@kylecheng3146/agent-ops 0.1.4 → 0.1.5

package/dist/runtime/src/install/surface-inspection.js

@@ -0,0 +1,296 @@
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { resolveContainedPath } from "../fs/paths.js";
+import { harnessDescriptor, harnessSurfaceByPath, harnessSurfaces } from "./harness.js";
+import { resolveCapabilities, resolveProfiles } from "./profiles.js";
+import { isWritableSurface } from "./surfaces.js";
+const MAX_SURFACE_FILE_BYTES = 1024 * 1024;
+function isMissing(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function readSurface(root, surface) {
+    if (surface.scope === "external") {
+        return null;
+    }
+    let resolvedPath;
+    try {
+        resolvedPath = await resolveContainedPath(root, surface.path);
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            return null;
+        }
+        throw error;
+    }
+    let before;
+    try {
+        before = await lstat(resolvedPath, { bigint: true });
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            return null;
+        }
+        throw error;
+    }
+    if (!before.isFile() ||
+        before.size > BigInt(MAX_SURFACE_FILE_BYTES)) {
+        throw new Error("Surface is not a bounded regular file.");
+    }
+    const handle = await open(resolvedPath, constants.O_RDONLY |
+        constants.O_NOFOLLOW |
+        constants.O_NONBLOCK);
+    try {
+        const opened = await handle.stat({ bigint: true });
+        const resolvedAgain = await resolveContainedPath(root, surface.path);
+        const after = await lstat(resolvedAgain, { bigint: true });
+        if (!opened.isFile() ||
+            opened.size > BigInt(MAX_SURFACE_FILE_BYTES) ||
+            before.dev !== after.dev ||
+            before.ino !== after.ino) {
+            throw new Error("Surface identity changed during inspection.");
+        }
+        const chunks = [];
+        let totalBytes = 0;
+        while (totalBytes <= MAX_SURFACE_FILE_BYTES) {
+            const remaining = MAX_SURFACE_FILE_BYTES + 1 - totalBytes;
+            const chunk = Buffer.alloc(Math.min(64 * 1024, remaining));
+            const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+            if (bytesRead === 0) {
+                return {
+                    source: Buffer.concat(chunks, totalBytes).toString("utf8")
+                };
+            }
+            chunks.push(chunk.subarray(0, bytesRead));
+            totalBytes += bytesRead;
+        }
+        throw new Error("Surface exceeded its inspection limit.");
+    }
+    finally {
+        await handle.close();
+    }
+}
+function sameEvents(left, right) {
+    return (left.length === right.length &&
+        left.every((event) => right.includes(event)));
+}
+function desiredCapabilities(config) {
+    return config.profiles.length === 0
+        ? []
+        : resolveCapabilities(config).capabilities;
+}
+function managedJsonCount(source, isManagedHandler) {
+    if (source === null) {
+        return 0;
+    }
+    return jsonHandlerCounts(source, isManagedHandler)?.managed ?? 0;
+}
+export async function inspectHarnessRegistrations(options) {
+    const capabilities = desiredCapabilities(options.config);
+    const statuses = [];
+    for (const harness of options.manifest.harness) {
+        const descriptor = harnessDescriptor(harness);
+        const control = descriptor.control;
+        const hookRecord = options.manifest.hooks?.find(({ harness: recordHarness }) => recordHarness === harness);
+        const recordedEvents = hookRecord?.events ?? [];
+        const desiredEvents = control.buildHooks === undefined
+            ? []
+            : Object.keys(control.buildHooks(capabilities, "probe").hooks);
+        if (control.buildHooks !== undefined) {
+            const surfaces = harnessSurfaces(harness, options.manifest.scope, options.root);
+            const writableJsonSurfaces = surfaces.filter((surface) => isWritableSurface(surface) && surface.representation === "json");
+            let managedCount = 0;
+            for (const surface of writableJsonSurfaces) {
+                try {
+                    const read = await readSurface(options.root, surface);
+                    managedCount += managedJsonCount(read?.source ?? null, control.isManagedHandler);
+                }
+                catch {
+                    // An unsafe surface is treated as drift below when it is selected.
+                    managedCount += 1;
+                }
+            }
+            const selectedSurface = hookRecord === undefined
+                ? writableJsonSurfaces.find((surface) => surface.access === "managed-default")
+                : harnessSurfaceByPath(harness, options.manifest.scope, hookRecord.path, options.root);
+            let source = null;
+            if (selectedSurface !== undefined) {
+                try {
+                    source = (await readSurface(options.root, selectedSurface))?.source ??
+                        null;
+                }
+                catch {
+                    source = null;
+                }
+            }
+            const registered = hookRecord === undefined
+                ? desiredEvents.length === 0 && managedCount === 0
+                : selectedSurface !== undefined &&
+                    sameEvents(desiredEvents, recordedEvents) &&
+                    (desiredEvents.length === 0
+                        ? managedCount === 0
+                        : source !== null &&
+                            control.hookRegistered(source, capabilities));
+            statuses.push({
+                harness,
+                registered,
+                desiredEvents,
+                recordedEvents
+            });
+            continue;
+        }
+        const pluginArtifact = options.manifest.artifacts.find(({ id }) => id === "opencode-plugin");
+        const hasDesiredPlugin = control.registrations.some((registration) => capabilities.includes(registration.capability));
+        let registered = !hasDesiredPlugin && pluginArtifact === undefined;
+        if (hasDesiredPlugin && pluginArtifact !== undefined) {
+            const discovered = harnessSurfaces(harness, options.manifest.scope, options.root).find((surface) => surface.id === "opencode-plugin");
+            const selectedSurface = discovered === undefined
+                ? undefined
+                : { ...discovered, path: pluginArtifact.path };
+            try {
+                const source = selectedSurface === undefined
+                    ? null
+                    : (await readSurface(options.root, selectedSurface))?.source ?? null;
+                registered =
+                    source !== null && control.hookRegistered(source, capabilities);
+            }
+            catch {
+                registered = false;
+            }
+        }
+        if (!hasDesiredPlugin && pluginArtifact !== undefined) {
+            registered = false;
+        }
+        statuses.push({
+            harness,
+            registered,
+            desiredEvents,
+            recordedEvents
+        });
+    }
+    return statuses;
+}
+function jsonHandlerCounts(source, isManagedHandler) {
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        return null;
+    }
+    if (!isRecord(parsed)) {
+        return null;
+    }
+    const hooks = parsed.hooks;
+    if (hooks === undefined) {
+        return { managed: 0, foreign: 0 };
+    }
+    if (!isRecord(hooks)) {
+        return null;
+    }
+    let managed = 0;
+    let foreign = 0;
+    for (const groups of Object.values(hooks)) {
+        if (!Array.isArray(groups)) {
+            return null;
+        }
+        for (const group of groups) {
+            if (!isRecord(group) || !Array.isArray(group.hooks)) {
+                return null;
+            }
+            for (const handler of group.hooks) {
+                if (isManagedHandler?.(handler) === true) {
+                    managed += 1;
+                }
+                else {
+                    foreign += 1;
+                }
+            }
+        }
+    }
+    return { managed, foreign };
+}
+function handlerCounts(surface, source, capabilities, isManagedHandler, hookRegistered) {
+    if (surface.representation === "json") {
+        return jsonHandlerCounts(source, isManagedHandler);
+    }
+    if (surface.representation === "javascript") {
+        return {
+            managed: hookRegistered(source, capabilities) ? 1 : 0,
+            foreign: 0
+        };
+    }
+    return { managed: 0, foreign: 0 };
+}
+export async function inspectHarnessSurfaces(options) {
+    const capabilities = options.profiles.length === 0
+        ? []
+        : resolveProfiles(options.profiles).capabilities;
+    const statuses = [];
+    for (const harness of options.harness) {
+        const descriptor = harnessDescriptor(harness);
+        for (const surface of harnessSurfaces(harness, options.scope, options.root)) {
+            if (surface.scope === "external") {
+                statuses.push({
+                    harness,
+                    surfaceId: surface.id,
+                    path: surface.path,
+                    status: "unknown",
+                    managedHandlerCount: 0,
+                    foreignHandlerCount: 0
+                });
+                continue;
+            }
+            try {
+                const read = await readSurface(options.root, surface);
+                if (read === null) {
+                    statuses.push({
+                        harness,
+                        surfaceId: surface.id,
+                        path: surface.path,
+                        status: "missing",
+                        managedHandlerCount: 0,
+                        foreignHandlerCount: 0
+                    });
+                    continue;
+                }
+                const counts = handlerCounts(surface, read.source, capabilities, descriptor.control.isManagedHandler, descriptor.control.hookRegistered);
+                if (counts === null) {
+                    statuses.push({
+                        harness,
+                        surfaceId: surface.id,
+                        path: surface.path,
+                        status: "unknown",
+                        managedHandlerCount: 0,
+                        foreignHandlerCount: 0
+                    });
+                    continue;
+                }
+                statuses.push({
+                    harness,
+                    surfaceId: surface.id,
+                    path: surface.path,
+                    status: counts.managed > 0 ? "managed" : "foreign",
+                    managedHandlerCount: counts.managed,
+                    foreignHandlerCount: counts.foreign
+                });
+            }
+            catch {
+                statuses.push({
+                    harness,
+                    surfaceId: surface.id,
+                    path: surface.path,
+                    status: "unknown",
+                    managedHandlerCount: 0,
+                    foreignHandlerCount: 0
+                });
+            }
+        }
+    }
+    return statuses;
+}

package/dist/runtime/src/install/surfaces.js

@@ -0,0 +1,11 @@
+export function findSurfaceById(surfaces, id) {
+    return surfaces.find((surface) => surface.id === id);
+}
+export function findSurfaceByPath(surfaces, path) {
+    return surfaces.find((surface) => surface.path === path);
+}
+export function isWritableSurface(surface) {
+    return (surface !== undefined &&
+        (surface.access === "managed-default" ||
+            surface.access === "managed-opt-in"));
+}

package/dist/runtime/src/install/uninstall.js

@@ -7,6 +7,7 @@ import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
 import { FileTransaction } from "../fs/transaction.js";
 import { planHookRemoval } from "./hooks.js";
 import { assertExpectedManagedBlock, assertSupportedManifestOwnership } from "./ownership.js";
+import { isOpencodeManagedPlugin } from "../adapters/opencode/config.js";
 const MANIFEST_PATH = ".agent-ops/manifest.json";
 const MAX_UNINSTALL_FILE_BYTES = 1024 * 1024;
 function isMissing(error) {
@@ -117,13 +118,17 @@ export async function createUninstallPlan(root) {
         };
     }
     const manifest = parseInstallManifest(currentManifest.content);
-    const expectedMarkers = assertSupportedManifestOwnership(manifest);
+    const expectedMarkers = assertSupportedManifestOwnership(manifest, root);
     const operations = [];
     for (const artifact of manifest.artifacts) {
         const current = await readCurrentFile(root, artifact.path);
         if (current === null || current.hash !== artifact.hash) {
             throw new AgentOpsError("MANAGED_ARTIFACT_CHANGED", `Managed artifact changed after installation: ${artifact.path}`);
         }
+        if (artifact.id === "opencode-plugin" &&
+            !isOpencodeManagedPlugin(current.content)) {
+            throw new AgentOpsError("MANIFEST_OWNERSHIP_INVALID", `The recorded opencode plugin is not an agent-ops managed plugin: ${artifact.path}`);
+        }
         operations.push({
             kind: "remove",
             path: artifact.path,
@@ -141,13 +146,15 @@ export async function createUninstallPlan(root) {
             ? {
                 kind: "remove",
                 path: hook.path,
-                expectedHash: current.hash
+                expectedHash: current.hash,
+                disclosure: removal.disclosure
             }
             : {
                 kind: "write",
                 path: hook.path,
                 content: removal.content,
-                expectedHash: current.hash
+                expectedHash: current.hash,
+                disclosure: removal.disclosure
             });
     }
     operations.push({

package/dist/runtime/src/install/update.js

@@ -88,7 +88,9 @@ export async function createUpdatePlan(options) {
         "manifest",
         "markers"
     ]) {
-        if (statusOf(report, id) !== "PASS") {
+        const status = statusOf(report, id);
+        if (status !== "PASS" &&
+            !(id === "markers" && status === "DEGRADED")) {
             throw new AgentOpsError("UPDATE_INSTALLATION_INVALID", `Update requires a passing ${id} doctor check.`);
         }
     }
@@ -103,13 +105,17 @@ export async function createUpdatePlan(options) {
     const installation = await createInstallPlan({
         root: options.root,
         scope: report.manifest.scope,
-        harness: report.manifest.harness,
+        harness: options.harness ?? report.manifest.harness,
         profiles: configPreview.migrated.profiles,
         adapters: options.adapters,
         toolkitVersion: targetVersion,
+        allowHarnessChange: true,
         ...(options.hookRuntimePath === undefined
             ? {}
             : { hookRuntimePath: options.hookRuntimePath }),
+        ...(options.hookTargets === undefined
+            ? {}
+            : { hookTargets: options.hookTargets }),
         existingConfig: {
             value: configPreview.migrated,
             sourceHash: configPreview.sourceHash

package/dist/runtime/src/schema/validate.js

@@ -1,11 +1,12 @@
-import { SCHEMA_VERSION } from "../contracts.js";
+import { CONFIG_SCHEMA_VERSION, EVIDENCE_SCHEMA_VERSION, MANIFEST_SCHEMA_VERSION, TASK_SCHEMA_VERSION } from "../contracts.js";
 const ID_PATTERN = /^[a-z][a-z0-9-]{0,127}$/;
 const HASH_PATTERN = /^[a-f0-9]{64}$/;
 const WINDOWS_RESERVED_SEGMENT = /^(?:aux|com[1-9]|con|lpt[1-9]|nul|prn)(?:\..*)?$/i;
 const PROFILE_VALUES = new Set(["advisory", "core", "guardrails"]);
 const EVIDENCE_KINDS = new Set(["exit-code", "file", "test-count"]);
 const SCOPE_VALUES = new Set(["project", "user"]);
-const HARNESS_VALUES = new Set(["both", "claude", "codex"]);
+const HARNESS_VALUES = new Set(["claude", "codex", "opencode"]);
+// opencode's plugin is a managed artifact, not a ManagedHookRecord entry.
 const HOOK_HARNESS_VALUES = new Set(["claude", "codex"]);
 const HOOK_EVENT_VALUES = new Set([
     "SessionStart",
@@ -38,12 +39,12 @@ function unknownFieldFailure(value, allowed, path) {
         ? undefined
         : failure("UNKNOWN_FIELD", `${path}.${unknown}`, `Unknown field: ${unknown}`);
 }
-function validateRoot(value, allowed) {
+function validateRoot(value, allowed, expectedVersion) {
     if (!isRecord(value)) {
         return failure("INVALID_TYPE", "$", "Expected an object.");
     }
-    if (value.schemaVersion !== SCHEMA_VERSION) {
-        return failure("SCHEMA_VERSION_UNSUPPORTED", "$.schemaVersion", `Expected schemaVersion ${SCHEMA_VERSION}.`);
+    if (value.schemaVersion !== expectedVersion) {
+        return failure("SCHEMA_VERSION_UNSUPPORTED", "$.schemaVersion", `Expected schemaVersion ${expectedVersion}.`);
     }
     return unknownFieldFailure(value, allowed, "$") ?? value;
 }
@@ -277,12 +278,13 @@ function validateSecurityException(value, path) {
 }
 export function validateConfig(value) {
     const root = validateRoot(value, [
+        "features",
         "pathMappings",
         "profiles",
         "schemaVersion",
         "securityExceptions",
         "verification"
-    ]);
+    ], CONFIG_SCHEMA_VERSION);
     if (isFailure(root)) {
         return root;
     }
@@ -306,6 +308,23 @@ export function validateConfig(value) {
     if (!hasUniqueStrings(root.profiles)) {
         return failure("DUPLICATE_ID", "$.profiles", "Profiles must be unique.");
     }
+    if (!isRecord(root.features)) {
+        return failure("INVALID_TYPE", "$.features", "features must be an object.");
+    }
+    const featuresUnknown = unknownFieldFailure(root.features, ["stopVerification"], "$.features");
+    if (featuresUnknown !== undefined) {
+        return featuresUnknown;
+    }
+    if (!isRecord(root.features.stopVerification)) {
+        return failure("INVALID_TYPE", "$.features.stopVerification", "stopVerification must be an object.");
+    }
+    const stopVerificationUnknown = unknownFieldFailure(root.features.stopVerification, ["enabled"], "$.features.stopVerification");
+    if (stopVerificationUnknown !== undefined) {
+        return stopVerificationUnknown;
+    }
+    if (typeof root.features.stopVerification.enabled !== "boolean") {
+        return failure("INVALID_FEATURE", "$.features.stopVerification.enabled", "stopVerification.enabled must be a boolean.");
+    }
     if (!isRecord(root.verification)) {
         return failure("INVALID_TYPE", "$.verification", "verification must be an object.");
     }
@@ -327,6 +346,10 @@ export function validateConfig(value) {
         }
         commandIds.add(command.value.id);
     }
+    if (root.features.stopVerification.enabled === true &&
+        root.verification.commands.length === 0) {
+        return failure("STOP_VERIFICATION_COMMANDS_REQUIRED", "$.features.stopVerification.enabled", "Stop verification requires at least one verification command.");
+    }
     if (!Array.isArray(root.pathMappings)) {
         return failure("INVALID_TYPE", "$.pathMappings", "pathMappings must be an array.");
     }
@@ -372,7 +395,7 @@ function validateCriterion(value, path) {
     return success(value);
 }
 export function validateTask(value) {
-    const root = validateRoot(value, ["criteria", "id", "schemaVersion", "title"]);
+    const root = validateRoot(value, ["criteria", "id", "schemaVersion", "title"], TASK_SCHEMA_VERSION);
     if (isFailure(root)) {
         return root;
     }
@@ -433,7 +456,7 @@ export function validateEvidence(value) {
         "taskId",
         "testCount",
         "toolVersions"
-    ]);
+    ], EVIDENCE_SCHEMA_VERSION);
     if (isFailure(root)) {
         return root;
     }
@@ -556,22 +579,18 @@ function validateManagedHook(value, path) {
     return success(value);
 }
 export function validateManifest(value) {
-    const root = validateRoot(value, [
-        "artifacts",
-        "harness",
-        "hooks",
-        "markers",
-        "schemaVersion",
-        "scope"
-    ]);
+    const root = validateRoot(value, ["artifacts", "harness", "hooks", "markers", "schemaVersion", "scope"], MANIFEST_SCHEMA_VERSION);
     if (isFailure(root)) {
         return root;
     }
     if (typeof root.scope !== "string" || !SCOPE_VALUES.has(root.scope)) {
         return failure("INVALID_SCOPE", "$.scope", "Unsupported install scope.");
     }
-    if (typeof root.harness !== "string" || !HARNESS_VALUES.has(root.harness)) {
-        return failure("INVALID_HARNESS", "$.harness", "Unsupported harness.");
+    if (!Array.isArray(root.harness) ||
+        root.harness.length === 0 ||
+        !root.harness.every((id) => typeof id === "string" && HARNESS_VALUES.has(id)) ||
+        new Set(root.harness).size !== root.harness.length) {
+        return failure("INVALID_HARNESS", "$.harness", "Harness must be a non-empty list of unique supported harnesses.");
     }
     if (!Array.isArray(root.artifacts) || !Array.isArray(root.markers)) {
         return failure("INVALID_TYPE", "$.artifacts", "artifacts and markers must be arrays.");

package/dist/runtime/src/task/service.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { SCHEMA_VERSION } from "../contracts.js";
+import { TASK_SCHEMA_VERSION } from "../contracts.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { validateTask } from "../schema/validate.js";
 import { renderTaskMarkdown } from "./render.js";
@@ -74,7 +74,7 @@ export class TaskService {
     }
     async create(input) {
         const task = {
-            schemaVersion: SCHEMA_VERSION,
+            schemaVersion: TASK_SCHEMA_VERSION,
             id: this.#generateId(),
             title: input.title,
             criteria: [...input.criteria]
@@ -117,7 +117,7 @@ export class TaskService {
         const state = await this.#store.read();
         if (query.taskId !== undefined) {
             return cloneRecord(findTask({
-                schemaVersion: 1,
+                schemaVersion: TASK_SCHEMA_VERSION,
                 tasks: [...state.tasks],
                 sessions: [...state.sessions]
             }, query.taskId));

package/dist/runtime/src/task/store.js

@@ -1,4 +1,5 @@
 import { lstat } from "node:fs/promises";
+import { TASK_SCHEMA_VERSION } from "../contracts.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { validateTask } from "../schema/validate.js";
 import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
@@ -154,7 +155,11 @@ function parseSession(value) {
 }
 function parseState(source) {
     if (source === null) {
-        return { schemaVersion: 1, tasks: [], sessions: [] };
+        return {
+            schemaVersion: TASK_SCHEMA_VERSION,
+            tasks: [],
+            sessions: []
+        };
     }
     let value;
     try {
@@ -165,7 +170,7 @@ function parseState(source) {
     }
     if (!isRecord(value) ||
         !hasExactKeys(value, ["schemaVersion", "sessions", "tasks"]) ||
-        value.schemaVersion !== 1 ||
+        value.schemaVersion !== TASK_SCHEMA_VERSION ||
         !Array.isArray(value.tasks) ||
         !Array.isArray(value.sessions)) {
         return invalidState("Task state has an unsupported structure.");
@@ -184,7 +189,11 @@ function parseState(source) {
     })) {
         return invalidState("Session attachments must reference known tasks.");
     }
-    return { schemaVersion: 1, tasks, sessions };
+    return {
+        schemaVersion: TASK_SCHEMA_VERSION,
+        tasks,
+        sessions
+    };
 }
 function positiveMaxBytes(value) {
     if (value === undefined) {

package/dist/runtime/src/verify/command-executor.js

@@ -0,0 +1,113 @@
+import { runVerificationCommand } from "./spawn.js";
+import { evaluateTestCount, parseTestCount } from "./test-count.js";
+function classifyTestCountCode(code) {
+    const classes = {
+        TEST_COUNT_BELOW_MINIMUM: "test-count-below-minimum",
+        TEST_COUNT_INVALID: "test-count-invalid",
+        TEST_COUNT_OK: "none",
+        TEST_COUNT_REQUIREMENT_INVALID: "test-count-requirement-invalid",
+        TEST_COUNT_UNPARSEABLE: "test-count-unparseable",
+        ZERO_TESTS: "zero-tests"
+    };
+    return classes[code];
+}
+function untrustedResult(commandId) {
+    return {
+        commandId,
+        status: "UNKNOWN",
+        failureClass: "repository-untrusted",
+        exitCode: null,
+        signal: null,
+        timedOut: false,
+        durationMs: 0,
+        stdout: "",
+        stderr: "",
+        stdoutTruncated: false,
+        stderrTruncated: false
+    };
+}
+function classifyCommand(command, spawned) {
+    if (command.evidence.kind === "file") {
+        return {
+            status: spawned.status === "PASS" ? "UNKNOWN" : spawned.status,
+            failureClass: spawned.status === "PASS"
+                ? "file-evidence-unsupported"
+                : spawned.failureClass,
+            testCount: null
+        };
+    }
+    if (command.evidence.kind !== "test-count") {
+        return {
+            status: spawned.status,
+            failureClass: spawned.failureClass,
+            testCount: null
+        };
+    }
+    const testCount = parseTestCount(`${spawned.stdout}\n${spawned.stderr}`);
+    if (spawned.status !== "PASS") {
+        return {
+            status: spawned.status,
+            failureClass: spawned.failureClass,
+            testCount
+        };
+    }
+    const evaluation = evaluateTestCount(testCount, command.evidence.minimum);
+    return {
+        status: evaluation.status,
+        failureClass: classifyTestCountCode(evaluation.code),
+        testCount: evaluation.testCount
+    };
+}
+function diagnostic(spawned) {
+    return spawned.stderr || spawned.stdout || spawned.failureClass;
+}
+export async function executeConfiguredCommand(command, options) {
+    let spawned;
+    if (!options.trusted) {
+        spawned = untrustedResult(command.id);
+    }
+    else {
+        const runOptions = {
+            cwd: options.cwd,
+            ...(options.runner === undefined
+                ? {}
+                : { runner: options.runner }),
+            ...(options.env === undefined ? {} : { env: options.env }),
+            ...(options.now === undefined ? {} : { now: options.now }),
+            ...(options.outputLimitBytes === undefined
+                ? {}
+                : { outputLimitBytes: options.outputLimitBytes }),
+            ...(options.terminationGraceMs === undefined
+                ? {}
+                : { terminationGraceMs: options.terminationGraceMs })
+        };
+        spawned = await runVerificationCommand(command, runOptions);
+    }
+    const classified = classifyCommand(command, spawned);
+    return {
+        commandId: command.id,
+        required: command.required,
+        status: classified.status,
+        failureClass: classified.failureClass,
+        exitCode: spawned.exitCode,
+        signal: spawned.signal,
+        timedOut: spawned.timedOut,
+        testCount: classified.testCount,
+        diagnostic: diagnostic(spawned),
+        stdout: spawned.stdout,
+        stderr: spawned.stderr,
+        stdoutTruncated: spawned.stdoutTruncated,
+        stderrTruncated: spawned.stderrTruncated
+    };
+}
+export function aggregateVerificationStatus(results) {
+    const required = results.filter((result) => result.required);
+    const gating = required.length > 0 ? required : results;
+    if (gating.some((result) => result.status === "FAIL")) {
+        return "FAIL";
+    }
+    if (gating.some((result) => result.status === "UNKNOWN")) {
+        return "UNKNOWN";
+    }
+    return "PASS";
+}