@jini-ai/agent-runtime 0.1.0

package/dist/resolution.js

@@ -0,0 +1,19 @@
+/**
+ * @module resolution
+ *
+ * Resolve the absolute path of an agent's binary on the current PATH, by
+ * agent id, from the registry. Ported verbatim from OD's
+ * `apps/daemon/src/runtimes/launch/resolution.ts`.
+ */
+import { getAgentDef } from './registry.js';
+import { resolveAgentExecutable } from './executables.js';
+// Used by the chat handler so spawn() gets the same executable that
+// detection reported as available — fixes Windows ENOENT when the bare
+// bin name isn't on the child process's PATH.
+export function resolveAgentBin(id, configuredEnv = {}) {
+    const def = getAgentDef(id);
+    if (!def?.bin)
+        return null;
+    return resolveAgentExecutable(def, configuredEnv);
+}
+//# sourceMappingURL=resolution.js.map

package/dist/resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution.js","sourceRoot":"","sources":["../src/resolution.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,oEAAoE;AACpE,uEAAuE;AACvE,8CAA8C;AAC9C,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,gBAAwC,EAAE;IACpF,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,EAAE,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC"}

package/dist/role-marker-guard.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @module role-marker-guard
+ *
+ * Shared utility for detecting and stripping fabricated role-marker lines
+ * (`## user`, `## assistant`, `## system`) injected by the model into its
+ * own output (see #3247 — same class as #2102 / #2464).
+ *
+ * `createRoleMarkerGuard()` — stateful per-message guard for structured
+ * stream handlers that can track message boundaries (Claude, Copilot,
+ * Qoder, OpenCode/Codex, Pi, ACP). Returns `{ feedText, contaminated,
+ * warningEvent }`.
+ *
+ * Ported verbatim from OD's `apps/daemon/src/role-marker-guard.ts` (a
+ * top-level daemon file, not under `runtimes/`, but consumed by
+ * `claude-stream.ts` and self-contained with no product coupling — see
+ * `source-map.md`).
+ */
+export declare const FABRICATED_ROLE_MARKER_RE: RegExp;
+export interface RoleMarkerGuard {
+    /** Feed a text delta for the current message. Returns the safe portion
+     *  to emit (may be shorter than `text` if a marker was found mid-chunk,
+     *  or empty string if the entire chunk is past the cut point). */
+    feedText(text: string): string;
+    /** Whether a fabricated marker was detected (further text is dropped). */
+    readonly contaminated: boolean;
+    /** If contaminated, the warning event to emit. `null` if clean. */
+    warningEvent(): {
+        type: 'fabricated_role_marker';
+        marker: string;
+        messageId: string;
+    } | null;
+}
+/**
+ * Create a stateful guard that detects fabricated role markers across
+ * chunk boundaries. Memory + per-call work is O(1): instead of
+ * accumulating the full message text, the guard retains only a small
+ * trailing suffix (TAIL_BUFFER_SIZE chars) — enough for the matcher to
+ * see across chunk boundaries when a marker straddles them.
+ *
+ * Usage in a stream handler:
+ *
+ *   const guard = createRoleMarkerGuard(messageId);
+ *   for (const delta of deltas) {
+ *     const safe = guard.feedText(delta.text);
+ *     if (safe.length > 0) onEvent({ type: 'text_delta', delta: safe });
+ *     if (guard.contaminated) {
+ *       onEvent(guard.warningEvent()!);
+ *       break; // stop emitting text for this message
+ *     }
+ *   }
+ */
+export declare function createRoleMarkerGuard(messageId: string): RoleMarkerGuard;
+//# sourceMappingURL=role-marker-guard.d.ts.map

package/dist/role-marker-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-marker-guard.d.ts","sourceRoot":"","sources":["../src/role-marker-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAuEH,eAAO,MAAM,yBAAyB,QAC8B,CAAC;AAuDrE,MAAM,WAAW,eAAe;IAC9B;;sEAEkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,mEAAmE;IACnE,YAAY,IAAI;QAAE,IAAI,EAAE,wBAAwB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9F;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAkIxE"}

package/dist/role-marker-guard.js

@@ -0,0 +1,280 @@
+/**
+ * @module role-marker-guard
+ *
+ * Shared utility for detecting and stripping fabricated role-marker lines
+ * (`## user`, `## assistant`, `## system`) injected by the model into its
+ * own output (see #3247 — same class as #2102 / #2464).
+ *
+ * `createRoleMarkerGuard()` — stateful per-message guard for structured
+ * stream handlers that can track message boundaries (Claude, Copilot,
+ * Qoder, OpenCode/Codex, Pi, ACP). Returns `{ feedText, contaminated,
+ * warningEvent }`.
+ *
+ * Ported verbatim from OD's `apps/daemon/src/role-marker-guard.ts` (a
+ * top-level daemon file, not under `runtimes/`, but consumed by
+ * `claude-stream.ts` and self-contained with no product coupling — see
+ * `source-map.md`).
+ */
+// Regex matching fabricated role-marker lines injected by the model into
+// its own output. Anchored to start-of-line via (?:^|\n) so we don't
+// false-positive on user prose like "here is the ## user content".
+//
+// Scope (deliberately narrow): Markdown-style `## user` / `## assistant`
+// / `## assist` / `## system` only — these are the patterns the chat
+// host actually parses as turn boundaries (see `buildDaemonTranscript`
+// in apps/web/src/providers/daemon.ts). Chat-style markers like
+// `User:` / `Assistant:` / `Human:` / `AI:` are intentionally NOT
+// included, because:
+//   (1) The host never parses them as turn boundaries; a model emitting
+//       them does NOT cause the original #3247 security failure mode.
+//   (2) They collide with legitimate output far more often than the
+//       Markdown family (e.g., "User: bob@example.com", form labels,
+//       JSDoc lines). With kill-on-detection wired in server.ts
+//       (`abortForRoleMarker`), a false positive aborts the whole run
+//       — a much more expensive failure than a stray unflagged
+//       `User:` line in the chat scrollback.
+// If a host frontend ever starts parsing chat-style markers as
+// boundaries, narrow the additions to that frontend's specific
+// path rather than the shared regex.
+//
+// Three deliberate refinements vs. a naive `## role` match:
+//
+// 1. CASE-SENSITIVE. The chat host's turn-boundary delimiter is
+//    lowercase (`## user` / `## assistant` / `## system` — see
+//    `buildDaemonTranscript` in apps/web/src/providers/daemon.ts), and
+//    the `## CRITICAL` system-prompt block forbids only the lowercase
+//    forms. Title-Case Markdown headings like `## User Guide`,
+//    `## System Architecture`, `## Assistant settings` are LEGITIMATE
+//    content (LLMs emit these constantly in technical writing) and
+//    must not contaminate. Matching with `/i` would deterministically
+//    abort any run that produced such a heading — exactly the
+//    "false positive aborts the whole run" cost the docblock cites
+//    as the reason to keep the regex narrow.
+//    (See PR #3303 review r3324151877.)
+//
+// 2. POSITIVE LOOKAHEAD `(?=[^a-z])`. Without it, `## userland`,
+//    `## userspace`, `## users guide`, `## systemd`, `## assistance`
+//    all match via prefix in the alternation. The positive lookahead
+//    requires the character after the role keyword to exist AND to NOT
+//    be a lowercase letter:
+//      - `## user\n…`     → match (newline is not lowercase)
+//      - `## assistantR…` → match (R is uppercase; the glued-form
+//                           attack pattern still gets caught)
+//      - `## assistant.`  → match (. is not a letter)
+//      - `## users guide` → no match (s is lowercase letter)
+//      - `## userland`    → no match (l is lowercase letter)
+//    Why POSITIVE `[^a-z]` rather than NEGATIVE `(?![a-z])`: the
+//    negative form is satisfied at end-of-string, which in a streaming
+//    context means "we have just received `## user` but don't know
+//    what comes next yet". A negative lookahead would fire prematurely
+//    if the rest of the role-keyword landed in a later chunk (e.g.
+//    the model emits `## user` then `land` arrives). The positive
+//    form requires an actual non-lowercase character to be present,
+//    so detection waits one more chunk in that edge case — a
+//    one-character latency traded for correctness.
+//
+// 3. `[ \t]` instead of `\s` for inner whitespace. `\s` matches
+//    newlines, which would let oddities like `##\nuser` match across
+//    lines. Markdown role markers are always single-line by
+//    convention; restricting to space/tab tightens the match without
+//    losing any real attack pattern.
+//
+// Alternation order: `assistant` is listed before `assist` so a
+// fully-spelled `## assistant` consumes 9 chars (not 6) and the
+// `(?![a-z])` check is applied at position 9 (after the full word)
+// rather than position 6. Truncated forms (`## assist\n` from a
+// stream cut mid-emission) still match via the `assist` branch.
+export const FABRICATED_ROLE_MARKER_RE = /(?:^|\n)[ \t]*##[ \t]+(?:user|assistant|assist|system)(?=[^a-z])/;
+// Internal-only variant used after the first chunk has been processed.
+// Drops the `^` alternative: once `tail` is a rolling slice of
+// mid-stream text, `^` no longer represents the genuine message start
+// — applying it would let the regex anchor at an arbitrary cut point
+// inside legitimate prose ("…take a look at the ## user content…"
+// fed char-by-char would eventually slide a tail window onto leading
+// whitespace + `## user` and false-positive). Only `\n`-preceded
+// markers are real role boundaries on subsequent chunks; the preceding
+// newline is retained inside the 64-char tail so genuine markers
+// straddling a chunk boundary are still caught.
+// (See PR #3303 review r3324060995.)
+const NEWLINE_ANCHORED_ROLE_MARKER_RE = /\n[ \t]*##[ \t]+(?:user|assistant|assist|system)(?=[^a-z])/;
+// Pending-marker variants used in the no-match branch to detect a
+// COMPLETE-but-unconfirmed marker prefix at the end of the buffer.
+// Drop the `(?=[^a-z])` lookahead and anchor with `$` instead — the
+// lookahead's whole purpose is to require a non-lowercase character
+// AFTER the role keyword, which by definition can't be present when
+// the chunk boundary fell exactly between the role keyword and its
+// next byte. If one of these matches, the role keyword IS at the end
+// of the current buffer; we withhold it and revisit on the next
+// feed, where one of three things will happen:
+//   (1) The next char is non-lowercase → main regex matches →
+//       contaminated → withheld bytes dropped.
+//   (2) The next char is lowercase (e.g. `## userl…`) → main regex
+//       no longer matches the role keyword → withheld bytes are
+//       confirmed safe and emitted alongside the new chunk.
+//   (3) The role keyword is part of a longer word that itself is a
+//       role keyword (only `user` ⊂ `users`, etc. — none extend to
+//       a different role) → still case (2), since the extension is
+//       lowercase.
+// This implements the suggested fix on review r3324277xxx —
+// preserves the documented "everything from the marker onward is
+// silently dropped" contract across chunk boundaries that fall
+// inside the lookahead-detection window.
+const FIRST_CHUNK_PENDING_MARKER_TAIL_RE = /(?:^|\n)[ \t]*##[ \t]+(?:user|assistant|assist|system)$/;
+const NEWLINE_ANCHORED_PENDING_MARKER_TAIL_RE = /\n[ \t]*##[ \t]+(?:user|assistant|assist|system)$/;
+// Bounded tail size for cross-chunk matching. Must comfortably exceed
+// the longest possible marker prefix:
+//   "\n" + whitespace run + "##" + whitespace + "assistant"  ≈  16–24
+// chars in practice (LLMs rarely emit more than a couple newlines or a
+// handful of spaces between sections). 64 leaves generous margin and
+// keeps the guard's memory + per-delta work O(1) regardless of message
+// length — important because a 50KB assistant response delivered in
+// 1000 chunks of 50 bytes is otherwise O(n²) on string concatenation
+// alone.
+const TAIL_BUFFER_SIZE = 64;
+/**
+ * Create a stateful guard that detects fabricated role markers across
+ * chunk boundaries. Memory + per-call work is O(1): instead of
+ * accumulating the full message text, the guard retains only a small
+ * trailing suffix (TAIL_BUFFER_SIZE chars) — enough for the matcher to
+ * see across chunk boundaries when a marker straddles them.
+ *
+ * Usage in a stream handler:
+ *
+ *   const guard = createRoleMarkerGuard(messageId);
+ *   for (const delta of deltas) {
+ *     const safe = guard.feedText(delta.text);
+ *     if (safe.length > 0) onEvent({ type: 'text_delta', delta: safe });
+ *     if (guard.contaminated) {
+ *       onEvent(guard.warningEvent()!);
+ *       break; // stop emitting text for this message
+ *     }
+ *   }
+ */
+export function createRoleMarkerGuard(messageId) {
+    // Rolling tail of the bytes we have ALREADY EMITTED, capped at
+    // TAIL_BUFFER_SIZE. Used as the prefix when matching against new
+    // text so we catch markers that straddle a chunk boundary.
+    let tail = '';
+    // Bytes we have RECEIVED but DEFERRED — held back because they form
+    // a complete-but-unconfirmed marker suffix at the end of the buffer
+    // and we don't yet know whether the next chunk will confirm them
+    // (next char non-lowercase → contaminated, drop) or deny them
+    // (next char lowercase → suffix was part of a longer word, emit).
+    // Without this, a chunk boundary falling exactly between the role
+    // keyword and its lookahead char would leak the marker line itself
+    // into the UI / app.sqlite before we could classify it. See review
+    // r3324277xxx.
+    let pending = '';
+    // Tracks whether `tail` still represents the ENTIRE emission so
+    // far — i.e. no slicing has occurred yet and `^` in the canonical
+    // regex genuinely anchors at byte 0 of the message stream. While
+    // this holds, the `^|\n` alternation safely catches a role marker
+    // that arrives at the start of the stream even if its prefix is
+    // split across multiple chunks (`## ` | `user\n…`, `## us` | `er\n…`,
+    // `##` | ` user\n…`). The moment `tail` would exceed
+    // TAIL_BUFFER_SIZE, the slice turns `tail` into a mid-stream
+    // window and `^` no longer represents the stream start — we then
+    // switch to the newline-only variants so a sliding window cannot
+    // manufacture a match from prose. The transition is on slicing,
+    // not on first emission: earlier definitions ("any byte emitted",
+    // "newline emitted") both had failure modes — see PR #3303 reviews
+    // r3324060995 and r3324xxxxxx, and the regression tests below.
+    let firstChunk = true;
+    let _contaminated = false;
+    let markerText = null;
+    return {
+        get contaminated() {
+            return _contaminated;
+        },
+        feedText(text) {
+            if (_contaminated)
+                return '';
+            if (text.length === 0)
+                return '';
+            // Combine `tail` (already-emitted suffix for cross-chunk matching),
+            // `pending` (deferred-from-prior-call suspicious suffix), and the
+            // new `text` into a single matching buffer.
+            const buffer = tail + pending + text;
+            const matchRe = firstChunk
+                ? FABRICATED_ROLE_MARKER_RE
+                : NEWLINE_ANCHORED_ROLE_MARKER_RE;
+            const pendingRe = firstChunk
+                ? FIRST_CHUNK_PENDING_MARKER_TAIL_RE
+                : NEWLINE_ANCHORED_PENDING_MARKER_TAIL_RE;
+            // `firstChunk` transitions are tied to actual byte emission, not
+            // feed count — see comment above. Transitioned at the end of
+            // this function only when we emit at least one byte.
+            const match = matchRe.exec(buffer);
+            if (match) {
+                // Marker confirmed. Compute the safe-to-emit portion (bytes
+                // between previously-emitted `tail` and the marker), drop
+                // `pending` (the deferred portion sits inside the marker
+                // region by definition once the lookahead char arrives), and
+                // mark contaminated. Subsequent feeds early-return.
+                _contaminated = true;
+                markerText = match[0].trim();
+                pending = '';
+                const alreadyEmitted = tail.length;
+                const markerStart = match.index;
+                if (markerStart <= alreadyEmitted)
+                    return '';
+                return buffer.slice(alreadyEmitted, markerStart);
+            }
+            // No confirmed marker. Check whether the buffer ends with a
+            // complete-but-unconfirmed marker prefix (role keyword present,
+            // lookahead char not yet arrived). If so, withhold that suffix
+            // until the next feed; emit the rest.
+            const pendingMatch = pendingRe.exec(buffer);
+            const alreadyEmitted = tail.length;
+            const pendingStart = pendingMatch
+                // Never withhold bytes we have already emitted in a prior
+                // feed — the suspicious suffix could in pathological cases
+                // start inside `tail` (we held back `pending` correctly on
+                // the prior call, but the suffix-start position is upstream
+                // of where we hold). Clamp to alreadyEmitted so safeToEmit
+                // never goes negative.
+                ? Math.max(pendingMatch.index, alreadyEmitted)
+                : buffer.length;
+            const safeToEmit = buffer.slice(alreadyEmitted, pendingStart);
+            pending = buffer.slice(pendingStart);
+            // Roll the emitted-bytes tail forward.
+            const fullEmitted = tail + safeToEmit;
+            const willSlice = fullEmitted.length > TAIL_BUFFER_SIZE;
+            tail = willSlice
+                ? fullEmitted.slice(fullEmitted.length - TAIL_BUFFER_SIZE)
+                : fullEmitted;
+            // `firstChunk` is true exactly while `tail` still represents the
+            // entire emission so far — i.e. no slice has occurred and `^` in
+            // the canonical regex genuinely anchors at byte 0 of the stream.
+            // The moment we slice (emitted bytes exceed TAIL_BUFFER_SIZE),
+            // `tail` becomes a mid-stream window, `^` becomes meaningless,
+            // and we switch to the newline-only variants.
+            //
+            // Earlier iterations of this code used "any byte emitted" or
+            // "newline emitted" as the transition trigger. Both were wrong:
+            //   - "any byte" lost the `^` anchor before a chunk-split
+            //     message-start marker (e.g. `## ` | `user\n…`,
+            //     `## us` | `er\n…`) could finish arriving — see PR #3303
+            //     review r3324xxxxxx, and the new tests below.
+            //   - "newline emitted" left `^` valid on a sliced buffer for
+            //     streams that hadn't yet emitted a newline, which then
+            //     false-positived the rolling-tail mid-stream case from
+            //     review r3324060995.
+            // Slice-based is the invariant that satisfies both: while we
+            // haven't sliced, `^` is correct; once we slice, it isn't.
+            if (willSlice)
+                firstChunk = false;
+            return safeToEmit;
+        },
+        warningEvent() {
+            if (!_contaminated || !markerText)
+                return null;
+            return {
+                type: 'fabricated_role_marker',
+                marker: markerText,
+                messageId,
+            };
+        },
+    };
+}
+//# sourceMappingURL=role-marker-guard.js.map

package/dist/role-marker-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-marker-guard.js","sourceRoot":"","sources":["../src/role-marker-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,yEAAyE;AACzE,qEAAqE;AACrE,mEAAmE;AACnE,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,uEAAuE;AACvE,gEAAgE;AAChE,kEAAkE;AAClE,qBAAqB;AACrB,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,gEAAgE;AAChE,sEAAsE;AACtE,+DAA+D;AAC/D,6CAA6C;AAC7C,+DAA+D;AAC/D,+DAA+D;AAC/D,qCAAqC;AACrC,EAAE;AACF,4DAA4D;AAC5D,EAAE;AACF,gEAAgE;AAChE,+DAA+D;AAC/D,uEAAuE;AACvE,sEAAsE;AACtE,+DAA+D;AAC/D,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,8DAA8D;AAC9D,mEAAmE;AACnE,6CAA6C;AAC7C,wCAAwC;AACxC,EAAE;AACF,iEAAiE;AACjE,qEAAqE;AACrE,qEAAqE;AACrE,uEAAuE;AACvE,4BAA4B;AAC5B,6DAA6D;AAC7D,kEAAkE;AAClE,8DAA8D;AAC9D,sDAAsD;AACtD,6DAA6D;AAC7D,6DAA6D;AAC7D,iEAAiE;AACjE,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,mEAAmE;AACnE,kEAAkE;AAClE,oEAAoE;AACpE,6DAA6D;AAC7D,mDAAmD;AACnD,EAAE;AACF,gEAAgE;AAChE,qEAAqE;AACrE,4DAA4D;AAC5D,qEAAqE;AACrE,qCAAqC;AACrC,EAAE;AACF,gEAAgE;AAChE,gEAAgE;AAChE,mEAAmE;AACnE,gEAAgE;AAChE,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GACpC,kEAAkE,CAAC;AAErE,uEAAuE;AACvE,+DAA+D;AAC/D,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,qEAAqE;AACrE,iEAAiE;AACjE,uEAAuE;AACvE,iEAAiE;AACjE,gDAAgD;AAChD,qCAAqC;AACrC,MAAM,+BAA+B,GACnC,4DAA4D,CAAC;AAE/D,kEAAkE;AAClE,mEAAmE;AACnE,oEAAoE;AACpE,oEAAoE;AACpE,oEAAoE;AACpE,mEAAmE;AACnE,qEAAqE;AACrE,gEAAgE;AAChE,+CAA+C;AAC/C,8DAA8D;AAC9D,+CAA+C;AAC/C,mEAAmE;AACnE,gEAAgE;AAChE,4DAA4D;AAC5D,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,mBAAmB;AACnB,4DAA4D;AAC5D,iEAAiE;AACjE,+DAA+D;AAC/D,yCAAyC;AACzC,MAAM,kCAAkC,GACtC,yDAAyD,CAAC;AAE5D,MAAM,uCAAuC,GAC3C,mDAAmD,CAAC;AAEtD,sEAAsE;AACtE,sCAAsC;AACtC,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,SAAS;AACT,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAa5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,+DAA+D;IAC/D,iEAAiE;IACjE,2DAA2D;IAC3D,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,oEAAoE;IACpE,oEAAoE;IACpE,iEAAiE;IACjE,8DAA8D;IAC9D,kEAAkE;IAClE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,eAAe;IACf,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,gEAAgE;IAChE,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAClE,gEAAgE;IAChE,sEAAsE;IACtE,qDAAqD;IACrD,6DAA6D;IAC7D,iEAAiE;IACjE,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,mEAAmE;IACnE,+DAA+D;IAC/D,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,UAAU,GAAkB,IAAI,CAAC;IAErC,OAAO;QACL,IAAI,YAAY;YACd,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,QAAQ,CAAC,IAAY;YACnB,IAAI,aAAa;gBAAE,OAAO,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAEjC,oEAAoE;YACpE,kEAAkE;YAClE,4CAA4C;YAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC;YACrC,MAAM,OAAO,GAAG,UAAU;gBACxB,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,+BAA+B,CAAC;YACpC,MAAM,SAAS,GAAG,UAAU;gBAC1B,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,uCAAuC,CAAC;YAC5C,iEAAiE;YACjE,6DAA6D;YAC7D,qDAAqD;YAErD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACV,4DAA4D;gBAC5D,0DAA0D;gBAC1D,yDAAyD;gBACzD,6DAA6D;gBAC7D,oDAAoD;gBACpD,aAAa,GAAG,IAAI,CAAC;gBACrB,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;gBACnC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC;gBAChC,IAAI,WAAW,IAAI,cAAc;oBAAE,OAAO,EAAE,CAAC;gBAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YACnD,CAAC;YAED,4DAA4D;YAC5D,gEAAgE;YAChE,+DAA+D;YAC/D,sCAAsC;YACtC,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;YACnC,MAAM,YAAY,GAAG,YAAY;gBAC/B,0DAA0D;gBAC1D,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,uBAAuB;gBACvB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC;gBAC9C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YAElB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;YAC9D,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAErC,uCAAuC;YACvC,MAAM,WAAW,GAAG,IAAI,GAAG,UAAU,CAAC;YACtC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,GAAG,gBAAgB,CAAC;YACxD,IAAI,GAAG,SAAS;gBACd,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,gBAAgB,CAAC;gBAC1D,CAAC,CAAC,WAAW,CAAC;YAChB,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,+DAA+D;YAC/D,+DAA+D;YAC/D,8CAA8C;YAC9C,EAAE;YACF,6DAA6D;YAC7D,gEAAgE;YAChE,0DAA0D;YAC1D,oDAAoD;YACpD,8DAA8D;YAC9D,mDAAmD;YACnD,8DAA8D;YAC9D,4DAA4D;YAC5D,4DAA4D;YAC5D,0BAA0B;YAC1B,6DAA6D;YAC7D,2DAA2D;YAC3D,IAAI,SAAS;gBAAE,UAAU,GAAG,KAAK,CAAC;YAElC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,YAAY;YACV,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC/C,OAAO;gBACL,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,UAAU;gBAClB,SAAS;aACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/telemetry-sink.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @module telemetry-sink
+ *
+ * Port replacing the OD analytics naming baked into OD's
+ * `runtimes/runs/run-artifacts.ts` (`run_finished.artifact_count`,
+ * `runAskedUserQuestion` → `run_finished.asked_user_question`,
+ * `deriveActivationMilestones`'s PostHog `$set_once` person-property
+ * scheme) and `run-lifecycle-analytics.ts` (not present as a separate file
+ * on this branch — its concerns are folded into `run-artifacts.ts` here).
+ * None of that OD-schema logic is ported.
+ *
+ * Per r1b §1b: the engine emits a generic run-lifecycle event stream; the
+ * host maps it to its own analytics schema. `data` is intentionally
+ * `Record<string, unknown>` — artifactCount, askedUserQuestion, stopReason,
+ * etc. are opaque to the engine, populated by whatever
+ * `ArtifactTaxonomy`/`PromptAugmenter` implementation the host wires in.
+ */
+export interface RunLifecycleEvent {
+    type: 'run_started' | 'run_finished' | 'run_failed' | 'tool_use' | 'artifact_written';
+    runId: string;
+    agentId: string;
+    at: number;
+    data?: Record<string, unknown>;
+}
+export interface TelemetrySink {
+    emit(event: RunLifecycleEvent): void;
+    reportFinalizedMessage?(input: {
+        runId: string;
+        text: string;
+        meta: Record<string, unknown>;
+    }): void;
+}
+/** Discards every event. Safe default until a host supplies a real sink. */
+export declare const noopTelemetrySink: TelemetrySink;
+//# sourceMappingURL=telemetry-sink.d.ts.map

package/dist/telemetry-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-sink.d.ts","sourceRoot":"","sources":["../src/telemetry-sink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,YAAY,GAAG,UAAU,GAAG,kBAAkB,CAAC;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,sBAAsB,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CACtG;AAED,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,aAE/B,CAAC"}

package/dist/telemetry-sink.js

@@ -0,0 +1,5 @@
+/** Discards every event. Safe default until a host supplies a real sink. */
+export const noopTelemetrySink = {
+    emit: () => { },
+};
+//# sourceMappingURL=telemetry-sink.js.map

package/dist/telemetry-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-sink.js","sourceRoot":"","sources":["../src/telemetry-sink.ts"],"names":[],"mappings":"AA8BA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC9C,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;CACf,CAAC"}

package/dist/terminal-launch.d.ts

@@ -0,0 +1,11 @@
+export type TerminalLaunchResult = {
+    ok: true;
+    platform: NodeJS.Platform;
+    via: string;
+} | {
+    ok: false;
+    platform: NodeJS.Platform;
+    reason: string;
+};
+export declare function launchAgentInSystemTerminal(command: string, platform?: NodeJS.Platform, windowTitle?: string): Promise<TerminalLaunchResult>;
+//# sourceMappingURL=terminal-launch.d.ts.map

package/dist/terminal-launch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-launch.d.ts","sourceRoot":"","sources":["../src/terminal-launch.ts"],"names":[],"mappings":"AA2BA,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAmF7D,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,WAAW,GAAE,MAAwB,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAe/B"}

package/dist/terminal-launch.js

@@ -0,0 +1,123 @@
+/**
+ * @module terminal-launch
+ *
+ * Cross-platform "open a system terminal and run this command in it."
+ * Used by adapters whose OAuth flow cannot complete in a headless/print
+ * mode (e.g. antigravity's `agy -p`) — the CLI has to run interactively at
+ * least once to populate a credential keyring, and spawning a terminal from
+ * inside the host app makes that a one-click action instead of a "go open
+ * Terminal yourself" task.
+ *
+ * Ported from OD's `apps/daemon/src/runtimes/launch/terminal-launch.ts`
+ * with one de-branding change: the Windows path opened a `cmd.exe` window
+ * titled literally with the product's own name (see `source-map.md` for
+ * the exact original string). `launchAgentInSystemTerminal` now takes an
+ * optional `windowTitle` (default `'Agent Sign-in'`).
+ *
+ * Each platform branch uses primitives that are safe against shell
+ * injection BECAUSE we never accept user input here — the `command`
+ * argument is always a hard-coded binary name. Adding caller-supplied
+ * flags or env vars to this helper would invalidate that guarantee, so the
+ * signature is intentionally narrow.
+ */
+import { execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+// macOS: AppleScript via osascript. Bringing Terminal.app to the
+// foreground and creating a new shell that immediately runs the command is
+// the canonical macOS pattern.
+async function launchOnDarwin(command) {
+    // `do script "<cmd>"` opens a new Terminal window and runs <cmd> in it;
+    // activate brings Terminal.app to the foreground so the user actually
+    // sees the new window. Strict double-quote escaping protects us if
+    // `command` ever grows special characters.
+    const safe = command.replace(/"/g, '\\"');
+    const script = `tell application "Terminal" to do script "${safe}"\ntell application "Terminal" to activate`;
+    try {
+        await execFileAsync('osascript', ['-e', script], { timeout: 5_000 });
+        return { ok: true, platform: 'darwin', via: 'osascript' };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            platform: 'darwin',
+            reason: `osascript failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+// Linux: try the Debian/Ubuntu meta-emulator first, then the common
+// concrete terminals. Each attempt spawns detached so the terminal
+// window's lifetime is independent from the host process group. We
+// resolve as soon as the child process starts (not when it exits), because
+// terminals like xterm and x-terminal-emulator stay alive for the duration
+// of the interactive session — waiting for exit would time out and kill
+// the window mid-OAuth-flow.
+async function launchOnLinux(command) {
+    // Order matters: x-terminal-emulator is the Debian alternative that
+    // resolves to whichever terminal the distro chose. Otherwise try the
+    // common ones. Each requires a slightly different invocation syntax
+    // (`-e` vs `--` vs `-x`), captured in this table.
+    const attempts = [
+        { bin: 'x-terminal-emulator', args: ['-e', command] },
+        { bin: 'gnome-terminal', args: ['--', 'sh', '-c', `${command}; exec $SHELL`] },
+        { bin: 'konsole', args: ['-e', command] },
+        { bin: 'xfce4-terminal', args: ['-e', command] },
+        { bin: 'xterm', args: ['-e', command] },
+    ];
+    const errors = [];
+    for (const { bin, args } of attempts) {
+        try {
+            await new Promise((resolve, reject) => {
+                const child = spawn(bin, args, { detached: true, stdio: 'ignore' });
+                child.unref();
+                child.once('spawn', resolve);
+                child.once('error', reject);
+            });
+            return { ok: true, platform: 'linux', via: bin };
+        }
+        catch (err) {
+            errors.push(`${bin}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return {
+        ok: false,
+        platform: 'linux',
+        reason: `no system terminal worked (${errors.join('; ')})`,
+    };
+}
+// Windows: `cmd /c start "<title>" cmd /k "<command>"` — the outer `start`
+// opens a new console window (the first quoted arg is the window title,
+// required by `start`'s positional-arg parser when the next token is also
+// quoted), and the inner `cmd /k` keeps the window open after the command
+// finishes so the user can see OAuth output and finish the flow before the
+// window closes.
+async function launchOnWindows(command, windowTitle) {
+    try {
+        await execFileAsync('cmd.exe', ['/c', 'start', windowTitle, 'cmd.exe', '/k', command], { timeout: 5_000 });
+        return { ok: true, platform: 'win32', via: 'cmd /c start' };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            platform: 'win32',
+            reason: `cmd /c start failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+export async function launchAgentInSystemTerminal(command, platform = process.platform, windowTitle = 'Agent Sign-in') {
+    switch (platform) {
+        case 'darwin':
+            return launchOnDarwin(command);
+        case 'linux':
+            return launchOnLinux(command);
+        case 'win32':
+            return launchOnWindows(command, windowTitle);
+        default:
+            return {
+                ok: false,
+                platform,
+                reason: `system-terminal launch is not supported on ${platform}`,
+            };
+    }
+}
+//# sourceMappingURL=terminal-launch.js.map

package/dist/terminal-launch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-launch.js","sourceRoot":"","sources":["../src/terminal-launch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAM1C,iEAAiE;AACjE,2EAA2E;AAC3E,+BAA+B;AAC/B,KAAK,UAAU,cAAc,CAAC,OAAe;IAC3C,wEAAwE;IACxE,sEAAsE;IACtE,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,6CAA6C,IAAI,4CAA4C,CAAC;IAC7G,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,mEAAmE;AACnE,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,6BAA6B;AAC7B,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,kDAAkD;IAClD,MAAM,QAAQ,GAA2C;QACvD,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QACrD,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,eAAe,CAAC,EAAE;QAC9E,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QACzC,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QAChD,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;KACxC,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpE,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KAC3D,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,2EAA2E;AAC3E,iBAAiB;AACjB,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,WAAmB;IACjE,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAe,EACf,WAA4B,OAAO,CAAC,QAAQ,EAC5C,cAAsB,eAAe;IAErC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;QACjC,KAAK,OAAO;YACV,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;QAChC,KAAK,OAAO;YACV,OAAO,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC/C;YACE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ;gBACR,MAAM,EAAE,8CAA8C,QAAQ,EAAE;aACjE,CAAC;IACN,CAAC;AACH,CAAC"}