@monoes/monomindcli 2.11.0 → 2.11.2

package/dist/src/orgrt/reporting.js

@@ -136,9 +136,19 @@ export function readHistory(cwd, org) {
     })
         .filter((s) => s !== null);
 }
+// Human-facing times are rendered in UTC; the trailing Z says so, so operators
+// and agents on other zones don't read them as local time (#253).
+/** `HH:MM:SSZ` */
+export function utcTime(ts) {
+    return `${new Date(ts).toISOString().slice(11, 19)}Z`;
+}
+/** `YYYY-MM-DD HH:MMZ` */
+export function utcDateMinute(ts) {
+    return `${new Date(ts).toISOString().replace('T', ' ').slice(0, 16)}Z`;
+}
 /** One bus event as a compact human-readable log line. */
 export function formatEvent(e) {
-    const t = new Date(e.ts).toISOString().slice(11, 19);
+    const t = utcTime(e.ts);
     const from = e.from ?? '·';
     switch (e.type) {
         case 'message':

package/dist/src/orgrt/reporting.js.map

@@ -1 +1 @@
-{"version":3,"file":"reporting.js","sourceRoot":"","sources":["../../../src/orgrt/reporting.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA8BrC,MAAM,SAAS,GAAG,GAAc,EAAE,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC;IACf,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,CAAC,GAAe;QACpB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE;QACzB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAC;IACF,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,IAAI,GAAG,CAAC,EAAsB,EAAa,EAAE;QACjD,MAAM,GAAG,GAAG,EAAE,IAAI,UAAU,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC5B,MAAM;YACR,KAAK,MAAM;gBACT,CAAC,CAAC,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC3E,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;oBAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;;oBACjD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBACjC,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChE,MAAM;YACR,KAAK,OAAO,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,MAAM,CAAE,CAAC,CAAC,IAAwC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;gBAChF,MAAM,IAAI,GAAG,MAAM,CAAE,CAAC,CAAC,IAA0C,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;gBAClF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;gBACnB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;oBAClB,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC;gBACzB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,OAAO;gBACV,IAAI,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACvB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC9B,CAAC;gBACD,MAAM;YACR,KAAK,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,CAAC,MAAM,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBAChD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAC,IAA0D,CAAC;gBACvE,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,EAAE,OAAO;oBAC3C,CAAC,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBAChF,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACnC,IAAI,EAAE;SACN,OAAO,EAAE,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;IACjE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAa,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,WAAW,CAAC,CAAW;IACrC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;IAC3B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACxG,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9F,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,OAAO,IAAI,KAAM,CAAC,CAAC,IAAwC,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC;QAC/F,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvD,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C;YACE,OAAO,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,CAAC,GAAG,GAAG,EAAU,EAAE;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC,CAAC"}
+{"version":3,"file":"reporting.js","sourceRoot":"","sources":["../../../src/orgrt/reporting.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA8BrC,MAAM,SAAS,GAAG,GAAc,EAAE,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC;IACf,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,CAAC,GAAe;QACpB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE;QACzB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAC;IACF,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,IAAI,GAAG,CAAC,EAAsB,EAAa,EAAE;QACjD,MAAM,GAAG,GAAG,EAAE,IAAI,UAAU,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC5B,MAAM;YACR,KAAK,MAAM;gBACT,CAAC,CAAC,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC3E,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;oBAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;;oBACjD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBACjC,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChE,MAAM;YACR,KAAK,OAAO,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,MAAM,CAAE,CAAC,CAAC,IAAwC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;gBAChF,MAAM,IAAI,GAAG,MAAM,CAAE,CAAC,CAAC,IAA0C,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;gBAClF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;gBACnB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;oBAClB,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC;gBACzB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,OAAO;gBACV,IAAI,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACvB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC9B,CAAC;gBACD,MAAM;YACR,KAAK,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,CAAC,MAAM,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBAChD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAC,IAA0D,CAAC;gBACvE,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,EAAE,OAAO;oBAC3C,CAAC,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBAChF,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACnC,IAAI,EAAE;SACN,OAAO,EAAE,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;IACjE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAa,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,kEAAkE;AAClE,kBAAkB;AAClB,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;AACxD,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AACzE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,WAAW,CAAC,CAAW;IACrC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;IAC3B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACxG,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9F,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,OAAO,IAAI,KAAM,CAAC,CAAC,IAAwC,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC;QAC/F,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvD,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C;YACE,OAAO,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,CAAC,GAAG,GAAG,EAAU,EAAE;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC,CAAC"}

package/dist/src/orgrt/role-sandbox.d.ts

@@ -0,0 +1,87 @@
+/**
+ * OS-level enforcement of `policy.git` for claude-runtime roles (#258).
+ *
+ * The Claude Agent SDK can run the Bash tool inside an OS sandbox (bubblewrap
+ * + socat on Linux, seatbelt on macOS). For roles below 'push' this module
+ * builds that sandbox so the level holds even against a role that bypasses
+ * the git guard env (git-guard.ts):
+ *   - writes: the role's cwd, the org root, $HOME and the temp dir stay
+ *     writable (installs, caches, test fixtures), minus the protected git dir
+ *     ('read'/'none') or its config + hooks ('commit'), the guard's hooks,
+ *     local-path remotes, and git/shell/Claude config that would undo the guard;
+ *   - network: every host allowed (`policy.sandbox.allowedDomains`, default
+ *     ['*']) minus the opt-in `policy.sandbox.deniedDomains`, deterministically,
+ *     with local binding kept for dev servers and tests. Git remote hosts are
+ *     not denied: read roles fetch, ls-remote and clone, and a forge's API
+ *     would stay reachable anyway — the push barrier is withheld credentials;
+ *   - reads of credential files (ssh keys, git-credentials, gh login, netrc).
+ * Bash stays gated by canUseTool (autoAllowBashIfSandboxed: false) and
+ * dangerouslyDisableSandbox is ignored (allowUnsandboxedCommands: false).
+ * Write/Edit/Read run in-process, outside the sandbox, so matching permission
+ * deny rules (`disallowedTools`) cover them — those need no sandbox at all.
+ *
+ * Availability (`policy.sandbox.mode`):
+ *   'auto' (default) — sandbox when bwrap/socat (or seatbelt) are present;
+ *                      otherwise run without it and emit a
+ *                      `git-sandbox-unavailable` audit event (fail open, loud).
+ *   'required'       — fail closed: the session refuses to start.
+ *   'off'            — no sandbox; `git-sandbox-off` audit event.
+ * `monomind org validate` reports the same findings before a run.
+ */
+import type { OrgBus } from './bus.js';
+import { type GitGuard } from './git-guard.js';
+import type { OrgDef, OrgRole } from './types.js';
+export interface RoleSandboxPolicy {
+    mode?: 'auto' | 'required' | 'off';
+    allowedDomains?: string[];
+    deniedDomains?: string[];
+    allowWrite?: string[];
+    allowUnixSockets?: boolean;
+}
+/** What ClaudeAgentRunner merges into the SDK's query() options. */
+export interface ClaudeRestrictions {
+    sandbox?: Record<string, unknown>;
+    disallowedTools: string[];
+}
+export interface SandboxAvailability {
+    available: boolean;
+    reason?: string;
+}
+/** Whether the SDK sandbox can start for a CLI spawned with `env`. Mirrors the
+ *  SDK's own dependency check, so 'auto' can decide before query() fails. */
+export declare function sandboxAvailability(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SandboxAvailability;
+export declare function buildClaudeRestrictions(guard: GitGuard, cfg: RoleSandboxPolicy | undefined, ctx: {
+    cwd: string;
+    orgRoot?: string;
+    home?: string;
+    tmp?: string;
+    env?: NodeJS.ProcessEnv;
+}, sandboxEnabled: boolean): ClaudeRestrictions;
+/**
+ * Per-session enforcement for one role: the git guard env (every runtime) and,
+ * for the Claude runtime, the SDK restrictions. Throws when
+ * policy.sandbox.mode is 'required' and the sandbox cannot start.
+ */
+export declare function resolveRoleGitEnforcement(args: {
+    org: string;
+    role: OrgRole;
+    cwd: string;
+    orgRoot?: string;
+    orgDir?: string;
+    bus: OrgBus;
+    claudeRuntime: boolean;
+    runtime?: string;
+    availability?: SandboxAvailability;
+    /** Defaults to process.env; injectable for tests. */
+    env?: NodeJS.ProcessEnv;
+}): {
+    env: Record<string, string>;
+    claudeRestrictions?: ClaudeRestrictions;
+};
+/** `monomind org validate` findings: roles whose policy.git will not have the
+ *  OS sandbox behind it on this host. */
+export declare function gitEnforcementFindings(def: OrgDef, availability?: SandboxAvailability): {
+    warnings: string[];
+    errors: string[];
+};
+//# sourceMappingURL=role-sandbox.d.ts.map

package/dist/src/orgrt/role-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-sandbox.d.ts","sourceRoot":"","sources":["../../../src/orgrt/role-sandbox.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,OAAO,EACL,KAAK,QAAQ,EAKd,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD;6EAC6E;AAC7E,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,mBAAmB,CAmBrB;AAoFD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,QAAQ,EACf,GAAG,EAAE,iBAAiB,GAAG,SAAS,EAClC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,EAC5F,cAAc,EAAE,OAAO,GACtB,kBAAkB,CAoDpB;AAmBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CAAE,CA4G3E;AAQD;yCACyC;AACzC,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,YAAY,GAAE,mBAA2C,GACxD;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA6C1C"}

package/dist/src/orgrt/role-sandbox.js

@@ -0,0 +1,342 @@
+// packages/@monomind/cli/src/orgrt/role-sandbox.ts
+/**
+ * OS-level enforcement of `policy.git` for claude-runtime roles (#258).
+ *
+ * The Claude Agent SDK can run the Bash tool inside an OS sandbox (bubblewrap
+ * + socat on Linux, seatbelt on macOS). For roles below 'push' this module
+ * builds that sandbox so the level holds even against a role that bypasses
+ * the git guard env (git-guard.ts):
+ *   - writes: the role's cwd, the org root, $HOME and the temp dir stay
+ *     writable (installs, caches, test fixtures), minus the protected git dir
+ *     ('read'/'none') or its config + hooks ('commit'), the guard's hooks,
+ *     local-path remotes, and git/shell/Claude config that would undo the guard;
+ *   - network: every host allowed (`policy.sandbox.allowedDomains`, default
+ *     ['*']) minus the opt-in `policy.sandbox.deniedDomains`, deterministically,
+ *     with local binding kept for dev servers and tests. Git remote hosts are
+ *     not denied: read roles fetch, ls-remote and clone, and a forge's API
+ *     would stay reachable anyway — the push barrier is withheld credentials;
+ *   - reads of credential files (ssh keys, git-credentials, gh login, netrc).
+ * Bash stays gated by canUseTool (autoAllowBashIfSandboxed: false) and
+ * dangerouslyDisableSandbox is ignored (allowUnsandboxedCommands: false).
+ * Write/Edit/Read run in-process, outside the sandbox, so matching permission
+ * deny rules (`disallowedTools`) cover them — those need no sandbox at all.
+ *
+ * Availability (`policy.sandbox.mode`):
+ *   'auto' (default) — sandbox when bwrap/socat (or seatbelt) are present;
+ *                      otherwise run without it and emit a
+ *                      `git-sandbox-unavailable` audit event (fail open, loud).
+ *   'required'       — fail closed: the session refuses to start.
+ *   'off'            — no sandbox; `git-sandbox-off` audit event.
+ * `monomind org validate` reports the same findings before a run.
+ */
+import { accessSync, constants, existsSync, readdirSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { delimiter, isAbsolute, join } from 'node:path';
+import { CLI_SANDBOX_MODES } from './cli-sandbox.js';
+import { gitCommonDir, gitLocalRemotePaths, prepareGitGuard, } from './git-guard.js';
+function onPath(bin, env) {
+    for (const dir of (env.PATH ?? '').split(delimiter)) {
+        if (!dir)
+            continue;
+        try {
+            accessSync(join(dir, bin), constants.X_OK);
+            return true;
+        }
+        catch {
+            /* not here */
+        }
+    }
+    return false;
+}
+/** Whether the SDK sandbox can start for a CLI spawned with `env`. Mirrors the
+ *  SDK's own dependency check, so 'auto' can decide before query() fails. */
+export function sandboxAvailability(env = process.env, platform = process.platform) {
+    if (platform === 'linux') {
+        const missing = ['bwrap', 'socat'].filter((b) => !onPath(b, env));
+        return missing.length
+            ? {
+                available: false,
+                reason: `${missing.join(' and ')} not found on PATH (install bubblewrap and socat)`,
+            }
+            : { available: true };
+    }
+    if (platform === 'darwin') {
+        try {
+            accessSync('/usr/bin/sandbox-exec', constants.X_OK);
+            return { available: true };
+        }
+        catch {
+            return { available: false, reason: '/usr/bin/sandbox-exec not found' };
+        }
+    }
+    return { available: false, reason: `the SDK sandbox is not supported on ${platform}` };
+}
+/** Files under $HOME that would undo the guard (git/shell/Claude config) —
+ *  writable $HOME must not include them. */
+const HOME_DENY_WRITE = [
+    '.gitconfig',
+    '.config/git',
+    '.ssh',
+    '.config/gh',
+    '.bashrc',
+    '.bash_profile',
+    '.bash_login',
+    '.profile',
+    '.zshrc',
+    '.zprofile',
+    '.zshenv',
+    '.zlogin',
+    '.claude',
+    '.claude.json',
+];
+/** Credential stores sandboxed commands may not read. */
+const HOME_DENY_READ = [
+    '.ssh',
+    '.git-credentials',
+    '.config/git/credentials',
+    '.config/gh',
+    '.netrc',
+];
+/** Sockets and runtime dirs a role must not reach. The XDG runtime dir is the
+ *  important one: it carries the session D-Bus, and through it the login
+ *  keyring — `gh auth token` returns the operator's GitHub token from there,
+ *  which is a push credential (verified inside the real sandbox). It is denied
+ *  whether or not unix sockets are allowed, because it holds credential files
+ *  too, and the SDK's own default deny of /run/user does not survive passing
+ *  our own `filesystem` block. */
+const DAEMON_SOCKETS = [
+    '/run/dbus',
+    '/run/docker.sock',
+    '/var/run/docker.sock',
+    '/run/podman/podman.sock',
+    '/run/containerd/containerd.sock',
+];
+/** Agent sockets that would hand a role push credentials, plus the X11 socket
+ *  dir (desktop input injection). Only relevant while unix sockets are
+ *  reachable — see `policy.sandbox.allowUnixSockets`, which is true by default
+ *  because Chrome's process singleton needs a socket ("socket() failed:
+ *  Operation not permitted" kills `monomind browse` otherwise). */
+function agentSocketPaths(home, env, tmp) {
+    const paths = [
+        env.SSH_AUTH_SOCK && isAbsolute(env.SSH_AUTH_SOCK) ? env.SSH_AUTH_SOCK : undefined,
+        join(home, '.1password'),
+        '/tmp/.X11-unix',
+        ...DAEMON_SOCKETS,
+    ];
+    for (const dir of [tmp, '/tmp']) {
+        try {
+            for (const e of readdirSync(dir))
+                if (e.startsWith('ssh-'))
+                    paths.push(join(dir, e));
+        }
+        catch {
+            /* unreadable temp dir — nothing to mask there */
+        }
+    }
+    return paths.filter((p) => !!p);
+}
+/** $XDG_RUNTIME_DIR, or the conventional /run/user/<uid> when it is unset. */
+function runtimeDir(env) {
+    if (env.XDG_RUNTIME_DIR && isAbsolute(env.XDG_RUNTIME_DIR))
+        return env.XDG_RUNTIME_DIR;
+    const uid = process.getuid?.();
+    return uid === undefined ? undefined : `/run/user/${uid}`;
+}
+const uniq = (xs) => [
+    ...new Set(xs.filter((x) => !!x)),
+];
+/** Deny entries for paths that don't exist are dropped: the sandbox masks a
+ *  missing path so that access() fails with EACCES instead of ENOENT, and git
+ *  treats an unreadable ~/.gitconfig as fatal — every git command in the role
+ *  would fail (observed against the real SDK sandbox). */
+const existing = (xs) => uniq(xs).filter((p) => existsSync(p));
+/** Permission-rule form of an absolute path (`//abs/path`). */
+const rule = (tool, abs) => `${tool}(/${abs})`;
+export function buildClaudeRestrictions(guard, cfg, ctx, sandboxEnabled) {
+    const home = ctx.home ?? homedir();
+    const tmp = ctx.tmp ?? tmpdir();
+    const unixSockets = cfg?.allowUnixSockets ?? true;
+    const gitDirs = guard.protectedGitDirs;
+    const lockedRepo = guard.level === 'read' || guard.level === 'none';
+    const disallowedTools = [
+        rule('Edit', `${guard.dir}/**`),
+        ...gitDirs.flatMap((d) => lockedRepo
+            ? [rule('Edit', `${d}/**`)]
+            : [rule('Edit', join(d, 'config')), rule('Edit', `${join(d, 'hooks')}/**`)]),
+        ...(guard.level === 'none' ? gitDirs.map((d) => rule('Read', `${d}/**`)) : []),
+    ];
+    if (!sandboxEnabled)
+        return { disallowedTools };
+    const sandbox = {
+        enabled: true,
+        failIfUnavailable: true,
+        autoAllowBashIfSandboxed: false,
+        allowUnsandboxedCommands: false,
+        network: {
+            allowedDomains: cfg?.allowedDomains ?? ['*'],
+            deniedDomains: uniq(cfg?.deniedDomains ?? []),
+            strictAllowlist: true,
+            allowLocalBinding: true,
+            allowAllUnixSockets: unixSockets,
+        },
+        filesystem: {
+            allowWrite: uniq([ctx.cwd, ctx.orgRoot, home, tmp, ...(cfg?.allowWrite ?? [])]),
+            denyWrite: existing([
+                guard.dir,
+                ...(lockedRepo ? gitDirs : gitDirs.flatMap((d) => [join(d, 'config'), join(d, 'hooks')])),
+                ...gitDirs.flatMap(gitLocalRemotePaths),
+                ...HOME_DENY_WRITE.map((p) => join(home, p)),
+            ]),
+            denyRead: existing([
+                ...(guard.level === 'none' ? gitDirs : []),
+                runtimeDir(ctx.env ?? process.env),
+                ...(unixSockets ? agentSocketPaths(home, ctx.env ?? process.env, tmp) : []),
+            ]),
+        },
+        credentials: {
+            files: existing(HOME_DENY_READ.map((p) => join(home, p))).map((path) => ({
+                path,
+                mode: 'deny',
+            })),
+        },
+    };
+    return { sandbox, disallowedTools };
+}
+const audited = new WeakMap();
+function auditOnce(bus, from, reason, msg, data) {
+    const seen = audited.get(bus) ?? new Set();
+    audited.set(bus, seen);
+    if (seen.has(`${from}:${reason}`))
+        return;
+    seen.add(`${from}:${reason}`);
+    bus.emit({ type: 'audit', from, reason, msg, data });
+}
+const safeSegment = (s) => s.replace(/[^A-Za-z0-9_.-]/g, '_');
+/**
+ * Per-session enforcement for one role: the git guard env (every runtime) and,
+ * for the Claude runtime, the SDK restrictions. Throws when
+ * policy.sandbox.mode is 'required' and the sandbox cannot start.
+ */
+export function resolveRoleGitEnforcement(args) {
+    const { role, bus } = args;
+    const level = (role.policy?.git ?? 'read');
+    const stateDir = args.orgDir
+        ? join(args.orgDir, 'git-guard', safeSegment(role.id))
+        : join(tmpdir(), 'monomind-git-guard', safeSegment(args.org), safeSegment(role.id));
+    const build = (excludeSandboxPlaceholders) => prepareGitGuard({
+        level,
+        stateDir,
+        excludeSandboxPlaceholders,
+        protectedGitDirs: uniq([
+            gitCommonDir(args.cwd),
+            args.orgRoot ? gitCommonDir(args.orgRoot) : undefined,
+        ]),
+    });
+    let guard = build(false);
+    if (!guard)
+        return { env: {} };
+    const data = { level, protectedGitDirs: guard.protectedGitDirs };
+    if (!args.claudeRuntime) {
+        const runtime = args.runtime ?? 'non-claude';
+        // #263: codex and grok run their own OS sandbox at the role's level.
+        const cliMode = CLI_SANDBOX_MODES[runtime];
+        if (cliMode) {
+            auditOnce(bus, role.id, 'git-sandbox-cli', `policy.git '${level}' on runtime ${runtime} runs the CLI's own sandbox ('${cliMode}'): writes confined to the role's cwd and temp dir, $HOME and the rest of the filesystem read-only. It has no per-tool gate and no .git deny rules, so git itself still rests on the guard hooks and withheld credentials.`, data);
+        }
+        else {
+            auditOnce(bus, role.id, 'git-sandbox-unsupported-runtime', `policy.git '${level}' on runtime ${runtime} is enforced only by git hooks and withheld credentials — no OS sandbox; a same-user role can bypass them`, data);
+        }
+        // #262: an opencode role that ATTACHES to an already-running server
+        // (OPENCODE_URL) loses the guard env too — that server is the operator's
+        // own process, started before the session and outside its control. Only
+        // the ephemeral server the runner spawns itself receives the env.
+        if (args.runtime === 'opencode' && (args.env ?? process.env).OPENCODE_URL) {
+            auditOnce(bus, role.id, 'git-guard-unapplied', `policy.git '${level}' has NO enforcement for this role: it attaches to the opencode server at OPENCODE_URL, which cannot be given the guard env. Unset OPENCODE_URL so the role spawns its own server.`, data);
+        }
+        return { env: guard.env };
+    }
+    const cfg = role.policy?.sandbox;
+    const mode = cfg?.mode ?? 'auto';
+    let sandboxEnabled = mode !== 'off';
+    if (mode === 'off') {
+        auditOnce(bus, role.id, 'git-sandbox-off', `policy.sandbox.mode 'off': policy.git '${level}' runs without the OS sandbox — git hooks, withheld credentials and file-tool deny rules only`, data);
+    }
+    else {
+        const availability = args.availability ?? sandboxAvailability();
+        if (!availability.available) {
+            if (mode === 'required') {
+                const msg = `policy.sandbox.mode 'required' but the OS sandbox is unavailable (${availability.reason}) — refusing to start role ${role.id}`;
+                auditOnce(bus, role.id, 'git-sandbox-required', msg, data);
+                throw new Error(msg);
+            }
+            auditOnce(bus, role.id, 'git-sandbox-unavailable', `OS sandbox unavailable (${availability.reason}): policy.git '${level}' is enforced only by git hooks, withheld credentials and file-tool deny rules, which a same-user role can bypass. Set policy.sandbox.mode 'required' to refuse to run unsandboxed.`, data);
+            sandboxEnabled = false;
+        }
+    }
+    // The sandbox drops zero-byte placeholder files into the role's cwd; hide
+    // them from git so `git add -A` can't stage them (git-guard.ts).
+    if (sandboxEnabled)
+        guard = build(true) ?? guard;
+    return {
+        // Inside the sandbox all egress goes through the runtime's HTTP proxy,
+        // which node's global fetch() ignores unless this is set — without it
+        // `fetch('https://registry.npmjs.org/…')` in a role's `node -e` fails with
+        // EAI_AGAIN (verified against the real sandbox). Curl, npm and git read the
+        // proxy variables on their own. An operator value always wins.
+        env: {
+            ...guard.env,
+            ...(sandboxEnabled && process.env.NODE_USE_ENV_PROXY === undefined
+                ? { NODE_USE_ENV_PROXY: '1' }
+                : {}),
+        },
+        claudeRestrictions: buildClaudeRestrictions(guard, cfg, { cwd: args.cwd, orgRoot: args.orgRoot }, sandboxEnabled),
+    };
+}
+const PROVIDER_RUNTIME = {
+    'vercel-api-key': 'vercel',
+    codex: 'codex',
+    antigravity: 'antigravity',
+};
+/** `monomind org validate` findings: roles whose policy.git will not have the
+ *  OS sandbox behind it on this host. */
+export function gitEnforcementFindings(def, availability = sandboxAvailability()) {
+    const warnings = [];
+    const errors = [];
+    const unsupported = [];
+    const cliSandboxed = [];
+    const unsandboxed = [];
+    const off = [];
+    for (const role of def.roles) {
+        if (role.kind === 'endpoint')
+            continue;
+        const level = role.policy?.git ?? 'read';
+        if (level === 'push')
+            continue;
+        const runtime = role.runtime ??
+            def.runtime ??
+            PROVIDER_RUNTIME[role.provider?.kind ?? ''] ??
+            process.env.MONOMIND_RUNTIME ??
+            'claude';
+        const mode = role.policy?.sandbox?.mode ?? 'auto';
+        if (CLI_SANDBOX_MODES[runtime])
+            cliSandboxed.push(`${role.id} (${runtime}: ${CLI_SANDBOX_MODES[runtime]})`);
+        else if (runtime !== 'claude')
+            unsupported.push(`${role.id} (${runtime})`);
+        else if (mode === 'off')
+            off.push(role.id);
+        else if (!availability.available && mode === 'required')
+            errors.push(`role ${role.id}: policy.sandbox.mode 'required' but the OS sandbox is unavailable (${availability.reason}) — the role will refuse to start`);
+        else if (!availability.available)
+            unsandboxed.push(role.id);
+    }
+    if (unsupported.length)
+        warnings.push(`policy.git below 'push' has no OS sandbox on these runtimes — enforced only by git hooks and withheld credentials: ${unsupported.join(', ')}`);
+    if (cliSandboxed.length)
+        warnings.push(`policy.git below 'push' runs the CLI's own sandbox on these roles — writes confined, but no per-tool gate and no .git deny rules: ${cliSandboxed.join(', ')}`);
+    if (unsandboxed.length)
+        warnings.push(`OS sandbox unavailable on this host (${availability.reason}) — policy.git for ${unsandboxed.join(', ')} will run without it (set policy.sandbox.mode 'required' to refuse)`);
+    if (off.length)
+        warnings.push(`policy.sandbox.mode 'off' for ${off.join(', ')} — policy.git runs without the OS sandbox`);
+    return { warnings, errors };
+}
+//# sourceMappingURL=role-sandbox.js.map

package/dist/src/orgrt/role-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-sandbox.js","sourceRoot":"","sources":["../../../src/orgrt/role-sandbox.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAGL,YAAY,EACZ,mBAAmB,EACnB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAsBxB,SAAS,MAAM,CAAC,GAAW,EAAE,GAAsB;IACjD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,mBAAmB,CACjC,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC,MAAM;YACnB,CAAC,CAAC;gBACE,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mDAAmD;aACpF;YACH,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,UAAU,CAAC,uBAAuB,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,QAAQ,EAAE,EAAE,CAAC;AACzF,CAAC;AAED;4CAC4C;AAC5C,MAAM,eAAe,GAAG;IACtB,YAAY;IACZ,aAAa;IACb,MAAM;IACN,YAAY;IACZ,SAAS;IACT,eAAe;IACf,aAAa;IACb,UAAU;IACV,QAAQ;IACR,WAAW;IACX,SAAS;IACT,SAAS;IACT,SAAS;IACT,cAAc;CACf,CAAC;AACF,yDAAyD;AACzD,MAAM,cAAc,GAAG;IACrB,MAAM;IACN,kBAAkB;IAClB,yBAAyB;IACzB,YAAY;IACZ,QAAQ;CACT,CAAC;AAEF;;;;;;kCAMkC;AAClC,MAAM,cAAc,GAAG;IACrB,WAAW;IACX,kBAAkB;IAClB,sBAAsB;IACtB,yBAAyB;IACzB,iCAAiC;CAClC,CAAC;AAEF;;;;mEAImE;AACnE,SAAS,gBAAgB,CAAC,IAAY,EAAE,GAAsB,EAAE,GAAW;IACzE,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,aAAa,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAClF,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACxB,gBAAgB;QAChB,GAAG,cAAc;KAClB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,GAAsB;IACxC,IAAI,GAAG,CAAC,eAAe,IAAI,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,GAAG,CAAC,eAAe,CAAC;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,EAA6B,EAAY,EAAE,CAAC;IACxD,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/C,CAAC;AACF;;;0DAG0D;AAC1D,MAAM,QAAQ,GAAG,CAAC,EAA6B,EAAY,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACpG,+DAA+D;AAC/D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,GAAG,GAAG,CAAC;AAE/D,MAAM,UAAU,uBAAuB,CACrC,KAAe,EACf,GAAkC,EAClC,GAA4F,EAC5F,cAAuB;IAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,GAAG,EAAE,gBAAgB,IAAI,IAAI,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC;IAEpE,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;QAC/B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACvB,UAAU;YACR,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAC9E;QACD,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;IACF,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAEhD,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,IAAI;QACb,iBAAiB,EAAE,IAAI;QACvB,wBAAwB,EAAE,KAAK;QAC/B,wBAAwB,EAAE,KAAK;QAC/B,OAAO,EAAE;YACP,cAAc,EAAE,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,CAAC;YAC5C,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC;YAC7C,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,IAAI;YACvB,mBAAmB,EAAE,WAAW;SACjC;QACD,UAAU,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/E,SAAS,EAAE,QAAQ,CAAC;gBAClB,KAAK,CAAC,GAAG;gBACT,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBACzF,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBACvC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;aAC7C,CAAC;YACF,QAAQ,EAAE,QAAQ,CAAC;gBACjB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;gBAClC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;SACH;QACD,WAAW,EAAE;YACX,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI;gBACJ,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;SACJ;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuB,CAAC;AACnD,SAAS,SAAS,CAChB,GAAW,EACX,IAAY,EACZ,MAAc,EACd,GAAW,EACX,IAA6B;IAE7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;QAAE,OAAO;IAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC;IAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAEtE;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAYzC;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAa,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM;QAC1B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,CAAC,0BAAmC,EAAE,EAAE,CACpD,eAAe,CAAC;QACd,KAAK;QACL,QAAQ;QACR,0BAA0B;QAC1B,gBAAgB,EAAE,IAAI,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SACtD,CAAC;KACH,CAAC,CAAC;IACL,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAEjE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC;QAC7C,qEAAqE;QACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,CACP,GAAG,EACH,IAAI,CAAC,EAAE,EACP,iBAAiB,EACjB,eAAe,KAAK,gBAAgB,OAAO,iCAAiC,OAAO,4NAA4N,EAC/S,IAAI,CACL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CACP,GAAG,EACH,IAAI,CAAC,EAAE,EACP,iCAAiC,EACjC,eAAe,KAAK,gBAAgB,OAAO,2GAA2G,EACtJ,IAAI,CACL,CAAC;QACJ,CAAC;QACD,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC;YAC1E,SAAS,CACP,GAAG,EACH,IAAI,CAAC,EAAE,EACP,qBAAqB,EACrB,eAAe,KAAK,oLAAoL,EACxM,IAAI,CACL,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,OAAwC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,MAAM,CAAC;IACjC,IAAI,cAAc,GAAG,IAAI,KAAK,KAAK,CAAC;IACpC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,SAAS,CACP,GAAG,EACH,IAAI,CAAC,EAAE,EACP,iBAAiB,EACjB,0CAA0C,KAAK,+FAA+F,EAC9I,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;QAChE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,qEAAqE,YAAY,CAAC,MAAM,8BAA8B,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC5I,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,SAAS,CACP,GAAG,EACH,IAAI,CAAC,EAAE,EACP,yBAAyB,EACzB,2BAA2B,YAAY,CAAC,MAAM,kBAAkB,KAAK,qLAAqL,EAC1P,IAAI,CACL,CAAC;YACF,cAAc,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI,cAAc;QAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;IACjD,OAAO;QACL,uEAAuE;QACvE,sEAAsE;QACtE,2EAA2E;QAC3E,4EAA4E;QAC5E,+DAA+D;QAC/D,GAAG,EAAE;YACH,GAAG,KAAK,CAAC,GAAG;YACZ,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,SAAS;gBAChE,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE;gBAC7B,CAAC,CAAC,EAAE,CAAC;SACR;QACD,kBAAkB,EAAE,uBAAuB,CACzC,KAAK,EACL,GAAG,EACH,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EACxC,cAAc,CACf;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAA2B;IAC/C,gBAAgB,EAAE,QAAQ;IAC1B,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF;yCACyC;AACzC,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,YAAY,GAAwB,mBAAmB,EAAE;IAEzD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAK,IAA0B,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC;QACzC,IAAI,KAAK,KAAK,MAAM;YAAE,SAAS;QAC/B,MAAM,OAAO,GACX,IAAI,CAAC,OAAO;YACZ,GAAG,CAAC,OAAO;YACX,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAC5B,QAAQ,CAAC;QACX,MAAM,IAAI,GAAI,IAAI,CAAC,MAAM,EAAE,OAAyC,EAAE,IAAI,IAAI,MAAM,CAAC;QACrF,IAAI,iBAAiB,CAAC,OAAO,CAAC;YAC5B,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,OAAO,KAAK,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;aACzE,IAAI,OAAO,KAAK,QAAQ;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,OAAO,GAAG,CAAC,CAAC;aACtE,IAAI,IAAI,KAAK,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aACtC,IAAI,CAAC,YAAY,CAAC,SAAS,IAAI,IAAI,KAAK,UAAU;YACrD,MAAM,CAAC,IAAI,CACT,QAAQ,IAAI,CAAC,EAAE,uEAAuE,YAAY,CAAC,MAAM,mCAAmC,CAC7I,CAAC;aACC,IAAI,CAAC,YAAY,CAAC,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,WAAW,CAAC,MAAM;QACpB,QAAQ,CAAC,IAAI,CACX,sHAAsH,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/I,CAAC;IACJ,IAAI,YAAY,CAAC,MAAM;QACrB,QAAQ,CAAC,IAAI,CACX,qIAAqI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/J,CAAC;IACJ,IAAI,WAAW,CAAC,MAAM;QACpB,QAAQ,CAAC,IAAI,CACX,wCAAwC,YAAY,CAAC,MAAM,sBAAsB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAC7K,CAAC;IACJ,IAAI,GAAG,CAAC,MAAM;QACZ,QAAQ,CAAC,IAAI,CACX,iCAAiC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAC3F,CAAC;IACJ,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/src/orgrt/session.d.ts

@@ -15,7 +15,14 @@ import type { OrgDef, OrgRole } from './types.js';
  */
 export declare function resolveRoleExtraGuidance(role: OrgRole): string | undefined;
 /** Resolve the model string for a role: explicit adapter_config.model wins;
- *  otherwise fall back to the vendor/runtime default. */
+ *  otherwise fall back to the vendor/runtime default.
+ *
+ *  Vendor defaults are read straight off VERCEL_PROVIDERS, which already
+ *  carries a defaultModel per vendor. A second hand-kept table lived here and
+ *  restated all sixteen of them — two lists of per-vendor defaults that would
+ *  eventually disagree, which is precisely the drift #252 was. An empty
+ *  registry default (openai-compatible, which serves arbitrary endpoints) is
+ *  falsy and so falls through to the runtime switch, as it always did. */
 export declare function resolveModel(role: OrgRole, runtime?: string, vendor?: string): string;
 export type DeliverFn = (from: string, to: string, subject: string, body: string) => Promise<string>;
 /** The SDK's `canUseTool` gate, composed from two independent layers: PolicyEngine's
@@ -128,12 +135,16 @@ export interface SessionOpts {
      *  session.ts builds a ClaudeAgentRunner from queryFn (or the default),
      *  preserving the previous Claude-only behaviour exactly. */
     runner?: AgentRunner;
-    /** Caller-owned cancellation handle for THIS incarnation. When supplied,
-     *  runAgentSession uses it instead of creating its own internal
-     *  AbortController — lets the daemon force-stop a specific incarnation
-     *  (mid-run role replacement's forced-stop step) without reaching into
-     *  runAgentSession's internals. */
+    /** Caller-owned cancellation handle for THIS incarnation. Every session
+     *  attempt runs on its own AbortController linked to this one: aborting it
+     *  aborts the in-flight attempt, which lets the daemon force-stop a specific
+     *  incarnation (org stop, mid-run role replacement's forced-stop step)
+     *  without reaching into runAgentSession's internals. An attempt's own abort
+     *  (the silent-stream kill) never propagates back to it (#256). */
     externalAbort?: AbortController;
+    /** Override how long a session's first stream pull may stay silent before
+     *  the attempt is aborted and retried (tests only; default 4 minutes). */
+    silentSessionMs?: number;
     /** ID of the last message received by this agent (for threading responses). Function to ensure live reading. */
     lastMessageId?: () => string | undefined;
     /** Callback for each output line — feeds ScrollbackBuffer. */

package/dist/src/orgrt/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/orgrt/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,KAAK,EAAgB,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAalD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAa1E;AAuBD;yDACyD;AACzD,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAuBrF;AAED,MAAM,MAAM,SAAS,GAAG,CACtB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB;;;;;;;+DAO+D;AAC/D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,EACrC,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,SAAS;AACjB;4EAC4E;AAC5E,MAAM,CAAC,EAAE,CACP,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,KAC9C,IAAI;AACT;;;;;0DAK0D;AAC1D,cAAc,CAAC,EAAE,MAAM,OAAO,GAC7B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAkDzE;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;8DAE0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;2EAEuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;mDAE+C;IAC/C,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,KAAK,IAAI,IAAI,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IACvF,OAAO,EAAE,SAAS,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjG;;6CAEyC;IACzC,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,KACE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;mEAC+D;IAC/D,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,wEAAwE;IACxE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,oGAAoG;IACpG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtF,iFAAiF;IACjF,KAAK,CAAC,EAAE,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QACP,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAChE,KAAK,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACrF,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC9C,KACE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kFAAkF;IAClF,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE;;;4EAGwE;IACxE,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC7B;8DAC0D;IAC1D,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvE;;6DAEyD;IACzD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;;iEAE6D;IAC7D,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;uCAImC;IACnC,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,gHAAgH;IAChH,aAAa,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,sFAAsF;IACtF,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC;;yEAEqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4CAA4C;IAC5C,cAAc,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACtF,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,kDAAkD;IAClD,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,iDAAiD;IACjD,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IACvF,0CAA0C;IAC1C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACzE,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,CACV,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,KAC5C,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACzE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACvE;;;6EAGyE;IACzE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACxF,SAAS,CAAC,EAAE,CACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,KACzE,MAAM,CAAC;CACb;AAED;;;;;sEAKsE;AACtE,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,EAClC,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,aAAa,CAAC,EAAE,MAAM;AACtB,0EAA0E;AAC1E,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAC1B,MAAM,CA8BR;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtE;AAgfD;;;;;;kFAMkF;AAClF,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,EAAE,CAmS7D"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/orgrt/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,KAAK,EAAgB,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAelD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAa1E;AAED;;;;;;;;0EAQ0E;AAC1E,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAwBrF;AAED,MAAM,MAAM,SAAS,GAAG,CACtB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB;;;;;;;+DAO+D;AAC/D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,EACrC,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,SAAS;AACjB;4EAC4E;AAC5E,MAAM,CAAC,EAAE,CACP,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,KAC9C,IAAI;AACT;;;;;0DAK0D;AAC1D,cAAc,CAAC,EAAE,MAAM,OAAO,GAC7B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAkDzE;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;8DAE0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;2EAEuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;mDAE+C;IAC/C,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,KAAK,IAAI,IAAI,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IACvF,OAAO,EAAE,SAAS,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjG;;6CAEyC;IACzC,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,KACE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;mEAC+D;IAC/D,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,wEAAwE;IACxE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,oGAAoG;IACpG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtF,iFAAiF;IACjF,KAAK,CAAC,EAAE,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QACP,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAChE,KAAK,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACrF,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC9C,KACE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kFAAkF;IAClF,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE;;;4EAGwE;IACxE,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC7B;8DAC0D;IAC1D,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvE;;6DAEyD;IACzD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;;iEAE6D;IAC7D,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;uEAKmE;IACnE,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC;8EAC0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gHAAgH;IAChH,aAAa,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,sFAAsF;IACtF,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC;;yEAEqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4CAA4C;IAC5C,cAAc,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACtF,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,kDAAkD;IAClD,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,iDAAiD;IACjD,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IACvF,0CAA0C;IAC1C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACzE,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,CACV,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,KAC5C,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACzE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACvE;;;6EAGyE;IACzE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACxF,SAAS,CAAC,EAAE,CACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,KACzE,MAAM,CAAC;CACb;AAED;;;;;sEAKsE;AACtE,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,EAClC,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,aAAa,CAAC,EAAE,MAAM;AACtB,0EAA0E;AAC1E,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAC1B,MAAM,CA8BR;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtE;AA2hBD;;;;;;kFAMkF;AAClF,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,EAAE,CAmS7D"}