;IAC1D,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,2BAA2B;IACxC,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACxC,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB;IACD,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;QACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,CAAC,MAAM,gBAAgB,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IAC/F,CAAC;CACF,CAAC"}

package/dist/cli/hardening.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Input hardening — Agent DX CLI axis 5.
+ *
+ * Defends against agent-specific failure modes:
+ *   - control chars in resource ids → break logs and downstream tools
+ *   - path traversal (`..`, `%2e`, raw URL-encoded segments) → escape
+ *     the intended sandbox (e.g. --log-dir, --json file path)
+ *   - embedded query params (`?`, `#`, raw `&`) in ids that the agent
+ *     would otherwise let through as part of a hallucinated URL
+ *   - oversized inputs that would balloon the session log
+ *
+ * Failure mode: throw `InputHardeningError`. The CLI top-level catches
+ * it and emits `{type:"error", code:"INPUT_HARDENED", field, reason}`
+ * as a single NDJSON event with exit code 64 (EX_USAGE).
+ */
+export declare class InputHardeningError extends Error {
+    readonly field: string;
+    readonly reason: string;
+    readonly value: string;
+    readonly name = "InputHardeningError";
+    constructor(field: string, reason: string, value: string);
+}
+export interface HardeningRules {
+    rejectControlChars?: boolean;
+    rejectPathTraversal?: boolean;
+    rejectQueryChars?: boolean;
+    maxLength?: number;
+    pattern?: string;
+}
+export declare function hardenString(field: string, value: string, rules: HardeningRules): string;
+/**
+ * Path hardening: in addition to string hardening, validate that the
+ * resolved path is either absolute or stays within CWD. Symlinks and
+ * platform-specific normalization are out of scope at this layer —
+ * the resolved path is returned and consumers are responsible for
+ * `realpath`-ing if they care.
+ */
+export declare function hardenPath(field: string, raw: string, rules: HardeningRules, cwd: string): string;
+//# sourceMappingURL=hardening.d.ts.map

package/dist/cli/hardening.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardening.d.ts","sourceRoot":"","sources":["../../src/cli/hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJxB,SAAkB,IAAI,yBAAyB;gBAEpC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM;CAIzB;AAOD,MAAM,WAAW,cAAc;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CA0BxF;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAKjG"}

package/dist/cli/hardening.js

@@ -0,0 +1,68 @@
+/**
+ * Input hardening — Agent DX CLI axis 5.
+ *
+ * Defends against agent-specific failure modes:
+ *   - control chars in resource ids → break logs and downstream tools
+ *   - path traversal (`..`, `%2e`, raw URL-encoded segments) → escape
+ *     the intended sandbox (e.g. --log-dir, --json file path)
+ *   - embedded query params (`?`, `#`, raw `&`) in ids that the agent
+ *     would otherwise let through as part of a hallucinated URL
+ *   - oversized inputs that would balloon the session log
+ *
+ * Failure mode: throw `InputHardeningError`. The CLI top-level catches
+ * it and emits `{type:"error", code:"INPUT_HARDENED", field, reason}`
+ * as a single NDJSON event with exit code 64 (EX_USAGE).
+ */
+export class InputHardeningError extends Error {
+    field;
+    reason;
+    value;
+    name = 'InputHardeningError';
+    constructor(field, reason, value) {
+        super(`Input hardening rejected ${field}: ${reason}`);
+        this.field = field;
+        this.reason = reason;
+        this.value = value;
+    }
+}
+const CONTROL_CHAR_RE = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/;
+const PATH_TRAVERSAL_RE = /(^|[\\/])\.\.([\\/]|$)/;
+const PERCENT_ENCODED_DOT_RE = /%2e/i;
+const QUERY_CHARS_RE = /[?#]/;
+export function hardenString(field, value, rules) {
+    if (rules.maxLength !== undefined && value.length > rules.maxLength) {
+        throw new InputHardeningError(field, `exceeds max length ${rules.maxLength} (got ${value.length})`, value);
+    }
+    if (rules.rejectControlChars && CONTROL_CHAR_RE.test(value)) {
+        throw new InputHardeningError(field, 'contains control characters', value);
+    }
+    if (rules.rejectPathTraversal) {
+        if (PATH_TRAVERSAL_RE.test(value)) {
+            throw new InputHardeningError(field, 'contains path traversal segment "../"', value);
+        }
+        if (PERCENT_ENCODED_DOT_RE.test(value)) {
+            throw new InputHardeningError(field, 'contains percent-encoded dot (%2e)', value);
+        }
+    }
+    if (rules.rejectQueryChars && QUERY_CHARS_RE.test(value)) {
+        throw new InputHardeningError(field, 'contains URL query/fragment chars (? #)', value);
+    }
+    if (rules.pattern && !new RegExp(rules.pattern).test(value)) {
+        throw new InputHardeningError(field, `does not match required pattern ${rules.pattern}`, value);
+    }
+    return value;
+}
+/**
+ * Path hardening: in addition to string hardening, validate that the
+ * resolved path is either absolute or stays within CWD. Symlinks and
+ * platform-specific normalization are out of scope at this layer —
+ * the resolved path is returned and consumers are responsible for
+ * `realpath`-ing if they care.
+ */
+export function hardenPath(field, raw, rules, cwd) {
+    hardenString(field, raw, { ...rules, rejectControlChars: rules.rejectControlChars ?? true });
+    return raw.startsWith('/') || /^[A-Za-z]:[\\/]/.test(raw)
+        ? raw
+        : `${cwd.replace(/\/$/, '')}/${raw}`;
+}
+//# sourceMappingURL=hardening.js.map

package/dist/cli/hardening.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardening.js","sourceRoot":"","sources":["../../src/cli/hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAGjC;IACA;IACA;IAJO,IAAI,GAAG,qBAAqB,CAAC;IAC/C,YACW,KAAa,EACb,MAAc,EACd,KAAa;QAEtB,KAAK,CAAC,4BAA4B,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;QAJ7C,UAAK,GAAL,KAAK,CAAQ;QACb,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAQ;IAGxB,CAAC;CACF;AAED,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAC3D,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AACnD,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,cAAc,GAAG,MAAM,CAAC;AAU9B,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,KAAqB;IAC9E,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,KAAK,EACL,sBAAsB,KAAK,CAAC,SAAS,SAAS,KAAK,CAAC,MAAM,GAAG,EAC7D,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAAC,KAAK,EAAE,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAAC,KAAK,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,KAAK,EAAE,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,mBAAmB,CAAC,KAAK,EAAE,yCAAyC,EAAE,KAAK,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAAC,KAAK,EAAE,mCAAmC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,GAAW,EAAE,KAAqB,EAAE,GAAW;IACvF,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;AACzC,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `@inbrowser/agent/cli` — programmatic entry to the same CLI surface
+ * the `agent` binary exposes. Use this when embedding the CLI inside
+ * another process (e.g. an MCP server, an in-process supervisor) so
+ * that argv parsing, hardening, and output emission stay consistent.
+ */
+export { main } from './main.js';
+export type { MainOptions } from './main.js';
+export { runCommand } from './commands/run.js';
+export type { RunCommandIO, RunPayload } from './commands/run.js';
+export { fleetCommand } from './commands/fleet.js';
+export type { FleetCommandIO } from './commands/fleet.js';
+export { describeCommand } from './commands/describe.js';
+export { schemaCommand } from './commands/schema.js';
+export { helpCommand, versionCommand } from './commands/help.js';
+export { parseArgs, UsageError, InputHardeningError } from './parse.js';
+export type { ParsedArgs } from './parse.js';
+export { createEmitter, errorEvent, pickMode } from './output.js';
+export type { Emitter, OutputMode, OutputOptions } from './output.js';
+export { hardenString, hardenPath } from './hardening.js';
+export type { HardeningRules } from './hardening.js';
+export { openSessionLog, defaultLogDir } from './session-log.js';
+export type { SessionLog, OpenSessionLogOptions } from './session-log.js';
+export { scriptedLlm, fakeSandbox, writeRulesTool, writeCodeTool } from './fixtures.js';
+export type { ScenarioId } from './fixtures.js';
+export { CLI_SPEC, findCommand } from './spec.js';
+export type { CliSpec, CommandSpec, OptionSpec, OptionType } from './spec.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjE,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACxF,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAClD,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,19 @@
+/**
+ * `@inbrowser/agent/cli` — programmatic entry to the same CLI surface
+ * the `agent` binary exposes. Use this when embedding the CLI inside
+ * another process (e.g. an MCP server, an in-process supervisor) so
+ * that argv parsing, hardening, and output emission stay consistent.
+ */
+export { main } from './main.js';
+export { runCommand } from './commands/run.js';
+export { fleetCommand } from './commands/fleet.js';
+export { describeCommand } from './commands/describe.js';
+export { schemaCommand } from './commands/schema.js';
+export { helpCommand, versionCommand } from './commands/help.js';
+export { parseArgs, UsageError, InputHardeningError } from './parse.js';
+export { createEmitter, errorEvent, pickMode } from './output.js';
+export { hardenString, hardenPath } from './hardening.js';
+export { openSessionLog, defaultLogDir } from './session-log.js';
+export { scriptedLlm, fakeSandbox, writeRulesTool, writeCodeTool } from './fixtures.js';
+export { CLI_SPEC, findCommand } from './spec.js';
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAExF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC"}

package/dist/cli/llm/openrouter.d.ts

@@ -0,0 +1,33 @@
+/**
+ * OpenRouter `LlmClient` for the CLI's `agent run`.
+ *
+ * Distinct from the playground's `openrouterProvider` in
+ * `examples/admin-compat-browser/src/openrouter.ts` (which is browser-
+ * specific — reads keys from localStorage, surfaces BYOK forms, etc.).
+ * This module is CLI-native: it takes its config explicitly at
+ * construction time (no env-var sniffing here — the caller decides
+ * how to source the key) and implements the narrow `LlmClient`
+ * contract that `@inbrowser/agent`' strategy + session expect.
+ *
+ * Streams via OpenAI-compatible SSE. Function-calling supported via
+ * `tools` + `tool_choice: 'auto'`. Reasoning surfaced through
+ * `reasoning.effort` + `include_reasoning` headers for models that
+ * carry extended thinking (GLM, DeepSeek-R1, Claude, GPT reasoning
+ * models). Cost surfaced through OpenRouter's per-call `usage.cost`
+ * field so the agent's `MetricsCollector` doesn't need a per-model
+ * pricing table for OpenRouter-served models.
+ */
+import type { LlmClient } from '../../types/llm.js';
+export interface OpenRouterConfig {
+    apiKey: string;
+    /** OpenRouter model id, e.g. `z-ai/glm-4.6`. */
+    model: string;
+    reasoningEffort?: 'off' | 'low' | 'medium' | 'high';
+    /** Override the endpoint (e.g. for an OpenAI-compatible proxy). */
+    baseUrl?: string;
+    /** Optional referer / title headers OpenRouter shows on the dashboard. */
+    referer?: string;
+    title?: string;
+}
+export declare function openRouterClient(config: OpenRouterConfig): LlmClient;
+//# sourceMappingURL=openrouter.d.ts.map

package/dist/cli/llm/openrouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openrouter.d.ts","sourceRoot":"","sources":["../../../src/cli/llm/openrouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAA0B,SAAS,EAAY,MAAM,oBAAoB,CAAC;AAItF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpD,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,CA+KpE"}