@namzu/cli 34.1.1 → 36.0.0

package/dist/chunks/chunk-6ZPODOJN.js

@@ -0,0 +1,828 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  allowsCommands,
+  expandPermissions
+} from "./chunk-MS3IYQ72.js";
+import {
+  JOB_NAME,
+  jobFormatVersion,
+  jobSecurityDigest,
+  sanitizeLine,
+  stableStringify
+} from "./chunk-SKKWMMFP.js";
+import {
+  readPreferences
+} from "./chunk-SB6UD3ED.js";
+import {
+  PROVIDER_REGISTRY
+} from "./chunk-6LLJQ3KY.js";
+import {
+  AuthorizationGate,
+  NOOP_LOGGER,
+  SCHEDULE_CATCH_UP_WINDOW_MS,
+  countOccurrences,
+  describeSchedule,
+  generateScheduleJobId,
+  hostTimeZone,
+  installedCommandShellForDialect,
+  lexShellCommandLine,
+  parseScheduleSpec,
+  resolveScriptPrograms,
+  upcomingFireTimes,
+  validateTimeZone
+} from "./chunk-K5HARZ7G.js";
+import {
+  __name
+} from "./chunk-76FLAFCG.js";
+
+// src/schedule/folder.ts
+import { lstatSync, mkdirSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, parse, relative, resolve, sep } from "node:path";
+function isWithinOrSame(parent, child) {
+  const rel = relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !rel.startsWith(sep) && rel !== ".." && !/^[A-Za-z]:/.test(rel);
+}
+__name(isWithinOrSame, "isWithinOrSame");
+function canonical(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(path);
+  }
+}
+__name(canonical, "canonical");
+var SCRATCH_JOB_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function plannedScratchFolder(namzuHome, jobId) {
+  if (!SCRATCH_JOB_ID.test(jobId)) throw new Error(`invalid scheduled job id: ${jobId}`);
+  const home = resolve(namzuHome);
+  if (home === parse(home).root) throw new Error("NAMZU_HOME cannot be the file system root");
+  const parent = realpathSync(dirname(home));
+  return join(parent, `${basename(home)}-schedule-workspaces`, jobId);
+}
+__name(plannedScratchFolder, "plannedScratchFolder");
+function checkScratchFolder(namzuHome, jobId) {
+  let path;
+  try {
+    path = plannedScratchFolder(namzuHome, jobId);
+  } catch (error) {
+    return {
+      ok: false,
+      reason: `scratch folder cannot be located: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  for (const dir of [dirname(path), path]) {
+    try {
+      const st = lstatSync(dir);
+      if (!st.isDirectory() || st.isSymbolicLink())
+        return { ok: false, reason: `scratch folder path ${dir} is not a real directory` };
+      if ((st.mode & 511) !== 448)
+        return { ok: false, reason: `scratch folder path ${dir} must have mode 0700` };
+      if (process.getuid && st.uid !== process.getuid())
+        return { ok: false, reason: `scratch folder path ${dir} has a different owner` };
+      if (realpathSync(dir) !== dir)
+        return { ok: false, reason: `scratch folder path ${dir} resolves elsewhere` };
+    } catch (error) {
+      return {
+        ok: false,
+        reason: `scratch folder path ${dir} cannot be verified: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+  }
+  const checked = checkJobFolder(path, { namzuHome });
+  if (!checked.ok) return checked;
+  if (checked.canonical !== path)
+    return { ok: false, reason: `scratch folder ${path} resolves elsewhere` };
+  return checked;
+}
+__name(checkScratchFolder, "checkScratchFolder");
+function ensureScratchFolder(namzuHome, jobId) {
+  let path;
+  try {
+    path = plannedScratchFolder(namzuHome, jobId);
+  } catch (error) {
+    return {
+      ok: false,
+      reason: `scratch folder cannot be located: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  try {
+    mkdirSync(dirname(path), { mode: 448 });
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      return {
+        ok: false,
+        reason: `scratch folder cannot be created: ${error instanceof Error ? error.message : String(error)}`
+      };
+  }
+  const root = dirname(path);
+  try {
+    const st = lstatSync(root);
+    if (!st.isDirectory() || st.isSymbolicLink() || (st.mode & 511) !== 448 || process.getuid && st.uid !== process.getuid() || realpathSync(root) !== root)
+      return {
+        ok: false,
+        reason: `scratch folder root ${root} is not a user-owned real directory with mode 0700`
+      };
+    mkdirSync(path, { mode: 448 });
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      return {
+        ok: false,
+        reason: `scratch folder cannot be created: ${error instanceof Error ? error.message : String(error)}`
+      };
+  }
+  return checkScratchFolder(namzuHome, jobId);
+}
+__name(ensureScratchFolder, "ensureScratchFolder");
+function checkJobFolder(folder, options) {
+  let real;
+  try {
+    real = realpathSync(resolve(folder));
+  } catch {
+    return { ok: false, reason: `the folder ${folder} does not exist` };
+  }
+  try {
+    if (!statSync(real).isDirectory()) return { ok: false, reason: `${real} is not a directory` };
+  } catch {
+    return { ok: false, reason: `${real} cannot be read` };
+  }
+  const namzuHome = canonical(options.namzuHome);
+  const osHome = canonical(options.osHome ?? homedir());
+  if (real === parse(real).root)
+    return { ok: false, reason: "a job cannot run in the file system root" };
+  if (real === osHome) {
+    return {
+      ok: false,
+      reason: `a job cannot run in your home directory itself (${real}); pick the project folder`
+    };
+  }
+  if (isWithinOrSame(real, namzuHome)) {
+    return {
+      ok: false,
+      reason: `${real} contains NAMZU_HOME (${namzuHome}); a run there could rewrite its own job`
+    };
+  }
+  if (isWithinOrSame(namzuHome, real)) {
+    return { ok: false, reason: `${real} is inside NAMZU_HOME (${namzuHome})` };
+  }
+  return { ok: true, canonical: real };
+}
+__name(checkJobFolder, "checkJobFolder");
+function folderReadable(folder) {
+  try {
+    readdirSync(folder);
+    return { ok: true };
+  } catch (error) {
+    const code = error.code;
+    const tcc = process.platform === "darwin" && /\/(Documents|Desktop|Downloads)(\/|$)/.test(folder) ? " \u2014 macOS privacy protection may be blocking the scheduler; grant it Files and Folders access, or move the project out of Documents, Desktop or Downloads" : "";
+    return { ok: false, reason: `${folder} cannot be listed (${code ?? "error"})${tcc}` };
+  }
+}
+__name(folderReadable, "folderReadable");
+function isPrivacyProtectedFolder(folder, osHome = homedir()) {
+  return ["Documents", "Desktop", "Downloads"].some(
+    (name) => isWithinOrSame(resolve(osHome, name), folder)
+  );
+}
+__name(isPrivacyProtectedFolder, "isPrivacyProtectedFolder");
+
+// src/schedule/script-shell.ts
+function scriptShellUnavailableReason(shell) {
+  return `the requested ${shell} shell is not executable on this host; install it or choose an installed shell before confirming this job`;
+}
+__name(scriptShellUnavailableReason, "scriptShellUnavailableReason");
+
+// src/schedule/build.ts
+import { dirname as dirname2, join as join3 } from "node:path";
+
+// src/schedule/store/digest.ts
+import { createHash } from "node:crypto";
+import { lstatSync as lstatSync2, readFileSync, readdirSync as readdirSync2 } from "node:fs";
+import { join as join2, relative as relative2 } from "node:path";
+var DIGESTED_SECTIONS = [
+  "hooks",
+  "mcpServers",
+  "plugins",
+  "permissions",
+  "permissionChecks",
+  "sandbox",
+  "web",
+  "additionalDirectories",
+  "profiles"
+];
+var MAX_FILES = 2e3;
+var MAX_BYTES = 32 * 1024 * 1024;
+function sha(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+__name(sha, "sha");
+function configSections(folder) {
+  let raw;
+  try {
+    raw = readFileSync(join2(folder, "namzu.config.json"), "utf8").replace(/^\uFEFF/, "");
+  } catch {
+    return "absent";
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const picked = {};
+    for (const key of DIGESTED_SECTIONS) if (key in parsed) picked[key] = parsed[key];
+    return Object.keys(picked).length === 0 ? "absent" : sha(stableStringify(picked));
+  } catch {
+    return `unparsed:${sha(raw)}`;
+  }
+}
+__name(configSections, "configSections");
+function treeDigest(root) {
+  const hash = createHash("sha256");
+  let files = 0;
+  let bytes = 0;
+  let overflow = false;
+  const visit = /* @__PURE__ */ __name((dir) => {
+    let entries;
+    try {
+      entries = readdirSync2(dir).sort();
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (files >= MAX_FILES) {
+        overflow = true;
+        return;
+      }
+      const path = join2(dir, name);
+      let st;
+      try {
+        st = lstatSync2(path);
+      } catch {
+        continue;
+      }
+      const rel = relative2(root, path).replaceAll("\\", "/");
+      if (st.isSymbolicLink()) {
+        hash.update(`link:${rel}\0`);
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (name === "node_modules" || name === ".git") {
+          hash.update(`dir:${rel}:${st.mtimeMs}\0`);
+          continue;
+        }
+        visit(path);
+        continue;
+      }
+      if (!st.isFile()) continue;
+      files++;
+      if (bytes + st.size > MAX_BYTES) {
+        overflow = true;
+        hash.update(`file:${rel}:${st.size}:${st.mtimeMs}\0`);
+        continue;
+      }
+      bytes += st.size;
+      hash.update(`file:${rel}\0`);
+      try {
+        hash.update(readFileSync(path));
+      } catch {
+        hash.update("unreadable");
+      }
+      hash.update("\0");
+    }
+  }, "visit");
+  try {
+    if (!lstatSync2(root).isDirectory()) return "absent";
+  } catch {
+    return "absent";
+  }
+  visit(root);
+  return `${overflow ? "partial:" : ""}${hash.digest("hex")}`;
+}
+__name(treeDigest, "treeDigest");
+function computeProjectDigest(folder) {
+  return {
+    algo: "sha256",
+    files: {
+      "namzu.config.json": configSections(folder),
+      ".namzu/commands": treeDigest(join2(folder, ".namzu", "commands")),
+      ".namzu/plugins": treeDigest(join2(folder, ".namzu", "plugins"))
+    },
+    sections: [...DIGESTED_SECTIONS]
+  };
+}
+__name(computeProjectDigest, "computeProjectDigest");
+function projectDigestChanges(pinned, now) {
+  const keys = /* @__PURE__ */ new Set([...Object.keys(pinned.files), ...Object.keys(now.files)]);
+  return [...keys].filter((k) => pinned.files[k] !== now.files[k]).sort();
+}
+__name(projectDigestChanges, "projectDigestChanges");
+
+// src/schedule/build.ts
+var DEFAULT_TOKEN_BUDGET = 0;
+var DEFAULT_TIMEOUT_MS = 30 * 6e4;
+var DEFAULT_MAX_ITERATIONS = 50;
+var FEW_ITERATIONS = 10;
+var FEW_TOKENS = 5e4;
+var DEFAULT_WAIT_FOR_PROVIDER_MS = 10 * 6e4;
+var DEFAULT_APPROVAL_TTL_MS = 7 * 24 * 60 * 6e4;
+var DEFAULT_KEEP_SESSIONS = 20;
+var DEFAULT_PAUSE_AFTER_FAILURES = 5;
+var DEFAULT_SCRIPT_TIMEOUT_MS = 2 * 6e4;
+var DEFAULT_WAKE_GATE_CONTEXT_CHARS = 4e3;
+var JobRequestError = class extends Error {
+  static {
+    __name(this, "JobRequestError");
+  }
+  name = "JobRequestError";
+};
+function positive(label, value, fallback) {
+  const v = value ?? fallback;
+  if (!Number.isSafeInteger(v) || v <= 0)
+    throw new JobRequestError(`${label} must be a whole number above zero`);
+  return v;
+}
+__name(positive, "positive");
+function tokenBudget(value, fallback) {
+  const budget = value ?? fallback;
+  if (!Number.isSafeInteger(budget) || budget < 0)
+    throw new JobRequestError(
+      "the token budget must be a nonnegative whole number (0 means unlimited)"
+    );
+  return budget;
+}
+__name(tokenBudget, "tokenBudget");
+function resolveJobModel(spec, home) {
+  if (spec) {
+    const [provider = "", ...rest] = spec.split("/");
+    if (!(provider in PROVIDER_REGISTRY)) {
+      throw new JobRequestError(
+        `unknown provider "${provider}" (known: ${Object.keys(PROVIDER_REGISTRY).join(", ")})`
+      );
+    }
+    const model = rest.join("/");
+    return {
+      provider,
+      ...model ? { model } : { model: PROVIDER_REGISTRY[provider].defaultModel }
+    };
+  }
+  const read = readPreferences(home);
+  const primary = read.status === "ok" ? read.prefs.providers[0] : void 0;
+  if (!primary) {
+    throw new JobRequestError(
+      "no provider is configured; pass --model <provider>/<model> or pick one in namzu first"
+    );
+  }
+  return {
+    provider: primary.id,
+    model: primary.model ?? PROVIDER_REGISTRY[primary.id].defaultModel
+  };
+}
+__name(resolveJobModel, "resolveJobModel");
+function buildJob(request, context) {
+  if (!JOB_NAME.test(request.name)) {
+    throw new JobRequestError(
+      `"${request.name}" is not a job name: lowercase letters, digits and dashes, starting with a letter or digit`
+    );
+  }
+  const runKind = request.runKind ?? "agent";
+  if (request.workspace !== void 0 && request.workspace !== "none")
+    throw new JobRequestError("workspace is none or omitted for a project job");
+  if (request.workspace === "none" && runKind !== "script")
+    throw new JobRequestError("workspace: none only applies to a pure script job");
+  if (request.workspace === "none" && request.folder !== void 0)
+    throw new JobRequestError("workspace: none cannot be combined with a project folder");
+  if (request.workspace === void 0 && request.folder === void 0)
+    throw new JobRequestError("a project folder is required unless workspace is none");
+  if (runKind === "script" && (request.model !== void 0 || request.effort !== void 0)) {
+    throw new JobRequestError(
+      "a pure script job has no model or effort; remove --model and --effort"
+    );
+  }
+  if (runKind === "script" && request.prompt.trim())
+    throw new JobRequestError("a pure script job has no prompt; remove the prompt");
+  if (runKind === "agent" && request.script !== void 0) {
+    throw new JobRequestError("an agent job has no script; pass --kind script or script+agent");
+  }
+  if (request.script?.report !== void 0 && request.script.report !== "json-v1")
+    throw new JobRequestError("script report is json-v1 or omitted");
+  if (request.script?.report !== void 0 && runKind !== "script")
+    throw new JobRequestError("script reports only apply to a pure script job");
+  if (request.deliveryWaiverRunIds?.length) {
+    if (request.delivery !== void 0)
+      throw new JobRequestError("a source binding cannot carry delivery waivers");
+    if (request.deliveryWaiverRunIds.length > 1e3 || new Set(request.deliveryWaiverRunIds).size !== request.deliveryWaiverRunIds.length || request.deliveryWaiverRunIds.some(
+      (id2) => !/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/.test(
+        id2
+      )
+    ))
+      throw new JobRequestError("delivery waiver run IDs are invalid");
+  }
+  if (runKind !== "agent" && !request.script?.body.trim()) {
+    throw new JobRequestError(
+      runKind === "script" ? "the script is empty" : "the wake-gate script is empty"
+    );
+  }
+  if (runKind !== "script" && !request.prompt.trim()) {
+    throw new JobRequestError("the prompt is empty");
+  }
+  if (request.wakeGate !== void 0 && runKind !== "script+agent") {
+    throw new JobRequestError("a wake-gate only applies to a script+agent job");
+  }
+  if (runKind !== "agent" && process.platform === "win32") {
+    throw new JobRequestError(
+      `a ${runKind} job is not supported on native Windows yet: its script would run through cmd.exe, read only as a loose approximation the floor cannot fully verify. Use WSL, where a job\u2019s script runs on the Linux side, or an agent job.`
+    );
+  }
+  if (runKind !== "agent" && request.script && !installedCommandShellForDialect(request.script.shell)) {
+    throw new JobRequestError(scriptShellUnavailableReason(request.script.shell));
+  }
+  const permissions = (() => {
+    try {
+      return expandPermissions(request.permissions);
+    } catch (error) {
+      throw new JobRequestError(error instanceof Error ? error.message : String(error));
+    }
+  })();
+  if (permissions.unmatched === "allow" && permissions.execution === "host" && !request.allowUnattendedHost) {
+    throw new JobRequestError(
+      "unmatched: allow with execution on the host lets an unattended run do anything no rule forbids; pass --allow-unattended-host to mean it, or use --execution sandbox"
+    );
+  }
+  if (runKind === "script" && permissions.unmatched === "park") {
+    throw new JobRequestError(
+      "a pure script job cannot use unmatched: park; nothing can wait for the operator while a script runs. Use unmatched: deny or allow (the floor and the job\u2019s own rules still decide everything the script tries), or make this a script+agent job if a person should review something first"
+    );
+  }
+  if (runKind !== "agent" && permissions.execution === "sandbox") {
+    throw new JobRequestError(
+      `execution: sandbox is not yet supported for a ${runKind} job\u2019s script phase; use execution: host (a follow-up may add sandboxed scripts)`
+    );
+  }
+  const id = context.jobId ?? generateScheduleJobId();
+  const folder = (() => {
+    if (request.workspace === "none") {
+      try {
+        const path2 = plannedScratchFolder(context.paths.home, id);
+        return { path: path2, canonical: path2 };
+      } catch (error) {
+        throw new JobRequestError(
+          `scratch folder cannot be planned: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+    const path = request.folder;
+    const checked = checkJobFolder(path, {
+      namzuHome: context.paths.home,
+      ...context.osHome ? { osHome: context.osHome } : {}
+    });
+    if (!checked.ok) throw new JobRequestError(checked.reason);
+    return { path, canonical: checked.canonical };
+  })();
+  const extra = (permissions.additionalDirectories ?? []).map((dir) => {
+    const checked = checkJobFolder(dir, {
+      namzuHome: context.paths.home,
+      ...context.osHome ? { osHome: context.osHome } : {}
+    });
+    if (!checked.ok) throw new JobRequestError(`additional directory: ${checked.reason}`);
+    return checked.canonical;
+  });
+  const tz = validateTimeZone(request.tz ?? hostTimeZone());
+  let spec;
+  try {
+    spec = request.spec ?? parseScheduleSpec(request.when, { now: context.now, tz });
+  } catch (error) {
+    throw new JobRequestError(error instanceof Error ? error.message : String(error));
+  }
+  const limits = context.config.limits ?? {};
+  const budget = {
+    maxIterations: positive(
+      "max iterations",
+      request.budget?.maxIterations,
+      limits.maxIterations || DEFAULT_MAX_ITERATIONS
+    ),
+    tokenBudget: tokenBudget(
+      request.budget?.tokenBudget,
+      limits.tokenBudget ?? DEFAULT_TOKEN_BUDGET
+    ),
+    timeoutMs: positive(
+      "the timeout",
+      request.budget?.timeoutMs,
+      limits.timeoutMs || DEFAULT_TIMEOUT_MS
+    ),
+    waitForProviderMs: request.budget?.waitForProviderMs ?? limits.waitForProviderMs ?? DEFAULT_WAIT_FOR_PROVIDER_MS
+  };
+  if (budget.timeoutMs > 2147483647 - 6e4)
+    throw new JobRequestError("the timeout is too long");
+  if (request.script && request.script.timeoutMs !== void 0 && (!Number.isSafeInteger(request.script.timeoutMs) || request.script.timeoutMs <= 0 || request.script.timeoutMs > 2147483647 - 6e4)) {
+    throw new JobRequestError(
+      "the script timeout must be a whole number of milliseconds above zero and below the timer limit"
+    );
+  }
+  const at = context.now.toISOString();
+  return {
+    v: jobFormatVersion({
+      runKind,
+      script: request.script,
+      workspace: request.workspace,
+      delivery: request.delivery,
+      deliveryWaiverRunIds: request.deliveryWaiverRunIds
+    }),
+    kind: "schedule-job",
+    id,
+    name: request.name,
+    revision: 0,
+    createdAt: at,
+    updatedAt: at,
+    createdBy: request.createdBy,
+    prompt: runKind === "script" ? "" : request.prompt,
+    ...runKind !== "agent" ? {
+      runKind,
+      script: {
+        body: request.script.body,
+        shell: request.script.shell,
+        timeoutMs: request.script.timeoutMs ?? DEFAULT_SCRIPT_TIMEOUT_MS,
+        ...request.script?.report ? { report: request.script.report } : {}
+      }
+    } : {},
+    ...runKind === "script+agent" ? {
+      wakeGate: {
+        maxContextChars: request.wakeGate?.maxContextChars ?? DEFAULT_WAKE_GATE_CONTEXT_CHARS
+      }
+    } : {},
+    ...request.workspace === "none" ? { workspace: "none" } : {},
+    ...request.delivery ? { delivery: request.delivery } : {},
+    ...request.deliveryWaiverRunIds?.length ? { deliveryWaiverRunIds: request.deliveryWaiverRunIds } : {},
+    folder,
+    trust: null,
+    schedule: spec,
+    permissions: {
+      ...permissions,
+      ...extra.length > 0 ? { additionalDirectories: extra } : {}
+    },
+    budget,
+    ...runKind === "script" ? {} : {
+      model: {
+        ...resolveJobModel(request.model, context.paths.home),
+        ...request.effort ? { effort: request.effort } : {}
+      }
+    },
+    catchUp: { windowMs: SCHEDULE_CATCH_UP_WINDOW_MS },
+    notify: {
+      finished: request.notifyOnFinish ?? true,
+      failed: true,
+      awaitingApproval: true,
+      includeSummary: request.includeSummary === true
+    },
+    failurePolicy: {
+      pauseAfterFailures: request.pauseAfterFailures ?? DEFAULT_PAUSE_AFTER_FAILURES
+    },
+    retention: { keepSessions: request.keepSessions ?? DEFAULT_KEEP_SESSIONS },
+    state: "pending-confirmation",
+    approvalTtlMs: request.approvalTtlMs ?? DEFAULT_APPROVAL_TTL_MS,
+    projectDigest: computeProjectDigest(folder.canonical),
+    confirmation: null
+  };
+}
+__name(buildJob, "buildJob");
+function confirmJob(job, surface, now, options = {}) {
+  if (surface === "cli-noninteractive")
+    return { ...job, state: "pending-confirmation", confirmation: null };
+  if (job.workspace !== void 0 && job.workspace !== "none")
+    throw new JobRequestError("the job has an unknown workspace mode");
+  if (job.workspace === "none") {
+    if (job.runKind !== "script")
+      throw new JobRequestError("workspace: none only applies to a pure script job");
+    const paths = options.paths;
+    if (!paths)
+      throw new JobRequestError(
+        "a no-project job needs schedule paths to confirm its scratch folder"
+      );
+    let expected;
+    try {
+      expected = plannedScratchFolder(paths.home, job.id);
+    } catch (error) {
+      throw new JobRequestError(
+        `scratch folder cannot be planned: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    if (job.folder.path !== expected || job.folder.canonical !== expected)
+      throw new JobRequestError("scratch folder differs from the job id and NAMZU_HOME");
+    const checked = ensureScratchFolder(paths.home, job.id);
+    if (!checked.ok) throw new JobRequestError(checked.reason);
+    if (checked.canonical !== expected)
+      throw new JobRequestError("scratch folder resolves outside its planned path");
+  }
+  const at = now.toISOString();
+  const trusted = {
+    ...job,
+    trust: {
+      canonical: job.folder.canonical,
+      grantedAt: at,
+      by: "operator-confirmation"
+    },
+    projectDigest: computeProjectDigest(job.folder.canonical)
+  };
+  return {
+    ...trusted,
+    state: options.paused ? "paused" : "active",
+    ...options.paused ? { pausedAt: at, pausedBy: "operator" } : {},
+    confirmation: { at, surface, digest: jobSecurityDigest(trusted) }
+  };
+}
+__name(confirmJob, "confirmJob");
+function editedJob(current, rebuilt) {
+  return {
+    ...current,
+    prompt: rebuilt.prompt,
+    runKind: rebuilt.runKind,
+    script: rebuilt.script,
+    wakeGate: rebuilt.wakeGate,
+    workspace: rebuilt.workspace,
+    delivery: rebuilt.delivery,
+    deliveryWaiverRunIds: rebuilt.deliveryWaiverRunIds,
+    folder: rebuilt.workspace === "none" && rebuilt.id !== current.id ? {
+      path: join3(dirname2(rebuilt.folder.path), current.id),
+      canonical: join3(dirname2(rebuilt.folder.canonical), current.id)
+    } : rebuilt.folder,
+    schedule: rebuilt.schedule,
+    permissions: rebuilt.permissions,
+    budget: rebuilt.budget,
+    // Keep an older pure script's real (unused) model field across edits,
+    // so a fresh confirmation still binds that field. New scripts omit it.
+    model: rebuilt.runKind === "script" && current.runKind === "script" ? current.model : rebuilt.model,
+    notify: rebuilt.notify,
+    failurePolicy: rebuilt.failurePolicy,
+    retention: rebuilt.retention,
+    approvalTtlMs: rebuilt.approvalTtlMs
+  };
+}
+__name(editedJob, "editedJob");
+function runsPerDay(spec, now) {
+  if (spec.kind === "at") return 1;
+  if (spec.kind === "every") return Math.ceil(24 * 60 * 6e4 / spec.everyMs);
+  let most = 0;
+  for (let d = 0; d < 7; d++) {
+    const from = new Date(now.getTime() + d * 24 * 60 * 6e4);
+    const to = new Date(from.getTime() + 24 * 60 * 6e4);
+    most = Math.max(most, countOccurrences(spec, from, to).count);
+  }
+  return most;
+}
+__name(runsPerDay, "runsPerDay");
+function duration(ms) {
+  if (ms % 864e5 === 0) return `${ms / 864e5} d`;
+  if (ms % 36e5 === 0) return `${ms / 36e5} h`;
+  if (ms % 6e4 === 0) return `${ms / 6e4} min`;
+  return `${Math.round(ms / 1e3)} s`;
+}
+__name(duration, "duration");
+function previewLines(job, policy, now) {
+  const tz = job.schedule.kind === "cron" ? job.schedule.tz : hostTimeZone();
+  const next = upcomingFireTimes(job.schedule, now, 3).map(
+    (t) => new Intl.DateTimeFormat("en-GB", {
+      dateStyle: "medium",
+      timeStyle: "short",
+      timeZone: tz
+    }).format(t)
+  );
+  const perDay = runsPerDay(job.schedule, now);
+  const hasScriptPhase = job.runKind === "script" || job.runKind === "script+agent";
+  const networkCapable = policy.network || job.permissions.execution === "host" && (hasScriptPhase || allowsCommands(job.permissions));
+  return [
+    `Job         ${job.name}`,
+    ...job.workspace === "none" ? ["Workspace   none (private scratch directory for this job)"] : [`Folder      ${job.folder.canonical}`],
+    ...job.runKind === "script" ? [
+      job.workspace === "none" ? "Scope       private scratch directory is the script\u2019s working directory, not a write boundary" : "Scope       this folder is the script\u2019s working directory, not a write boundary"
+    ] : [],
+    `When        ${describeSchedule(job.schedule, { tz })}`,
+    `Next        ${next.length > 0 ? next.join(" \xB7 ") : "never"}`,
+    `Notify      ${job.notify.finished ? "routine completion notices enabled (rate limited)" : "no routine completed-run notice; failures still notify"}`,
+    ...job.delivery?.kind === "source-conversation" ? ["Results     post back to the source conversation"] : [],
+    ...job.runKind === "script" ? [
+      "Model       none (script only)",
+      `Budget      0 tokens; script timeout ${job.script ? duration(job.script.timeoutMs) : "unknown"} per run`,
+      ...job.script?.report === "json-v1" ? ["Report      json-v1 (structured status and scheduler-owned state)"] : []
+    ] : [
+      `Model       ${job.model?.provider ?? "(missing)"}${job.model?.model ? `/${job.model.model}` : ""}${job.model?.effort ? ` (${job.model.effort})` : ""}`,
+      `Budget      ${job.budget.tokenBudget === 0 ? "no token limit" : `${job.budget.tokenBudget.toLocaleString("en-US")} tokens`}, ${job.budget.maxIterations} iterations, ${duration(job.budget.timeoutMs)} per run`
+    ],
+    // A proposal once set 1, read as "one post per run": the first run
+    // stopped after its first model call, with nothing done.
+    ...job.runKind !== "script" && job.budget.maxIterations < FEW_ITERATIONS ? [
+      `Warning     ${job.budget.maxIterations} iteration${job.budget.maxIterations === 1 ? "" : "s"} is one model call${job.budget.maxIterations === 1 ? "" : " each"} with its tool calls; most tasks need more (the default is ${DEFAULT_MAX_ITERATIONS}), and a run that runs out stops unfinished`
+    ] : [],
+    // A proposal once set 4,000 tokens for a job whose runs each took
+    // about 110,000: every model call resends the whole prompt.
+    ...job.runKind !== "script" && job.budget.tokenBudget > 0 && job.budget.tokenBudget < FEW_TOKENS ? [
+      `Warning     ${job.budget.tokenBudget.toLocaleString("en-US")} tokens may not cover even a few model calls, each of which resends the whole prompt; a run that runs out stops unfinished (the default has no token limit)`
+    ] : [],
+    ...job.runKind === "script" ? [] : job.budget.tokenBudget === 0 ? ["Ceiling     no daily token limit"] : [
+      `Ceiling     up to ${perDay} run${perDay === 1 ? "" : "s"} a day \xD7 ${job.budget.tokenBudget.toLocaleString("en-US")} tokens = ${(perDay * job.budget.tokenBudget).toLocaleString("en-US")} tokens a day`
+    ],
+    `Runs on     ${job.permissions.execution === "host" ? "this machine (host)" : "the sandbox"}`,
+    ...networkCapable ? ["Network     THIS RUN CAN REACH THE NETWORK"] : [],
+    ...job.permissions.browser && job.runKind !== "script" ? [
+      `Browser     SIGNED IN AS YOU: profile ${job.permissions.browser.profile}, only ${Object.keys(job.permissions.browser.sites).join(", ")}`
+    ] : [],
+    ...job.runKind !== "script" && job.permissions.unmatched === "allow" ? ["Unmatched   CALLS NO RULE COVERS RUN WITHOUT ASKING"] : [],
+    ...job.runKind === "script" ? [
+      "Script check  shell commands meet the floor and deny rules; review interpreter code yourself",
+      "Permissions   allow, ask and unmatched rules below do not constrain this script"
+    ] : ["Permissions"],
+    ...policy.lines.map((line) => `  ${line}`),
+    ...job.runKind === "script" ? [] : [`Approvals   a call that waits for you expires after ${duration(job.approvalTtlMs)}`]
+  ];
+}
+__name(previewLines, "previewLines");
+
+// src/schedule/script-check.ts
+var MAX_SHOWN = 240;
+function shown(text, max = MAX_SHOWN) {
+  const cut = sanitizeLine(text, max);
+  return cut.includes("`") ? `\`\` ${cut} \`\`` : `\`${cut}\``;
+}
+__name(shown, "shown");
+function denyOnlyGate(rules, denyDangerousPatterns) {
+  return new AuthorizationGate(
+    {
+      enabled: true,
+      allowReadOnlyTools: false,
+      denyDangerousPatterns,
+      logDecisions: false,
+      rules: [...rules]
+    },
+    NOOP_LOGGER
+  );
+}
+__name(denyOnlyGate, "denyOnlyGate");
+function verifyScheduledScript(body, shell, policy) {
+  const reading = lexShellCommandLine(body, { dialect: shell });
+  if (reading.opaque) {
+    return {
+      ok: false,
+      reason: `the script cannot be verified line-for-line (${reading.reasons[0] ?? "a construct the lexer does not model"}); a script that cannot be read is refused rather than run unattended`
+    };
+  }
+  for (const { command, positions } of resolveScriptPrograms(reading.commands, shell)) {
+    for (const position of positions) {
+      if (position.unknown !== void 0) {
+        return {
+          ok: false,
+          reason: `the command ${shown(command.text)}'s program cannot be verified ahead of time (${position.unknown}); a script whose commands cannot be verified is refused rather than run unattended`
+        };
+      }
+    }
+  }
+  const floorGate = denyOnlyGate(policy.floorRules, true);
+  const floorResult = floorGate.evaluate({
+    toolName: "bash",
+    toolInput: { command: body },
+    toolDef: void 0,
+    commandDialect: shell
+  });
+  if (floorResult.decision === "deny") {
+    return { ok: false, reason: floorResult.reason };
+  }
+  if (policy.denyRules.length > 0) {
+    const denyGate = denyOnlyGate(policy.denyRules, false);
+    for (const command of reading.commands) {
+      if (!command.text.trim()) continue;
+      const result = denyGate.evaluate({
+        toolName: "bash",
+        toolInput: { command: command.text },
+        toolDef: void 0,
+        commandDialect: shell
+      });
+      if (result.decision === "deny") {
+        const blanketBashDeny = result.reason.includes("denied by name (bash)");
+        return {
+          ok: false,
+          reason: `the command ${shown(command.text)} is denied: ${result.reason}${blanketBashDeny ? "; a bash deny rule blocks every script command, so changing the script text cannot fix it" : ""}`
+        };
+      }
+    }
+  }
+  return { ok: true };
+}
+__name(verifyScheduledScript, "verifyScheduledScript");
+
+export {
+  plannedScratchFolder,
+  checkScratchFolder,
+  checkJobFolder,
+  folderReadable,
+  isPrivacyProtectedFolder,
+  scriptShellUnavailableReason,
+  computeProjectDigest,
+  projectDigestChanges,
+  DEFAULT_TOKEN_BUDGET,
+  DEFAULT_TIMEOUT_MS,
+  DEFAULT_MAX_ITERATIONS,
+  DEFAULT_WAKE_GATE_CONTEXT_CHARS,
+  JobRequestError,
+  buildJob,
+  confirmJob,
+  editedJob,
+  runsPerDay,
+  previewLines,
+  verifyScheduledScript
+};
+//# sourceMappingURL=chunk-6ZPODOJN.js.map