@intutic/cli 2.3.0 → 2.5.0

package/dist/commands/credentials.js

@@ -4,8 +4,9 @@
  *
  * Subcommands:
  *   - `intutic credentials list [--json]`
- *   - `intutic credentials set <provider> --field key=value [--field key=value ...]`
+ *   - `intutic credentials set <provider> --field key=value [--field-file key=path ...]`
  *   - `intutic credentials unset <provider>`
+ *   - `intutic credentials models <provider> [--json]`
  *
  * Server side: services/control-plane/src/routes/providerCredentials.ts.
  * `list` reports every provider in the shared registry
@@ -19,9 +20,18 @@ import { log } from '../lib/logger.js';
 import { loadCredentials } from '../config/store.js';
 import { resolveControlPlaneUrl } from '../config/paths.js';
 import { createApiClient } from '../lib/api.js';
-import { PROVIDER_REGISTRY, getProviderDefinition } from '@intutic/shared-types';
+import { readFileSync } from 'node:fs';
+import { PROVIDER_REGISTRY, checkCloudCredentialFields, getProviderDefinition } from '@intutic/shared-types';
 import pc from 'picocolors';
 const NOT_AUTHENTICATED = 'Not authenticated. Run `intutic login` first.';
+function requireProvider(provider) {
+    const def = getProviderDefinition(provider);
+    if (!def) {
+        log.error(`Unknown provider "${provider}". Must be one of: ${PROVIDER_REGISTRY.map((p) => p.id).join(', ')}`);
+        process.exit(1);
+    }
+    return def;
+}
 async function getClient(opts) {
     const creds = await loadCredentials();
     if (!creds) {
@@ -58,7 +68,26 @@ export async function runCredentialsList(opts) {
 }
 /** `intutic credentials set <provider>` */
 export async function runCredentialsSet(provider, opts) {
-    const fields = opts.field ?? [];
+    // `--field-file key=path` reads the value from a file: a Vertex AI
+    // service-account key is a multi-line JSON document no shell quotes well.
+    const fromFiles = [];
+    for (const f of opts.fieldFile ?? []) {
+        const idx = f.indexOf('=');
+        if (idx <= 0) {
+            log.error(`--field-file "${f}" is not in key=path form`);
+            process.exit(1);
+        }
+        let value;
+        try {
+            value = readFileSync(f.slice(idx + 1), 'utf8');
+        }
+        catch {
+            log.error(`--field-file ${f.slice(0, idx)}: could not read ${f.slice(idx + 1)}`);
+            process.exit(1);
+        }
+        fromFiles.push(`${f.slice(0, idx)}=${value}`);
+    }
+    const fields = [...(opts.field ?? []), ...fromFiles];
     if (fields.length === 0) {
         log.error('At least one --field key=value is required (e.g. --field apiKey=sk-ant-... for a single-key ' +
             'provider, or multiple --field flags for a multi-field one like Azure OpenAI).');
@@ -73,11 +102,7 @@ export async function runCredentialsSet(provider, opts) {
     // that has a missing field. The server (`providerCredentials.ts`) remains
     // the authoritative validator (length bounds, etc.) — this is a faster,
     // local UX check, not a replacement for it.
-    const def = getProviderDefinition(provider);
-    if (!def) {
-        log.error(`Unknown provider "${provider}". Must be one of: ${PROVIDER_REGISTRY.map((p) => p.id).join(', ')}`);
-        process.exit(1);
-    }
+    const def = requireProvider(provider);
     const knownKeys = new Set(def.fields.map((f) => f.key));
     const body = {};
     for (const f of fields) {
@@ -99,14 +124,47 @@ export async function runCredentialsSet(provider, opts) {
             process.exit(1);
         }
     }
+    if (def.requiresOneOf && !def.requiresOneOf.some((set) => set.every((k) => body[k]))) {
+        log.error(`${def.displayName} requires one of: ${def.requiresOneOf.map((set) => set.map((k) => `--field ${k}=<value>`).join(' ')).join('  or  ')}`);
+        process.exit(1);
+    }
+    const trimmed = Object.fromEntries(Object.entries(body).map(([k, v]) => [k, v.trim()]));
+    const cloudError = checkCloudCredentialFields(def.id, trimmed);
+    if (cloudError) {
+        log.error(cloudError);
+        process.exit(1);
+    }
     const client = await getClient(opts);
     try {
         const res = await client.put(`/api/v1/workspace/provider-credentials/${encodeURIComponent(provider)}`, body);
+        // Checked against the provider as soon as it is saved, server-side, so
+        // the operator learns now — not on the first failed request — whether
+        // the credential works. A failed check never undoes the save.
+        let verification = null;
+        try {
+            verification = await client.post(`/api/v1/workspace/provider-credentials/${encodeURIComponent(provider)}/verify`, {});
+        }
+        catch {
+            verification = null;
+        }
         if (opts.json) {
-            console.log(JSON.stringify(res, null, 2));
+            console.log(JSON.stringify({ ...res, verification }, null, 2));
             return;
         }
         log.success(`${provider}: provisioned (…${res.lastFour ?? '????'}).`);
+        if (verification?.status === 'valid')
+            log.success(`  Verified: ${verification.detail}`);
+        else if (verification?.status === 'invalid') {
+            log.warn(`  ${verification.detail}. Check the values and run this command again.`);
+        }
+        else if (verification)
+            log.dim(`  Not verified: ${verification.detail}`);
+        if (verification?.models) {
+            log.dim(`  The key can reach ${verification.models.length} model${verification.models.length === 1 ? '' : 's'}; ` +
+                `\`intutic credentials models ${provider}\` lists them.`);
+        }
+        if (def.usageHint)
+            log.dim(`  ${def.usageHint}`);
         if (!res.routingLive) {
             log.warn(`${provider} is stored but not yet routable — the proxy does not forward requests to it. ` +
                 'Its credential is safe to have on file ahead of that support landing.');
@@ -131,4 +189,35 @@ export async function runCredentialsUnset(provider, opts) {
         process.exit(1);
     }
 }
+/** `intutic credentials models <provider>` */
+export async function runCredentialsModels(provider, opts) {
+    const def = requireProvider(provider);
+    const client = await getClient(opts);
+    try {
+        const res = await client.get(`/api/v1/workspace/provider-credentials/${encodeURIComponent(provider)}/models`);
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        // The list is recorded when a saved key is checked against the provider,
+        // so `null` means no check has listed models yet, not that the key
+        // reaches none.
+        if (!res.models) {
+            log.dim(`No models discovered for ${def.displayName} yet.`);
+            log.dim(`  \`intutic credentials set ${provider} --field ...\` checks the key against the provider and records the models it can reach.`);
+            return;
+        }
+        log.header(`Intutic — ${def.displayName} models`);
+        if (res.checkedAt)
+            log.field('Checked', res.checkedAt);
+        log.field('Models', String(res.models.length));
+        console.log('');
+        for (const model of res.models)
+            console.log(`  ${model}`);
+    }
+    catch (err) {
+        log.error(`Failed to list ${provider} models: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+}
 //# sourceMappingURL=credentials.js.map

package/dist/commands/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/commands/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,MAAM,YAAY,CAAA;AAE3B,MAAM,iBAAiB,GAAG,+CAA+C,CAAA;AAezE,KAAK,UAAU,SAAS,CAAC,IAAwB;IAC/C,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,OAAO,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;AACvD,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAwB;IAC/D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAC1B,wCAAwC,CACzC,CAAA;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;QAE3B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACzC,OAAM;QACR,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAA;YACjC,GAAG,CAAC,KAAK,CACP,SAAS,EACT,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CACrG,CAAA;YACD,GAAG,CAAC,KAAK,CACP,aAAa,EACb,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAC1E,CAAA;YACD,IAAI,CAAC,CAAC,SAAS;gBAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,IAA+C;IAE/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,CACP,8FAA8F;YAC5F,+EAA+E,CAClF,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,8DAA8D;IAC9D,kEAAkE;IAClE,0EAA0E;IAC1E,oEAAoE;IACpE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,GAAG,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,qBAAqB,QAAQ,sBAAsB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvD,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAA;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,CACP,IAAI,GAAG,oBAAoB,GAAG,CAAC,WAAW,qBAAqB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC9B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,WAAW,qBAAqB,KAAK,CAAC,GAAG,UAAU,CAAC,CAAA;YACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAC1B,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EACxE,IAAI,CACL,CAAA;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACzC,OAAM;QACR,CAAC;QAED,GAAG,CAAC,OAAO,CAAC,GAAG,QAAQ,mBAAmB,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,CAAC,CAAA;QACrE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CACN,GAAG,QAAQ,+EAA+E;gBACxF,uEAAuE,CAC1E,CAAA;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,iBAAiB,QAAQ,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC1F,GAAG,CAAC,OAAO,CAAC,GAAG,QAAQ,uBAAuB,CAAC,CAAA;QAC/C,GAAG,CAAC,GAAG,CACL,0FAA0F;YACxF,yCAAyC,CAC5C,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,oBAAoB,QAAQ,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/commands/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5G,OAAO,EAAE,MAAM,YAAY,CAAA;AAE3B,MAAM,iBAAiB,GAAG,+CAA+C,CAAA;AA+BzE,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,GAAG,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,qBAAqB,QAAQ,sBAAsB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAwB;IAC/C,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,OAAO,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;AACvD,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAwB;IAC/D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAC1B,wCAAwC,CACzC,CAAA;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;QAE3B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACzC,OAAM;QACR,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAA;QAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAA;YACjC,GAAG,CAAC,KAAK,CACP,SAAS,EACT,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CACrG,CAAA;YACD,GAAG,CAAC,KAAK,CACP,aAAa,EACb,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAC1E,CAAA;YACD,IAAI,CAAC,CAAC,SAAS;gBAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,IAAqE;IAErE,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;YAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,CAAA;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,CACP,8FAA8F;YAC5F,+EAA+E,CAClF,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,8DAA8D;IAC9D,kEAAkE;IAClE,0EAA0E;IAC1E,oEAAoE;IACpE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvD,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAA;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,CACP,IAAI,GAAG,oBAAoB,GAAG,CAAC,WAAW,qBAAqB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC9B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,WAAW,qBAAqB,KAAK,CAAC,GAAG,UAAU,CAAC,CAAA;YACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,KAAK,CACP,GAAG,GAAG,CAAC,WAAW,qBAAqB,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACzI,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACvF,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAC1B,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EACxE,IAAI,CACL,CAAA;QAED,uEAAuE;QACvE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,YAAY,GAAwB,IAAI,CAAA;QAC5C,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAC/E,EAAE,CACH,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,IAAI,CAAA;QACrB,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YAC9D,OAAM;QACR,CAAC;QAED,GAAG,CAAC,OAAO,CAAC,GAAG,QAAQ,mBAAmB,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,CAAC,CAAA;QACrE,IAAI,YAAY,EAAE,MAAM,KAAK,OAAO;YAAE,GAAG,CAAC,OAAO,CAAC,eAAe,YAAY,CAAC,MAAM,EAAE,CAAC,CAAA;aAClF,IAAI,YAAY,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,MAAM,gDAAgD,CAAC,CAAA;QACpF,CAAC;aAAM,IAAI,YAAY;YAAE,GAAG,CAAC,GAAG,CAAC,mBAAmB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1E,IAAI,YAAY,EAAE,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CACL,uBAAuB,YAAY,CAAC,MAAM,CAAC,MAAM,SAAS,YAAY,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;gBACvG,gCAAgC,QAAQ,gBAAgB,CAC3D,CAAA;QACH,CAAC;QACD,IAAI,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CACN,GAAG,QAAQ,+EAA+E;gBACxF,uEAAuE,CAC1E,CAAA;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,iBAAiB,QAAQ,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC1F,GAAG,CAAC,OAAO,CAAC,GAAG,QAAQ,uBAAuB,CAAC,CAAA;QAC/C,GAAG,CAAC,GAAG,CACL,0FAA0F;YACxF,yCAAyC,CAC5C,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,oBAAoB,QAAQ,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,IAAwB;IACnF,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAC1B,0CAA0C,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAChF,CAAA;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACzC,OAAM;QACR,CAAC;QAED,yEAAyE;QACzE,mEAAmE;QACnE,gBAAgB;QAChB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,GAAG,CAAC,4BAA4B,GAAG,CAAC,WAAW,OAAO,CAAC,CAAA;YAC3D,GAAG,CAAC,GAAG,CACL,+BAA+B,QAAQ,yFAAyF,CACjI,CAAA;YACD,OAAM;QACR,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,WAAW,SAAS,CAAC,CAAA;QACjD,IAAI,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;QACtD,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAA;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,kBAAkB,QAAQ,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC"}

package/dist/commands/exec.d.ts

@@ -18,7 +18,7 @@
  */
 import type { IntuticCredentials } from '@intutic/shared-types';
 import { type GraphIdentity } from '../lib/graphIdentity.js';
-import { type SandboxKind } from '../lib/sandbox/index.js';
+import { type SandboxBackend, type SandboxKind, type SandboxSpec } from '../lib/sandbox/index.js';
 /** Workspace requirement for whether agents must run sandboxed. */
 export type SandboxRequirement = 'off' | 'warn' | 'require';
 /**
@@ -61,6 +61,34 @@ export declare function buildProxyEnv(apiKey: string | undefined, identity?: Gra
  *   only egress is the proxy instead of directly on the host.
  */
 export declare function runExec(commandAndArgs: string[], sandbox?: SandboxExecOptions): Promise<void>;
+/** Why a sandbox launch was refused before anything ran. */
+export declare class SandboxUnavailableError extends Error {
+    /** `health` means the backend cannot run on this host. */
+    readonly stage: 'select' | 'health' | 'image';
+    constructor(message: string, 
+    /** `health` means the backend cannot run on this host. */
+    stage: 'select' | 'health' | 'image');
+}
+/**
+ * The environment a sandboxed agent receives, for a proxy listening on the
+ * host's `port`. Inside the sandbox `localhost` is the sandbox, not the host —
+ * so the proxy env is built against the host-gateway alias. The values are
+ * handed to the runtime process and referenced by *name*, so secrets never
+ * appear in the container runtime's argv.
+ */
+export declare function sandboxProxyEnv(creds: IntuticCredentials | null, identity: GraphIdentity, port: string, allow: string[]): {
+    env: Record<string, string>;
+    proxyUrl: string;
+};
+/**
+ * Select the backend, check it can run here and get `image` ready. Throws
+ * {@link SandboxUnavailableError} rather than falling back: an unavailable
+ * backend is never swapped for running the agent ungoverned on the host.
+ * `env` is held by reference, so variables added later still reach the run.
+ */
+export declare function readySandbox(kind: SandboxKind, env: Record<string, string>, image: string): Promise<SandboxBackend>;
+/** The spec for one sandboxed command: the env goes in by name only. */
+export declare function sandboxSpec(command: string[], workdir: string, env: Record<string, string>, opts: SandboxExecOptions, extra: Pick<SandboxSpec, 'tty'> & Partial<Pick<SandboxSpec, 'name' | 'onStdout' | 'signal'>>): SandboxSpec;
 /** Opens a SANDBOX-mode session for telemetry. Returns null on any failure. */
 export declare function openSandboxSession(creds: IntuticCredentials, identity: GraphIdentity, backendName: string): Promise<string | null>;
 /** Ends a session opened by openSandboxSession. Best-effort. */

package/dist/commands/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAG/D,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAiB,KAAK,WAAW,EAAoB,MAAM,yBAAyB,CAAA;AAI3F,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAkC7B;AAKD,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,CAAC,EAAE,aAAa,EACxB,gBAAgB,CAAC,EAAE,MAAM,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAyDxB;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAkFf;AAgHD,+EAA+E;AAC/E,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmBxB;AAED,gEAAgE;AAChE,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAarG"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAG/D,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAIhH,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAkC7B;AAKD,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,CAAC,EAAE,aAAa,EACxB,gBAAgB,CAAC,EAAE,MAAM,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAyDxB;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAkFf;AAED,4DAA4D;AAC5D,qBAAa,uBAAwB,SAAQ,KAAK;IAG9C,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO;gBAF7C,OAAO,EAAE,MAAM;IACf,0DAA0D;IACjD,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO;CAIhD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,kBAAkB,GAAG,IAAI,EAChC,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EAAE,GACd;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAsBnD;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,cAAc,CAAC,CAmBzB;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC,CAAC,GAC3F,WAAW,CAab;AAmED,+EAA+E;AAC/E,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmBxB;AAED,gEAAgE;AAChE,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAarG"}

package/dist/commands/exec.js

@@ -214,19 +214,26 @@ export async function runExec(commandAndArgs, sandbox) {
         }
     });
 }
+/** Why a sandbox launch was refused before anything ran. */
+export class SandboxUnavailableError extends Error {
+    stage;
+    constructor(message, 
+    /** `health` means the backend cannot run on this host. */
+    stage) {
+        super(message);
+        this.stage = stage;
+    }
+}
 /**
- * Run the agent inside an isolated sandbox whose only egress is the proxy.
- *
- * Inside the sandbox `localhost` is the sandbox, not the host — so the proxy
- * env is rebuilt against the host-gateway alias, and the sandbox's egress
- * firewall is opened to exactly that address plus DNS (and any `--sandbox-allow`
- * CIDRs). Secrets are passed by env-var *name*, so they never appear in the
- * container runtime's argv.
+ * The environment a sandboxed agent receives, for a proxy listening on the
+ * host's `port`. Inside the sandbox `localhost` is the sandbox, not the host —
+ * so the proxy env is built against the host-gateway alias. The values are
+ * handed to the runtime process and referenced by *name*, so secrets never
+ * appear in the container runtime's argv.
  */
-async function runSandboxed(commandAndArgs, creds, identity, opts) {
-    const port = String(localProxyPort());
-    const proxyUrlOverride = `http://${PROXY_HOST_ALIAS}:${port}`;
-    const proxyEnv = buildProxyEnv(creds?.apiKey, identity, proxyUrlOverride);
+export function sandboxProxyEnv(creds, identity, port, allow) {
+    const proxyUrl = `http://${PROXY_HOST_ALIAS}:${port}`;
+    const proxyEnv = buildProxyEnv(creds?.apiKey, identity, proxyUrl);
     // The values the runtime will read for the `--env NAME` references.
     //
     // INTUTIC_SANDBOX_PROXY_PORT is separate from ANTHROPIC_BASE_URL/etc on
@@ -242,33 +249,74 @@ async function runSandboxed(commandAndArgs, creds, identity, opts) {
         ...proxyEnv,
         INTUTIC_SANDBOX_PROXY_HOST: PROXY_HOST_ALIAS,
         INTUTIC_SANDBOX_PROXY_PORT: port,
-        ...(opts.allow.length ? { INTUTIC_SANDBOX_ALLOW: opts.allow.join(',') } : {}),
+        ...(allow.length ? { INTUTIC_SANDBOX_ALLOW: allow.join(',') } : {}),
     };
+    return { env, proxyUrl };
+}
+/**
+ * Select the backend, check it can run here and get `image` ready. Throws
+ * {@link SandboxUnavailableError} rather than falling back: an unavailable
+ * backend is never swapped for running the agent ungoverned on the host.
+ * `env` is held by reference, so variables added later still reach the run.
+ */
+export async function readySandbox(kind, env, image) {
     let backend;
     try {
-        backend = selectBackend(opts.kind, env);
+        backend = selectBackend(kind, env);
     }
     catch (err) {
-        log.error(`Sandbox unavailable: ${err instanceof Error ? err.message : String(err)}`);
-        process.exit(1);
+        throw new SandboxUnavailableError(`Sandbox unavailable: ${err instanceof Error ? err.message : String(err)}`, 'select');
     }
     const health = await backend.health();
     if (!health.available) {
-        // Honesty rule: never silently fall back to running the agent
-        // ungoverned on the host — say what is unavailable and stop.
-        log.error(`Sandbox backend '${backend.name}' is not available: ${health.detail}`);
-        log.dim('Start Docker (or Podman), or drop --sandbox to run on the host.');
-        process.exit(1);
+        throw new SandboxUnavailableError(`Sandbox backend '${backend.name}' is not available: ${health.detail}`, 'health');
     }
     try {
-        await backend.prepare?.(opts.image);
+        await backend.prepare?.(image);
     }
     catch (err) {
-        log.error(`Sandbox image unavailable: ${err instanceof Error ? err.message : String(err)}`);
+        throw new SandboxUnavailableError(`Sandbox image unavailable: ${err instanceof Error ? err.message : String(err)}`, 'image');
+    }
+    return backend;
+}
+/** The spec for one sandboxed command: the env goes in by name only. */
+export function sandboxSpec(command, workdir, env, opts, extra) {
+    return {
+        command,
+        workdir,
+        image: opts.image,
+        envKeys: Object.keys(env),
+        proxyHostAlias: PROXY_HOST_ALIAS,
+        allowCidrs: opts.allow,
+        memory: opts.memory,
+        cpus: opts.cpus,
+        pidsLimit: opts.pidsLimit,
+        ...extra,
+    };
+}
+/**
+ * Run the agent inside an isolated sandbox whose only egress is the proxy.
+ *
+ * The sandbox's egress firewall is opened to exactly the proxy plus DNS (and
+ * any `--sandbox-allow` CIDRs).
+ */
+async function runSandboxed(commandAndArgs, creds, identity, opts) {
+    const { env, proxyUrl } = sandboxProxyEnv(creds, identity, String(localProxyPort()), opts.allow);
+    let backend;
+    try {
+        backend = await readySandbox(opts.kind, env, opts.image);
+    }
+    catch (err) {
+        log.error(err instanceof Error ? err.message : String(err));
+        // Honesty rule: never silently fall back to running the agent
+        // ungoverned on the host — say what is unavailable and stop.
+        if (err instanceof SandboxUnavailableError && err.stage === 'health') {
+            log.dim('Start Docker (or Podman), or drop --sandbox to run on the host.');
+        }
         process.exit(1);
     }
     log.info(`Sandbox: ${backend.name} · image ${opts.image} · egress locked to the proxy`);
-    log.dim(`Proxy (from sandbox): ${proxyUrlOverride}`);
+    log.dim(`Proxy (from sandbox): ${proxyUrl}`);
     const [exe, ...rest] = commandAndArgs;
     log.info(`Launching in sandbox: ${pc.bold(exe)} ${rest.join(' ')}`);
     console.log('');
@@ -286,18 +334,7 @@ async function runSandboxed(commandAndArgs, creds, identity, opts) {
     const sessionId = creds ? await openSandboxSession(creds, identity, backend.name) : null;
     if (sessionId)
         env.INTUTIC_SESSION_ID = sessionId;
-    const spec = {
-        command: commandAndArgs,
-        workdir: process.cwd(),
-        image: opts.image,
-        envKeys: Object.keys(env),
-        proxyHostAlias: PROXY_HOST_ALIAS,
-        allowCidrs: opts.allow,
-        memory: opts.memory,
-        cpus: opts.cpus,
-        pidsLimit: opts.pidsLimit,
-        tty: Boolean(process.stdout.isTTY),
-    };
+    const spec = sandboxSpec(commandAndArgs, process.cwd(), env, opts, { tty: Boolean(process.stdout.isTTY) });
     const code = await backend.run(spec);
     if (creds && sessionId)
         await closeSandboxSession(creds, sessionId);

package/dist/commands/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,OAAO,EAAE,SAAS,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,kBAAkB,GAEnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,aAAa,EAAsC,MAAM,yBAAyB,CAAA;AAC3F,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAKrD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,CAAC,CAAU,EAAsB,EAAE,CAChD,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAE7C,MAAM,IAAI,GAAG,sBAAsB,EAAE,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE;YAC3D,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;gBACvC,gBAAgB,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;aAC1C;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoD,CAAA;YAClF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;YACtD,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;YAChH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAqC,CAAA;QACpG,OAAO,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,sBAAsB,CAAA;AAa/C;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA0B,EAC1B,QAAwB,EACxB,gBAAyB;IAEzB,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAErF,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IAClF,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,CAAA;IAElC,MAAM,GAAG,GAA2B;QAClC,oEAAoE;QACpE,eAAe,EAAE,QAAQ;QACzB,6DAA6D;QAC7D,eAAe,EAAE,QAAQ;QACzB,+CAA+C;QAC/C,mBAAmB,EAAE,QAAQ;QAC7B,gDAAgD;QAChD,WAAW,EAAE,SAAS;QACtB,wEAAwE;QACxE,kBAAkB,EAAE,SAAS;KAC9B,CAAA;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,wEAAwE;QACxE,oDAAoD;QACpD,GAAG,CAAC,cAAc,GAAG,MAAM,CAAA;QAC3B,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAA;QAC9B,GAAG,CAAC,eAAe,GAAG,MAAM,CAAA;IAC9B,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,wEAAwE;QACxE,0EAA0E;QAC1E,aAAa;QACb,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAA;QAEzC,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAA;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,GAAG,CAAC,wBAAwB,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,cAAwB,EACxB,OAA4B;IAE5B,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAClC,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QACrD,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC1C,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QAC/D,GAAG,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IAErC,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAA;IAEjC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5D,OAAM;IACR,CAAC;IAED,8DAA8D;IAC9D,qDAAqD;IACrD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAA;QACpE,GAAG,CAAC,GAAG,CAAC,uDAAuD,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;IAEhD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAA;IAErC,aAAa;IACb,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,GAAG,CACL,KAAK;QACH,CAAC,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QACpE,CAAC,CAAC,sFAAsF,CAC3F,CAAA;IACD,GAAG,CAAC,GAAG,CACL,QAAQ,CAAC,KAAK,KAAK,CAAC;QAClB,CAAC,CAAC,UAAU,QAAQ,CAAC,OAAO,SAAS;QACrC,CAAC,CAAC,UAAU,QAAQ,CAAC,OAAO,WAAW,QAAQ,CAAC,MAAM,YAAY,QAAQ,CAAC,KAAK,EAAE,CACrF,CAAA;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,oEAAoE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,2CAA2C;KACjF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;YACtC,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QACjE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CACzB,cAAwB,EACxB,KAAgC,EAChC,QAAuB,EACvB,IAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,CAAA;IACrC,MAAM,gBAAgB,GAAG,UAAU,gBAAgB,IAAI,IAAI,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IAEzE,oEAAoE;IACpE,EAAE;IACF,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,GAAG,GAA2B;QAClC,mEAAmE;QACnE,oDAAoD;QACpD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QACnC,GAAG,QAAQ;QACX,0BAA0B,EAAE,gBAAgB;QAC5C,0BAA0B,EAAE,IAAI;QAChC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAA;IAED,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,8DAA8D;QAC9D,6DAA6D;QAC7D,GAAG,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,IAAI,uBAAuB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACjF,GAAG,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,IAAI,YAAY,IAAI,CAAC,KAAK,+BAA+B,CAAC,CAAA;IACvF,GAAG,CAAC,GAAG,CAAC,yBAAyB,gBAAgB,EAAE,CAAC,CAAA;IACpD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAA;IACrC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,iDAAiD;IACjD,wEAAwE;IACxE,8CAA8C;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACxF,IAAI,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAA;IAEjD,MAAM,IAAI,GAAgB;QACxB,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,cAAc,EAAE,gBAAgB;QAChC,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;KACnC,CAAA;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,KAAK,IAAI,SAAS;QAAE,MAAM,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACnE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpB,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe;IACtB,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IAC/B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAyB,EACzB,QAAuB,EACvB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,sBAAsB,EAAE,kBAAkB,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE;YACxF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,SAAS;gBACtB,aAAa,EAAE,SAAS;gBACxB,cAAc,EAAE,mBAAmB,WAAW,UAAU,QAAQ,CAAC,OAAO,EAAE;aAC3E,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAA;QACzD,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAyB,EAAE,SAAiB;IACpF,IAAI,CAAC;QACH,MAAM,KAAK,CACT,GAAG,sBAAsB,EAAE,oBAAoB,SAAS,MAAM,EAC9D;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE;YACpD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CACF,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,OAAO,EAAE,SAAS,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,kBAAkB,GAEnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,aAAa,EAA2D,MAAM,yBAAyB,CAAA;AAChH,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAKrD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,CAAC,CAAU,EAAsB,EAAE,CAChD,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAE7C,MAAM,IAAI,GAAG,sBAAsB,EAAE,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE;YAC3D,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;gBACvC,gBAAgB,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;aAC1C;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoD,CAAA;YAClF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;YACtD,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;YAChH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAqC,CAAA;QACpG,OAAO,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,sBAAsB,CAAA;AAa/C;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA0B,EAC1B,QAAwB,EACxB,gBAAyB;IAEzB,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAErF,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IAClF,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,CAAA;IAElC,MAAM,GAAG,GAA2B;QAClC,oEAAoE;QACpE,eAAe,EAAE,QAAQ;QACzB,6DAA6D;QAC7D,eAAe,EAAE,QAAQ;QACzB,+CAA+C;QAC/C,mBAAmB,EAAE,QAAQ;QAC7B,gDAAgD;QAChD,WAAW,EAAE,SAAS;QACtB,wEAAwE;QACxE,kBAAkB,EAAE,SAAS;KAC9B,CAAA;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,wEAAwE;QACxE,oDAAoD;QACpD,GAAG,CAAC,cAAc,GAAG,MAAM,CAAA;QAC3B,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAA;QAC9B,GAAG,CAAC,eAAe,GAAG,MAAM,CAAA;IAC9B,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,wEAAwE;QACxE,0EAA0E;QAC1E,aAAa;QACb,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAA;QAEzC,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAA;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,GAAG,CAAC,wBAAwB,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,cAAwB,EACxB,OAA4B;IAE5B,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAClC,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QACrD,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC1C,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QAC/D,GAAG,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IAErC,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAA;IAEjC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5D,OAAM;IACR,CAAC;IAED,8DAA8D;IAC9D,qDAAqD;IACrD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAA;QACpE,GAAG,CAAC,GAAG,CAAC,uDAAuD,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;IAEhD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAA;IAErC,aAAa;IACb,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,GAAG,CACL,KAAK;QACH,CAAC,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QACpE,CAAC,CAAC,sFAAsF,CAC3F,CAAA;IACD,GAAG,CAAC,GAAG,CACL,QAAQ,CAAC,KAAK,KAAK,CAAC;QAClB,CAAC,CAAC,UAAU,QAAQ,CAAC,OAAO,SAAS;QACrC,CAAC,CAAC,UAAU,QAAQ,CAAC,OAAO,WAAW,QAAQ,CAAC,MAAM,YAAY,QAAQ,CAAC,KAAK,EAAE,CACrF,CAAA;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,oEAAoE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,2CAA2C;KACjF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;YACtC,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QACjE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAIrC;IAHX,YACE,OAAe;IACf,0DAA0D;IACjD,KAAoC;QAE7C,KAAK,CAAC,OAAO,CAAC,CAAA;QAFL,UAAK,GAAL,KAAK,CAA+B;IAG/C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAgC,EAChC,QAAuB,EACvB,IAAY,EACZ,KAAe;IAEf,MAAM,QAAQ,GAAG,UAAU,gBAAgB,IAAI,IAAI,EAAE,CAAA;IACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAEjE,oEAAoE;IACpE,EAAE;IACF,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,GAAG,GAA2B;QAClC,mEAAmE;QACnE,oDAAoD;QACpD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QACnC,GAAG,QAAQ;QACX,0BAA0B,EAAE,gBAAgB;QAC5C,0BAA0B,EAAE,IAAI;QAChC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAiB,EACjB,GAA2B,EAC3B,KAAa;IAEb,IAAI,OAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IACzH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,oBAAoB,OAAO,CAAC,IAAI,uBAAuB,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAA;IACrH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAC9H,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CACzB,OAAiB,EACjB,OAAe,EACf,GAA2B,EAC3B,IAAwB,EACxB,KAA4F;IAE5F,OAAO;QACL,OAAO;QACP,OAAO;QACP,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,cAAc,EAAE,gBAAgB;QAChC,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,KAAK;KACT,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,cAAwB,EACxB,KAAgC,EAChC,QAAuB,EACvB,IAAwB;IAExB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAEhG,IAAI,OAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3D,8DAA8D;QAC9D,6DAA6D;QAC7D,IAAI,GAAG,YAAY,uBAAuB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrE,GAAG,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,IAAI,YAAY,IAAI,CAAC,KAAK,+BAA+B,CAAC,CAAA;IACvF,GAAG,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAA;IAC5C,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAA;IACrC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,iDAAiD;IACjD,wEAAwE;IACxE,8CAA8C;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACxF,IAAI,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAA;IAEjD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAE1G,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,KAAK,IAAI,SAAS;QAAE,MAAM,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACnE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpB,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe;IACtB,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IAC/B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAyB,EACzB,QAAuB,EACvB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,sBAAsB,EAAE,kBAAkB,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE;YACxF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,SAAS;gBACtB,aAAa,EAAE,SAAS;gBACxB,cAAc,EAAE,mBAAmB,WAAW,UAAU,QAAQ,CAAC,OAAO,EAAE;aAC3E,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAA;QACzD,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAyB,EAAE,SAAiB;IACpF,IAAI,CAAC;QACH,MAAM,KAAK,CACT,GAAG,sBAAsB,EAAE,oBAAoB,SAAS,MAAM,EAC9D;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE;YACpD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CACF,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC"}

package/dist/commands/incidents.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `intutic incidents` — the workspace's governance incidents, as on the
+ * dashboard's Findings › Incidents tab.
+ *
+ * Subcommands:
+ *   - `intutic incidents list [--status] [--severity] [--type] [--page] [--limit] [--json]`
+ *   - `intutic incidents show <incidentId> [--json]`
+ *
+ * Server side: `GET /api/v1/incidents` and `GET /api/v1/incidents/:id`
+ * (services/control-plane/src/routes/incidents.ts), OWNER, ADMIN and EM only.
+ * The list is ranked by review priority, not time, and bounded by a review
+ * budget; the CLI says so when the budget withholds incidents, as the
+ * dashboard does. `--severity` and `--type` are checked here before any
+ * request, against the same lists the control plane checks.
+ *
+ * @module
+ */
+import { type ApiCommandOpts } from './apiCommand.js';
+export interface IncidentListOpts extends ApiCommandOpts {
+    status?: string;
+    severity?: string;
+    type?: string;
+    page?: string;
+    limit?: string;
+}
+/** The route's query string for the given filters; fails on a severity or type the control plane would refuse. */
+export declare function incidentQuery(opts: IncidentListOpts): string;
+/** `intutic incidents list` */
+export declare function runIncidentsList(opts: IncidentListOpts): Promise<void>;
+/** `intutic incidents show <incidentId>` */
+export declare function runIncidentsShow(incidentId: string, opts: ApiCommandOpts): Promise<void>;
+//# sourceMappingURL=incidents.d.ts.map

package/dist/commands/incidents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incidents.d.ts","sourceRoot":"","sources":["../../src/commands/incidents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAsBvF,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAKD,kHAAkH;AAClH,wBAAgB,aAAa,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAqB5D;AAMD,+BAA+B;AAC/B,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5E;AAED,4CAA4C;AAC5C,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB9F"}

package/dist/commands/incidents.js

@@ -0,0 +1,94 @@
+/**
+ * `intutic incidents` — the workspace's governance incidents, as on the
+ * dashboard's Findings › Incidents tab.
+ *
+ * Subcommands:
+ *   - `intutic incidents list [--status] [--severity] [--type] [--page] [--limit] [--json]`
+ *   - `intutic incidents show <incidentId> [--json]`
+ *
+ * Server side: `GET /api/v1/incidents` and `GET /api/v1/incidents/:id`
+ * (services/control-plane/src/routes/incidents.ts), OWNER, ADMIN and EM only.
+ * The list is ranked by review priority, not time, and bounded by a review
+ * budget; the CLI says so when the budget withholds incidents, as the
+ * dashboard does. `--severity` and `--type` are checked here before any
+ * request, against the same lists the control plane checks.
+ *
+ * @module
+ */
+import pc from 'picocolors';
+import { INCIDENT_TYPES, RiskLevel } from '@intutic/shared-types';
+import { log } from '../lib/logger.js';
+import { fail, positiveInt, runApiCommand } from './apiCommand.js';
+/** Most severe first, as the dashboard lists them. */
+const SEVERITIES = Object.values(RiskLevel).reverse();
+/** The route's query string for the given filters; fails on a severity or type the control plane would refuse. */
+export function incidentQuery(opts) {
+    const q = new URLSearchParams();
+    if (opts.status)
+        q.set('status', opts.status.toUpperCase());
+    if (opts.severity) {
+        const severity = opts.severity.toUpperCase();
+        if (!SEVERITIES.includes(severity))
+            fail(`--severity must be one of ${SEVERITIES.join(', ')}, got "${opts.severity}"`);
+        q.set('severity', severity);
+    }
+    if (opts.type) {
+        const type = opts.type.toUpperCase();
+        if (!INCIDENT_TYPES.includes(type))
+            fail(`--type must be one of ${INCIDENT_TYPES.join(', ')}, got "${opts.type}"`);
+        q.set('type', type);
+    }
+    if (opts.page !== undefined)
+        q.set('page', String(positiveInt(opts.page, '--page')));
+    if (opts.limit !== undefined) {
+        const limit = positiveInt(opts.limit, '--limit');
+        if (limit > 100)
+            fail(`--limit is at most 100, got ${limit}`);
+        q.set('limit', String(limit));
+    }
+    const s = q.toString();
+    return s ? `?${s}` : '';
+}
+function severityLabel(severity) {
+    return severity === 'CRITICAL' || severity === 'HIGH' ? pc.red(severity) : severity === 'MEDIUM' ? pc.yellow(severity) : severity;
+}
+/** `intutic incidents list` */
+export async function runIncidentsList(opts) {
+    const path = `/api/v1/incidents${incidentQuery(opts)}`;
+    await runApiCommand(opts, 'Failed to list incidents', (client) => client.get(path), (res) => {
+        log.header('Intutic — Incidents');
+        if (res.data.length === 0) {
+            log.dim('  No incidents match.');
+            return;
+        }
+        for (const i of res.data) {
+            console.log(`  ${i.incident_id}  ${severityLabel(i.severity)}  ${i.anomaly_type}  ${i.resolution_status ?? 'OPEN'}  ${pc.dim(i.created_at ?? '')}`);
+            log.dim(`    ${i.description}`);
+        }
+        const { total, page, limit, audit } = res.meta;
+        log.dim(`  Page ${page} of ${Math.max(1, Math.ceil(total / limit))}, ${total} matching, ranked by review priority.`);
+        if (audit?.overBudget) {
+            log.warn(`The review queue covers the ${audit.budget} most suspicious of ${audit.matched} matching incidents: ${audit.withheld} not shown.`);
+        }
+    });
+}
+/** `intutic incidents show <incidentId>` */
+export async function runIncidentsShow(incidentId, opts) {
+    await runApiCommand(opts, `Failed to read incident ${incidentId}`, async (client) => (await client.get(`/api/v1/incidents/${encodeURIComponent(incidentId)}`)).data, (i) => {
+        log.header(`Intutic — Incident ${i.incident_id}`);
+        log.field('Type', i.anomaly_type);
+        log.field('Severity', severityLabel(i.severity));
+        log.field('Status', i.resolution_status ?? 'OPEN');
+        log.field('Created', i.created_at ?? '—');
+        if (i.resolved_at)
+            log.field('Resolved', `${i.resolved_at}${i.resolved_by ? ` by ${i.resolved_by}` : ''}`);
+        if (i.session_id)
+            log.field('Session', i.session_id);
+        if (i.trace_id)
+            log.field('Trace', i.trace_id);
+        log.field('Description', i.description);
+        if (i.escalation_chain)
+            log.field('Details', JSON.stringify(i.escalation_chain));
+    });
+}
+//# sourceMappingURL=incidents.js.map

package/dist/commands/incidents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"incidents.js","sourceRoot":"","sources":["../../src/commands/incidents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAuB,MAAM,iBAAiB,CAAA;AA8BvF,sDAAsD;AACtD,MAAM,UAAU,GAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAc,CAAC,OAAO,EAAE,CAAA;AAEnE,kHAAkH;AAClH,MAAM,UAAU,aAAa,CAAC,IAAsB;IAClD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAA;IAC/B,IAAI,IAAI,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,6BAA6B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;QACtH,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC7B,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;QACpC,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,yBAAyB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,GAAG,CAAC,CAAA;QACzI,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACrB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACpF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAChD,IAAI,KAAK,GAAG,GAAG;YAAE,IAAI,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAA;QAC7D,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/B,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;IACtB,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AACnI,CAAC;AAED,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAsB;IAC3D,MAAM,IAAI,GAAG,oBAAoB,aAAa,CAAC,IAAI,CAAC,EAAE,CAAA;IACtD,MAAM,aAAa,CACjB,IAAI,EACJ,0BAA0B,EAC1B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAe,IAAI,CAAC,EAC1C,CAAC,GAAG,EAAE,EAAE;QACN,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACjC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YAChC,OAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,iBAAiB,IAAI,MAAM,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;YACnJ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QAC9C,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,KAAK,uCAAuC,CAAC,CAAA;QACpH,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,MAAM,uBAAuB,KAAK,CAAC,OAAO,wBAAwB,KAAK,CAAC,QAAQ,aAAa,CAAC,CAAA;QAC9I,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAoB;IAC7E,MAAM,aAAa,CACjB,IAAI,EACJ,2BAA2B,UAAU,EAAE,EACvC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAwB,qBAAqB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EACvH,CAAC,CAAC,EAAE,EAAE;QACJ,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QACjD,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,CAAA;QACjC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChD,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAA;QAClD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1G,IAAI,CAAC,CAAC,UAAU;YAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;QACpD,IAAI,CAAC,CAAC,QAAQ;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAA;QAC9C,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,CAAA;QACvC,IAAI,CAAC,CAAC,gBAAgB;YAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAClF,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/commands/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,sBAAsB,EACtB,iBAAiB,EAIlB,MAAM,uBAAuB,CAAA;AAI9B,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAE/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AA0C9F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB9F;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/F;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GACvC,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACzC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,8EAA8E;IAC9E,UAAU,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB3F;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0C9E;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAW7B,CAAA;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,iEAAoB,CAAA;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,MAAM,EAAE,WAAW,CAAC,MAAM,CAAA;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;CACjD;AAyFD;;;;;GAKG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,+BAAyB,CAAA;AACxD,eAAO,MAAM,wBAAwB,0BAAoB,CAAA;AAEzD;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,SAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAsKjB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDvF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAUtF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAQhG;AAID,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,kJAAkJ;AAClJ,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA4BlI;AAWD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EACnC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,GAAG,CAAC,EAAE,OAAO,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DhB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFhB;AAwBD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GACtD,OAAO,CAAC,IAAI,CAAC,CAsEf;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA6BxD"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,sBAAsB,EACtB,iBAAiB,EAIlB,MAAM,uBAAuB,CAAA;AAI9B,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAG/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AA0C9F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB9F;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/F;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GACvC,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACzC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,8EAA8E;IAC9E,UAAU,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB3F;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0C9E;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAW7B,CAAA;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,iEAAoB,CAAA;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,MAAM,EAAE,WAAW,CAAC,MAAM,CAAA;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;CACjD;AAyFD;;;;;GAKG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,+BAAyB,CAAA;AACxD,eAAO,MAAM,wBAAwB,0BAAoB,CAAA;AAEzD;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,SAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAsKjB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDvF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAUtF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAQhG;AAID,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,kJAAkJ;AAClJ,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA4BlI;AAWD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EACnC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,GAAG,CAAC,EAAE,OAAO,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DhB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoFhB;AAwBD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GACtD,OAAO,CAAC,IAAI,CAAC,CAsEf;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA6BxD"}

package/dist/commands/policy.js

@@ -10,6 +10,7 @@ import { decideCase, loadMeteredRegoRule } from './rules.js';
 import { loadCredentials, loadConfig } from '../config/store.js';
 import { resolveControlPlaneUrl } from '../config/paths.js';
 import { createApiClient } from '../lib/api.js';
+import { writeFileAtomic } from '@intutic/sync-daemon/lib/atomicWrite';
 import { resolveSnapshotRulesPath, SNAPSHOT_RULES_FILE } from '../lib/policySnapshot.js';
 /**
  * Message of a caught value.
@@ -769,7 +770,9 @@ export async function runPolicyInstall(opts) {
     const dest = path.join(dir, fileName);
     try {
         await fs.mkdir(dir, { recursive: true });
-        await fs.writeFile(dest, wasmBuffer);
+        // Atomic: the proxies load this directory while running, and a rule read
+        // half-written refuses every call it governs.
+        await writeFileAtomic(dest, wasmBuffer);
     }
     catch (err) {
         log.error(`Failed to install rule to "${dest}": ${errMessage(err)}`);