@intutic/cli 2.3.0 → 2.5.0

package/dist/lib/chaos/workspace.js

@@ -0,0 +1,216 @@
+/**
+ * Carrying the project's gates into a repetition's workspace.
+ *
+ * A repetition runs in a fresh worktree of HEAD, mounted in the sandbox at
+ * `/work`. What `intutic connect` generated for the project is usually not in
+ * it, and what is in it points at the host:
+ *
+ * - the gate scripts under `.intutic/hooks/` are normally untracked, so the
+ *   worktree has none;
+ * - the harness hook settings name the gate by its absolute host path
+ *   (`node /Users/me/proj/.intutic/hooks/claude-code-check.js`), and the gate
+ *   scripts name their event logs the same way; neither path exists in the
+ *   sandbox;
+ * - the policy snapshot the gates enforce, and the approved-bypass list they
+ *   consult, live in the host's `~/.intutic/hooks/`, while the sandbox has an
+ *   empty home of its own.
+ *
+ * {@link prepareWorkspace} copies the generated gates and any untracked hook
+ * settings from the host project into the worktree (never over a file the
+ * commit already has), rewrites the host project root to `/work` in the
+ * worktree's copies, copies the snapshot and the bypass list next to the
+ * runner's events, and returns the environment that points the gates at
+ * them. It writes only inside the worktree; the project is read, never
+ * changed.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+/** Where the worktree is mounted in the sandbox. */
+export const SANDBOX_ROOT = '/work';
+/** The generated gate scripts, relative to the project root. */
+export const GATE_DIR = '.intutic/hooks';
+/** Where a gate writes its decision and review logs, relative to the project root. */
+export const GATE_EVENTS_DIR = '.intutic/events';
+/**
+ * Project-level hook settings that register a gate by path: Claude Code's
+ * shared and local settings, Codex's and Cursor's project hooks. User-level
+ * settings (`~/.claude/settings.json` and the like) are not carried: the
+ * sandbox home is empty.
+ */
+export const HARNESS_SETTINGS = [
+    '.claude/settings.json',
+    '.claude/settings.local.json',
+    '.codex/hooks.json',
+    '.cursor/hooks.json',
+];
+const SNAPSHOT_BASENAME = 'policy-snapshot.rules';
+const BYPASSES_BASENAME = 'approved-bypasses.jsonl';
+/** Prepare one repetition's worktree so a harness inside the sandbox finds its gates. */
+export async function prepareWorkspace(opts) {
+    const { hostRoot, workspace } = opts;
+    const out = { copied: [], rewritten: [], settings: [], gates: 0, env: {}, warnings: [] };
+    // 1. The generated gates, where the commit does not carry them.
+    for (const rel of await filesUnder(hostRoot, GATE_DIR)) {
+        if (await copyIfAbsent(path.join(hostRoot, rel), path.join(workspace, rel)))
+            out.copied.push(rel);
+    }
+    // 2. Hook settings the commit does not carry (settings.local.json is
+    //    normally ignored).
+    for (const rel of HARNESS_SETTINGS) {
+        if (await copyIfAbsent(path.join(hostRoot, rel), path.join(workspace, rel)))
+            out.copied.push(rel);
+        if (await isFile(path.join(workspace, rel)))
+            out.settings.push(rel);
+    }
+    // 3. Host paths to sandbox paths, in the worktree's copies only.
+    const gateFiles = await filesUnder(workspace, GATE_DIR);
+    out.gates = gateFiles.length;
+    const targets = [...out.settings, ...gateFiles];
+    const pattern = hostRootPattern(await hostRoots(hostRoot, targets.map((rel) => path.join(workspace, rel))));
+    for (const rel of targets) {
+        if (await rewriteFile(path.join(workspace, rel), pattern))
+            out.rewritten.push(rel);
+    }
+    // 4. Where the gates write. The sandbox user is not the host user, so the
+    //    directory must be writable by anyone; made here so the runner (and
+    //    not that user) owns it and can remove it afterwards.
+    if (out.gates > 0) {
+        const events = path.join(workspace, GATE_EVENTS_DIR);
+        await fs.mkdir(events, { recursive: true });
+        await fs.chmod(events, 0o777);
+    }
+    // 5. What the gates read from the host's home.
+    const policyDir = path.join(workspace, opts.policyDir);
+    const sandboxPolicyDir = `${SANDBOX_ROOT}/${opts.policyDir.split(path.sep).join('/')}`;
+    if (opts.snapshotRules && (await isFile(opts.snapshotRules))) {
+        await fs.mkdir(policyDir, { recursive: true });
+        await fs.copyFile(opts.snapshotRules, path.join(policyDir, SNAPSHOT_BASENAME));
+        out.snapshot = opts.snapshotRules;
+        out.env.INTUTIC_SNAPSHOT_RULES = `${sandboxPolicyDir}/${SNAPSHOT_BASENAME}`;
+    }
+    if (opts.approvedBypasses && (await isFile(opts.approvedBypasses))) {
+        await fs.mkdir(policyDir, { recursive: true });
+        await fs.copyFile(opts.approvedBypasses, path.join(policyDir, BYPASSES_BASENAME));
+        out.env.INTUTIC_APPROVED_BYPASSES = `${sandboxPolicyDir}/${BYPASSES_BASENAME}`;
+    }
+    if (out.gates === 0) {
+        out.warnings.push(`no generated gates in ${path.join(hostRoot, GATE_DIR)} (has \`intutic connect\` run in this project?): ` +
+            'a harness in the sandbox runs ungoverned, so the gate faults and the destructive-command tier cannot fire');
+    }
+    else if (!out.snapshot) {
+        out.warnings.push(`no policy snapshot at ${opts.snapshotRules ?? '~/.intutic/hooks/' + SNAPSHOT_BASENAME}: the gates in the sandbox ` +
+            'enforce their built-in protections only, without the destructive-command tier or your rules');
+    }
+    return out;
+}
+/**
+ * Every spelling of the project root the files use: as given, as resolved,
+ * and any other absolute path in front of `/.intutic/` in `files` that
+ * resolves to the same directory. A project reached through a symlink (or
+ * macOS's /var, which is /private/var) was connected under one spelling and
+ * may be run from another.
+ */
+async function hostRoots(hostRoot, files) {
+    const real = await realpathOr(hostRoot);
+    const roots = new Set([path.resolve(hostRoot), real]);
+    const candidates = new Set();
+    for (const file of files) {
+        let text;
+        try {
+            text = await fs.readFile(file, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        for (const m of text.matchAll(/(\/[^\s"'`:;,()[\]{}]*?)\/\.intutic\//g))
+            candidates.add(m[1]);
+    }
+    for (const c of candidates)
+        if (!roots.has(c) && (await realpathOr(c)) === real)
+            roots.add(c);
+    return [...roots].map((r) => r.replace(/[/\\]+$/, '')).filter(Boolean);
+}
+async function realpathOr(p) {
+    try {
+        return await fs.realpath(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+/** Any of the roots, as a whole path component: `/a/proj` and `/a/proj/x`, never `/a/project`. */
+function hostRootPattern(roots) {
+    const alternatives = roots
+        .sort((a, b) => b.length - a.length)
+        .map((r) => r.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    return new RegExp(`(?:${alternatives.join('|')})(?![^/\\\\"'\\s:;,)\\]}])`, 'g');
+}
+/** Replace the host root in a text file; true when it changed. Binary files are left alone. */
+async function rewriteFile(file, pattern) {
+    let text;
+    try {
+        text = await fs.readFile(file, 'utf-8');
+    }
+    catch {
+        return false;
+    }
+    if (text.includes('\0'))
+        return false;
+    const next = text.replace(pattern, SANDBOX_ROOT);
+    if (next === text)
+        return false;
+    const { mode } = await fs.stat(file);
+    await fs.writeFile(file, next);
+    await fs.chmod(file, mode & 0o7777);
+    return true;
+}
+/** Copy `from` to `to` unless `to` exists or `from` does not; true when copied. */
+async function copyIfAbsent(from, to) {
+    if (!(await isFile(from)) || (await exists(to)))
+        return false;
+    await fs.mkdir(path.dirname(to), { recursive: true });
+    await fs.copyFile(from, to);
+    return true;
+}
+/** Regular files under `root/dir`, relative to `root`, with `/` separators. */
+async function filesUnder(root, dir) {
+    const out = [];
+    const walk = async (rel) => {
+        let entries;
+        try {
+            entries = await fs.readdir(path.join(root, rel), { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const child = `${rel}/${e.name}`;
+            if (e.isDirectory())
+                await walk(child);
+            else if (e.isFile())
+                out.push(child);
+        }
+    };
+    await walk(dir);
+    return out.sort();
+}
+async function isFile(p) {
+    try {
+        return (await fs.stat(p)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function exists(p) {
+    try {
+        await fs.lstat(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=workspace.js.map

package/dist/lib/chaos/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../../src/lib/chaos/workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAA;AAEnC,gEAAgE;AAChE,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAA;AAExC,sFAAsF;AACtF,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,uBAAuB;IACvB,6BAA6B;IAC7B,mBAAmB;IACnB,oBAAoB;CACZ,CAAA;AA+BV,MAAM,iBAAiB,GAAG,uBAAuB,CAAA;AACjD,MAAM,iBAAiB,GAAG,yBAAyB,CAAA;AAEnD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAoB;IACzD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAA;IACpC,MAAM,GAAG,GAAsB,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAE3G,gEAAgE;IAChE,KAAK,MAAM,GAAG,IAAI,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnG,CAAC;IACD,qEAAqE;IACrE,wBAAwB;IACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjG,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,CAAC;IAED,iEAAiE;IACjE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACvD,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,CAAA;IAC5B,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3G,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpF,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,0DAA0D;IAC1D,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACpD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC;IAED,+CAA+C;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,gBAAgB,GAAG,GAAG,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IACtF,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAC9E,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAA;QACjC,GAAG,CAAC,GAAG,CAAC,sBAAsB,GAAG,GAAG,gBAAgB,IAAI,iBAAiB,EAAE,CAAA;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAA;QACjF,GAAG,CAAC,GAAG,CAAC,yBAAyB,GAAG,GAAG,gBAAgB,IAAI,iBAAiB,EAAE,CAAA;IAChF,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACpB,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,yBAAyB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,mDAAmD;YACvG,2GAA2G,CAC9G,CAAA;IACH,CAAC;SAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,yBAAyB,IAAI,CAAC,aAAa,IAAI,mBAAmB,GAAG,iBAAiB,6BAA6B;YACjH,6FAA6F,CAChG,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,KAAwB;IACjE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;IAChG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC7F,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,eAAe,CAAC,KAAe;IACtC,MAAM,YAAY,GAAG,KAAK;SACvB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAA;IACvD,OAAO,IAAI,MAAM,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAA;AAClF,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe;IACtD,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAChD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,CAAA;IACnC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,EAAU;IAClD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC3B,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW;IACjD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QAChD,IAAI,OAAO,CAAA;QACX,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;YAChC,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,CAAA;iBACjC,IAAI,CAAC,CAAC,MAAM,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;IACH,CAAC,CAAA;IACD,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;IACf,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/lib/gitHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitHooks.d.ts","sourceRoot":"","sources":["../../src/lib/gitHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA8IH;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG7E"}
+{"version":3,"file":"gitHooks.d.ts","sourceRoot":"","sources":["../../src/lib/gitHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgJH;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG7E"}

package/dist/lib/gitHooks.js

@@ -11,6 +11,7 @@
 import * as node_fs from 'node:fs/promises';
 import * as node_path from 'node:path';
 import { secretPatternAlternation } from '@intutic/shared-types';
+import { writeFileAtomic } from '@intutic/sync-daemon/lib/atomicWrite';
 import { log } from './logger.js';
 /** Marker line identifying a post-commit/post-checkout hook as ours — the overwrite guard. */
 const GIT_CONTEXT_MARKER = '# Intutic Git Context Sync Hook';
@@ -109,8 +110,8 @@ exit 0
  *
  * Reads the existing file first: absent, or already carrying `marker` (a
  * previous install of this same hook, safe to overwrite with the current
- * content — this is what makes a re-run idempotent), writes `content` and
- * marks it executable. Anything else is a hook this codebase did not write —
+ * content — this is what makes a re-run idempotent), writes `content`
+ * executable, atomically. Anything else is a hook this codebase did not write —
  * left standing untouched, with `warnMessage` logged so the operator knows
  * why the hook they expected is missing.
  *
@@ -128,8 +129,9 @@ async function writeHookIfOursOrAbsent(hooksDir, name, content, marker, warnMess
         existing = null;
     }
     if (existing === null || existing.includes(marker)) {
-        await node_fs.writeFile(hookPath, content, { encoding: 'utf-8', mode: 0o755 });
-        await node_fs.chmod(hookPath, 0o755);
+        // Atomic: git runs the hook at moments this does not choose, and a hook
+        // read half-written is a pre-commit secret scan that never ran.
+        await writeFileAtomic(hookPath, content, { mode: 0o755 });
         return true;
     }
     log.warn(warnMessage);

package/dist/lib/gitHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"gitHooks.js","sourceRoot":"","sources":["../../src/lib/gitHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEjC,8FAA8F;AAC9F,MAAM,kBAAkB,GAAG,iCAAiC,CAAA;AAE5D,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,kCAAkC,CAAA;AAE5D,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,4CAA4C,CAAA;AAEtE;;;;;GAKG;AACH,SAAS,qBAAqB;IAC5B,OAAO;;EAEP,kBAAkB;;;;CAInB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB;IACvB,OAAO;;EAEP,iBAAiB;;;;CAIlB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,gBAAgB;IACvB,OAAO;;EAEP,iBAAiB;;;;oGAIiF,wBAAwB,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsB7H,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,IAAY,EACZ,OAAe,EACf,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC/C,IAAI,QAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;IAEpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAElD,mEAAmE;QACnE,gEAAgE;QAChE,iEAAiE;QACjE,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,mBAAmB,GAAG,MAAM,uBAAuB,CACvD,QAAQ,EACR,aAAa,EACb,qBAAqB,EAAE,EACvB,kBAAkB,EAClB,2EAA2E;YACzE,mEAAmE;YACnE,gGAAgG,CACnG,CAAA;QACD,MAAM,qBAAqB,GAAG,MAAM,uBAAuB,CACzD,QAAQ,EACR,eAAe,EACf,qBAAqB,EAAE,EACvB,kBAAkB,EAClB,6EAA6E;YAC3E,qEAAqE;YACrE,gGAAgG,CACnG,CAAA;QAED,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,wEAAwE;QACxE,uEAAuE;QACvE,WAAW;QACX,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,0EAA0E;YACxE,6EAA6E;YAC7E,mCAAmC,CACtC,CAAA;QAED,qEAAqE;QACrE,iEAAiE;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,eAAe;QACf,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,0EAA0E;YACxE,wFAAwF;YACxF,wEAAwE,CAC3E,CAAA;QAED,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,4CAA4C;QAC5C,MAAM,SAAS,GAAa,EAAE,CAAA;QAC9B,IAAI,mBAAmB;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtD,IAAI,qBAAqB;YAAE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC1D,IAAI,kBAAkB;YAAE,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAChE,IAAI,kBAAkB;YAAE,SAAS,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;QAC1E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,qCAAqC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAA;QAC7F,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1F,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"gitHooks.js","sourceRoot":"","sources":["../../src/lib/gitHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEjC,8FAA8F;AAC9F,MAAM,kBAAkB,GAAG,iCAAiC,CAAA;AAE5D,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,kCAAkC,CAAA;AAE5D,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,4CAA4C,CAAA;AAEtE;;;;;GAKG;AACH,SAAS,qBAAqB;IAC5B,OAAO;;EAEP,kBAAkB;;;;CAInB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB;IACvB,OAAO;;EAEP,iBAAiB;;;;CAIlB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,gBAAgB;IACvB,OAAO;;EAEP,iBAAiB;;;;oGAIiF,wBAAwB,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsB7H,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,IAAY,EACZ,OAAe,EACf,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC/C,IAAI,QAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;IAEpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAElD,mEAAmE;QACnE,gEAAgE;QAChE,iEAAiE;QACjE,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,mBAAmB,GAAG,MAAM,uBAAuB,CACvD,QAAQ,EACR,aAAa,EACb,qBAAqB,EAAE,EACvB,kBAAkB,EAClB,2EAA2E;YACzE,mEAAmE;YACnE,gGAAgG,CACnG,CAAA;QACD,MAAM,qBAAqB,GAAG,MAAM,uBAAuB,CACzD,QAAQ,EACR,eAAe,EACf,qBAAqB,EAAE,EACvB,kBAAkB,EAClB,6EAA6E;YAC3E,qEAAqE;YACrE,gGAAgG,CACnG,CAAA;QAED,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,wEAAwE;QACxE,uEAAuE;QACvE,WAAW;QACX,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,0EAA0E;YACxE,6EAA6E;YAC7E,mCAAmC,CACtC,CAAA;QAED,qEAAqE;QACrE,iEAAiE;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,eAAe;QACf,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,0EAA0E;YACxE,wFAAwF;YACxF,wEAAwE,CAC3E,CAAA;QAED,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,4CAA4C;QAC5C,MAAM,SAAS,GAAa,EAAE,CAAA;QAC9B,IAAI,mBAAmB;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtD,IAAI,qBAAqB;YAAE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC1D,IAAI,kBAAkB;YAAE,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAChE,IAAI,kBAAkB;YAAE,SAAS,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;QAC1E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,qCAAqC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAA;QAC7F,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1F,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/lib/providerProbe.d.ts

@@ -21,7 +21,7 @@ export interface ProviderProbeOutcome {
 /**
  * Verify a credential the caller holds locally (not yet, or not necessarily,
  * saved anywhere). `fields` matches the provider's registry field shape,
- * e.g. `{apiKey: '...'}` for Anthropic, `{apiKey, endpoint, deploymentName}`
+ * e.g. `{apiKey: '...'}` for Anthropic, `{apiKey, endpoint}`
  * for Azure OpenAI.
  */
 export declare function probeProviderCredential(providerId: string, fields: Record<string, string>, timeoutMs?: number): Promise<ProviderProbeOutcome>;

package/dist/lib/providerProbe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerProbe.d.ts","sourceRoot":"","sources":["../../src/lib/providerProbe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAwE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAE/H,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,YAAY,GAAG,aAAa,CAAA;IACpC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,SAAS,SAAS,GACjB,OAAO,CAAC,oBAAoB,CAAC,CAoC/B"}
+{"version":3,"file":"providerProbe.d.ts","sourceRoot":"","sources":["../../src/lib/providerProbe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAE5H,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,YAAY,GAAG,aAAa,CAAA;IACpC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,SAAS,SAAS,GACjB,OAAO,CAAC,oBAAoB,CAAC,CA6C/B"}

package/dist/lib/providerProbe.js

@@ -12,11 +12,11 @@
  *
  * @module
  */
-import { buildVerificationProbe, classifyProbeResponse, getProviderDefinition } from '@intutic/shared-types';
+import { buildVerificationProbeAsync, classifyProbe, getProviderDefinition } from '@intutic/shared-types';
 /**
  * Verify a credential the caller holds locally (not yet, or not necessarily,
  * saved anywhere). `fields` matches the provider's registry field shape,
- * e.g. `{apiKey: '...'}` for Anthropic, `{apiKey, endpoint, deploymentName}`
+ * e.g. `{apiKey: '...'}` for Anthropic, `{apiKey, endpoint}`
  * for Azure OpenAI.
  */
 export async function probeProviderCredential(providerId, fields, timeoutMs = 10_000) {
@@ -24,13 +24,19 @@ export async function probeProviderCredential(providerId, fields, timeoutMs = 10
     if (!def) {
         return { status: 'unsupported', detail: `Unknown provider '${providerId}'` };
     }
-    const probe = buildVerificationProbe(providerId, fields);
+    const probe = await buildVerificationProbeAsync(providerId, fields);
     if (!probe) {
         return {
             status: 'unsupported',
             detail: `${def.displayName} cannot be verified automatically yet — double-check the credential by hand`,
         };
     }
+    if (probe.localVerdict) {
+        return {
+            status: probe.localVerdict,
+            detail: `${def.displayName}: ${probe.validDetail ?? 'the credential cannot be used'}`,
+        };
+    }
     try {
         const res = await fetch(probe.url, {
             method: probe.method,
@@ -38,12 +44,14 @@ export async function probeProviderCredential(providerId, fields, timeoutMs = 10
             ...(probe.body ? { body: probe.body } : {}),
             signal: AbortSignal.timeout(timeoutMs),
         });
-        const verdict = classifyProbeResponse(res.status);
+        const verdict = classifyProbe(probe, res.status, res.headers);
         return {
             status: verdict,
             httpStatus: res.status,
             detail: verdict === 'valid'
-                ? `${def.displayName} credential looks valid`
+                ? probe.validDetail
+                    ? `${def.displayName}: ${probe.validDetail}`
+                    : `${def.displayName} credential looks valid`
                 : verdict === 'invalid'
                     ? `${def.displayName} rejected the credential (HTTP ${res.status})`
                     : `${def.displayName} returned HTTP ${res.status} — could not confirm either way`,

package/dist/lib/providerProbe.js.map

@@ -1 +1 @@
-{"version":3,"file":"providerProbe.js","sourceRoot":"","sources":["../../src/lib/providerProbe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,qBAAqB,EAAqB,MAAM,uBAAuB,CAAA;AAQ/H;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAkB,EAClB,MAA8B,EAC9B,SAAS,GAAG,MAAM;IAElB,MAAM,GAAG,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,UAAU,GAAG,EAAE,CAAA;IAC9E,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,6EAA6E;SACxG,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO;YACL,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,MAAM,EACJ,OAAO,KAAK,OAAO;gBACjB,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,yBAAyB;gBAC7C,CAAC,CAAC,OAAO,KAAK,SAAS;oBACrB,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,kCAAkC,GAAG,CAAC,MAAM,GAAG;oBACnE,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,kBAAkB,GAAG,CAAC,MAAM,iCAAiC;SACxF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,WAAW,eAAe,OAAO,EAAE,EAAE,CAAA;IAClG,CAAC;AACH,CAAC"}
+{"version":3,"file":"providerProbe.js","sourceRoot":"","sources":["../../src/lib/providerProbe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,2BAA2B,EAAE,aAAa,EAAE,qBAAqB,EAAqB,MAAM,uBAAuB,CAAA;AAQ5H;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAkB,EAClB,MAA8B,EAC9B,SAAS,GAAG,MAAM;IAElB,MAAM,GAAG,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,UAAU,GAAG,EAAE,CAAA;IAC9E,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,6EAA6E;SACxG,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,+BAA+B,EAAE;SACtF,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7D,OAAO;YACL,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,MAAM,EACJ,OAAO,KAAK,OAAO;gBACjB,CAAC,CAAC,KAAK,CAAC,WAAW;oBACjB,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE;oBAC5C,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,yBAAyB;gBAC/C,CAAC,CAAC,OAAO,KAAK,SAAS;oBACrB,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,kCAAkC,GAAG,CAAC,MAAM,GAAG;oBACnE,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,kBAAkB,GAAG,CAAC,MAAM,iCAAiC;SACxF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,WAAW,eAAe,OAAO,EAAE,EAAE,CAAA;IAClG,CAAC;AACH,CAAC"}

package/dist/lib/sandbox/firecracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firecracker.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,MAAM,EAAE,KAAK,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,OAAO,CAAA;QACvB,YAAY,EAAE,OAAO,CAAA;KACtB,CAAC,CAAA;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxE,gBAAgB,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,CAkBlF;AAED,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGtD;AASD,qBAAa,kBAAmB,YAAW,cAAc;IACvD,QAAQ,CAAC,IAAI,iBAAgB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEhC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKjE;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAiBhC,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CAoC9C"}
+{"version":3,"file":"firecracker.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,MAAM,EAAE,KAAK,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,OAAO,CAAA;QACvB,YAAY,EAAE,OAAO,CAAA;KACtB,CAAC,CAAA;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxE,gBAAgB,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,CAkBlF;AAED,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGtD;AASD,qBAAa,kBAAmB,YAAW,cAAc;IACvD,QAAQ,CAAC,IAAI,iBAAgB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEhC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKjE;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAiBhC,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CAsC9C"}

package/dist/lib/sandbox/firecracker.js

@@ -121,9 +121,12 @@ export class FirecrackerBackend {
         ];
         return new Promise((resolve) => {
             const child = spawn('bash', args, {
-                stdio: 'inherit',
+                stdio: spec.onStdout ? ['inherit', 'pipe', 'inherit'] : 'inherit',
                 env: { ...process.env, ...this.env },
             });
+            if (spec.onStdout)
+                child.stdout?.on('data', spec.onStdout);
+            spec.signal?.addEventListener('abort', () => child.kill('SIGTERM'), { once: true });
             child.on('error', (err) => {
                 log.error(`firecracker launch failed: ${err.message}`);
                 resolve(127);

package/dist/lib/sandbox/firecracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../../src/lib/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAkCjD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,QAAQ,GACZ,0DAA0D;QAC1D,MAAM,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,YAAY,CAAA;IAC3D,OAAO;QACL,aAAa,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;QAC1E,MAAM,EAAE;YACN;gBACE,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,IAAI,CAAC,UAAU;gBAC7B,cAAc,EAAE,IAAI;gBACpB,YAAY,EAAE,KAAK;aACpB;SACF;QACD,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3E,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE;KACxE,CAAA;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAA;IACnE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjE,CAAC;AAED,gEAAgE;AAChE,SAAS,gBAAgB;IACvB,sEAAsE;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,aAAa,CAAA;IACZ,IAAI,CAAoB;IACxB,GAAG,CAAwB;IAE5C,YAAY,IAAwB,EAAE,GAA2B;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAA;QAC7F,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;QACxF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;QACxF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;QACvE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAiB;QACzB,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAA;YACzD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,IAAI,GAAG;YACX,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC5B,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC/B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YAC7B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAClC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YACpC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO;SACtB,CAAA;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;gBAChC,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,GAAG,CAAC,KAAK,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtD,OAAO,CAAC,GAAG,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../../src/lib/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAkCjD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,QAAQ,GACZ,0DAA0D;QAC1D,MAAM,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,YAAY,CAAA;IAC3D,OAAO;QACL,aAAa,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;QAC1E,MAAM,EAAE;YACN;gBACE,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,IAAI,CAAC,UAAU;gBAC7B,cAAc,EAAE,IAAI;gBACpB,YAAY,EAAE,KAAK;aACpB;SACF;QACD,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3E,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE;KACxE,CAAA;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAA;IACnE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjE,CAAC;AAED,gEAAgE;AAChE,SAAS,gBAAgB;IACvB,sEAAsE;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,aAAa,CAAA;IACZ,IAAI,CAAoB;IACxB,GAAG,CAAwB;IAE5C,YAAY,IAAwB,EAAE,GAA2B;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAA;QAC7F,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;QACxF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;QACxF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;QACvE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAiB;QACzB,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAA;YACzD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,IAAI,GAAG;YACX,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC5B,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC/B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YAC7B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAClC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YACpC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO;SACtB,CAAA;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;gBAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1D,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACnF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,GAAG,CAAC,KAAK,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtD,OAAO,CAAC,GAAG,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/lib/sandbox/image.d.ts

@@ -1,5 +1,5 @@
 /**
- * The default sandbox image, built locally from the Dockerfile the CLI ships.
+ * The sandbox images, built locally from the Dockerfiles the CLI ships.
  *
  * There is no registry copy to pull: the default used to be
  * `intutic/sandbox:latest`, a name nothing publishes, so `intutic exec
@@ -8,19 +8,28 @@
  * which is in the npm package, so the first sandboxed run builds it and tags it
  * with the CLI version; later runs, and upgrades to the same version, reuse it.
  *
+ * A second well-known tag, `<default>-node`, is the default image plus Node.js
+ * and npm (`Dockerfile.node`), the base for agents that run on Node. It is
+ * built the same way, on first use, FROM the default image.
+ *
  * @module
  */
 /** The image `--sandbox-image` defaults to: built locally, tagged with this CLI's version. */
 export declare const DEFAULT_SANDBOX_IMAGE: string;
+/**
+ * The default image plus Node.js and npm, for agents that run on Node (Claude
+ * Code, Codex, …): same entrypoint, firewall and capability drop.
+ */
+export declare const NODE_SANDBOX_IMAGE: string;
 /** Directory holding the shipped Dockerfile and entrypoint. */
 export declare function sandboxBuildContext(): string;
 /** Runs a container-runtime command; resolves with its exit code. */
 export type RuntimeRunner = (runtime: string, args: string[], inheritOutput: boolean) => Promise<number>;
 /**
- * Make sure `image` can be run. Only the default image is built here; any
- * other name is the user's own and the runtime pulls it as usual.
+ * Make sure `image` can be run. Only the two well-known images are built here;
+ * any other name is the user's own and the runtime pulls it as usual.
  *
- * Throws with a message for the user when the default image is missing and
+ * Throws with a message for the user when a well-known image is missing and
  * cannot be built.
  */
 export declare function ensureSandboxImage(runtime: string, image: string, run?: RuntimeRunner, context?: string): Promise<void>;

package/dist/lib/sandbox/image.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAA+B,CAAA;AAEjE,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;AASxG;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,aAA4B,EACjC,OAAO,GAAE,MAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAA+B,CAAA;AAEjE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAkC,CAAA;AAEjE,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;AASxG;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,aAA4B,EACjC,OAAO,GAAE,MAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/lib/sandbox/image.js

@@ -1,5 +1,5 @@
 /**
- * The default sandbox image, built locally from the Dockerfile the CLI ships.
+ * The sandbox images, built locally from the Dockerfiles the CLI ships.
  *
  * There is no registry copy to pull: the default used to be
  * `intutic/sandbox:latest`, a name nothing publishes, so `intutic exec
@@ -8,6 +8,10 @@
  * which is in the npm package, so the first sandboxed run builds it and tags it
  * with the CLI version; later runs, and upgrades to the same version, reuse it.
  *
+ * A second well-known tag, `<default>-node`, is the default image plus Node.js
+ * and npm (`Dockerfile.node`), the base for agents that run on Node. It is
+ * built the same way, on first use, FROM the default image.
+ *
  * @module
  */
 import { spawn } from 'node:child_process';
@@ -19,6 +23,11 @@ import { log } from '../logger.js';
 const { version } = createRequire(import.meta.url)('../../../package.json');
 /** The image `--sandbox-image` defaults to: built locally, tagged with this CLI's version. */
 export const DEFAULT_SANDBOX_IMAGE = `intutic/sandbox:${version}`;
+/**
+ * The default image plus Node.js and npm, for agents that run on Node (Claude
+ * Code, Codex, …): same entrypoint, firewall and capability drop.
+ */
+export const NODE_SANDBOX_IMAGE = `${DEFAULT_SANDBOX_IMAGE}-node`;
 /** Directory holding the shipped Dockerfile and entrypoint. */
 export function sandboxBuildContext() {
     // src/lib/sandbox/image.ts and dist/lib/sandbox/image.js are the same depth.
@@ -31,23 +40,31 @@ const spawnRuntime = (runtime, args, inheritOutput) => new Promise((resolve) =>
     child.on('exit', (code) => resolve(code ?? 1));
 });
 /**
- * Make sure `image` can be run. Only the default image is built here; any
- * other name is the user's own and the runtime pulls it as usual.
+ * Make sure `image` can be run. Only the two well-known images are built here;
+ * any other name is the user's own and the runtime pulls it as usual.
  *
- * Throws with a message for the user when the default image is missing and
+ * Throws with a message for the user when a well-known image is missing and
  * cannot be built.
  */
 export async function ensureSandboxImage(runtime, image, run = spawnRuntime, context = sandboxBuildContext()) {
-    if (image !== DEFAULT_SANDBOX_IMAGE)
+    if (image !== DEFAULT_SANDBOX_IMAGE && image !== NODE_SANDBOX_IMAGE)
         return;
     if ((await run(runtime, ['image', 'inspect', image], false)) === 0)
         return;
-    if (!existsSync(path.join(context, 'Dockerfile'))) {
-        throw new Error(`the sandbox Dockerfile is not part of this installation (${context}). ` +
+    const node = image === NODE_SANDBOX_IMAGE;
+    const dockerfile = path.join(context, node ? 'Dockerfile.node' : 'Dockerfile');
+    if (!existsSync(dockerfile)) {
+        throw new Error(`the sandbox Dockerfile is not part of this installation (${dockerfile}). ` +
             'Install the CLI from npm, or pass --sandbox-image with your own image.');
     }
+    // The Node image is built FROM the default one, so that comes first.
+    if (node)
+        await ensureSandboxImage(runtime, DEFAULT_SANDBOX_IMAGE, run, context);
     log.info(`Building the sandbox image ${image} (first sandboxed run with this CLI version)…`);
-    if ((await run(runtime, ['build', '-t', image, context], true)) !== 0) {
+    const args = node
+        ? ['build', '-f', dockerfile, '--build-arg', `INTUTIC_SANDBOX_BASE=${DEFAULT_SANDBOX_IMAGE}`, '-t', image, context]
+        : ['build', '-t', image, context];
+    if ((await run(runtime, args, true)) !== 0) {
         throw new Error(`${runtime} build of ${image} failed; see the output above`);
     }
 }

package/dist/lib/sandbox/image.js.map

@@ -1 +1 @@
-{"version":3,"file":"image.js","sourceRoot":"","sources":["../../../src/lib/sandbox/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAwB,CAAA;AAElG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,OAAO,EAAE,CAAA;AAEjE,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB;IACjC,6EAA6E;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAA;AACzD,CAAC;AAKD,MAAM,YAAY,GAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CACnE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACnF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACrC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,KAAa,EACb,MAAqB,YAAY,EACjC,UAAkB,mBAAmB,EAAE;IAEvC,IAAI,KAAK,KAAK,qBAAqB;QAAE,OAAM;IAC3C,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC;QAAE,OAAM;IAE1E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,KAAK;YACtE,wEAAwE,CAC3E,CAAA;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,8BAA8B,KAAK,+CAA+C,CAAC,CAAA;IAC5F,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,aAAa,KAAK,+BAA+B,CAAC,CAAA;IAC9E,CAAC;AACH,CAAC"}
+{"version":3,"file":"image.js","sourceRoot":"","sources":["../../../src/lib/sandbox/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAwB,CAAA;AAElG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,OAAO,EAAE,CAAA;AAEjE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,qBAAqB,OAAO,CAAA;AAEjE,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB;IACjC,6EAA6E;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAA;AACzD,CAAC;AAKD,MAAM,YAAY,GAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CACnE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACnF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACrC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,KAAa,EACb,MAAqB,YAAY,EACjC,UAAkB,mBAAmB,EAAE;IAEvC,IAAI,KAAK,KAAK,qBAAqB,IAAI,KAAK,KAAK,kBAAkB;QAAE,OAAM;IAC3E,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC;QAAE,OAAM;IAE1E,MAAM,IAAI,GAAG,KAAK,KAAK,kBAAkB,CAAA;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IAC9E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,4DAA4D,UAAU,KAAK;YACzE,wEAAwE,CAC3E,CAAA;IACH,CAAC;IACD,qEAAqE;IACrE,IAAI,IAAI;QAAE,MAAM,kBAAkB,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAChF,GAAG,CAAC,IAAI,CAAC,8BAA8B,KAAK,+CAA+C,CAAC,CAAA;IAC5F,MAAM,IAAI,GAAG,IAAI;QACf,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,wBAAwB,qBAAqB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC;QACnH,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,aAAa,KAAK,+BAA+B,CAAC,CAAA;IAC9E,CAAC;AACH,CAAC"}

package/dist/lib/sandbox/oci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/oci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE5C;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAoC7E;AAED,qBAAa,UAAW,YAAW,cAAc;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEhC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAMtD,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAgBhC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CAuB9C"}
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/oci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE5C;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CA0C7E;AAED,qBAAa,UAAW,YAAW,cAAc;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEhC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAMtD,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAgBhC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CA8B9C"}

package/dist/lib/sandbox/oci.js

@@ -28,6 +28,8 @@ import { ensureSandboxImage } from './image.js';
  */
 export function buildOciArgs(runtime, spec) {
     const args = ['run', '--rm'];
+    if (spec.name)
+        args.push('--name', spec.name);
     // -i always (pipe stdin); -t only when we have a real terminal.
     args.push(spec.tty ? '-it' : '-i');
     // Capability envelope: drop everything, add back only what the entrypoint
@@ -39,8 +41,12 @@ export function buildOciArgs(runtime, spec) {
     args.push('--security-opt=no-new-privileges');
     // Immutable rootfs with writable scratch.
     args.push('--read-only');
-    for (const t of ['/tmp', '/run', '/home/sandbox'])
-        args.push('--tmpfs', t);
+    // A tmpfs is mounted root-owned, mode 755 unless told otherwise, so the
+    // agent's own home would be read-only to the unprivileged user it runs as,
+    // and every agent that keeps state there (Claude Code's ~/.claude, an MCP
+    // proxy's pins) would fail. The entrypoint cannot chown it (no CAP_CHOWN),
+    // so it is mounted writable for whichever uid the image's `sandbox` user has.
+    args.push('--tmpfs', '/tmp', '--tmpfs', '/run', '--tmpfs', '/home/sandbox:mode=1777');
     // Resource bounds.
     args.push(`--pids-limit=${spec.pidsLimit}`);
     args.push(`--memory=${spec.memory}`);
@@ -87,10 +93,19 @@ export class OciBackend {
         log.dim(`sandbox: ${this.runtime} ${args.slice(0, 12).join(' ')} …`);
         return new Promise((resolve) => {
             const child = spawn(this.runtime, args, {
-                stdio: 'inherit',
+                stdio: spec.onStdout ? ['inherit', 'pipe', 'inherit'] : 'inherit',
                 // Values for the `--env NAME` references live here, not in argv.
                 env: { ...process.env, ...this.env },
             });
+            if (spec.onStdout)
+                child.stdout?.on('data', spec.onStdout);
+            // Killing the `docker run` client can leave the container running, so
+            // stop it by name when there is one.
+            spec.signal?.addEventListener('abort', () => {
+                if (spec.name)
+                    spawn(this.runtime, ['kill', spec.name], { stdio: 'ignore' }).on('error', () => { });
+                child.kill('SIGTERM');
+            }, { once: true });
             child.on('error', (err) => {
                 if (err.code === 'ENOENT') {
                     log.error(`Sandbox runtime '${this.runtime}' not found. Install Docker or Podman.`);

package/dist/lib/sandbox/oci.js.map

@@ -1 +1 @@
-{"version":3,"file":"oci.js","sourceRoot":"","sources":["../../../src/lib/sandbox/oci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAK/C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAmB,EAAE,IAAiB;IACjE,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACtC,gEAAgE;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAElC,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAE7C,0CAA0C;IAC1C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IAE1E,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAEhC,+BAA+B;IAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,eAAe,CAAC,CAAA;IAE3D,uDAAuD;IACvD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAEvD,8EAA8E;IAC9E,8BAA8B;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAEvD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrB,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,OAAO,UAAU;IACZ,IAAI,CAAQ;IACJ,OAAO,CAAY;IACpC,2EAA2E;IAC1D,GAAG,CAAwB;IAE5C,YAAY,OAAmB,EAAE,GAA2B;QAC1D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE;gBAC5E,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;aACtC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,EAAE,CAAC,CAC3E,CAAA;YACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,IAAI,KAAK,CAAC;gBACR,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB,EAAE,CAAC;gBAC1E,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE,CAAC,CAClF,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAiB;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC7C,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE;gBACtC,KAAK,EAAE,SAAS;gBAChB,iEAAiE;gBACjE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,OAAO,wCAAwC,CAAC,CAAA;gBACrF,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtD,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,IAAI,MAAM;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAA;;oBACnB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"oci.js","sourceRoot":"","sources":["../../../src/lib/sandbox/oci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAK/C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAmB,EAAE,IAAiB;IACjE,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACtC,IAAI,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7C,gEAAgE;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAElC,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAE7C,0CAA0C;IAC1C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACxB,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IAErF,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAEhC,+BAA+B;IAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,eAAe,CAAC,CAAA;IAE3D,uDAAuD;IACvD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAEvD,8EAA8E;IAC9E,8BAA8B;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAEvD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrB,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,OAAO,UAAU;IACZ,IAAI,CAAQ;IACJ,OAAO,CAAY;IACpC,2EAA2E;IAC1D,GAAG,CAAwB;IAE5C,YAAY,OAAmB,EAAE,GAA2B;QAC1D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE;gBAC5E,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;aACtC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,EAAE,CAAC,CAC3E,CAAA;YACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,IAAI,KAAK,CAAC;gBACR,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB,EAAE,CAAC;gBAC1E,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE,CAAC,CAClF,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAiB;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC7C,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE;gBACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,iEAAiE;gBACjE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1D,sEAAsE;YACtE,qCAAqC;YACrC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC1C,IAAI,IAAI,CAAC,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAClB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,OAAO,wCAAwC,CAAC,CAAA;gBACrF,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtD,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,IAAI,MAAM;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAA;;oBACnB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}