@north-light/crouter 0.3.318 → 0.3.320

package/dist/core/runtime/session-visibility.js

@@ -1,99 +1 @@
-// session-visibility.ts — the transcript projection shared by live and dormant
-// reads. Raw session entries remain authoritative; durable stamps and review
-// boundaries select which reconstructed messages a person can see.
-import { readStamps, STAMP_SCHEMA_VERSION, } from './stamp/protocol.js';
-import { REVIEW_BOUNDARY_CUSTOM_TYPE } from '../../shared/generated-context.js';
-export { REVIEW_BOUNDARY_CUSTOM_TYPE };
-/** True when an entry is a durable review boundary, optionally for one review. */
-export function isReviewBoundary(entry, reviewId) {
-    if (entry === null || typeof entry !== 'object')
-        return false;
-    const candidate = entry;
-    return ((candidate.role === 'custom' || candidate.type === 'custom_message') &&
-        candidate.customType === REVIEW_BOUNDARY_CUSTOM_TYPE &&
-        (reviewId === undefined || candidate.details?.reviewId === reviewId));
-}
-function syntheticBoundary(timestamp) {
-    return {
-        role: 'custom',
-        customType: REVIEW_BOUNDARY_CUSTOM_TYPE,
-        content: 'Earlier conversation with the origin is not shown.',
-        display: true,
-        timestamp: timestamp ?? Date.now(),
-    };
-}
-function classifyMessages(messages, sessionEntries) {
-    const internalByTimestamp = new Map();
-    for (const stamp of readStamps(sessionEntries ?? [])) {
-        if (stamp.kind !== 'message' || stamp.v !== STAMP_SCHEMA_VERSION)
-            continue;
-        const payload = stamp.payload;
-        if (typeof payload.msgTs !== 'number')
-            continue;
-        // Last stamp wins, matching every other message-stamp reader.
-        internalByTimestamp.set(payload.msgTs, payload.visibility === 'internal');
-    }
-    let visibility = 'visible';
-    return messages.map((identified) => {
-        const { message } = identified;
-        if (message.role === 'user') {
-            visibility = typeof message.timestamp === 'number'
-                && internalByTimestamp.get(message.timestamp) === true
-                ? 'internal'
-                : 'visible';
-        }
-        return { ...identified, visibility };
-    });
-}
-/**
- * Project identified snapshot messages for transcript presentation.
- *
- * Every retained message carries its durable visibility classification. A
- * companion then passes its binding's review id so its slice starts at ITS OWN
- * boundary marker: a node forked from another companion inherits that
- * companion's earlier marker, and slicing at the first marker of any review
- * would reveal the origin companion's transcript.
- */
-export function projectTranscript(messages, opts) {
-    const projected = classifyMessages(messages, opts.sessionEntries);
-    const markerIndex = projected.findIndex(({ message }) => isReviewBoundary(message, opts.boundaryReviewId));
-    if (markerIndex !== -1)
-        return projected.slice(markerIndex);
-    if (opts.boundaryReviewId === undefined)
-        return projected;
-    const [first, ...retainedTail] = projected;
-    const boundary = {
-        id: '~boundary',
-        message: syntheticBoundary(first?.message.timestamp),
-        visibility: 'visible',
-    };
-    if (first?.message.role === 'compactionSummary') {
-        return [boundary, ...retainedTail];
-    }
-    return [boundary];
-}
-/**
- * Project a session tree to the review companion's visible transcript boundary.
- *
- * Pre-boundary ancestors are omitted rather than retained as empty structural
- * shells, making each durable boundary a root in the returned forest. Once a
- * boundary is crossed, its complete descendant subtree remains navigable. An
- * absent boundary produces an empty tree, so picker previews never disclose an
- * inherited entry before a mutation guard can reject its selection.
- *
- * `boundaryReviewId` selects only this binding's marker as a root, so a
- * companion forked from another companion never navigates into the inherited
- * subtree rooted at the origin's earlier marker.
- */
-export function boundaryRootedTree(tree, boundaryReviewId) {
-    const retainSubtree = (node) => ({
-        ...node,
-        children: node.children.map(retainSubtree),
-    });
-    const project = (node) => {
-        if (isReviewBoundary(node.entry, boundaryReviewId))
-            return [retainSubtree(node)];
-        return node.children.flatMap(project);
-    };
-    return tree.flatMap(project);
-}
+var l=Object.defineProperty;var o=(n,r)=>l(n,"name",{value:r,configurable:!0});import{readStamps as p,STAMP_SCHEMA_VERSION as f}from"./stamp/protocol.js";import{REVIEW_BOUNDARY_CUSTOM_TYPE as a}from"../../shared/generated-context.js";function c(n,r){if(n===null||typeof n!="object")return!1;const t=n;return(t.role==="custom"||t.type==="custom_message")&&t.customType===a&&(r===void 0||t.details?.reviewId===r)}o(c,"isReviewBoundary");function d(n){return{role:"custom",customType:a,content:"Earlier conversation with the origin is not shown.",display:!0,timestamp:n??Date.now()}}o(d,"syntheticBoundary");function y(n,r){const t=new Map;for(const e of p(r??[])){if(e.kind!=="message"||e.v!==f)continue;const i=e.payload;typeof i.msgTs=="number"&&t.set(i.msgTs,i.visibility==="internal")}let s="visible";return n.map(e=>{const{message:i}=e;return i.role==="user"&&(s=typeof i.timestamp=="number"&&t.get(i.timestamp)===!0?"internal":"visible"),{...e,visibility:s}})}o(y,"classifyMessages");function T(n,r){const t=y(n,r.sessionEntries),s=t.findIndex(({message:m})=>c(m,r.boundaryReviewId));if(s!==-1)return t.slice(s);if(r.boundaryReviewId===void 0)return t;const[e,...i]=t,u={id:"~boundary",message:d(e?.message.timestamp),visibility:"visible"};return e?.message.role==="compactionSummary"?[u,...i]:[u]}o(T,"projectTranscript");function h(n,r){const t=o(e=>({...e,children:e.children.map(t)}),"retainSubtree"),s=o(e=>c(e.entry,r)?[t(e)]:e.children.flatMap(s),"project");return n.flatMap(s)}o(h,"boundaryRootedTree");export{a as REVIEW_BOUNDARY_CUSTOM_TYPE,h as boundaryRootedTree,c as isReviewBoundary,T as projectTranscript};

package/dist/core/runtime/shell-expansion.js

@@ -1,100 +1,9 @@
-import { execFile } from 'node:child_process';
-// Shell expansion inside Markdown bodies: `!`cmd`` inline and ```! fenced
-// blocks are replaced by the command's output.
-//
-// The grammar and substitution ORDER live here; the execution STRATEGY is
-// injected. Two callers need different strategies:
-//   • Broker-side extensions run through `pi.exec`, so the engine sees the
-//     subprocess (claude-plugin-commands, memory-slash-commands).
-//   • CLI leaves have no pi engine and must not import one — `crtr memory read`
-//     uses `makeNodeShellRunner` over node:child_process.
-//
-// Node built-ins ONLY. This module is reachable from `src/commands/**`, where a
-// `@earendil-works/pi-coding-agent` import would load the whole pi runtime just
-// to read a document.
-// Built fresh per use, never shared. A module-level /g regex carries mutable
-// `lastIndex`, and both `.test()` and `matchAll` (which copies it into its
-// internal clone) would make one call silently skip matches another consumed.
-const SHELL_INLINE_SOURCE = '!`([^`\\n]+)`';
-const SHELL_BLOCK_SOURCE = '```!\\n([\\s\\S]*?)\\n```';
-const inlineRe = () => new RegExp(SHELL_INLINE_SOURCE, 'g');
-const blockRe = () => new RegExp(SHELL_BLOCK_SOURCE, 'g');
-export const DEFAULT_SHELL_TIMEOUT_MS = 120_000;
-const MAX_OUTPUT_LINES = 2000;
-const MAX_OUTPUT_BYTES = 50_000;
-/** True when `body` carries at least one shell construct. Lets a caller skip an
- * async execution pass (and its cwd/timeout plumbing) for the common inert
- * document. */
-export function hasShellBlocks(body) {
-    return new RegExp(SHELL_INLINE_SOURCE).test(body) || new RegExp(SHELL_BLOCK_SOURCE).test(body);
-}
-/** Cap runaway command output before it becomes model context. */
-export function truncateShellOutput(content) {
-    const lines = content.split('\n');
-    if (lines.length > MAX_OUTPUT_LINES) {
-        return `${lines.slice(0, MAX_OUTPUT_LINES).join('\n')}\n[truncated: hit ${MAX_OUTPUT_LINES} lines]`;
-    }
-    if (Buffer.byteLength(content, 'utf8') > MAX_OUTPUT_BYTES) {
-        return `${Buffer.from(content, 'utf8').subarray(0, MAX_OUTPUT_BYTES).toString('utf8')}\n[truncated: hit ${MAX_OUTPUT_BYTES} bytes]`;
-    }
-    return content;
-}
-/** Merge a completed command's streams the way the model should read them. */
-export function formatShellResult(result) {
-    if (result.killed === true) {
-        return `[Shell error: timed out after ${Math.max(1, Math.round(result.timeoutMs / 1000))}s]`;
-    }
-    if (result.code !== 0) {
-        return `[Shell error: exit code ${result.code}]\n${truncateShellOutput(result.stderr ?? '')}`;
-    }
-    let combined = result.stdout ?? '';
-    if (result.stderr !== undefined && result.stderr !== '') {
-        const sep = combined.length === 0 || combined.endsWith('\n') ? '' : '\n';
-        combined = `${combined}${sep}[stderr]\n${result.stderr}`;
-    }
-    return truncateShellOutput(combined);
-}
-/** The runner for processes with no pi engine — every CLI leaf. */
-export function makeNodeShellRunner(opts) {
-    const timeoutMs = opts.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS;
-    const [sh, flag] = process.platform === 'win32' ? ['powershell.exe', '-Command'] : ['sh', '-c'];
-    return (cmd) => new Promise((resolve) => {
-        execFile(sh, [flag, cmd], { cwd: opts.cwd, timeout: timeoutMs, maxBuffer: MAX_OUTPUT_BYTES * 4, encoding: 'utf8' }, (err, stdout, stderr) => {
-            // On timeout execFile kills the child and reports `killed: true` with
-            // a null `code` and a signal — never a numeric exit status. Check that
-            // first, or a timeout is misreported as a generic failure.
-            const e = err;
-            const killed = e !== null && (e.killed === true || (e.signal !== undefined && e.signal !== null));
-            const code = e === null ? 0 : typeof e.code === 'number' ? e.code : 1;
-            resolve(formatShellResult({ code, killed, stdout, stderr, timeoutMs }));
-        });
-    });
-}
-/** Replace every shell construct in `body` with its output.
- *
- * Fenced blocks resolve first behind sentinels so an inline pattern inside a
- * block's own text is never executed a second time; inline forms resolve
- * against the masked text; sentinels are then restored. Commands run in
- * document order, exactly once per call — a document read twice runs its
- * commands twice, which is the intended "once per invocation" contract. */
-export async function expandShellBlocks(body, run) {
-    const blockOut = [];
-    let masked = '';
-    let last = 0;
-    for (const m of body.matchAll(blockRe())) {
-        const idx = m.index ?? 0;
-        masked += body.slice(last, idx) + `\x00B${blockOut.length}\x00`;
-        blockOut.push(await run(m[1] ?? ''));
-        last = idx + m[0].length;
-    }
-    masked += body.slice(last);
-    let inlined = '';
-    last = 0;
-    for (const m of masked.matchAll(inlineRe())) {
-        const idx = m.index ?? 0;
-        inlined += masked.slice(last, idx) + (await run(m[1] ?? ''));
-        last = idx + m[0].length;
-    }
-    inlined += masked.slice(last);
-    return inlined.replace(/\x00B(\d+)\x00/g, (_, n) => blockOut[parseInt(n, 10)] ?? '');
-}
+var S=Object.defineProperty;var l=(e,t)=>S(e,"name",{value:t,configurable:!0});import{execFile as E}from"node:child_process";const a="!`([^`\\n]+)`",h="```!\\n([\\s\\S]*?)\\n```",_=l(()=>new RegExp(a,"g"),"inlineRe"),w=l(()=>new RegExp(h,"g"),"blockRe"),L=12e4,f=2e3,d=5e4;function B(e){return new RegExp(a).test(e)||new RegExp(h).test(e)}l(B,"hasShellBlocks");function x(e){const t=e.split(`
+`);return t.length>f?`${t.slice(0,f).join(`
+`)}
+[truncated: hit ${f} lines]`:Buffer.byteLength(e,"utf8")>d?`${Buffer.from(e,"utf8").subarray(0,d).toString("utf8")}
+[truncated: hit ${d} bytes]`:e}l(x,"truncateShellOutput");function $(e){if(e.killed===!0)return`[Shell error: timed out after ${Math.max(1,Math.round(e.timeoutMs/1e3))}s]`;if(e.code!==0)return`[Shell error: exit code ${e.code}]
+${x(e.stderr??"")}`;let t=e.stdout??"";if(e.stderr!==void 0&&e.stderr!==""){const i=t.length===0||t.endsWith(`
+`)?"":`
+`;t=`${t}${i}[stderr]
+${e.stderr}`}return x(t)}l($,"formatShellResult");function M(e){const t=e.timeoutMs??L,[i,s]=process.platform==="win32"?["powershell.exe","-Command"]:["sh","-c"];return o=>new Promise(u=>{E(i,[s,o],{cwd:e.cwd,timeout:t,maxBuffer:d*4,encoding:"utf8"},(n,r,m)=>{const c=n,p=c!==null&&(c.killed===!0||c.signal!==void 0&&c.signal!==null),g=c===null?0:typeof c.code=="number"?c.code:1;u($({code:g,killed:p,stdout:r,stderr:m,timeoutMs:t}))})})}l(M,"makeNodeShellRunner");async function O(e,t){const i=[];let s="",o=0;for(const n of e.matchAll(w())){const r=n.index??0;s+=e.slice(o,r)+`\0B${i.length}\0`,i.push(await t(n[1]??"")),o=r+n[0].length}s+=e.slice(o);let u="";o=0;for(const n of s.matchAll(_())){const r=n.index??0;u+=s.slice(o,r)+await t(n[1]??""),o=r+n[0].length}return u+=s.slice(o),u.replace(/\x00B(\d+)\x00/g,(n,r)=>i[parseInt(r,10)]??"")}l(O,"expandShellBlocks");export{L as DEFAULT_SHELL_TIMEOUT_MS,O as expandShellBlocks,$ as formatShellResult,B as hasShellBlocks,M as makeNodeShellRunner,x as truncateShellOutput};

package/dist/core/runtime/situational-context.js

@@ -1,67 +1,2 @@
-// situational-context.ts — the hidden ambient "current situation" sidecar.
-//
-// A node-owned runtime file (nodes/<id>/situational-context.md, NOT under
-// context/ — see `situationalContextPath`) storing ONE rendered runtime-card
-// envelope describing the LATEST situation: current state (e.g. which applet
-// page a concierge is attached to right now), not task history, and never the
-// node's goal or a visible chat message. Upserted (replace), never appended, so
-// stale applet pages never accumulate across concierge reuse.
-//
-// `situationalContextEnvelope()` is the ONE read, and it yields the stored card
-// verbatim — no caller downstream has a shape to check. Its three callers use
-// it differently, and only the last nests:
-//   - canvas-inbox-watcher's context channel — delivered verbatim as a custom
-//     message's content, with SITUATIONAL_CONTEXT_CUSTOM_TYPE as delivery
-//     metadata only.
-//   - setSituationalContextLive() (warm-spare claim) — the same verbatim
-//     delivery, `deliverAs: 'nextTurn'`.
-//   - buildContextBearingsFromState() / buildForkBearingsFromState() — the card
-//     is placed in the bearings body, where it is deliberately a nested card
-//     inside the outer `bearings` card. The only nesting site in the system.
-//
-// The visible revive kickoff carries NO situational context: a fresh or cycling
-// revive receives it through the session-start bearings instead.
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { situationalContextPath, nodeDir } from '../canvas/paths.js';
-import { formatCard, parseCard } from '../../shared/generated-context.js';
-/** The `customType` stamped on the hidden custom message the inbox watcher
- *  sends for an existing node's situational-context update. */
-export { SITUATIONAL_CONTEXT_CUSTOM_TYPE } from '../../shared/generated-context.js';
-/** Render prose supplied through a `situational_context` string entry point
- *  (`crtr node message --situational-context`, the node-create seed) as the
- *  card the sidecar stores. Card-supplying callers pass their own rendered
- *  envelope to `appendSituationalContext` instead. Blank prose renders as ''
- *  so the sidecar write stays a no-op rather than storing an empty card. */
-export function formatSituationalProse(prose) {
-    return prose.trim() === '' ? '' : formatCard('situational', {}, prose);
-}
-/** Upsert the node's current situational context (replace, not append) — the
- *  one sanctioned writer for the sidecar, taking an ALREADY-RENDERED envelope.
- *  No-op for blank text, so a caller can pass through an optional/empty value
- *  with no guard at the call site. */
-export function appendSituationalContext(nodeId, text) {
-    const body = text.trim();
-    if (body === '')
-        return;
-    mkdirSync(nodeDir(nodeId), { recursive: true });
-    writeFileSync(situationalContextPath(nodeId), body + '\n', 'utf8');
-}
-/** Read the stored text, or null if none was ever set. Module-private:
- *  `situationalContextEnvelope` is the one read, and it shape-checks. */
-function readSituationalContext(nodeId) {
-    const p = situationalContextPath(nodeId);
-    if (!existsSync(p))
-        return null;
-    const body = readFileSync(p, 'utf8').trim();
-    return body !== '' ? body : null;
-}
-/** The node's stored situational card, verbatim, or null when none is set.
- *  The ONE read of the sidecar. A sidecar written before the card cut holds
- *  bare prose; that single legacy branch lives here alone and self-clears on
- *  the next situation change. */
-export function situationalContextEnvelope(nodeId) {
-    const text = readSituationalContext(nodeId);
-    if (text === null)
-        return null;
-    return parseCard({ content: text }) === null ? formatSituationalProse(text) : text;
-}
+var e=Object.defineProperty;var o=(t,n)=>e(t,"name",{value:n,configurable:!0});import{existsSync as u,readFileSync as a,writeFileSync as l,mkdirSync as f}from"node:fs";import{situationalContextPath as i,nodeDir as c}from"../canvas/paths.js";import{formatCard as m,parseCard as p}from"../../shared/generated-context.js";import{SITUATIONAL_CONTEXT_CUSTOM_TYPE as _}from"../../shared/generated-context.js";function s(t){return t.trim()===""?"":m("situational",{},t)}o(s,"formatSituationalProse");function T(t,n){const r=n.trim();r!==""&&(f(c(t),{recursive:!0}),l(i(t),r+`
+`,"utf8"))}o(T,"appendSituationalContext");function x(t){const n=i(t);if(!u(n))return null;const r=a(n,"utf8").trim();return r!==""?r:null}o(x,"readSituationalContext");function E(t){const n=x(t);return n===null?null:p({content:n})===null?s(n):n}o(E,"situationalContextEnvelope");export{_ as SITUATIONAL_CONTEXT_CUSTOM_TYPE,T as appendSituationalContext,s as formatSituationalProse,E as situationalContextEnvelope};

package/dist/core/runtime/situational-live.js

@@ -1,41 +1 @@
-// situational-live.ts — hand a node its situational context WITHOUT waking it.
-//
-// The sidecar (`situational-context.ts`) is the durable half: it stores one
-// rendered `situational` card, which every revive path nests into the bearings.
-// This module is the LIVE half for a node whose session has already passed
-// `session_start` — the warm-pool claim, where a spare booted with no
-// situational context is handed to a claimant that has one. The stored card is
-// delivered UNWRAPPED; the customType is delivery metadata only.
-//
-// It is deliberately NOT the inbox watcher's situational send. That seam exists
-// to WAKE a live node when its applet situation changes. A freshly-claimed
-// spare must not run a turn before its owner says anything, so this path uses
-// `nextTurn` delivery: the card rides the claimant's first real turn instead of
-// starting one.
-//
-// Everything below the sidecar write is the shared live-delivery path
-// (`deliver-live.ts`), which the claim's bearings delivery also rides.
-import { getNode } from '../canvas/index.js';
-import { deliverCustomMessageLive } from './deliver-live.js';
-import { appendSituationalContext, formatSituationalProse, situationalContextEnvelope, SITUATIONAL_CONTEXT_CUSTOM_TYPE, } from './situational-context.js';
-/** Write `text` (prose) to the node's sidecar and, when its broker is live,
- *  deliver the stored card into the running session for the NEXT turn.
- *
- *  Rejects when a live broker cannot be reached or refuses the frame — the
- *  caller decides what that means. For a warm claim it is fatal (a node holding
- *  the wrong situation is worse than a slow one), the same call the model swap
- *  makes. A DORMANT node needs no delivery at all: its next revive renders the
- *  sidecar into the kickoff. */
-export async function setSituationalContextLive(nodeId, text) {
-    appendSituationalContext(nodeId, formatSituationalProse(text));
-    if (getNode(nodeId) === null)
-        throw new Error(`setSituationalContextLive: unknown node ${nodeId}`);
-    const envelope = situationalContextEnvelope(nodeId);
-    if (envelope === null)
-        return; // no sidecar at all — blank text on a node that never had one
-    await deliverCustomMessageLive(nodeId, {
-        customType: SITUATIONAL_CONTEXT_CUSTOM_TYPE,
-        content: envelope,
-        deliverAs: 'nextTurn',
-    });
-}
+var i=Object.defineProperty;var n=(t,e)=>i(t,"name",{value:e,configurable:!0});import{getNode as r}from"../canvas/index.js";import{deliverCustomMessageLive as a}from"./deliver-live.js";import{appendSituationalContext as l,formatSituationalProse as u,situationalContextEnvelope as s,SITUATIONAL_CONTEXT_CUSTOM_TYPE as m}from"./situational-context.js";async function C(t,e){if(l(t,u(e)),r(t)===null)throw new Error(`setSituationalContextLive: unknown node ${t}`);const o=s(t);o!==null&&await a(t,{customType:m,content:o,deliverAs:"nextTurn"})}n(C,"setSituationalContextLive");export{C as setSituationalContextLive};

package/dist/core/runtime/spawn-env.js

@@ -1,255 +1 @@
-// The spawn-env boundary (design: C-1 crtr substrate spawn-env boundary).
-//
-// One authoritative builder for every broker child's process env. The prior
-// shape was `{ ...process.env, ...inv.env }` — the whole host env, including
-// every ambient credential (`MISTRAL_API_KEY`, `GITHUB_TOKEN`, `AWS_*`, …),
-// inherited verbatim into the broker and, through it, into pi's bash tool
-// (`printenv`/`ps eww` both expose it). This module replaces that spread with
-// a default-deny allowlist: nothing in `process.env` crosses unless it is a
-// literal non-secret operational name (A1), a value-guarded proxy var (A2), a
-// configured model-provider key (B), or an explicit `spawnEnv.allow` entry
-// (C). A separate source E, the TARGET profile's own `profile env` store
-// (`core/profiles/env-store.ts`), is read directly off disk — never through
-// `process.env` — and injected unconditionally: storing a value there IS the
-// operator's consent to cross the boundary, so it needs no matching
-// `spawnEnv.allow` entry. `inv.env` (D) is crtr-constructed and trusted, so
-// it overlays unconditionally, layered after E.
-//
-// One name IS rewritten rather than merely admitted: `PATH`. Bare-binary
-// contributions (`bin` in a plugin manifest or a scope `config.json`) are
-// materialized into a crouter-owned shim directory by
-// `core/runtime/bin-contributions.ts`, and that directory is PREPENDED here so
-// a declared bare command wins its name in every node's bash. The admitted
-// host PATH stays intact behind it.
-//
-// `GIT_*` is deliberately absent from the allowlist: the whole namespace is an
-// auth/config-injection surface (`GIT_CONFIG_KEY_*`/`GIT_CONFIG_VALUE_*`,
-// `GIT_ASKPASS`, `GIT_SSH_COMMAND`), not a non-secret operational family, and
-// ordinary git needs none of it (identity/credential-helper config via
-// `~/.gitconfig`, reached through the allowlisted `HOME`; SSH remotes via the
-// allowlisted `SSH_AUTH_SOCK`). A deliberate `GIT_*` need goes through
-// `spawnEnv.allow`.
-import { statSync } from 'node:fs';
-import { delimiter, resolve } from 'node:path';
-import { readMergedLaunchConfig } from '../config.js';
-import { readProfileEnvVars } from '../profiles/env-store.js';
-import { metadataEnvName, readProfileMetadata } from '../profiles/manifest.js';
-import { binShimDirFor } from './bin-contributions.js';
-import { FRONT_DOOR_ENV } from './front-door-env.js';
-/** A1 — literal env-var names copied verbatim (no value inspection): a login
- *  shell plus dev toolchain needs exactly these, and none of them can carry a
- *  credential. */
-const OPERATIONAL_LITERAL_NAMES = new Set([
-    'HOME',
-    'PATH',
-    'SHELL',
-    'USER',
-    'LOGNAME',
-    'PWD',
-    'TMPDIR',
-    'TERM',
-    'TERMINFO',
-    'COLORTERM',
-    'LANG',
-    'LANGUAGE',
-    'TZ',
-    'NO_PROXY',
-    'no_proxy',
-    'SSH_AUTH_SOCK',
-    // Bash safety-valve deadline override (ms) — an operator-wide knob set in
-    // the daemon's own ambient env, not a per-node secret.
-    'CRTR_BASH_VALVE_MS',
-]);
-/** A1 — prefixes admitted in full: each is a structurally non-secret family
- *  (locale, XDG base-dir paths, pi's own config/rendering knobs — pi's auth is
- *  file-backed in `auth.json`, never an env value). `GIT_` is NOT here — see
- *  module comment. */
-const OPERATIONAL_PREFIXES = ['LC_', 'XDG_', 'PI_'];
-/** The unshimmed PATH admitted from the host. Broker and cron shells resolve
- *  crouter-owned executables from this value, while commands those shells run
- *  still receive the shim-prepended PATH. */
-export const ADMITTED_HOST_PATH_ENV = 'CRTR_ADMITTED_HOST_PATH';
-/** Resolve a regular executable against a shell PATH without executing it.
- *  The result is absolute, or null when no PATH entry supplies the command. */
-export function resolvePathExecutable(name, env, cwd) {
-    const pathValue = env['PATH'];
-    if (pathValue === undefined || pathValue === '')
-        return null;
-    for (const directory of pathValue.split(delimiter)) {
-        const candidate = resolve(cwd, directory === '' ? '.' : directory, name);
-        try {
-            const stat = statSync(candidate);
-            if (stat.isFile() && (stat.mode & 0o111) !== 0)
-                return candidate;
-        }
-        catch {
-            // Keep searching exactly as PATH resolution does.
-        }
-    }
-    return null;
-}
-export function resolveAdmittedHostCommand(name, env, cwd) {
-    const pathValue = env[ADMITTED_HOST_PATH_ENV] ?? env['PATH'];
-    if (pathValue === undefined || pathValue === '') {
-        throw new Error(`cannot resolve crouter-owned ${name}: the admitted host PATH is empty`);
-    }
-    const command = resolvePathExecutable(name, { PATH: pathValue }, cwd);
-    if (command !== null)
-        return command;
-    throw new Error(`cannot resolve crouter-owned ${name} from the admitted host PATH`);
-}
-/** A2 — proxy var names. Admitted only when the value's URL authority carries
- *  no userinfo component (no `user@` / `user:pass@`) — the one value-inspected
- *  entry in the whole builder, because a proxy var is the single operational
- *  name whose *value* (not name) can carry a secret. */
-const PROXY_NAMES = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy'];
-/** B — the exact env-var name of each crtr-configured model provider's API
- *  key. Deliberately an explicit provider→env-key mapping, NOT inferred from
- *  `MODEL_PROVIDER_KEYS` in launch.ts (that constant is a provider-ID list —
- *  `['anthropic', 'openai']` — not env-var names; conflating the two would
- *  silently admit the wrong names the moment either list changes). */
-const PROVIDER_ENV_KEYS = {
-    anthropic: 'ANTHROPIC_API_KEY',
-    openai: 'OPENAI_API_KEY',
-};
-/** True when `value` is an absolute `http(s)` proxy URL with a host and NO
- *  embedded userinfo (`user@` / `user:pass@` / `:pass@`) — the only shape
- *  allowed to cross by default. Rejects three leak shapes a naive
- *  `new URL(value).username === ''` check misses:
- *   - password-only authority (`http://:pass@host`) — `username` is empty but
- *     `password` is not, so both must be checked.
- *   - scheme-less userinfo (`user:pass@host:3128`, no `http(s)://` prefix) —
- *     `URL` parses the text before the first `:` as a CUSTOM scheme (here
- *     `user:`), leaving `username`/`password` both empty even though the
- *     value plainly carries credentials. Requiring `protocol` to be exactly
- *     `http:`/`https:` rejects this shape before userinfo parsing could ever
- *     be fooled by it, rather than normalizing/re-parsing a scheme-less form.
- *   - anything else unparseable, protocol-mismatched, or hostless — safe-fail
- *     to "never admit" rather than silently passing a value through. */
-function isCredentialFreeProxyValue(value) {
-    let parsed;
-    try {
-        parsed = new URL(value);
-    }
-    catch {
-        return false;
-    }
-    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
-        return false;
-    if (parsed.hostname === '')
-        return false;
-    if (parsed.username !== '' || parsed.password !== '')
-        return false;
-    return true;
-}
-/** Anchored FULL-STRING glob match for one `spawnEnv.allow` entry: `*` matches
- *  any (possibly empty) run of characters; every other character — including
- *  regex metacharacters — matches literally. A pattern with no `*` is a plain
- *  exact-name match (the common case, and the only shape prior to this fix).
- *  A bare/all-`*` "match everything" pattern is rejected earlier, at config
- *  read (`core/config.ts`'s `mergeSpawnEnv`), so it can never reach here. */
-function matchesAllowPattern(name, pattern) {
-    if (!pattern.includes('*'))
-        return name === pattern;
-    const escaped = pattern
-        .split('*')
-        .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
-        .join('.*');
-    return new RegExp(`^${escaped}$`).test(name);
-}
-/** Sources A–C: the operational base shared by the broker boundary (this
- *  module's `buildBrokerEnv`) and cron executor — the single shared definition
- *  of "non-secret host state the runtime exposes to any spawned shell." Does not include
- *  `inv.env`/`FRONT_DOOR_ENV` (source D), which is broker-specific. */
-export function buildOperationalEnvBase(opts) {
-    const host = opts.host ?? process.env;
-    const out = {};
-    // A1 — literal names + non-secret prefixes, copied verbatim.
-    for (const [key, value] of Object.entries(host)) {
-        if (value === undefined)
-            continue;
-        if (OPERATIONAL_LITERAL_NAMES.has(key) || OPERATIONAL_PREFIXES.some((prefix) => key.startsWith(prefix))) {
-            out[key] = value;
-        }
-    }
-    // A2 — proxy vars, admitted only past the userinfo guard.
-    for (const key of PROXY_NAMES) {
-        const value = host[key];
-        if (value !== undefined && isCredentialFreeProxyValue(value))
-            out[key] = value;
-    }
-    // B — configured model-provider keys, by exact env-var name.
-    for (const envKey of Object.values(PROVIDER_ENV_KEYS)) {
-        const value = host[envKey];
-        if (value !== undefined)
-            out[envKey] = value;
-    }
-    // C — explicit config-declared extra allowlist (literal names and/or
-    // globs), resolved from the TARGET's own cwd/profile scope (default empty).
-    const allow = readMergedLaunchConfig(opts.targetCwd, opts.targetProfileId).spawnEnv.allow;
-    if (allow.length > 0) {
-        for (const [key, value] of Object.entries(host)) {
-            if (value === undefined)
-                continue;
-            if (allow.some((pattern) => matchesAllowPattern(key, pattern)))
-                out[key] = value;
-        }
-    }
-    // Preserve the unshimmed admitted host PATH across broker and cron children.
-    // A nested `crtr` launched from an agent inherits this constructed value,
-    // rather than mistaking its shim-prepended PATH for the host path.
-    const admittedHostPath = host[ADMITTED_HOST_PATH_ENV] ?? out['PATH'];
-    if (admittedHostPath !== undefined && admittedHostPath !== '')
-        out[ADMITTED_HOST_PATH_ENV] = admittedHostPath;
-    // Bare-binary contributions (`core/runtime/bin-contributions.ts`): the shim
-    // dir holding one symlink per declared bare command, PREPENDED so a
-    // contribution wins its name, with the host PATH admitted above left intact
-    // behind it. Resolved from the TARGET's own cwd/profile like source C.
-    const shimDir = binShimDirFor(opts.targetCwd, opts.targetProfileId);
-    if (shimDir !== null) {
-        const hostPath = out['PATH'];
-        out['PATH'] = hostPath === undefined || hostPath === '' ? shimDir : `${shimDir}:${hostPath}`;
-    }
-    return out;
-}
-/** Source F — the TARGET profile's manifest `metadata`, each entry surfaced
- *  as `CRTR_PROFILE_META_<KEY>` (key uppercased, every non-alphanumeric run
- *  → `_`). Identity facts rather than secrets — unlike the env store these
- *  are readable back (`profile show`, ProfileDTO). Read straight off the
- *  manifest at every launch; never throws (a bad profile id yields `{}`). */
-export function profileMetadataEnv(profileId) {
-    const out = {};
-    for (const [key, value] of Object.entries(readProfileMetadata(profileId))) {
-        out[metadataEnvName(key)] = value;
-    }
-    return out;
-}
-/** The one authoritative broker child env: sources A–C (the operational
- *  base, resolved from the TARGET node's own cwd/profile — `inv.env`'s
- *  `CRTR_NODE_CWD`/`CRTR_PROFILE_ID`, never this process's ambient
- *  `process.cwd()`/`CRTR_PROFILE_ID`, which may be a launcher's or the
- *  daemon's own and belong to an unrelated scope), E — the TARGET profile's
- *  own `profile env` store (`readProfileEnvVars`, `core/profiles/env-store.ts`)
- *  read directly off disk and injected regardless of the host env or any
- *  `spawnEnv.allow` entry (setting a value there IS the consent to cross this
- *  boundary), F — the TARGET profile's manifest metadata as
- *  `CRTR_PROFILE_META_*` (`profileMetadataEnv` above), plus D — the trusted,
- *  crtr-constructed `inv.env` overlay and the
- *  fork-bomb recursion guard `FRONT_DOOR_ENV=1`. D is layered last so crtr's
- *  own constructed env always wins a name collision with a stored profile
- *  value. Every broker launch (front-door root, managed child, `--root`,
- *  every revive/daemon relaunch) funnels through `headlessBrokerHost.launch()`,
- *  which calls this. */
-export function buildBrokerEnv(inv) {
-    const targetCwd = inv.env['CRTR_NODE_CWD'] ?? process.cwd();
-    const targetProfileId = inv.env['CRTR_PROFILE_ID'] || null;
-    const operational = buildOperationalEnvBase({ targetCwd, targetProfileId });
-    return {
-        ...operational,
-        ...profileMetadataEnv(targetProfileId),
-        ...readProfileEnvVars(targetProfileId),
-        ...inv.env,
-        [ADMITTED_HOST_PATH_ENV]: operational[ADMITTED_HOST_PATH_ENV],
-        [FRONT_DOOR_ENV]: '1',
-    };
-}
+var u=Object.defineProperty;var a=(e,t)=>u(e,"name",{value:t,configurable:!0});import{statSync as d}from"node:fs";import{delimiter as P,resolve as E}from"node:path";import{readMergedLaunchConfig as T}from"../config.js";import{readProfileEnvVars as _}from"../profiles/env-store.js";import{metadataEnvName as p,readProfileMetadata as m}from"../profiles/manifest.js";import{binShimDirFor as A}from"./bin-contributions.js";import{FRONT_DOOR_ENV as O}from"./front-door-env.js";const R=new Set(["HOME","PATH","SHELL","USER","LOGNAME","PWD","TMPDIR","TERM","TERMINFO","COLORTERM","LANG","LANGUAGE","TZ","NO_PROXY","no_proxy","SSH_AUTH_SOCK","CRTR_BASH_VALVE_MS"]),h=["LC_","XDG_","PI_"],f="CRTR_ADMITTED_HOST_PATH";function H(e,t,o){const n=t.PATH;if(n===void 0||n==="")return null;for(const s of n.split(P)){const c=E(o,s===""?".":s,e);try{const r=d(c);if(r.isFile()&&(r.mode&73)!==0)return c}catch{}}return null}a(H,"resolvePathExecutable");function $(e,t,o){const n=t[f]??t.PATH;if(n===void 0||n==="")throw new Error(`cannot resolve crouter-owned ${e}: the admitted host PATH is empty`);const s=H(e,{PATH:n},o);if(s!==null)return s;throw new Error(`cannot resolve crouter-owned ${e} from the admitted host PATH`)}a($,"resolveAdmittedHostCommand");const v=["HTTP_PROXY","HTTPS_PROXY","http_proxy","https_proxy"],I={anthropic:"ANTHROPIC_API_KEY",openai:"OPENAI_API_KEY"};function w(e){let t;try{t=new URL(e)}catch{return!1}return!(t.protocol!=="http:"&&t.protocol!=="https:"||t.hostname===""||t.username!==""||t.password!=="")}a(w,"isCredentialFreeProxyValue");function N(e,t){if(!t.includes("*"))return e===t;const o=t.split("*").map(n=>n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")).join(".*");return new RegExp(`^${o}$`).test(e)}a(N,"matchesAllowPattern");function S(e){const t=e.host??process.env,o={};for(const[r,i]of Object.entries(t))i!==void 0&&(R.has(r)||h.some(l=>r.startsWith(l)))&&(o[r]=i);for(const r of v){const i=t[r];i!==void 0&&w(i)&&(o[r]=i)}for(const r of Object.values(I)){const i=t[r];i!==void 0&&(o[r]=i)}const n=T(e.targetCwd,e.targetProfileId).spawnEnv.allow;if(n.length>0)for(const[r,i]of Object.entries(t))i!==void 0&&n.some(l=>N(r,l))&&(o[r]=i);const s=t[f]??o.PATH;s!==void 0&&s!==""&&(o[f]=s);const c=A(e.targetCwd,e.targetProfileId);if(c!==null){const r=o.PATH;o.PATH=r===void 0||r===""?c:`${c}:${r}`}return o}a(S,"buildOperationalEnvBase");function C(e){const t={};for(const[o,n]of Object.entries(m(e)))t[p(o)]=n;return t}a(C,"profileMetadataEnv");function F(e){const t=e.env.CRTR_NODE_CWD??process.cwd(),o=e.env.CRTR_PROFILE_ID||null,n=S({targetCwd:t,targetProfileId:o});return{...n,...C(o),..._(o),...e.env,[f]:n[f],[O]:"1"}}a(F,"buildBrokerEnv");export{f as ADMITTED_HOST_PATH_ENV,F as buildBrokerEnv,S as buildOperationalEnvBase,C as profileMetadataEnv,$ as resolveAdmittedHostCommand,H as resolvePathExecutable};