@indigoai-us/hq-cloud 6.11.15 → 6.11.16

package/.github/workflows/publish.yml

@@ -2,77 +2,33 @@ name: Publish to npm
 on:
   push:
     tags: ["v*"]
-  # Manual trigger as a fallback when a tag push doesn't fire the workflow
-  # (e.g. tag created via API, or `gh pr merge` attribution edge cases that
-  # bypass Actions trigger). Pick the existing tag to publish — the
-  # checkout step's `ref:` honors this input.
+  # Manual trigger: republish an existing tag (set `tag`, dry_run=false), or run
+  # a dry-run validation of the current branch (leave `tag` empty, dry_run=true).
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Tag to publish (e.g. v5.39.0). Must already exist.'
-        required: true
+        description: "Tag to publish (e.g. v6.11.16). Must already exist. Empty = current ref."
+        required: false
         type: string
+      dry_run:
+        description: "Dry-run (validate build/pack without publishing)"
+        type: boolean
+        default: true
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # On workflow_dispatch, checkout the input tag rather than the
-          # branch the dispatch was launched from. On push events, this is
-          # empty/unset → falls back to the tag that triggered the push.
-          ref: ${{ inputs.tag || github.ref }}
-      - uses: actions/setup-node@v4
-        with:
-          # Node 24 ships npm 11.x, required for npm's trusted-publisher OIDC
-          # token-exchange flow. Node 22 ships npm 10.9.x, which signs sigstore
-          # provenance via OIDC but cannot swap the OIDC token for a short-lived
-          # publish token — the PUT then goes out unauthenticated and npm returns
-          # a masked 404. Self-upgrading npm on top of npm 10 trips a known
-          # promise-retry MODULE_NOT_FOUND bug during self-replacement; upgrading
-          # the Node base avoids the whole class of failure.
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-
-      # pnpm via corepack (bundled with Node 24) instead of pnpm/action-setup —
-      # the third-party action's codeload fetch is the first thing to break
-      # when GitHub has partial-storage outages, and the OIDC publish flow
-      # uses the npm CLI anyway. Corepack is a one-shell-line, zero-network
-      # path off the pre-installed Node binary.
-      - run: |
-          corepack enable
-          corepack prepare pnpm@10.33.2 --activate
-          node --version && npm --version && pnpm --version
-      # Install with pnpm (honors supply-chain min-release-age policy), but
-      # publish with npm CLI (required for trusted-publisher OIDC flow).
-      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
-      - run: pnpm run build
-
-      # Publish via npm trusted publishing (OIDC). No NODE_AUTH_TOKEN — auth is
-      # short-lived, minted from the GitHub OIDC identity token at runtime, and
-      # scoped to this workflow by @indigoai-us/hq-cloud's trusted-publisher
-      # config on npmjs.com.
-      #
-      # `--provenance` is intentionally omitted: npm's sigstore provenance
-      # verifier refuses to attach provenance bundles produced from PRIVATE
-      # GitHub repositories (HTTP 422 "Unsupported GitHub Actions source
-      # repository visibility: 'private'") after npm tightened that check on
-      # 2026-05-10. Trusted-publisher OIDC auth still works without provenance.
-      #
-      # Skip-if-published gate prevents the job from failing when the tag is
-      # ahead of the package.json version (or when the version was already
-      # shipped from somewhere else, e.g. the legacy hq monorepo before this
-      # repo was extracted).
-      - name: Publish to npm
-        run: |
-          NAME=$(jq -r .name package.json)
-          VER=$(jq -r .version package.json)
-          if npm view "$NAME@$VER" version >/dev/null 2>&1; then
-            echo "$NAME@$VER already on npm — skipping"
-          else
-            npm publish --access public
-          fi
+    uses: indigoai-us/.github/.github/workflows/_npm-publish.yml@main
+    with:
+      package-manager: pnpm
+      # Corepack (Node-bundled) pnpm — no third-party action fetch, resilient to
+      # GitHub partial-storage outages. The npm CLI still drives the OIDC publish.
+      pnpm-setup: corepack
+      pnpm-version: "10.33.2"
+      node-version: "24"
+      build-command: "pnpm run build"
+      # On workflow_dispatch, honor the input tag; on tag push it is empty.
+      checkout-ref: ${{ inputs.tag || github.ref }}
+      dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}

package/dist/agent-codex-instructions.d.ts

@@ -0,0 +1,84 @@
+/** hq-root-relative location of the (locally-written) agent identity briefing. */
+export declare const AGENTS_PROFILE_REL = "personal/agents-profile.md";
+/** hq-root-relative dir holding the synced agent-capability overlay docs. */
+export declare const AGENT_CAPABILITIES_REL = "personal/knowledge/public/agent-capabilities";
+/** The capability doc carrying the operating contract — ordered first. */
+export declare const AGENT_CONTRACT_FILE = "hq-agent-contract.md";
+/** Leading marker so the file is self-describing and recognizable as generated. */
+export declare const CODEX_AGENTS_MARKER = "<!-- hq-agent: generated by hq-sync-runner";
+export interface CodexSection {
+    /** hq-root-relative source path (for diagnostics; not written to the file). */
+    name: string;
+    content: string;
+}
+/**
+ * Pure: compose the codex global `AGENTS.md` body from ordered sections.
+ * Trims and drops empty/whitespace-only sections. Returns "" when nothing
+ * substantive remains, so the caller can SKIP the write (never emit an
+ * empty/marker-only file, never wipe a previously-materialized one).
+ *
+ * Deliberately carries NO timestamp: the output is a deterministic projection
+ * of its inputs, so a no-change sync rewrites byte-identical content (no churn;
+ * the write/skip/error events are timestamped in the diagnostic log instead).
+ */
+export declare function composeCodexAgentsMd(sections: CodexSection[]): string;
+/**
+ * Pure: order capability filenames — the operating contract first, then the
+ * remaining `*.md` alphabetically. Non-markdown entries are dropped.
+ */
+export declare function orderCapabilityFiles(files: string[]): string[];
+/**
+ * IO: gather the agent overlay sections present under `hqRoot`. Order:
+ *   1. identity briefing (`personal/agents-profile.md`)
+ *   2. the operating contract (`agent-capabilities/hq-agent-contract.md`)
+ *   3. any other `agent-capabilities/*.md`, alphabetically
+ * Each is included only when it is a regular file and non-whitespace-only.
+ * Symlinks and directories are skipped (containment / no symlink-escape).
+ */
+export declare function gatherCodexAgentSections(hqRoot: string): CodexSection[];
+export interface MaterializeLog {
+    (e: {
+        event: string;
+        message: string;
+        err?: unknown;
+        context?: Record<string, unknown>;
+    }): void;
+}
+export interface MaterializeResult {
+    written: boolean;
+    path: string;
+    sectionCount: number;
+    skippedReason?: "empty-overlay" | "target-not-regular-file" | "error";
+}
+/**
+ * Resolve the codex home dir. Honors `CODEX_HOME` only when it is an ABSOLUTE
+ * path with no `..` traversal; otherwise falls back to `~/.codex` (an injected
+ * relative/traversing value must not redirect the write off-target).
+ */
+export declare function codexHomeDir(): string;
+/**
+ * Best-effort: project the synced agent overlay into `~/.codex/AGENTS.md`.
+ * Idempotent atomic rewrite (write entropy-named temp + rename). NEVER throws —
+ * logs and returns a result.
+ *
+ * Non-destructive guarantees:
+ *   - SKIPS (no write, no delete) when the overlay yields no content, so a
+ *     transient empty/unsynced tree can never wipe a previously-materialized
+ *     file. (Emits a distinct event when a prior file exists — a possible
+ *     provisioning regression worth an operator's eye.)
+ *   - SKIPS when the target already exists but is NOT a regular file (a symlink
+ *     or directory), rather than silently clobbering an external config
+ *     relationship (or failing opaquely with EISDIR).
+ *   - On any write/rename failure, the entropy-named temp file is cleaned up so
+ *     repeated failures can't accumulate `*.hq-tmp` orphans.
+ *
+ * First boot: before the first `--personal` sync lands, the overlay is absent
+ * and this skips — the agent operates on the project `AGENTS.md` (charter)
+ * alone until the first sync materializes the contract (~one cycle).
+ */
+export declare function materializeCodexAgents(opts: {
+    hqRoot: string;
+    codexHome?: string;
+    log?: MaterializeLog;
+}): MaterializeResult;
+//# sourceMappingURL=agent-codex-instructions.d.ts.map

package/dist/agent-codex-instructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-codex-instructions.d.ts","sourceRoot":"","sources":["../src/agent-codex-instructions.ts"],"names":[],"mappings":"AA6CA,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,iDACa,CAAC;AAEjD,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,+CACc,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAWrE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAK9D;AA0BD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CA6BvE;AAED,MAAM,WAAW,cAAc;IAC7B,CAAC,CAAC,EAAE;QACF,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,eAAe,GAAG,yBAAyB,GAAG,OAAO,CAAC;CACvE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAMrC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,iBAAiB,CA6FpB"}

package/dist/agent-codex-instructions.js

@@ -0,0 +1,275 @@
+/**
+ * Agent codex-instructions materialization.
+ *
+ * Projects the synced HQ agent overlay into `~/.codex/AGENTS.md` — the codex
+ * GLOBAL instruction file, which `codex exec` natively merges on every run
+ * (alongside the project `AGENTS.md`, which on an HQ box symlinks to the
+ * `.claude/CLAUDE.md` charter). This is the codex mirror of how Claude reads
+ * `~/.claude/CLAUDE.md`: it carries the agent OPERATING CONTRACT (build your
+ * own tools, resolve credentials via group grants, follow team policy, the
+ * safety boundary) on top of the generic HQ charter.
+ *
+ * Why here (the sync runner), and why this file:
+ *   - DURABLE: `~/.codex/AGENTS.md` lives OUTSIDE the hq-root, so `hq rescue`
+ *     (`--hq-root`) and core upgrades never touch it. (In-tree `AGENTS.md` is
+ *     classified regenerable and silently overwritten by rescue.)
+ *   - SCALABLE: every agent box runs `@indigoai-us/hq-cloud@latest`
+ *     `hq-sync-runner` each cycle, so shipping the projection here reaches the
+ *     whole fleet — new and existing agents — with no reprovision or SSM push.
+ *   - AGENT-ONLY: the caller gates on `custom:entityType === "agent"`, so a
+ *     human running `hq sync` never materializes this file.
+ *
+ * Trust + isolation boundary (where it is actually enforced):
+ *   - Tenant isolation is enforced UPSTREAM at the sync boundary: an agent's
+ *     `--personal` sync resolves the agent's OWN vault (`pickAgentSelfEntity`,
+ *     server-authorized by the agent's machine JWT). This function trusts that
+ *     `hqRoot/personal/` was populated by that agent-scoped sync; it does not
+ *     re-fetch entity membership (the gate claim is the SAME one the runner
+ *     already trusts for `--personal` resolution; tampering it requires local
+ *     compromise of the 0o600 token cache, i.e. the box is already owned).
+ *   - DEFENCE-IN-DEPTH against a tampered local tree: every read is restricted
+ *     to REGULAR files (symlinks/dirs are skipped), so a planted symlink in the
+ *     overlay can't exfiltrate arbitrary files into `~/.codex/AGENTS.md`.
+ *   - The projection NEVER reads release-shipped `core/` content — the charter
+ *     reaches codex via the project `AGENTS.md` symlink, not this file.
+ *
+ * Deployment assumption: ONE agent identity per machine (the EC2 agent box
+ * model). `~/.codex/AGENTS.md` is a single, non-namespaced path; multiple agent
+ * identities sharing one OS home would last-write-wins. Not a concern in the
+ * one-agent-per-box fleet; revisit (per-agent namespacing) if that changes.
+ */
+import * as crypto from "crypto";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+/** hq-root-relative location of the (locally-written) agent identity briefing. */
+export const AGENTS_PROFILE_REL = "personal/agents-profile.md";
+/** hq-root-relative dir holding the synced agent-capability overlay docs. */
+export const AGENT_CAPABILITIES_REL = "personal/knowledge/public/agent-capabilities";
+/** The capability doc carrying the operating contract — ordered first. */
+export const AGENT_CONTRACT_FILE = "hq-agent-contract.md";
+/** Leading marker so the file is self-describing and recognizable as generated. */
+export const CODEX_AGENTS_MARKER = "<!-- hq-agent: generated by hq-sync-runner";
+/**
+ * Pure: compose the codex global `AGENTS.md` body from ordered sections.
+ * Trims and drops empty/whitespace-only sections. Returns "" when nothing
+ * substantive remains, so the caller can SKIP the write (never emit an
+ * empty/marker-only file, never wipe a previously-materialized one).
+ *
+ * Deliberately carries NO timestamp: the output is a deterministic projection
+ * of its inputs, so a no-change sync rewrites byte-identical content (no churn;
+ * the write/skip/error events are timestamped in the diagnostic log instead).
+ */
+export function composeCodexAgentsMd(sections) {
+    const body = sections
+        .map((s) => s.content.trim())
+        .filter((c) => c.length > 0)
+        .join("\n\n");
+    if (body.length === 0)
+        return "";
+    const header = `${CODEX_AGENTS_MARKER} from the synced HQ agent overlay. ` +
+        `Do not edit by hand — regenerated on every agent sync. ` +
+        `Source: ${AGENTS_PROFILE_REL} + ${AGENT_CAPABILITIES_REL}/*.md -->`;
+    return `${header}\n\n${body}\n`;
+}
+/**
+ * Pure: order capability filenames — the operating contract first, then the
+ * remaining `*.md` alphabetically. Non-markdown entries are dropped.
+ */
+export function orderCapabilityFiles(files) {
+    const md = files.filter((f) => f.endsWith(".md")).sort();
+    const contractFirst = md.filter((f) => f === AGENT_CONTRACT_FILE);
+    const rest = md.filter((f) => f !== AGENT_CONTRACT_FILE);
+    return [...contractFirst, ...rest];
+}
+/** True iff `p` exists and is a REGULAR file (symlinks/dirs/etc. → false). */
+function isRegularFile(p) {
+    try {
+        return fs.lstatSync(p).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read `p` only when it is a regular file (best-effort, never throws). lstat
+ * gates the read so a symlink is never followed — a planted symlink in the
+ * overlay cannot exfiltrate an out-of-tree file into the materialized output.
+ */
+function readRegularFileIfPresent(p) {
+    if (!isRegularFile(p))
+        return null;
+    try {
+        const s = fs.readFileSync(p, "utf8");
+        return s.trim().length > 0 ? s : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * IO: gather the agent overlay sections present under `hqRoot`. Order:
+ *   1. identity briefing (`personal/agents-profile.md`)
+ *   2. the operating contract (`agent-capabilities/hq-agent-contract.md`)
+ *   3. any other `agent-capabilities/*.md`, alphabetically
+ * Each is included only when it is a regular file and non-whitespace-only.
+ * Symlinks and directories are skipped (containment / no symlink-escape).
+ */
+export function gatherCodexAgentSections(hqRoot) {
+    const sections = [];
+    const profile = readRegularFileIfPresent(path.join(hqRoot, AGENTS_PROFILE_REL));
+    if (profile)
+        sections.push({ name: AGENTS_PROFILE_REL, content: profile });
+    const capDir = path.join(hqRoot, AGENT_CAPABILITIES_REL);
+    // Reject a symlinked capability DIR (only descend into a real directory).
+    let capDirIsRealDir = false;
+    try {
+        capDirIsRealDir = fs.lstatSync(capDir).isDirectory();
+    }
+    catch {
+        capDirIsRealDir = false;
+    }
+    if (capDirIsRealDir) {
+        let entries = [];
+        try {
+            entries = fs.readdirSync(capDir);
+        }
+        catch {
+            entries = [];
+        }
+        for (const f of orderCapabilityFiles(entries)) {
+            const content = readRegularFileIfPresent(path.join(capDir, f));
+            if (content) {
+                sections.push({ name: `${AGENT_CAPABILITIES_REL}/${f}`, content });
+            }
+        }
+    }
+    return sections;
+}
+/**
+ * Resolve the codex home dir. Honors `CODEX_HOME` only when it is an ABSOLUTE
+ * path with no `..` traversal; otherwise falls back to `~/.codex` (an injected
+ * relative/traversing value must not redirect the write off-target).
+ */
+export function codexHomeDir() {
+    const env = process.env.CODEX_HOME?.trim();
+    if (env && path.isAbsolute(env) && !env.split(path.sep).includes("..")) {
+        return env;
+    }
+    return path.join(os.homedir(), ".codex");
+}
+/**
+ * Best-effort: project the synced agent overlay into `~/.codex/AGENTS.md`.
+ * Idempotent atomic rewrite (write entropy-named temp + rename). NEVER throws —
+ * logs and returns a result.
+ *
+ * Non-destructive guarantees:
+ *   - SKIPS (no write, no delete) when the overlay yields no content, so a
+ *     transient empty/unsynced tree can never wipe a previously-materialized
+ *     file. (Emits a distinct event when a prior file exists — a possible
+ *     provisioning regression worth an operator's eye.)
+ *   - SKIPS when the target already exists but is NOT a regular file (a symlink
+ *     or directory), rather than silently clobbering an external config
+ *     relationship (or failing opaquely with EISDIR).
+ *   - On any write/rename failure, the entropy-named temp file is cleaned up so
+ *     repeated failures can't accumulate `*.hq-tmp` orphans.
+ *
+ * First boot: before the first `--personal` sync lands, the overlay is absent
+ * and this skips — the agent operates on the project `AGENTS.md` (charter)
+ * alone until the first sync materializes the contract (~one cycle).
+ */
+export function materializeCodexAgents(opts) {
+    const codexHome = opts.codexHome ?? codexHomeDir();
+    const target = path.join(codexHome, "AGENTS.md");
+    const log = opts.log ?? (() => { });
+    try {
+        const sections = gatherCodexAgentSections(opts.hqRoot);
+        const body = composeCodexAgentsMd(sections);
+        if (body.length === 0) {
+            const targetExists = (() => {
+                try {
+                    fs.lstatSync(target);
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            })();
+            log({
+                // A pre-existing target + now-empty overlay is a likely regression
+                // (broken provisioning / seed), distinct from a clean first-boot skip.
+                event: targetExists
+                    ? "runner.agent_codex_instructions.skipped_empty_target_exists"
+                    : "runner.agent_codex_instructions.skipped",
+                message: "no agent overlay content found; leaving ~/.codex/AGENTS.md untouched",
+                context: { target, targetExists },
+            });
+            return {
+                written: false,
+                path: target,
+                sectionCount: 0,
+                skippedReason: "empty-overlay",
+            };
+        }
+        // Refuse to clobber a non-regular target (symlink / directory): preserve an
+        // external config relationship + surface EISDIR-class problems distinctly.
+        let targetStat = null;
+        try {
+            targetStat = fs.lstatSync(target);
+        }
+        catch {
+            targetStat = null; // absent — fine, we create it
+        }
+        if (targetStat && !targetStat.isFile()) {
+            log({
+                event: "runner.agent_codex_instructions.config_error",
+                message: "~/.codex/AGENTS.md exists but is not a regular file (symlink or directory); refusing to overwrite",
+                context: {
+                    target,
+                    isSymbolicLink: targetStat.isSymbolicLink(),
+                    isDirectory: targetStat.isDirectory(),
+                },
+            });
+            return {
+                written: false,
+                path: target,
+                sectionCount: sections.length,
+                skippedReason: "target-not-regular-file",
+            };
+        }
+        fs.mkdirSync(codexHome, { recursive: true, mode: 0o700 });
+        const tmp = `${target}.${process.pid}.${crypto
+            .randomBytes(6)
+            .toString("hex")}.hq-tmp`;
+        try {
+            fs.writeFileSync(tmp, body, { mode: 0o600 });
+            fs.renameSync(tmp, target);
+        }
+        catch (writeErr) {
+            // Clean up the orphaned temp so repeated failures don't accumulate.
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch {
+                /* best-effort */
+            }
+            throw writeErr;
+        }
+        log({
+            event: "runner.agent_codex_instructions.written",
+            message: `materialized codex global AGENTS.md from ${sections.length} overlay section(s)`,
+            context: { target, sectionCount: sections.length },
+        });
+        return { written: true, path: target, sectionCount: sections.length };
+    }
+    catch (err) {
+        log({
+            event: "runner.agent_codex_instructions.error",
+            message: "failed to materialize codex global AGENTS.md",
+            err,
+            context: { target },
+        });
+        return { written: false, path: target, sectionCount: 0, skippedReason: "error" };
+    }
+}
+//# sourceMappingURL=agent-codex-instructions.js.map

package/dist/agent-codex-instructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-codex-instructions.js","sourceRoot":"","sources":["../src/agent-codex-instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GACjC,8CAA8C,CAAC;AAEjD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAC9B,4CAA4C,CAAC;AAQ/C;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAwB;IAC3D,MAAM,IAAI,GAAG,QAAQ;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,IAAI,CAAC,MAAM,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GACV,GAAG,mBAAmB,qCAAqC;QAC3D,yDAAyD;QACzD,WAAW,kBAAkB,MAAM,sBAAsB,WAAW,CAAC;IACvE,OAAO,GAAG,MAAM,OAAO,IAAI,IAAI,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAe;IAClD,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,CAAS;IACzC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAChF,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACzD,0EAA0E;IAC1E,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,OAAO,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,sBAAsB,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;gBACzB,IAAI,CAAC;oBACH,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;oBACrB,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,GAAG,CAAC;gBACF,mEAAmE;gBACnE,uEAAuE;gBACvE,KAAK,EAAE,YAAY;oBACjB,CAAC,CAAC,6DAA6D;oBAC/D,CAAC,CAAC,yCAAyC;gBAC7C,OAAO,EACL,sEAAsE;gBACxE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;aAClC,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,eAAe;aAC/B,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,UAAU,GAAoB,IAAI,CAAC;QACvC,IAAI,CAAC;YACH,UAAU,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC,CAAC,8BAA8B;QACnD,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,GAAG,CAAC;gBACF,KAAK,EAAE,8CAA8C;gBACrD,OAAO,EACL,mGAAmG;gBACrG,OAAO,EAAE;oBACP,MAAM;oBACN,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE;oBAC3C,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE;iBACtC;aACF,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,YAAY,EAAE,QAAQ,CAAC,MAAM;gBAC7B,aAAa,EAAE,yBAAyB;aACzC,CAAC;QACJ,CAAC;QAED,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM;aAC3C,WAAW,CAAC,CAAC,CAAC;aACd,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7C,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,oEAAoE;YACpE,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,MAAM,QAAQ,CAAC;QACjB,CAAC;QACD,GAAG,CAAC;YACF,KAAK,EAAE,yCAAyC;YAChD,OAAO,EAAE,4CAA4C,QAAQ,CAAC,MAAM,qBAAqB;YACzF,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE;SACnD,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC;YACF,KAAK,EAAE,uCAAuC;YAC9C,OAAO,EAAE,8CAA8C;YACvD,GAAG;YACH,OAAO,EAAE,EAAE,MAAM,EAAE;SACpB,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}

package/dist/agent-codex-instructions.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-codex-instructions.test.d.ts.map

package/dist/agent-codex-instructions.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-codex-instructions.test.d.ts","sourceRoot":"","sources":["../src/agent-codex-instructions.test.ts"],"names":[],"mappings":""}