@iowarp/clio-coder 0.4.8 → 0.4.9

package/dist/chunk-XTQ7MEJG.js

@@ -0,0 +1,457 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  gitCommitAttributionEnabled,
+  reportCommitAttributionDiagnostic,
+  withManagedGitCommitAttributionEnvironment
+} from "./chunk-LTR5QCLS.js";
+import {
+  clampTimerDelayMs
+} from "./chunk-6EXUUOSN.js";
+import {
+  AI_AGENT_NAME
+} from "./chunk-ZTNFYMIO.js";
+import {
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/core/safe-exec.ts
+init_esm_shims();
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { performance } from "node:perf_hooks";
+var SAFE_EXEC_DEFAULT_TIMEOUT_MS = 12e4;
+var SAFE_EXEC_DEFAULT_MAX_OUTPUT_BYTES = 6e5;
+var ENV_ALLOWLIST = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "LANG",
+  "LC_ALL",
+  "TMPDIR",
+  "TEMP",
+  "TMP",
+  "CI",
+  "NO_COLOR",
+  // Platform/session location variables needed by installed local CLIs. These
+  // locate operator-owned state; provider keys and Clio gates are deliberately
+  // absent from this allowlist.
+  "XDG_CONFIG_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_STATE_HOME",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "SYSTEMROOT",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT"
+];
+var SAFE_EXEC_DEFAULT_RETAIN_HEAD_BYTES = 4096;
+var SAFE_EXEC_DEFAULT_RETAIN_TAIL_BYTES = 16 * 1024;
+var SAFE_EXEC_DEFAULT_KILL_GRACE_MS = 3e3;
+var SAFE_EXEC_GROUP_TEARDOWN_BOUND_MS = 1e3;
+var SAFE_EXEC_PIPE_DRAIN_BOUND_MS = 1e3;
+var GROUP_POLL_INTERVAL_MS = 25;
+function trimIncompleteUtf8Suffix(bytes) {
+  const length = bytes.byteLength;
+  for (let back = 1; back <= 3 && back <= length; back += 1) {
+    const byte = bytes[length - back];
+    if ((byte & 192) === 128) continue;
+    const expected = byte >= 240 ? 4 : byte >= 224 ? 3 : byte >= 192 ? 2 : 1;
+    return expected > back ? bytes.subarray(0, length - back) : bytes;
+  }
+  return bytes;
+}
+function trimLeadingUtf8Continuation(bytes) {
+  let start = 0;
+  while (start < bytes.byteLength && start < 4 && (bytes[start] & 192) === 128) start += 1;
+  return start === 0 ? bytes : bytes.subarray(start);
+}
+function createRetainedStreamWindow(headCapBytes, tailCapBytes) {
+  const headCap = Math.max(0, Math.floor(headCapBytes));
+  const tailCap = Math.max(0, Math.floor(tailCapBytes));
+  const head = [];
+  let headBytes = 0;
+  const tail = [];
+  let tailBytes = 0;
+  let total = 0;
+  return {
+    get totalBytes() {
+      return total;
+    },
+    append(chunk) {
+      total += chunk.byteLength;
+      let rest = chunk;
+      if (headBytes < headCap) {
+        const take = Math.min(rest.byteLength, headCap - headBytes);
+        head.push(rest.subarray(0, take));
+        headBytes += take;
+        if (take === rest.byteLength) return;
+        rest = rest.subarray(take);
+      }
+      if (tailCap === 0) return;
+      tail.push(rest);
+      tailBytes += rest.byteLength;
+      while (tailBytes > tailCap && tail.length > 0) {
+        const first = tail[0];
+        const excess = tailBytes - tailCap;
+        if (first.byteLength <= excess) {
+          tail.shift();
+          tailBytes -= first.byteLength;
+        } else {
+          tail[0] = first.subarray(excess);
+          tailBytes -= excess;
+        }
+      }
+    },
+    render() {
+      if (total - headBytes - tailBytes <= 0) {
+        const text2 = Buffer.concat([...head, ...tail]).toString("utf8");
+        return { text: text2, retained: true, totalBytes: total, omittedBytes: 0 };
+      }
+      const headShown = trimIncompleteUtf8Suffix(Buffer.concat(head));
+      const tailShown = trimLeadingUtf8Continuation(Buffer.concat(tail));
+      const omitted = total - headShown.byteLength - tailShown.byteLength;
+      const headText = headShown.toString("utf8");
+      const tailText = tailShown.toString("utf8");
+      const marker = `[... ${omitted} bytes omitted ...]`;
+      const text = headText.length > 0 ? `${headText}
+${marker}
+${tailText}` : `${marker}
+${tailText}`;
+      return { text, retained: false, totalBytes: total, omittedBytes: omitted };
+    }
+  };
+}
+var SYSTEM_CLEANUP_SCHEDULER = {
+  setTimeout: (callback, delayMs) => setTimeout(callback, delayMs),
+  clearTimeout: (handle) => clearTimeout(handle)
+};
+function createProcessGroupCleanup(hooks) {
+  const scheduler = hooks.scheduler ?? SYSTEM_CLEANUP_SCHEDULER;
+  const graceMs = Math.max(0, hooks.graceMs);
+  const teardownBoundMs = Math.max(0, hooks.teardownBoundMs ?? SAFE_EXEC_GROUP_TEARDOWN_BOUND_MS);
+  const pollIntervalMs = Math.max(1, hooks.pollIntervalMs ?? GROUP_POLL_INTERVAL_MS);
+  let phase = "idle";
+  let leaderGone = false;
+  let descendantsCleaned = false;
+  let status = null;
+  let graceTimer = null;
+  let boundTimer = null;
+  let pollTimer = null;
+  const isDone = () => phase === "done";
+  const clearTimers = () => {
+    for (const handle of [graceTimer, boundTimer, pollTimer]) if (handle !== null) scheduler.clearTimeout(handle);
+    graceTimer = null;
+    boundTimer = null;
+    pollTimer = null;
+  };
+  const complete = (incomplete) => {
+    if (phase === "done") return;
+    phase = "done";
+    clearTimers();
+    status = { descendantsCleaned, incomplete };
+    hooks.onDone(status);
+  };
+  const membersRemain = () => {
+    if (hooks.probe()) return true;
+    complete(false);
+    return false;
+  };
+  const deliver = (signalName) => {
+    if (hooks.signal(signalName)) return true;
+    complete(false);
+    return false;
+  };
+  const escalate = () => {
+    graceTimer = null;
+    if (phase === "done" || !membersRemain()) return;
+    phase = "killing";
+    if (!deliver("SIGKILL")) return;
+    boundTimer = scheduler.setTimeout(() => {
+      boundTimer = null;
+      if (phase === "done") return;
+      if (membersRemain()) complete(true);
+    }, teardownBoundMs);
+  };
+  const openWindow = (probed) => {
+    if (phase !== "idle") return;
+    if (!probed && !membersRemain()) return;
+    phase = "terminating";
+    if (!deliver("SIGTERM")) return;
+    if (graceMs > 0) graceTimer = scheduler.setTimeout(escalate, graceMs);
+    else escalate();
+  };
+  const poll = () => {
+    pollTimer = scheduler.setTimeout(() => {
+      pollTimer = null;
+      if (phase === "done") return;
+      if (membersRemain()) poll();
+    }, pollIntervalMs);
+  };
+  return {
+    get done() {
+      return phase === "done";
+    },
+    get status() {
+      return status;
+    },
+    kill() {
+      if (phase === "done") return;
+      openWindow(false);
+    },
+    leaderExited() {
+      if (phase === "done" || leaderGone) return;
+      leaderGone = true;
+      if (!membersRemain()) return;
+      descendantsCleaned = true;
+      openWindow(true);
+      if (!isDone()) poll();
+    },
+    dispose() {
+      if (phase === "done") return;
+      phase = "done";
+      clearTimers();
+    }
+  };
+}
+function buildSafeToolEnv(extra = {}, source = process.env) {
+  const env = {};
+  for (const key of ENV_ALLOWLIST) {
+    const value = source[key];
+    if (value !== void 0) env[key] = value;
+  }
+  for (const [key, value] of Object.entries(extra)) {
+    if (!/^[A-Z_][A-Z0-9_]*$/i.test(key)) continue;
+    env[key] = value;
+  }
+  env.AI_AGENT = AI_AGENT_NAME;
+  return env;
+}
+function resolveSafeCwd(cwd, workspaceRoot = process.cwd()) {
+  const root = path.resolve(workspaceRoot);
+  const resolved = cwd === void 0 ? root : path.isAbsolute(cwd) ? path.resolve(cwd) : path.resolve(root, cwd);
+  const rel = path.relative(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel)) return resolved;
+  throw new Error(`cwd escapes workspace root: ${resolved}`);
+}
+function runCommandVector(file, args, options = {}) {
+  return new Promise((resolve) => {
+    const startedAtClock = performance.now();
+    const startedAt = Date.now();
+    const cwd = resolveSafeCwd(options.cwd, options.workspaceRoot);
+    const timeoutMs = clampTimerDelayMs(options.timeoutMs ?? SAFE_EXEC_DEFAULT_TIMEOUT_MS);
+    const killGraceMs = clampTimerDelayMs(options.killGraceMs ?? SAFE_EXEC_DEFAULT_KILL_GRACE_MS);
+    const maxOutputBytes = options.maxOutputBytes ?? SAFE_EXEC_DEFAULT_MAX_OUTPUT_BYTES;
+    const sink = options.output;
+    const stdoutWindow = sink === void 0 ? null : createRetainedStreamWindow(
+      sink.retainHeadBytes ?? SAFE_EXEC_DEFAULT_RETAIN_HEAD_BYTES,
+      sink.retainTailBytes ?? SAFE_EXEC_DEFAULT_RETAIN_TAIL_BYTES
+    );
+    const stderrWindow = sink === void 0 ? null : createRetainedStreamWindow(
+      sink.retainHeadBytes ?? SAFE_EXEC_DEFAULT_RETAIN_HEAD_BYTES,
+      sink.retainTailBytes ?? SAFE_EXEC_DEFAULT_RETAIN_TAIL_BYTES
+    );
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let sinkError = null;
+    const attribution = withManagedGitCommitAttributionEnvironment(buildSafeToolEnv(options.env), {
+      cwd,
+      enabled: gitCommitAttributionEnabled(process.env)
+    });
+    reportCommitAttributionDiagnostic(attribution.diagnostic);
+    let aborted = false;
+    let timedOut = false;
+    let outputCapped = false;
+    let outputBytes = 0;
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const captured = () => {
+      if (stdoutWindow === null || stderrWindow === null) {
+        return {
+          stdout,
+          stderr,
+          stdoutBytes,
+          stderrBytes,
+          stdoutRetained: !outputCapped,
+          stderrRetained: !outputCapped,
+          ...sinkError === null ? {} : { sinkError }
+        };
+      }
+      const out = stdoutWindow.render();
+      const err = stderrWindow.render();
+      return {
+        stdout: out.text,
+        stderr: err.text,
+        stdoutBytes,
+        stderrBytes,
+        stdoutRetained: out.retained,
+        stderrRetained: err.retained,
+        ...sinkError === null ? {} : { sinkError }
+      };
+    };
+    let timeoutId = null;
+    let leaderExit = null;
+    let closed = false;
+    let pipeDrainIncomplete = false;
+    let drainTimer = null;
+    const child = spawn(file, [...args], {
+      cwd,
+      env: attribution.env,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const onAbort = () => {
+      aborted = true;
+      killChild();
+      if (leaderExit !== null) stopDraining();
+    };
+    const groupProbe = () => {
+      const pid = child.pid;
+      if (!pid) return false;
+      if (process.platform === "win32") return child.exitCode === null && child.signalCode === null;
+      try {
+        process.kill(-pid, 0);
+        return true;
+      } catch (error) {
+        return error.code !== "ESRCH";
+      }
+    };
+    const groupSignal = (signalName) => {
+      const pid = child.pid;
+      if (pid && process.platform !== "win32") {
+        try {
+          process.kill(-pid, signalName);
+          return true;
+        } catch (error) {
+          if (error.code === "ESRCH") return false;
+          return true;
+        }
+      }
+      return child.kill(signalName);
+    };
+    const cleanup = createProcessGroupCleanup({
+      graceMs: killGraceMs,
+      probe: groupProbe,
+      signal: groupSignal,
+      onDone: () => tryFinish()
+    });
+    const killChild = () => cleanup.kill();
+    const finish = (exitCode, signalName, spawnError) => {
+      if (settled) return;
+      settled = true;
+      if (drainTimer) clearTimeout(drainTimer);
+      drainTimer = null;
+      if (timeoutId) clearTimeout(timeoutId);
+      timeoutId = null;
+      cleanup.dispose();
+      options.signal?.removeEventListener("abort", onAbort);
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      child.unref();
+      const output = captured();
+      resolve({
+        file,
+        args: [...args],
+        cwd,
+        ...output,
+        ...pipeDrainIncomplete ? { stdoutRetained: false, stderrRetained: false } : {},
+        stderr: output.stderr.length === 0 && spawnError !== void 0 ? spawnError.message : output.stderr,
+        exitCode: (cleanup.status?.incomplete === true || pipeDrainIncomplete) && exitCode === 0 ? 1 : exitCode,
+        leaderExit,
+        signal: signalName,
+        aborted,
+        timedOut,
+        outputCapped,
+        durationMs: Math.round(performance.now() - startedAtClock),
+        startedAt,
+        descendantsCleaned: cleanup.status?.descendantsCleaned ?? false,
+        cleanupIncomplete: cleanup.status?.incomplete ?? false,
+        pipeDrainIncomplete,
+        failure: cleanup.status?.incomplete === true ? `process group cleanup incomplete: members were still present ${SAFE_EXEC_GROUP_TEARDOWN_BOUND_MS}ms after SIGKILL` : pipeDrainIncomplete ? "output pipe draining incomplete after leader exit; logs may be incomplete and escaped processes are not contained" : null
+      });
+    };
+    const stopDraining = () => {
+      if (settled) return;
+      if (!child.stdout?.readableEnded || !child.stderr?.readableEnded) {
+        pipeDrainIncomplete = true;
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+      }
+      tryFinish();
+    };
+    function tryFinish() {
+      if (settled || !cleanup.done) return;
+      if (!closed && cleanup.status?.incomplete !== true && !pipeDrainIncomplete) return;
+      finish(leaderExit?.code ?? null, leaderExit?.signal ?? null);
+    }
+    if (timeoutMs > 0) {
+      timeoutId = setTimeout(() => {
+        timedOut = true;
+        killChild();
+      }, timeoutMs);
+    }
+    if (options.signal?.aborted) onAbort();
+    else options.signal?.addEventListener("abort", onAbort, { once: true });
+    const appendChunk = (target, chunk) => {
+      if (settled) return;
+      if (target === "stdout") stdoutBytes += chunk.byteLength;
+      else stderrBytes += chunk.byteLength;
+      if (sink !== void 0 && stdoutWindow !== null && stderrWindow !== null) {
+        (target === "stdout" ? stdoutWindow : stderrWindow).append(chunk);
+        if (sinkError !== null) return;
+        try {
+          if (target === "stdout") sink.onStdout?.(chunk);
+          else sink.onStderr?.(chunk);
+        } catch (error) {
+          sinkError = error instanceof Error ? error.message : String(error);
+          killChild();
+        }
+        return;
+      }
+      if (outputCapped) return;
+      outputBytes += chunk.byteLength;
+      if (outputBytes > maxOutputBytes) {
+        outputCapped = true;
+        killChild();
+        return;
+      }
+      if (target === "stdout") stdout += chunk.toString("utf8");
+      else stderr += chunk.toString("utf8");
+    };
+    child.stdout?.on("data", (chunk) => appendChunk("stdout", chunk));
+    child.stderr?.on("data", (chunk) => appendChunk("stderr", chunk));
+    child.on("error", (error) => finish(null, null, error));
+    child.on("exit", (code, signalName) => {
+      if (settled || leaderExit !== null) return;
+      leaderExit = { code, signal: signalName };
+      if (timeoutId) clearTimeout(timeoutId);
+      timeoutId = null;
+      drainTimer = setTimeout(stopDraining, SAFE_EXEC_PIPE_DRAIN_BOUND_MS);
+      cleanup.leaderExited();
+      if (aborted) stopDraining();
+    });
+    child.on("close", () => {
+      if (settled || closed) return;
+      closed = true;
+      tryFinish();
+    });
+  });
+}
+function combineSafeOutput(result) {
+  const { stdout, stderr } = result;
+  return stderr.length > 0 ? `${stdout}${stdout.endsWith("\n") || stdout.length === 0 ? "" : "\n"}${stderr}` : stdout;
+}
+
+export {
+  SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+  SAFE_EXEC_DEFAULT_MAX_OUTPUT_BYTES,
+  SAFE_EXEC_GROUP_TEARDOWN_BOUND_MS,
+  createRetainedStreamWindow,
+  buildSafeToolEnv,
+  resolveSafeCwd,
+  runCommandVector,
+  combineSafeOutput
+};
+//# sourceMappingURL=chunk-XTQ7MEJG.js.map

package/dist/{chunk-GEVQNST4.js → chunk-XZWSP67B.js}

@@ -2,7 +2,7 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   ToolNames,
   isBuiltinToolName
-} from "./chunk-WLHX3MM5.js";
+} from "./chunk-V4XJWDHR.js";
 import {
   init_esm_shims
 } from "./chunk-ECBHH7LU.js";
@@ -98,4 +98,4 @@ export {
   assertToolProfileEnforceable,
   applyToolProfile
 };
-//# sourceMappingURL=chunk-GEVQNST4.js.map
+//# sourceMappingURL=chunk-XZWSP67B.js.map

package/dist/{chunk-OEMFEL26.js → chunk-Y3M2T5RO.js}

@@ -5,7 +5,7 @@ import {
   projectCompatTrusted,
   recipeIdFromPath,
   skillCatalogValidity
-} from "./chunk-EXKUF426.js";
+} from "./chunk-7FBCRWVT.js";
 import {
   COMPAT_RESOURCE_PRECEDENCE,
   defaultScopedResourceRoots,
@@ -26,7 +26,7 @@ import {
 import {
   assertAgentSpecPolicy,
   normalizeAgentSpec
-} from "./chunk-ARRUMZ7X.js";
+} from "./chunk-I47EJPYL.js";
 import {
   INTEROP_AGENT_KINDS
 } from "./chunk-5EQO5NWP.js";
@@ -888,4 +888,4 @@ export {
   expandPromptTemplateInput,
   validateLibraryPackage
 };
-//# sourceMappingURL=chunk-OEMFEL26.js.map
+//# sourceMappingURL=chunk-Y3M2T5RO.js.map

package/dist/{chunk-HP7KJ5O2.js → chunk-YPQOPFP7.js}

@@ -1,10 +1,10 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   migrateSettingsV1Document
-} from "./chunk-P7GTE4FX.js";
+} from "./chunk-XRECG65F.js";
 import {
   parseAgentRecipeSchema
-} from "./chunk-EXKUF426.js";
+} from "./chunk-7FBCRWVT.js";
 import {
   parseFleetContract
 } from "./chunk-7QQRPB2E.js";
@@ -20,7 +20,7 @@ import {
 import {
   assertAgentSpecPolicy,
   normalizeAgentSpec
-} from "./chunk-ARRUMZ7X.js";
+} from "./chunk-I47EJPYL.js";
 import {
   extensionContentDigest
 } from "./chunk-XW2UZICE.js";
@@ -29,10 +29,10 @@ import {
   settingsPath,
   updateSettings,
   validateSettings
-} from "./chunk-PGEFOTJB.js";
+} from "./chunk-FPS4R2RN.js";
 import {
   DEFAULT_SETTINGS
-} from "./chunk-3XE4NRLF.js";
+} from "./chunk-ZKJU55MX.js";
 import {
   require_dist
 } from "./chunk-B5GGDIHT.js";
@@ -794,4 +794,4 @@ export {
   importShareArchive,
   ShareDomainModule
 };
-//# sourceMappingURL=chunk-HP7KJ5O2.js.map
+//# sourceMappingURL=chunk-YPQOPFP7.js.map

package/dist/{chunk-MEHBW2SP.js → chunk-YQYINEJI.js}

@@ -1,19 +1,19 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  StringEnum
-} from "./chunk-QLAGXTTV.js";
 import {
   truncateUtf8
 } from "./chunk-MYI32N4R.js";
 import {
   ToolNames
-} from "./chunk-WLHX3MM5.js";
+} from "./chunk-V4XJWDHR.js";
+import {
+  StringEnum
+} from "./chunk-UIU7MGZ3.js";
 import {
   SAFE_EXEC_DEFAULT_MAX_OUTPUT_BYTES,
   SAFE_EXEC_DEFAULT_TIMEOUT_MS,
   combineSafeOutput,
   runCommandVector
-} from "./chunk-GJ24ODAX.js";
+} from "./chunk-XTQ7MEJG.js";
 import {
   typebox_exports
 } from "./chunk-GH5ZR6JP.js";
@@ -129,4 +129,4 @@ export {
   runVectorTool,
   gitTool
 };
-//# sourceMappingURL=chunk-MEHBW2SP.js.map
+//# sourceMappingURL=chunk-YQYINEJI.js.map