@lumenflow/cli 3.18.1 → 3.19.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (159) hide show
  1. package/dist/docs-sync.js +123 -6
  2. package/dist/docs-sync.js.map +1 -1
  3. package/dist/gate-co-change.js +23 -4
  4. package/dist/gate-co-change.js.map +1 -1
  5. package/dist/gates-runners.js +108 -12
  6. package/dist/gates-runners.js.map +1 -1
  7. package/dist/lumenflow-upgrade.js +1 -0
  8. package/dist/lumenflow-upgrade.js.map +1 -1
  9. package/dist/public-manifest.js +1 -1
  10. package/dist/public-manifest.js.map +1 -1
  11. package/dist/sync-templates.js +13 -0
  12. package/dist/sync-templates.js.map +1 -1
  13. package/dist/wu-block.js +10 -0
  14. package/dist/wu-block.js.map +1 -1
  15. package/dist/wu-claim-validation.js +3 -1
  16. package/dist/wu-claim-validation.js.map +1 -1
  17. package/dist/wu-claim.js +3 -1
  18. package/dist/wu-claim.js.map +1 -1
  19. package/dist/wu-done-memory-telemetry.js +5 -1
  20. package/dist/wu-done-memory-telemetry.js.map +1 -1
  21. package/dist/wu-done-ownership.js +6 -0
  22. package/dist/wu-done-ownership.js.map +1 -1
  23. package/dist/wu-edit-operations.js +4 -4
  24. package/dist/wu-edit-operations.js.map +1 -1
  25. package/dist/wu-prep.js +88 -13
  26. package/dist/wu-prep.js.map +1 -1
  27. package/dist/wu-recover.js +15 -0
  28. package/dist/wu-recover.js.map +1 -1
  29. package/dist/wu-release.js +10 -1
  30. package/dist/wu-release.js.map +1 -1
  31. package/dist/wu-spawn-prompt-builders.js +27 -2
  32. package/dist/wu-spawn-prompt-builders.js.map +1 -1
  33. package/dist/wu-state-mutation-ownership.js +136 -0
  34. package/dist/wu-state-mutation-ownership.js.map +1 -0
  35. package/dist/wu-unblock.js +10 -0
  36. package/dist/wu-unblock.js.map +1 -1
  37. package/package.json +111 -110
  38. package/packs/agent-runtime/.turbo/turbo-build.log +1 -1
  39. package/packs/agent-runtime/package.json +1 -1
  40. package/packs/sidekick/.turbo/turbo-build.log +1 -1
  41. package/packs/sidekick/package.json +1 -1
  42. package/packs/software-delivery/.turbo/turbo-build.log +1 -1
  43. package/packs/software-delivery/package.json +1 -1
  44. package/templates/core/AGENTS.md.template +157 -32
  45. package/templates/core/LUMENFLOW.md.template +44 -29
  46. package/templates/core/_frameworks/lumenflow/wu-sizing-guide.md.template +644 -0
  47. package/templates/core/ai/onboarding/agent-invocation-guide.md.template +5 -5
  48. package/templates/core/ai/onboarding/agent-safety-card.md.template +1 -0
  49. package/templates/core/ai/onboarding/docs-generation.md.template +94 -4
  50. package/templates/core/ai/onboarding/first-15-mins.md.template +1 -1
  51. package/templates/core/ai/onboarding/first-wu-mistakes.md.template +2 -1
  52. package/templates/core/ai/onboarding/initiative-orchestration.md.template +21 -21
  53. package/templates/core/ai/onboarding/quick-ref-commands.md.template +102 -95
  54. package/templates/core/ai/onboarding/release-process.md.template +12 -12
  55. package/templates/core/ai/onboarding/starting-prompt.md.template +31 -31
  56. package/templates/vendors/claude/.claude/skills/initiative-management/SKILL.md.template +2 -2
  57. package/templates/vendors/claude/.claude/skills/multi-agent-coordination/SKILL.md.template +2 -2
  58. package/templates/vendors/claude/.claude/skills/orchestration/SKILL.md.template +3 -3
  59. package/dist/chunk-2D2VOCA4.js +0 -37
  60. package/dist/chunk-2D5KFYGX.js +0 -284
  61. package/dist/chunk-2GXVIN57.js +0 -14072
  62. package/dist/chunk-2MQ7HZWZ.js +0 -26
  63. package/dist/chunk-2UFQ3A3C.js +0 -643
  64. package/dist/chunk-3RG5ZIWI.js +0 -10
  65. package/dist/chunk-4N74J3UT.js +0 -15
  66. package/dist/chunk-5GTOXFYR.js +0 -392
  67. package/dist/chunk-5VY6MQMC.js +0 -240
  68. package/dist/chunk-67XVPMRY.js +0 -1297
  69. package/dist/chunk-6HO4GWJE.js +0 -164
  70. package/dist/chunk-6W5XHWYV.js +0 -1890
  71. package/dist/chunk-6X4EMYJQ.js +0 -64
  72. package/dist/chunk-6XYXI2NQ.js +0 -772
  73. package/dist/chunk-7ANSOV6Q.js +0 -285
  74. package/dist/chunk-A624LFLB.js +0 -1380
  75. package/dist/chunk-ADN5NHG4.js +0 -126
  76. package/dist/chunk-B7YJYJKG.js +0 -33
  77. package/dist/chunk-CCLHCPKG.js +0 -210
  78. package/dist/chunk-CK36VROC.js +0 -1584
  79. package/dist/chunk-D3UOFRSB.js +0 -81
  80. package/dist/chunk-DFR4DJBM.js +0 -230
  81. package/dist/chunk-DSYBDHYH.js +0 -79
  82. package/dist/chunk-DWMLTXKQ.js +0 -1176
  83. package/dist/chunk-E3REJTAJ.js +0 -28
  84. package/dist/chunk-EA3IVO64.js +0 -633
  85. package/dist/chunk-EK2AKZKD.js +0 -55
  86. package/dist/chunk-ELD7JTTT.js +0 -343
  87. package/dist/chunk-EX6TT2XI.js +0 -195
  88. package/dist/chunk-EXINSFZE.js +0 -82
  89. package/dist/chunk-EZ6ZBYBM.js +0 -510
  90. package/dist/chunk-FBKAPTJ2.js +0 -16
  91. package/dist/chunk-FVLV5RYH.js +0 -1118
  92. package/dist/chunk-GDNSBQVK.js +0 -2485
  93. package/dist/chunk-GPQHMBNN.js +0 -278
  94. package/dist/chunk-GTFJB67L.js +0 -68
  95. package/dist/chunk-HANJXVKW.js +0 -1127
  96. package/dist/chunk-HEVS5YLD.js +0 -269
  97. package/dist/chunk-HMEVZKPQ.js +0 -9
  98. package/dist/chunk-HRGSYNLM.js +0 -3511
  99. package/dist/chunk-ISZR5N4K.js +0 -60
  100. package/dist/chunk-J6SUPR2C.js +0 -226
  101. package/dist/chunk-JERYVEIZ.js +0 -244
  102. package/dist/chunk-JHHWGL2N.js +0 -87
  103. package/dist/chunk-JONWQUB5.js +0 -775
  104. package/dist/chunk-K2DIWWDM.js +0 -1766
  105. package/dist/chunk-KY4PGL5V.js +0 -969
  106. package/dist/chunk-L737LQ4C.js +0 -1285
  107. package/dist/chunk-LFTWYIB2.js +0 -497
  108. package/dist/chunk-LV47RFNJ.js +0 -41
  109. package/dist/chunk-MKSAITI7.js +0 -15
  110. package/dist/chunk-MZ7RKIX4.js +0 -212
  111. package/dist/chunk-NAP6CFSO.js +0 -84
  112. package/dist/chunk-ND6MY37M.js +0 -16
  113. package/dist/chunk-NMG736UR.js +0 -683
  114. package/dist/chunk-NRAXROED.js +0 -32
  115. package/dist/chunk-NRIZR3A7.js +0 -690
  116. package/dist/chunk-NX43BG3M.js +0 -233
  117. package/dist/chunk-O645XLSI.js +0 -297
  118. package/dist/chunk-OMJD6A3S.js +0 -235
  119. package/dist/chunk-QB6SJD4T.js +0 -430
  120. package/dist/chunk-QFSTL4J3.js +0 -276
  121. package/dist/chunk-QLGDFMFX.js +0 -212
  122. package/dist/chunk-RIAAGL2E.js +0 -13
  123. package/dist/chunk-RWO5XMZ6.js +0 -86
  124. package/dist/chunk-RXRKBBSM.js +0 -149
  125. package/dist/chunk-RZOZMML6.js +0 -363
  126. package/dist/chunk-U7I7FS7T.js +0 -113
  127. package/dist/chunk-UI42RODY.js +0 -717
  128. package/dist/chunk-UTVMVSCO.js +0 -519
  129. package/dist/chunk-V6OJGLBA.js +0 -1746
  130. package/dist/chunk-W2JHVH7D.js +0 -152
  131. package/dist/chunk-WD3Y7VQN.js +0 -280
  132. package/dist/chunk-WOCTQ5MS.js +0 -303
  133. package/dist/chunk-WZR3ZUNN.js +0 -696
  134. package/dist/chunk-XGI665H7.js +0 -150
  135. package/dist/chunk-XKY65P2T.js +0 -304
  136. package/dist/chunk-Y4CQZY65.js +0 -57
  137. package/dist/chunk-YFEXKLVE.js +0 -194
  138. package/dist/chunk-YHO3HS5X.js +0 -287
  139. package/dist/chunk-YLS7AZSX.js +0 -738
  140. package/dist/chunk-ZE473AO6.js +0 -49
  141. package/dist/chunk-ZF747T3O.js +0 -644
  142. package/dist/chunk-ZHCZHZH3.js +0 -43
  143. package/dist/chunk-ZZNZX2XY.js +0 -87
  144. package/dist/constants-7QAP3VQ4.js +0 -23
  145. package/dist/dist-IY3UUMWK.js +0 -33
  146. package/dist/invariants-runner-W5RGHCSU.js +0 -27
  147. package/dist/lane-lock-6J36HD5O.js +0 -35
  148. package/dist/mem-checkpoint-core-EANG2GVN.js +0 -14
  149. package/dist/mem-signal-core-2LZ2WYHW.js +0 -19
  150. package/dist/memory-store-OLB5FO7K.js +0 -18
  151. package/dist/service-6BYCOCO5.js +0 -13
  152. package/dist/spawn-policy-resolver-NTSZYQ6R.js +0 -17
  153. package/dist/spawn-task-builder-R4E2BHSW.js +0 -22
  154. package/dist/wu-done-pr-WLFFFEPJ.js +0 -25
  155. package/dist/wu-done-validation-3J5E36FE.js +0 -30
  156. package/dist/wu-duplicate-id-detector-5S7JHELK.js +0 -232
  157. package/packs/sidekick/.turbo/turbo-test.log +0 -12
  158. package/packs/sidekick/.turbo/turbo-typecheck.log +0 -4
  159. package/packs/software-delivery/.turbo/turbo-typecheck.log +0 -4
@@ -1,152 +0,0 @@
1
- import {
2
- generateMemId
3
- } from "./chunk-RIAAGL2E.js";
4
- import {
5
- appendNode,
6
- loadMemory,
7
- validateMemoryNode
8
- } from "./chunk-DFR4DJBM.js";
9
- import {
10
- LUMENFLOW_MEMORY_PATHS
11
- } from "./chunk-4N74J3UT.js";
12
- import {
13
- ErrorCodes,
14
- createError
15
- } from "./chunk-RXRKBBSM.js";
16
-
17
- // ../memory/dist/mem-summarize-core.js
18
- import path from "path";
19
- var SUMMARIZABLE_TYPES = ["discovery", "checkpoint", "note", "session"];
20
- var PROTECTED_LIFECYCLES = ["project"];
21
- function filterSummarizableNodes(nodes, wuId) {
22
- return nodes.filter((node) => {
23
- if (node.wu_id !== wuId) {
24
- return false;
25
- }
26
- if (node.lifecycle === "ephemeral") {
27
- return false;
28
- }
29
- if (node.metadata?.summarized_into) {
30
- return false;
31
- }
32
- if (node.type === "summary") {
33
- return false;
34
- }
35
- return SUMMARIZABLE_TYPES.includes(node.type);
36
- });
37
- }
38
- function getCompactionRatio(sourceCount, summaryCount) {
39
- if (sourceCount === 0 || summaryCount === 0) {
40
- return 0;
41
- }
42
- return sourceCount / summaryCount;
43
- }
44
- function groupNodesByType(nodes) {
45
- const groups = /* @__PURE__ */ new Map();
46
- for (const node of nodes) {
47
- if (!groups.has(node.type)) {
48
- groups.set(node.type, []);
49
- }
50
- const typeGroup = groups.get(node.type);
51
- if (typeGroup) {
52
- typeGroup.push(node);
53
- }
54
- }
55
- return groups;
56
- }
57
- function generateSummaryContent(nodes, wuId) {
58
- const groups = groupNodesByType(nodes);
59
- const sections = [];
60
- sections.push(`# Summary for ${wuId}`);
61
- sections.push(`Aggregated from ${nodes.length} node(s)`);
62
- const typeOrder = ["discovery", "checkpoint", "note", "session"];
63
- for (const type of typeOrder) {
64
- const typeNodes = groups.get(type);
65
- if (!typeNodes || typeNodes.length === 0) {
66
- continue;
67
- }
68
- sections.push(`## ${type.charAt(0).toUpperCase() + type.slice(1)}(s)`);
69
- for (const node of typeNodes) {
70
- const content = node.content.length > 200 ? `${node.content.slice(0, 197)}...` : node.content;
71
- sections.push(`- ${content}`);
72
- }
73
- }
74
- return sections.join("\n");
75
- }
76
- function filterNodesForCleanup(nodes) {
77
- return nodes.filter((node) => !PROTECTED_LIFECYCLES.includes(node.lifecycle));
78
- }
79
- function createSummaryNode(sourceNodes, wuId) {
80
- const timestamp = (/* @__PURE__ */ new Date()).toISOString();
81
- const content = generateSummaryContent(sourceNodes, wuId);
82
- const id = generateMemId(`summary-${wuId}-${timestamp}`);
83
- const summary = {
84
- id,
85
- type: "summary",
86
- lifecycle: "project",
87
- // Summaries persist across WUs
88
- content,
89
- created_at: timestamp,
90
- wu_id: wuId,
91
- metadata: {
92
- source_nodes: sourceNodes.map((n) => n.id),
93
- source_count: sourceNodes.length,
94
- summarized_at: timestamp
95
- }
96
- };
97
- const validation = validateMemoryNode(summary);
98
- if (!validation.success) {
99
- const issues = validation.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join(", ");
100
- throw createError(ErrorCodes.VALIDATION_ERROR, `Summary node validation failed: ${issues}`);
101
- }
102
- return summary;
103
- }
104
- function createCleanupMarkers(nodes, summaryId) {
105
- const timestamp = (/* @__PURE__ */ new Date()).toISOString();
106
- return nodes.map((node) => ({
107
- ...node,
108
- updated_at: timestamp,
109
- metadata: {
110
- ...node.metadata,
111
- summarized_into: summaryId,
112
- summarized_at: timestamp
113
- }
114
- }));
115
- }
116
- async function summarizeWu(baseDir, options) {
117
- const { wuId, dryRun = false } = options;
118
- const memoryDir = path.join(baseDir, LUMENFLOW_MEMORY_PATHS.MEMORY_DIR);
119
- const memory = await loadMemory(memoryDir);
120
- const summarizable = filterSummarizableNodes(memory.nodes, wuId);
121
- if (summarizable.length === 0) {
122
- throw createError(ErrorCodes.NODE_NOT_FOUND, `No summarizable nodes found for ${wuId}`);
123
- }
124
- const summary = createSummaryNode(summarizable, wuId);
125
- const cleanupNodes = filterNodesForCleanup(summarizable);
126
- const markedForCleanup = cleanupNodes.map((n) => n.id);
127
- const compactionRatio = getCompactionRatio(summarizable.length, 1);
128
- if (dryRun) {
129
- return {
130
- success: true,
131
- summary,
132
- markedForCleanup,
133
- dryRun: true,
134
- compactionRatio
135
- };
136
- }
137
- await appendNode(memoryDir, summary);
138
- const cleanupMarkers = createCleanupMarkers(cleanupNodes, summary.id);
139
- for (const marker of cleanupMarkers) {
140
- await appendNode(memoryDir, marker);
141
- }
142
- return {
143
- success: true,
144
- summary,
145
- markedForCleanup,
146
- compactionRatio
147
- };
148
- }
149
-
150
- export {
151
- summarizeWu
152
- };
@@ -1,280 +0,0 @@
1
- import {
2
- SANDBOX_BACKEND_IDS,
3
- WU_OPTIONS,
4
- buildSandboxProfile,
5
- createLinuxSandboxBackend,
6
- createMacosSandboxBackend,
7
- createWUParser,
8
- createWindowsSandboxBackend,
9
- resolveLocation,
10
- resolveSandboxBackendForPlatform,
11
- runCLI
12
- } from "./chunk-2GXVIN57.js";
13
- import {
14
- readWURaw
15
- } from "./chunk-NRIZR3A7.js";
16
- import {
17
- WU_PATHS,
18
- defaultWorktreeFrom
19
- } from "./chunk-6HO4GWJE.js";
20
- import {
21
- EXIT_CODES,
22
- LOG_PREFIX
23
- } from "./chunk-DWMLTXKQ.js";
24
- import {
25
- WORKSPACE_CONFIG_FILE_NAME,
26
- WORKSPACE_V2_KEYS
27
- } from "./chunk-V6OJGLBA.js";
28
- import {
29
- die
30
- } from "./chunk-RXRKBBSM.js";
31
-
32
- // src/wu-sandbox.ts
33
- import { existsSync, readFileSync } from "fs";
34
- import path from "path";
35
- import { spawn } from "child_process";
36
- import { parse as parseYaml } from "yaml";
37
- var PREFIX = LOG_PREFIX.CLAIM.replace("wu-claim", "wu:sandbox");
38
- var DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR = "LUMENFLOW_SANDBOX_ALLOW_UNSANDBOXED";
39
- var SOFTWARE_DELIVERY_KEY = WORKSPACE_V2_KEYS.SOFTWARE_DELIVERY;
40
- function toNormalizedAbsolute(targetPath) {
41
- const normalized = path.resolve(targetPath);
42
- return normalized.length > 1 && normalized.endsWith(path.sep) ? normalized.slice(0, -1) : normalized;
43
- }
44
- function isWithinRoot(candidatePath, rootPath) {
45
- const candidateKey = process.platform === "win32" ? candidatePath.toLowerCase() : candidatePath;
46
- const rootKey = process.platform === "win32" ? rootPath.toLowerCase() : rootPath;
47
- return candidateKey === rootKey || candidateKey.startsWith(`${rootKey}${path.sep}`);
48
- }
49
- function parsePolicyConfig(value) {
50
- if (!value || typeof value !== "object") {
51
- return {};
52
- }
53
- return value;
54
- }
55
- function readWorkspaceSoftwareDelivery(projectRoot) {
56
- const configPath = path.join(projectRoot, WORKSPACE_CONFIG_FILE_NAME);
57
- if (!existsSync(configPath)) {
58
- return null;
59
- }
60
- try {
61
- const parsed = parseYaml(readFileSync(configPath, "utf8"));
62
- if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
63
- return null;
64
- }
65
- const workspace = parsed;
66
- const softwareDelivery = workspace[SOFTWARE_DELIVERY_KEY];
67
- if (!softwareDelivery || typeof softwareDelivery !== "object" || Array.isArray(softwareDelivery)) {
68
- return null;
69
- }
70
- return softwareDelivery;
71
- } catch {
72
- return null;
73
- }
74
- }
75
- function readSandboxPolicy(projectRoot) {
76
- const softwareDelivery = readWorkspaceSoftwareDelivery(projectRoot);
77
- if (!softwareDelivery) {
78
- return {
79
- allowUnsandboxedEnvVar: DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR,
80
- extraWritableRoots: [],
81
- denyWritableRoots: []
82
- };
83
- }
84
- const sandbox = parsePolicyConfig(softwareDelivery.sandbox);
85
- const allowUnsandboxedEnvVar = typeof sandbox.allow_unsandboxed_fallback_env === "string" && sandbox.allow_unsandboxed_fallback_env.trim() !== "" ? sandbox.allow_unsandboxed_fallback_env.trim() : DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR;
86
- const extraWritableRoots = Array.isArray(sandbox.extra_writable_roots) ? sandbox.extra_writable_roots.filter((value) => typeof value === "string") : [];
87
- const denyWritableRoots = Array.isArray(sandbox.deny_writable_roots) ? sandbox.deny_writable_roots.filter((value) => typeof value === "string") : [];
88
- return {
89
- allowUnsandboxedEnvVar,
90
- extraWritableRoots,
91
- denyWritableRoots
92
- };
93
- }
94
- function extractSandboxCommandFromArgv(argv) {
95
- const separator = argv.indexOf("--");
96
- if (separator === -1 || separator === argv.length - 1) {
97
- return [];
98
- }
99
- return argv.slice(separator + 1);
100
- }
101
- function parseWuSandboxOptions(argv = process.argv) {
102
- const opts = createWUParser({
103
- name: "wu-sandbox",
104
- description: "Execute a command through the sandbox backend for this platform",
105
- options: [WU_OPTIONS.id, WU_OPTIONS.worktree],
106
- required: ["id"],
107
- allowPositionalId: true
108
- });
109
- const command = extractSandboxCommandFromArgv(argv);
110
- return {
111
- id: String(opts.id).toUpperCase(),
112
- worktree: opts.worktree,
113
- command
114
- };
115
- }
116
- function resolveCandidateRoots(projectRoot, policy) {
117
- const deniedRoots = policy.denyWritableRoots.map(
118
- (entry) => path.isAbsolute(entry) ? toNormalizedAbsolute(entry) : toNormalizedAbsolute(path.join(projectRoot, entry))
119
- );
120
- const extras = policy.extraWritableRoots.map(
121
- (entry) => path.isAbsolute(entry) ? toNormalizedAbsolute(entry) : toNormalizedAbsolute(path.join(projectRoot, entry))
122
- );
123
- return extras.filter((extra) => !deniedRoots.some((denied) => isWithinRoot(extra, denied)));
124
- }
125
- function resolveWorktreeFromWu(projectRoot, wuId) {
126
- const wuPath = path.join(projectRoot, WU_PATHS.WU(wuId));
127
- if (!existsSync(wuPath)) {
128
- return null;
129
- }
130
- try {
131
- const doc = readWURaw(wuPath);
132
- const defaultWorktree = defaultWorktreeFrom(doc);
133
- return defaultWorktree ? path.resolve(projectRoot, defaultWorktree) : null;
134
- } catch {
135
- return null;
136
- }
137
- }
138
- async function resolveWorktreePath(projectRoot, wuId, explicitWorktree, cwd) {
139
- if (explicitWorktree) {
140
- return path.isAbsolute(explicitWorktree) ? path.resolve(explicitWorktree) : path.resolve(projectRoot, explicitWorktree);
141
- }
142
- const location = await resolveLocation(cwd);
143
- if (location.type === "worktree") {
144
- return path.resolve(location.gitRoot);
145
- }
146
- const fromWu = resolveWorktreeFromWu(projectRoot, wuId);
147
- if (fromWu) {
148
- return fromWu;
149
- }
150
- die(
151
- `Unable to determine worktree path for ${wuId}.
152
- Run from the claimed worktree or provide --worktree <path>.`
153
- );
154
- }
155
- function createBackendForCurrentPlatform() {
156
- const resolution = resolveSandboxBackendForPlatform();
157
- if (!resolution.supported) {
158
- return null;
159
- }
160
- if (resolution.id === SANDBOX_BACKEND_IDS.LINUX) {
161
- return createLinuxSandboxBackend();
162
- }
163
- if (resolution.id === SANDBOX_BACKEND_IDS.MACOS) {
164
- return createMacosSandboxBackend();
165
- }
166
- if (resolution.id === SANDBOX_BACKEND_IDS.WINDOWS) {
167
- return createWindowsSandboxBackend();
168
- }
169
- return null;
170
- }
171
- function resolveAllowUnsandboxedFallback(env, envVarName) {
172
- return env[envVarName] === "1";
173
- }
174
- async function buildSandboxExecution(input) {
175
- const cwd = input.cwd || process.cwd();
176
- const location = await resolveLocation(cwd);
177
- const projectRoot = path.resolve(location.mainCheckout || cwd);
178
- const policy = readSandboxPolicy(projectRoot);
179
- const extraWritableRoots = resolveCandidateRoots(projectRoot, policy);
180
- const worktreePath = await resolveWorktreePath(projectRoot, input.id, input.worktree, cwd);
181
- const allowUnsandboxedFallback = resolveAllowUnsandboxedFallback(
182
- process.env,
183
- policy.allowUnsandboxedEnvVar
184
- );
185
- const profile = buildSandboxProfile({
186
- projectRoot,
187
- worktreePath,
188
- wuId: input.id,
189
- extraWritableRoots
190
- });
191
- const backend = createBackendForCurrentPlatform();
192
- if (!backend) {
193
- const unsupportedPlan = allowUnsandboxedFallback ? {
194
- backendId: SANDBOX_BACKEND_IDS.UNSUPPORTED,
195
- enforced: false,
196
- failClosed: false,
197
- warning: "Running unsandboxed because this platform does not have a hardened sandbox backend."
198
- } : {
199
- backendId: SANDBOX_BACKEND_IDS.UNSUPPORTED,
200
- enforced: false,
201
- failClosed: true,
202
- reason: `No hardened sandbox backend is available for this platform. Set ${policy.allowUnsandboxedEnvVar}=1 to allow explicit unsandboxed fallback.`
203
- };
204
- return {
205
- profile,
206
- plan: unsupportedPlan,
207
- worktreePath,
208
- policy,
209
- allowUnsandboxedFallback
210
- };
211
- }
212
- const plan = backend.resolveExecution({
213
- profile,
214
- command: input.command,
215
- allowUnsandboxedFallback
216
- });
217
- return {
218
- profile,
219
- plan,
220
- worktreePath,
221
- policy,
222
- allowUnsandboxedFallback
223
- };
224
- }
225
- async function runCommand(command, args, cwd) {
226
- return new Promise((resolve, reject) => {
227
- const child = spawn(command, args, {
228
- cwd,
229
- stdio: "inherit",
230
- env: process.env
231
- });
232
- child.on("error", reject);
233
- child.on("exit", (code, signal) => {
234
- if (signal) {
235
- resolve(EXIT_CODES.ERROR);
236
- } else {
237
- resolve(code ?? EXIT_CODES.ERROR);
238
- }
239
- });
240
- });
241
- }
242
- async function runWuSandbox(input) {
243
- if (!input.command || input.command.length === 0) {
244
- die("No command provided. Usage: pnpm wu:sandbox --id WU-XXXX -- <command> [args...]");
245
- }
246
- const { plan, worktreePath, policy } = await buildSandboxExecution(input);
247
- if (plan.failClosed) {
248
- die(
249
- `${plan.reason || "Sandbox backend failed closed."}
250
- To allow explicit unsandboxed fallback for this command, set ${policy.allowUnsandboxedEnvVar}=1.`
251
- );
252
- }
253
- if (plan.warning) {
254
- console.warn(`${PREFIX} Warning: ${plan.warning}`);
255
- }
256
- const commandToRun = plan.enforced && plan.invocation ? plan.invocation.command : input.command[0];
257
- const commandArgs = plan.enforced && plan.invocation ? plan.invocation.args : input.command.slice(1);
258
- if (plan.enforced) {
259
- console.log(`${PREFIX} Running command with ${plan.backendId} sandbox backend.`);
260
- } else {
261
- console.log(`${PREFIX} Running command unsandboxed (explicit fallback).`);
262
- }
263
- return runCommand(commandToRun, commandArgs, worktreePath);
264
- }
265
- async function main() {
266
- const options = parseWuSandboxOptions(process.argv);
267
- const exitCode = await runWuSandbox(options);
268
- process.exit(exitCode);
269
- }
270
- if (import.meta.main) {
271
- void runCLI(main);
272
- }
273
-
274
- export {
275
- readSandboxPolicy,
276
- extractSandboxCommandFromArgv,
277
- resolveAllowUnsandboxedFallback,
278
- runWuSandbox,
279
- main
280
- };