@kontextmind/kxm 0.6.0 → 0.7.0

package/scripts/assignment-run.mjs

@@ -746,30 +746,35 @@ function validateRework(reworkOf, taskDir, taskId, assignmentId, deps) {
   return priorId;
 }
 
-let cachedDiskPolicy = null;
-export function getRosterPolicy(deps = {}) {
-  if (deps.rosterPolicy) {
-    return deps.rosterPolicy.policy ?? deps.rosterPolicy;
+function requireRosterPolicyShape(policy) {
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) {
+    throw failClosed("roster policy is invalid or unparsed", "route_invalid");
   }
-  if (typeof deps.loadTrustedRosterPolicy === "function") {
-    const loaded = deps.loadTrustedRosterPolicy();
-    return loaded?.policy ?? loaded;
+  if (!policy.routes || typeof policy.routes !== "object" || Array.isArray(policy.routes) || Object.keys(policy.routes).length === 0) {
+    throw failClosed("roster policy is invalid or unparsed", "route_invalid");
   }
+  if (!policy.lineup || typeof policy.lineup !== "object" || Array.isArray(policy.lineup)) {
+    throw failClosed("roster policy is invalid or unparsed", "route_invalid");
+  }
+  return policy;
+}
+
+function unwrapRosterPolicy(loaded) {
+  return requireRosterPolicyShape(loaded?.policy ?? loaded);
+}
+
+export function getRosterPolicy(deps = {}) {
   try {
-    return loadTrustedRosterPolicy().policy;
-  } catch (error) {
-    // When executing in a local development checkout where git status has dirty
-    // uncommitted edits or during unit tests running against in-flight code,
-    // fallback to parsing the local .kxm/roster.json.
-    if (!cachedDiskPolicy) {
-      try {
-        const diskPath = join(fileURLToPath(new URL(".", import.meta.url)), "..", ".kxm/roster.json");
-        cachedDiskPolicy = Object.freeze(JSON.parse(readFileSync(diskPath, "utf8")));
-      } catch {
-        throw failClosed(error?.message ?? "roster policy unavailable", "route_invalid");
-      }
+    if (Object.hasOwn(deps, "rosterPolicy")) {
+      return unwrapRosterPolicy(deps.rosterPolicy);
+    }
+    if (typeof deps.loadTrustedRosterPolicy === "function") {
+      return unwrapRosterPolicy(deps.loadTrustedRosterPolicy());
     }
-    return cachedDiskPolicy;
+    return unwrapRosterPolicy(loadTrustedRosterPolicy());
+  } catch (error) {
+    if (error?.runnerCode === "route_invalid") throw error;
+    throw failClosed(error?.message ?? "roster policy unavailable", "route_invalid");
   }
 }
 
@@ -979,6 +984,15 @@ const MODEL_CLAIM_OVERRIDE_KEYS = Object.freeze([
   "usage",
   "transport",
 ]);
+function injectedPolicyDeps(source = {}) {
+  const deps = {};
+  if (Object.hasOwn(source, "rosterPolicy")) deps.rosterPolicy = source.rosterPolicy;
+  if (typeof source.loadTrustedRosterPolicy === "function") {
+    deps.loadTrustedRosterPolicy = source.loadTrustedRosterPolicy;
+  }
+  return deps;
+}
+
 function ioDeps(deps = {}) {
   return {
     spawnSync: deps.spawnSync ?? spawnSync,
@@ -996,8 +1010,7 @@ function ioDeps(deps = {}) {
     rmSync: deps.rmSync ?? rmSync,
     manifestBytes: deps.manifestBytes,
     now: deps.now,
-    rosterPolicy: deps.rosterPolicy,
-    loadTrustedRosterPolicy: deps.loadTrustedRosterPolicy,
+    ...injectedPolicyDeps(deps),
   };
 }
 
@@ -3374,7 +3387,7 @@ function closedObserved(pr, ci) {
 
 export function resolveRequiredCritics(policy) {
   if (!policy || typeof policy !== "object" || !policy.required_critics || !policy.routes) {
-    return REQUIRED_ACCEPT_CRITICS;
+    throw failClosed("roster policy is invalid or unparsed", "route_invalid");
   }
   const result = {};
   for (const [kind, routeId] of Object.entries(policy.required_critics)) {
@@ -3409,11 +3422,10 @@ function assertEligibleWriter(bound, policy) {
   if (!(transport?.status === "completed" && transport?.ok === true)) {
     throw failClosed("writer transport is not completed/ok", "witness_binding_invalid");
   }
-  if (policy?.lineup?.writer && policy?.routes) {
-    const matched = findLineupRoute(policy, "writer", bound.identity.harness, bound.identity.model);
-    if (!matched) {
-      throw failClosed(`writer ${bound.identity.harness}/${bound.identity.model} is not admitted in lineup`, "witness_binding_invalid");
-    }
+  requireRosterPolicyShape(policy);
+  const matched = findLineupRoute(policy, "writer", bound.identity.harness, bound.identity.model);
+  if (!matched) {
+    throw failClosed(`writer ${bound.identity.harness}/${bound.identity.model} is not admitted in lineup`, "witness_binding_invalid");
   }
 }
 
@@ -3669,12 +3681,7 @@ export async function acceptAssignment(request, deps = {}) {
     const commitValue = request?.commit;
     const writerRecordValue = request?.recordDir ?? request?.record_dir;
     const criticValues = request?.critics;
-    let policy;
-    try {
-      policy = getRosterPolicy(deps);
-    } catch {
-      policy = null;
-    }
+    const policy = getRosterPolicy(deps);
     const criticSpecs = resolveRequiredCritics(policy);
     const requiredKinds = Object.keys(criticSpecs);
     if (!Array.isArray(criticValues) || criticValues.length !== requiredKinds.length) {
@@ -4337,6 +4344,7 @@ export async function main(argv = process.argv, io = { stdin: process.stdin, std
         spawnSync: io.spawnSync ?? spawnSync,
         env: io.env,
         now: io.now,
+        ...injectedPolicyDeps(io),
       });
       io.stdout.write(`${JSON.stringify(accepted, undefined, 2)}\n`);
       process.exitCode = 0;
@@ -4395,6 +4403,7 @@ export async function main(argv = process.argv, io = { stdin: process.stdin, std
         spawnSync: io.spawnSync ?? spawnSync,
         env: io.env,
         now: io.now,
+        ...injectedPolicyDeps(io),
       });
       io.stdout.write(`${JSON.stringify(receipt, undefined, 2)}\n`);
       process.exitCode = receipt.result === "passed" ? 0 : 1;
@@ -4418,7 +4427,7 @@ export async function main(argv = process.argv, io = { stdin: process.stdin, std
   const bytes = readFileSync(manifestPath);
   const manifest = parseJsonFile(manifestPath, bytes, "assignment manifest");
   try {
-    const completion = await runAssignment(manifest, { manifestBytes: bytes });
+    const completion = await runAssignment(manifest, { manifestBytes: bytes, ...injectedPolicyDeps(io) });
     io.stdout.write(`${JSON.stringify(completion, undefined, 2)}\n`);
     process.exitCode = completion.transport?.ok === true && completion.recording?.status === "ok" ? 0 : 1;
     return completion;

package/scripts/check-generated.mjs

@@ -4,8 +4,9 @@ import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { listSkillMirrorArtifacts, loadSkillSuiteManifest } from "./emit-codex-artifacts.mjs";
 
-export const GENERATED_ARTIFACTS = [
+export const STATIC_GENERATED_ARTIFACTS = Object.freeze([
   "plugins/kxm/dist/cli.js",
   "plugins/kxm/dist/server.js",
   "plugins/kxm/dist/mcp-server.js",
@@ -14,13 +15,34 @@ export const GENERATED_ARTIFACTS = [
   "plugins/kxm/dist/runtime.js",
   "plugins/kxm/dist/client.js",
   "plugins/kxm/dist/extension.js",
-  ".agents/skills/kxm/SKILL.md",
-  ".agents/skills/kxm/references/protocol.md",
-  ".agents/skills/kxm-session/SKILL.md",
   "AGENTS.md",
   "CLAUDE.md",
   "GEMINI.md",
-];
+]);
+
+/**
+ * Compute the generated artifact list from the committed suite manifest.
+ * The manifest is required; missing or invalid manifests fail closed.
+ *
+ * @param {string} [repository]
+ * @returns {string[]}
+ */
+export function computeGeneratedArtifacts(repository = process.cwd()) {
+  const root = resolve(repository);
+  loadSkillSuiteManifest(root);
+  return Object.freeze([
+    ...STATIC_GENERATED_ARTIFACTS,
+    ...listSkillMirrorArtifacts(root),
+  ]);
+}
+
+/**
+ * Synchronous snapshot for the current repository. Tests that need a
+ * fixture-specific list should call computeGeneratedArtifacts(root).
+ *
+ * @type {readonly string[]}
+ */
+export const GENERATED_ARTIFACTS = computeGeneratedArtifacts();
 
 function runGit(repository, args, allowFailure = false) {
   const result = spawnSync("git", args, {
@@ -39,12 +61,14 @@ export function checkGeneratedArtifacts(repository = process.cwd()) {
   const requestedRoot = resolve(repository);
   const topLevel = runGit(requestedRoot, ["rev-parse", "--show-toplevel"]).stdout.trim();
   const root = resolve(topLevel);
-  const missing = GENERATED_ARTIFACTS.filter((path) => !existsSync(resolve(root, path)));
+  const artifacts = computeGeneratedArtifacts(root);
+
+  const missing = artifacts.filter((path) => !existsSync(resolve(root, path)));
   if (missing.length > 0) {
     throw new Error(`generated artifacts are missing: ${missing.join(", ")}`);
   }
 
-  const untracked = GENERATED_ARTIFACTS.filter((path) => runGit(
+  const untracked = artifacts.filter((path) => runGit(
     root,
     ["--literal-pathspecs", "ls-files", "--error-unmatch", "--", path],
     true,
@@ -58,12 +82,12 @@ export function checkGeneratedArtifacts(repository = process.cwd()) {
     "diff",
     "--name-only",
     "--",
-    ...GENERATED_ARTIFACTS,
+    ...artifacts,
   ]).stdout.trim();
   if (status) {
     throw new Error(`generated artifacts changed after build:\n${status}`);
   }
-  return { root, artifacts: [...GENERATED_ARTIFACTS] };
+  return { root, artifacts: [...artifacts] };
 }
 
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/scripts/emit-codex-artifacts.mjs

@@ -1,11 +1,24 @@
 #!/usr/bin/env node
 
-import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import {
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const MARKER_START = "<!-- kxm:codex:commands:start -->";
 const MARKER_END = "<!-- kxm:codex:commands:end -->";
+const SKILL_NAME = /^[a-z][a-z0-9-]*[a-z0-9]$/u;
+const COMMAND_NAME = /^[a-z][a-z0-9-]*$/u;
+const MANIFEST_REL = "plugins/kxm/skill-suite.json";
 
 export const CODEX_COMMANDS_BLOCK = `${MARKER_START}
 ## KXM agent commands
@@ -44,24 +57,243 @@ The \`kxm\` CLI is the unified agent surface for peer collaboration and workflow
 | \`kxm context recall <project>\` | Search durable context metadata | \`--query\`, \`--kinds\`, \`--limit\` |
 | \`kxm context state <project> <key>\` | Query authoritative temporal state | \`--as-of <timestamp>\` |
 | \`kxm context episode <project>\` | Query workflow learning episodes | \`--run\` |
-| \`kxm context promote <project> <key>\` | Propose temporal state change | \`--summary\`, \`--authority\`, \`--confidence\`, \`--evidence\` |
+| \`kxm context promote <project> <proposalId>\` | Promote an approved state proposal (control plane) | required \`--evidence <refs>\` |
 ${MARKER_END}`;
 
+function refuse(message) {
+  throw new Error(message);
+}
+
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function posixContained(value, label) {
+  if (typeof value !== "string" || !value || value.includes("\\") || value.includes("\0")) {
+    refuse(`${label} must be a contained relative path`);
+  }
+  const normalized = value.startsWith("./") ? value.slice(2) : value;
+  if (!normalized || normalized.startsWith("/") || normalized.split("/").some((part) => !part || part === "." || part === "..")) {
+    refuse(`${label} must be a contained relative path`);
+  }
+  return value;
+}
+
+function containedRoot(root) {
+  return existsSync(root) ? realpathSync(root) : resolve(root);
+}
+
+function assertPathStaysInRoot(resolvedRoot, current, relativePath) {
+  const real = realpathSync(current);
+  const prefix = resolvedRoot.endsWith(sep) ? resolvedRoot : `${resolvedRoot}${sep}`;
+  if (real !== resolvedRoot && !real.startsWith(prefix)) {
+    refuse(`path escapes repository: ${relativePath}`);
+  }
+  return real;
+}
+
+function assertExistingAncestorsAreRegularContained(root, relativePath, { required = false } = {}) {
+  const resolvedRoot = containedRoot(root);
+  const parts = posixContained(relativePath, "path").split("/");
+  let current = resolvedRoot;
+  for (let i = 0; i < parts.length; i++) {
+    current = join(current, parts[i]);
+    const rel = parts.slice(0, i + 1).join("/");
+    let info;
+    try {
+      info = lstatSync(current);
+    } catch {
+      if (required) refuse(`path is missing: ${rel}`);
+      return;
+    }
+    if (info.isSymbolicLink()) refuse(`symlinks are not allowed: ${rel}`);
+    if (!info.isDirectory()) {
+      refuse(`path must be a regular contained directory: ${rel}`);
+    }
+    assertPathStaysInRoot(resolvedRoot, current, rel);
+  }
+}
+
+function assertRegularContainedPath(root, relativePath, { directory = false } = {}) {
+  const resolvedRoot = containedRoot(root);
+  const parts = posixContained(relativePath, "path").split("/");
+  let current = resolvedRoot;
+  for (let i = 0; i < parts.length; i++) {
+    current = join(current, parts[i]);
+    let info;
+    try {
+      info = lstatSync(current);
+    } catch {
+      refuse(`path is missing: ${relativePath}`);
+    }
+    if (info.isSymbolicLink()) refuse(`symlinks are not allowed: ${relativePath}`);
+    const last = i === parts.length - 1;
+    if (last ? (directory ? !info.isDirectory() : !info.isFile()) : !info.isDirectory()) {
+      refuse(`path must be a regular contained ${directory ? "directory" : "file"}: ${relativePath}`);
+    }
+  }
+  assertPathStaysInRoot(resolvedRoot, current, relativePath);
+  return current;
+}
+
+function validateSkillSuiteManifest(manifest) {
+  if (!isPlainObject(manifest)) refuse("skill suite manifest must be an object");
+  for (const key of ["id", "version", "name", "description"]) {
+    if (typeof manifest[key] !== "string" || !manifest[key].trim()) {
+      refuse(`skill suite manifest missing ${key}`);
+    }
+  }
+  if (!Array.isArray(manifest.skills) || manifest.skills.length === 0) {
+    refuse("skill suite manifest skills must be a nonempty array");
+  }
+  const names = new Set();
+  const commands = new Set();
+  for (const skill of manifest.skills) {
+    if (!isPlainObject(skill)) refuse("skill suite entry must be an object");
+    const extra = Object.keys(skill).filter((key) => !["name", "path", "ownedCommands", "intent"].includes(key));
+    if (extra.length > 0) refuse(`skill suite entry has unknown field(s): ${extra.join(", ")}`);
+    if (typeof skill.name !== "string" || !SKILL_NAME.test(skill.name)) {
+      refuse(`invalid skill name: ${skill.name ?? ""}`);
+    }
+    if (names.has(skill.name)) refuse(`duplicate skill name: ${skill.name}`);
+    names.add(skill.name);
+    posixContained(skill.path, `skill path for ${skill.name}`);
+    if (!skill.path.startsWith("./skills/") || skill.path !== `./skills/${skill.name}`) {
+      refuse(`skill path must be ./skills/${skill.name}`);
+    }
+    if (typeof skill.intent !== "string" || skill.intent.length < 10 || skill.intent.length > 200) {
+      refuse(`skill ${skill.name} intent must be 10-200 characters`);
+    }
+    if (!Array.isArray(skill.ownedCommands) || skill.ownedCommands.some((cmd) => typeof cmd !== "string" || !COMMAND_NAME.test(cmd))) {
+      refuse(`skill ${skill.name} ownedCommands must be command tokens`);
+    }
+    for (const command of skill.ownedCommands) {
+      if (commands.has(command)) refuse(`command ${command} is owned by multiple skills`);
+      commands.add(command);
+    }
+  }
+  return manifest;
+}
+
+/**
+ * Read and validate the committed skill-suite manifest. Missing, symlink,
+ * malformed, or shape-invalid manifests fail closed.
+ *
+ * @param {string} repoRoot
+ * @returns {{ id: string, version: string, name: string, description: string, skills: Array<{ name: string, path: string, ownedCommands: string[], intent: string }> }}
+ */
+export function loadSkillSuiteManifest(repoRoot) {
+  const root = resolve(repoRoot);
+  const fullPath = assertRegularContainedPath(root, MANIFEST_REL);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(fullPath, "utf8"));
+  } catch {
+    refuse("skill suite manifest is malformed");
+  }
+  return validateSkillSuiteManifest(parsed);
+}
+
+function listFilesRecursive(dir, relativeBase = "") {
+  const results = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const rel = relativeBase ? `${relativeBase}/${entry.name}` : entry.name;
+    const full = join(dir, entry.name);
+    if (entry.isSymbolicLink() || lstatSync(full).isSymbolicLink()) {
+      refuse(`symlinks are not allowed: ${rel}`);
+    }
+    if (entry.isDirectory()) results.push(...listFilesRecursive(full, rel));
+    else if (entry.isFile()) results.push(rel);
+    else refuse(`unsupported skill artifact: ${rel}`);
+  }
+  return results.sort();
+}
+
+function ownedSkillDir(root, skillName) {
+  return assertRegularContainedPath(root, `plugins/kxm/skills/${skillName}`, { directory: true });
+}
+
+/**
+ * Return generated skill-mirror artifact paths relative to the repo root.
+ *
+ * @param {string} [repoRoot]
+ * @returns {string[]}
+ */
+export function listSkillMirrorArtifacts(repoRoot = process.cwd()) {
+  const root = resolve(repoRoot);
+  const suiteManifest = loadSkillSuiteManifest(root);
+  const artifacts = [];
+  for (const skill of suiteManifest.skills) {
+    const srcSkillDir = ownedSkillDir(root, skill.name);
+    const files = listFilesRecursive(srcSkillDir);
+    if (!files.includes("SKILL.md")) refuse(`SKILL.md missing for ${skill.name}`);
+    for (const rel of files) artifacts.push(`.agents/skills/${skill.name}/${rel}`);
+  }
+  return artifacts;
+}
+
+/**
+ * Emit the portable .agents/skills mirror from the authored plugin skills tree
+ * and update the AGENTS.md command block. Owned skills are replaced; unrelated
+ * skills are preserved. Missing or invalid manifests fail closed.
+ *
+ * @param {string} [repoRoot]
+ */
 export function emitCodexArtifacts(repoRoot = process.cwd()) {
   const root = resolve(repoRoot);
-  const srcSkillsDir = join(root, "plugins", "kxm", "skills");
+  const suiteManifest = loadSkillSuiteManifest(root);
   const destSkillsDir = join(root, ".agents", "skills");
+  assertExistingAncestorsAreRegularContained(root, ".agents/skills");
+  mkdirSync(destSkillsDir, { recursive: true });
+  assertExistingAncestorsAreRegularContained(root, ".agents/skills", { required: true });
+  const destRoot = realpathSync(destSkillsDir);
+  const repoReal = containedRoot(root);
+  const repoPrefix = repoReal.endsWith(sep) ? repoReal : `${repoReal}${sep}`;
+  if (destRoot !== repoReal && !destRoot.startsWith(repoPrefix)) {
+    refuse("path escapes repository: .agents/skills");
+  }
+  const ownedSkillNames = suiteManifest.skills.map((skill) => skill.name);
+  const emittedSkillPaths = [];
+  const preservedSkillNames = [];
 
-  // 1. Emit .agents/skills from authored skill tree
-  if (existsSync(srcSkillsDir)) {
-    mkdirSync(destSkillsDir, { recursive: true });
-    cpSync(srcSkillsDir, destSkillsDir, { recursive: true });
+  for (const skill of suiteManifest.skills) {
+    const srcSkillDir = ownedSkillDir(root, skill.name);
+    listFilesRecursive(srcSkillDir);
+    const destSkillPath = join(destSkillsDir, skill.name);
+    if (existsSync(destSkillPath)) {
+      if (lstatSync(destSkillPath).isSymbolicLink()) {
+        refuse(`symlinks are not allowed: .agents/skills/${skill.name}`);
+      }
+      rmSync(destSkillPath, { recursive: true, force: true });
+    }
+    cpSync(srcSkillDir, destSkillPath, {
+      recursive: true,
+      dereference: false,
+    });
+    if (lstatSync(destSkillPath).isSymbolicLink()) {
+      rmSync(destSkillPath, { recursive: true, force: true });
+      refuse(`symlinks are not allowed: .agents/skills/${skill.name}`);
+    }
+    const realDest = realpathSync(destSkillPath);
+    const prefix = destRoot.endsWith(sep) ? destRoot : `${destRoot}${sep}`;
+    if (realDest !== destRoot && !realDest.startsWith(prefix)) {
+      rmSync(destSkillPath, { recursive: true, force: true });
+      refuse(`path escapes repository: .agents/skills/${skill.name}`);
+    }
+    listFilesRecursive(destSkillPath);
+    emittedSkillPaths.push(destSkillPath);
+  }
+
+  for (const entry of readdirSync(destSkillsDir, { withFileTypes: true })) {
+    if (entry.isDirectory() && !ownedSkillNames.includes(entry.name)) {
+      preservedSkillNames.push(entry.name);
+    }
   }
 
-  // 2. Emit marker-delimited AGENTS.md block
   const agentsPath = join(root, "AGENTS.md");
   let agentsUpdated = false;
   if (existsSync(agentsPath)) {
+    if (lstatSync(agentsPath).isSymbolicLink()) refuse("AGENTS.md must be a regular file");
     const original = readFileSync(agentsPath, "utf8");
     let updated;
     if (original.includes(MARKER_START) && original.includes(MARKER_END)) {
@@ -82,10 +314,22 @@ export function emitCodexArtifacts(repoRoot = process.cwd()) {
     }
   }
 
-  return { destSkillsDir, agentsPath, agentsUpdated };
+  return {
+    destSkillsDir,
+    agentsPath,
+    agentsUpdated,
+    ownedSkills: ownedSkillNames,
+    preservedSkills: preservedSkillNames,
+    emittedSkillPaths,
+    artifacts: listSkillMirrorArtifacts(root),
+  };
 }
 
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   const result = emitCodexArtifacts();
-  process.stdout.write(`Codex artifacts emitted: skills -> ${result.destSkillsDir}, AGENTS.md updated -> ${result.agentsUpdated}\n`);
+  process.stdout.write(
+    `Codex artifacts emitted: skills -> ${result.destSkillsDir}, ` +
+    `owned=${result.ownedSkills.length}, preserved=${result.preservedSkills.length}, ` +
+    `AGENTS.md updated -> ${result.agentsUpdated}\n`,
+  );
 }

package/scripts/harness-run.d.mts

@@ -32,11 +32,19 @@ export function parseJson(text: string): unknown;
 export function piProviderOf(model?: string): string | undefined;
 export function piModelId(model?: string): string | undefined;
 export function piAuthCheckArgs(request: { model: string; role: string }): string[];
+export function resolveLaunch(cliId: string, options?: {
+  platform?: NodeJS.Platform | string | undefined;
+  pathEnv?: string | undefined;
+  existsSync?: ((path: string) => boolean) | undefined;
+  realpathSync?: ((path: string) => string) | undefined;
+  execPath?: string | undefined;
+}): { command: string; args: string[] };
 export function resolveLauncher(cliId: string, options?: {
-  platform?: NodeJS.Platform | string;
-  pathEnv?: string;
-  existsSync?: (path: string) => boolean;
-  realpathSync?: (path: string) => string;
+  platform?: NodeJS.Platform | string | undefined;
+  pathEnv?: string | undefined;
+  existsSync?: ((path: string) => boolean) | undefined;
+  realpathSync?: ((path: string) => string) | undefined;
+  execPath?: string | undefined;
 }): string;
 export function unsupportedLauncherMessage(target: string, platform?: string): string;
 export function parseAuth(harness: string, stdio: {