@odla-ai/harness 0.1.0

package/dist/chunk-PHXQH4YM.js

@@ -0,0 +1,550 @@
+import {
+  encodeAgentInput,
+  parseAgentOutput
+} from "./chunk-GE6CCN7W.js";
+import {
+  HARNESS_PROTOCOL_VERSION
+} from "./chunk-QTUEF2HZ.js";
+
+// src/container.ts
+import { execFile, spawn } from "child_process";
+import { constants } from "fs";
+import { access } from "fs/promises";
+import { delimiter, join } from "path";
+import { getgid, getuid } from "process";
+var DIGEST_IMAGE = /^[a-z0-9][a-z0-9._/-]*(?::[a-zA-Z0-9._-]+)?@sha256:[0-9a-f]{64}$/;
+function assertPinnedImage(image) {
+  if (!DIGEST_IMAGE.test(image)) throw new TypeError("container image must be pinned by sha256 digest");
+}
+async function commandAvailable(engine) {
+  for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
+    try {
+      await access(join(directory, engine), constants.X_OK);
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function selectContainerEngine(requested = "auto", options = {}) {
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const uid = options.uid ?? (typeof getuid === "function" ? getuid() : 1e3);
+  const available = options.available ?? commandAvailable;
+  const validate = async (engine) => {
+    if (engine === "container" && (platform !== "darwin" || arch !== "arm64")) {
+      throw new TypeError("Apple container requires Apple Silicon macOS");
+    }
+    if (engine === "podman" && platform === "linux" && uid === 0) {
+      throw new TypeError("the Linux harness requires rootless Podman; do not run the runner as root");
+    }
+    if (!await available(engine)) throw new TypeError(`${engine} is not installed or executable`);
+    return engine;
+  };
+  if (requested !== "auto") return validate(requested);
+  const candidates = platform === "darwin" ? arch === "arm64" ? ["container", "podman"] : ["podman"] : platform === "linux" ? ["podman"] : [];
+  for (const engine of candidates) {
+    if (await available(engine)) return validate(engine);
+  }
+  if (platform === "linux") {
+    throw new TypeError("no rootless Podman found; install Podman or explicitly choose --engine docker after reviewing its daemon boundary");
+  }
+  if (platform === "darwin") {
+    throw new TypeError("Apple container is not installed; on Apple Silicon macOS 26 run `brew install container`, then retry (Podman Machine is the fallback)");
+  }
+  throw new TypeError("no supported container engine found");
+}
+function inspectRootlessPodman() {
+  return new Promise((resolve3, reject) => {
+    execFile(
+      "podman",
+      ["info", "--format", "{{.Host.Security.Rootless}}"],
+      { encoding: "utf8", maxBuffer: 16 * 1024, timeout: 1e4 },
+      (error, stdout) => {
+        if (error) {
+          reject(new TypeError("could not verify that the active Podman service is rootless"));
+          return;
+        }
+        resolve3(stdout.trim() === "true");
+      }
+    );
+  });
+}
+async function verifyContainerEngineBoundary(engine, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const uid = options.uid ?? (typeof getuid === "function" ? getuid() : 1e3);
+  if (engine === "container" && (platform !== "darwin" || arch !== "arm64")) {
+    throw new TypeError("Apple container requires Apple Silicon macOS");
+  }
+  if (engine !== "podman" || platform !== "linux") return;
+  if (uid === 0) throw new TypeError("the Linux harness requires rootless Podman; do not run the runner as root");
+  const rootless = await (options.podmanRootless ?? inspectRootlessPodman)();
+  if (!rootless) throw new TypeError("the active Podman service is not rootless; refusing to run the harness");
+}
+function buildContainerRunArgs(options) {
+  if (!options.allowUnpinnedImage) assertPinnedImage(options.image);
+  if (/[,\r\n]/.test(options.workspaceDir)) throw new TypeError("workspace path contains unsupported mount characters");
+  const uid = typeof getuid === "function" ? getuid() : 1e3;
+  const gid = typeof getgid === "function" ? getgid() : 1e3;
+  const safeAttempt = options.task.attemptId.toLowerCase().replace(/[^a-z0-9_.-]/g, "-").slice(0, 40);
+  const name = `odla-harness-${safeAttempt}-${crypto.randomUUID().slice(0, 8)}`;
+  const limits = options.limits ?? {};
+  const access2 = options.workspaceAccess ?? "read-write";
+  const appleMount = access2 === "none" ? [] : [`--mount=type=bind,source=${options.workspaceDir},target=/workspace${access2 === "read-only" ? ",readonly" : ""}`];
+  const ociMount = access2 === "none" ? [] : [`--mount=type=bind,src=${options.workspaceDir},dst=/workspace${access2 === "read-only" ? ",readonly" : ""}`];
+  if (options.engine === "container") {
+    return [
+      "run",
+      "--rm",
+      "--interactive",
+      `--name=${name}`,
+      "--network=none",
+      "--read-only",
+      "--cap-drop=ALL",
+      `--memory=${limits.memory ?? "1g"}`,
+      `--cpus=${limits.cpus ?? 1}`,
+      `--user=${uid}:${gid}`,
+      "--tmpfs=/tmp",
+      ...appleMount,
+      "--workdir=/workspace",
+      `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,
+      `--label=ai.odla.harness.attempt=${options.task.attemptId}`,
+      options.image
+    ];
+  }
+  return [
+    "run",
+    "--rm",
+    "--interactive",
+    `--name=${name}`,
+    "--pull=never",
+    "--network=none",
+    "--read-only",
+    "--cap-drop=ALL",
+    "--security-opt=no-new-privileges",
+    `--pids-limit=${limits.pids ?? 256}`,
+    `--memory=${limits.memory ?? "1g"}`,
+    `--cpus=${limits.cpus ?? 1}`,
+    `--user=${uid}:${gid}`,
+    `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfsBytes ?? 64 * 1024 * 1024}`,
+    ...ociMount,
+    "--workdir=/workspace",
+    `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,
+    `--label=ai.odla.harness.attempt=${options.task.attemptId}`,
+    options.image
+  ];
+}
+function containerName(args) {
+  return args.find((arg) => arg.startsWith("--name=")).slice("--name=".length);
+}
+async function runContainerAttempt(options) {
+  if (options.signal?.aborted) return { exitCode: 1, status: "cancelled", stderr: "" };
+  await verifyContainerEngineBoundary(options.engine);
+  const args = buildContainerRunArgs(options);
+  const name = containerName(args);
+  const child = spawn(options.engine, args, { stdio: ["pipe", "pipe", "pipe"], shell: false });
+  let stderr = "";
+  let outputBytes = 0;
+  let complete = null;
+  let stopped = false;
+  let exited = false;
+  child.stderr.setEncoding("utf8");
+  child.stderr.on("data", (text) => {
+    if (stderr.length < 64 * 1024) stderr += text.slice(0, 64 * 1024 - stderr.length);
+  });
+  const stop = (reason) => {
+    if (stopped || exited) return;
+    stopped = true;
+    if (!child.stdin.destroyed) {
+      const cancel = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "attempt.cancel", reason };
+      child.stdin.write(encodeAgentInput(cancel));
+    }
+    const removeArgs = options.engine === "container" ? ["delete", "--force", name] : ["rm", "-f", name];
+    const killer = spawn(options.engine, removeArgs, { stdio: "ignore", shell: false });
+    killer.unref();
+  };
+  const abort = () => stop("runner_cancelled");
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const timeout = setTimeout(() => stop("timeout"), options.task.policy.timeoutMs);
+  const start = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "task.start", task: options.task };
+  if (!stopped && !options.signal?.aborted) child.stdin.write(encodeAgentInput(start));
+  const consume = (async () => {
+    let pending = Buffer.alloc(0);
+    const handleLine = async (raw) => {
+      const bytes = raw.at(-1) === 13 ? raw.subarray(0, -1) : raw;
+      if (bytes.byteLength > 1e6) throw new Error("agent message exceeds 1 MB");
+      const line = bytes.toString("utf8");
+      if (!line.trim()) return;
+      const message = parseAgentOutput(line);
+      if (message.type === "attempt.complete") complete = message;
+      const response = await options.onMessage(message);
+      if (response && !child.stdin.destroyed) child.stdin.write(encodeAgentInput(response));
+    };
+    try {
+      for await (const raw of child.stdout) {
+        const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+        outputBytes += chunk.byteLength;
+        if (outputBytes > options.task.policy.maxOutputBytes) {
+          throw new Error(`agent output exceeds ${options.task.policy.maxOutputBytes} bytes`);
+        }
+        pending = Buffer.concat([pending, chunk]);
+        let newline = pending.indexOf(10);
+        while (newline >= 0) {
+          await handleLine(pending.subarray(0, newline));
+          pending = pending.subarray(newline + 1);
+          newline = pending.indexOf(10);
+        }
+        if (pending.byteLength > 1e6) throw new Error("agent message exceeds 1 MB");
+      }
+      if (pending.byteLength) await handleLine(pending);
+    } catch (error) {
+      stop("protocol_error");
+      throw error;
+    }
+  })();
+  const exit = new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code) => {
+      exited = true;
+      accept(code ?? 1);
+    });
+  });
+  try {
+    const [exitCode] = await Promise.all([exit, consume]);
+    if (stderr && options.onStderr) await options.onStderr(stderr);
+    if (options.signal?.aborted) return { exitCode, status: "cancelled", stderr };
+    const terminal = complete;
+    if (!terminal) return { exitCode, status: "failed", result: { error: "agent exited without completion" }, stderr };
+    return { exitCode, status: exitCode === 0 ? terminal.status : "failed", result: terminal.result, stderr };
+  } catch (error) {
+    stop("runner_error");
+    await exit.catch(() => 1);
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+    options.signal?.removeEventListener("abort", abort);
+  }
+}
+
+// src/workspace-git-tree.ts
+import { mkdir, mkdtemp, realpath, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join2, resolve, sep } from "path";
+import { spawn as spawn2 } from "child_process";
+
+// src/workspace-policy.ts
+import { isAbsolute } from "path";
+var SKIP_WORKSPACE_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  ".odla",
+  ".wrangler",
+  "node_modules",
+  "dist",
+  "coverage"
+]);
+var SECRET_WORKSPACE_FILE = /^(?:\.env(?:\..+)?|\.dev\.vars|\.dev-token(?:\..+)?|credentials(?:\..+)?\.json|dev-token(?:\..+)?(?:\.json)?)$/i;
+function allowedWorkspacePath(relativePath) {
+  const parts = relativePath.split("/");
+  return !isAbsolute(relativePath) && !relativePath.includes("\\") && !relativePath.includes("\0") && !parts.some((part) => !part || part === "." || part === ".." || SKIP_WORKSPACE_DIRS.has(part)) && !SECRET_WORKSPACE_FILE.test(parts.at(-1) ?? "");
+}
+
+// src/workspace-git-tree.ts
+async function gitOutput(cwd, args, maxBytes) {
+  const child = spawn2("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], shell: false });
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  child.stdout.on("data", (chunk) => {
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (bytes > maxBytes) throw new Error(`git output exceeds ${maxBytes} bytes`);
+  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  return Buffer.concat(stdout);
+}
+async function gitBlobs(cwd, entries, maxBytes) {
+  const child = spawn2("git", ["cat-file", "--batch"], { cwd, stdio: ["pipe", "pipe", "pipe"], shell: false });
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  child.stdout.on("data", (chunk) => {
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes + entries.length * 100) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  child.stdin.end(`${entries.map((entry) => entry.hash).join("\n")}
+`);
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (bytes > maxBytes + entries.length * 100) throw new Error(`Git tree exceeds ${maxBytes} bytes`);
+  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  const output = Buffer.concat(stdout);
+  const blobs = [];
+  let offset = 0;
+  let total = 0;
+  for (const entry of entries) {
+    const newline = output.indexOf(10, offset);
+    if (newline < 0) throw new Error("git object output is truncated");
+    const match = /^([0-9a-f]{40,64}) blob ([0-9]+)$/.exec(output.subarray(offset, newline).toString("utf8"));
+    if (!match || match[1] !== entry.hash) throw new Error("git object output does not match its inventory");
+    const length = Number(match[2]);
+    if (!Number.isSafeInteger(length) || length < 0 || newline + 1 + length >= output.length) {
+      throw new Error("git object output has an invalid length");
+    }
+    const content = output.subarray(newline + 1, newline + 1 + length);
+    if (output[newline + 1 + length] !== 10) throw new Error("git object output is malformed");
+    total += content.byteLength;
+    if (total > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+    blobs.push(content);
+    offset = newline + 1 + length + 1;
+  }
+  return blobs;
+}
+async function materializeGitTree(source, commitSha, options = {}) {
+  if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new TypeError("Git tree requires an exact commit SHA");
+  const sourceDir = await realpath(resolve(source));
+  const maxFiles = options.maxFiles ?? 2e4;
+  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+  const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
+  const entries = inventory.flatMap((record) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record);
+    return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
+  });
+  if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+  const root = await mkdtemp(join2(options.tempRoot ?? tmpdir(), "odla-git-tree-"));
+  const targetRoot = join2(root, "source");
+  await mkdir(targetRoot);
+  let byteCount = 0;
+  try {
+    const blobs = await gitBlobs(sourceDir, entries, maxBytes);
+    for (const [index, entry] of entries.entries()) {
+      const content = blobs[index];
+      byteCount += content.byteLength;
+      if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+      const target = resolve(targetRoot, entry.path);
+      if (!target.startsWith(`${resolve(targetRoot)}${sep}`)) throw new TypeError("Git tree path escapes workspace");
+      await mkdir(resolve(target, ".."), { recursive: true });
+      await writeFile(target, content, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
+    }
+    return {
+      root,
+      sourceDir: targetRoot,
+      fileCount: entries.length,
+      byteCount,
+      cleanup: () => rm(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await rm(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+// src/workspace.ts
+import { chmod, copyFile, lstat, mkdir as mkdir2, mkdtemp as mkdtemp2, readdir, realpath as realpath2, rm as rm2, stat } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { basename, join as join3, relative, resolve as resolve2, sep as sep2 } from "path";
+import { spawn as spawn3 } from "child_process";
+async function sourceFiles(sourceDir, maxFiles, maxBytes) {
+  const files = [];
+  let bytes = 0;
+  const walk = async (dir) => {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
+      if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;
+      const path = join3(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        await walk(path);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const metadata = await stat(path);
+      bytes += metadata.size;
+      if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+      if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+      files.push({
+        source: path,
+        relativePath: relative(sourceDir, path),
+        mode: metadata.mode & 511,
+        bytes: metadata.size
+      });
+    }
+  };
+  await walk(sourceDir);
+  return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+}
+async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
+  const child = spawn3("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd: sourceDir,
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false
+  });
+  const stdout = [];
+  const stderr = [];
+  let outputBytes = 0;
+  child.stdout.on("data", (chunk) => {
+    outputBytes += chunk.byteLength;
+    if (outputBytes > 8 * 1024 * 1024) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
+  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
+  if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+  const root = resolve2(sourceDir);
+  const files = [];
+  let bytes = 0;
+  for (const relativePath of paths) {
+    if (!allowedWorkspacePath(relativePath)) continue;
+    const source = resolve2(root, relativePath);
+    if (!source.startsWith(`${root}${sep2}`)) throw new TypeError("git file path escapes workspace");
+    let metadata;
+    try {
+      metadata = await lstat(source);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    if (metadata.isSymbolicLink() || !metadata.isFile()) continue;
+    bytes += metadata.size;
+    if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+    files.push({ source, relativePath, mode: metadata.mode & 511, bytes: metadata.size });
+  }
+  return files;
+}
+async function copyTree(files, destination) {
+  for (const file of files) {
+    const target = join3(destination, file.relativePath);
+    await mkdir2(resolve2(target, ".."), { recursive: true });
+    await copyFile(file.source, target);
+    await chmod(target, file.mode);
+  }
+}
+async function captureGitDiff(root, maxBytes) {
+  const child = spawn3("git", [
+    "diff",
+    "--no-index",
+    "--binary",
+    "--no-ext-diff",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    "--",
+    "baseline",
+    "workspace"
+  ], { cwd: root, stdio: ["ignore", "pipe", "pipe"], shell: false });
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  child.stdout.on("data", (chunk) => {
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (bytes > maxBytes) throw new Error(`patch exceeds ${maxBytes} bytes`);
+  if (code !== 0 && code !== 1) {
+    throw new Error(`git diff failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  }
+  return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
+}
+async function stageWorkspace(source, options = {}) {
+  const sourceDir = await realpath2(resolve2(source));
+  const sourceStat = await stat(sourceDir);
+  if (!sourceStat.isDirectory()) throw new TypeError("workspace source must be a directory");
+  const root = await mkdtemp2(join3(options.tempRoot ?? tmpdir2(), "odla-harness-"));
+  const baselineDir = join3(root, "baseline");
+  const workspaceDir = join3(root, "workspace");
+  await Promise.all([mkdir2(baselineDir), mkdir2(workspaceDir)]);
+  try {
+    const maxFiles = options.maxFiles ?? 2e4;
+    const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+    const files = options.gitTrackedAndUnignored ? await gitSourceFiles(sourceDir, maxFiles, maxBytes) : await sourceFiles(sourceDir, maxFiles, maxBytes);
+    await Promise.all([copyTree(files, baselineDir), copyTree(files, workspaceDir)]);
+    return {
+      root,
+      baselineDir,
+      workspaceDir,
+      fileCount: files.length,
+      byteCount: files.reduce((sum, file) => sum + file.bytes, 0),
+      patch: (maxBytes2) => captureGitDiff(root, maxBytes2),
+      cleanup: () => rm2(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await rm2(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+async function stageWorkspacePair(baselineSource, workspaceSource, options = {}) {
+  const baselineDirSource = await realpath2(resolve2(baselineSource));
+  const workspaceDirSource = await realpath2(resolve2(workspaceSource));
+  const maxFiles = options.maxFiles ?? 2e4;
+  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+  const [baselineFiles, workspaceFiles] = await Promise.all([
+    sourceFiles(baselineDirSource, maxFiles, maxBytes),
+    sourceFiles(workspaceDirSource, maxFiles, maxBytes)
+  ]);
+  const root = await mkdtemp2(join3(options.tempRoot ?? tmpdir2(), "odla-harness-"));
+  const baselineDir = join3(root, "baseline");
+  const workspaceDir = join3(root, "workspace");
+  await Promise.all([mkdir2(baselineDir), mkdir2(workspaceDir)]);
+  try {
+    await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);
+    return {
+      root,
+      baselineDir,
+      workspaceDir,
+      fileCount: workspaceFiles.length,
+      byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),
+      patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),
+      cleanup: () => rm2(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await rm2(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+function safeWorkspaceLabel(value) {
+  const label = basename(value).toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!label) throw new TypeError("workspace label is empty");
+  return label.slice(0, 80);
+}
+
+export {
+  assertPinnedImage,
+  selectContainerEngine,
+  verifyContainerEngineBoundary,
+  buildContainerRunArgs,
+  runContainerAttempt,
+  materializeGitTree,
+  stageWorkspace,
+  stageWorkspacePair,
+  safeWorkspaceLabel
+};
+//# sourceMappingURL=chunk-PHXQH4YM.js.map

package/dist/chunk-PHXQH4YM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/container.ts","../src/workspace-git-tree.ts","../src/workspace-policy.ts","../src/workspace.ts"],"sourcesContent":["import { execFile, spawn } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport { access } from \"node:fs/promises\";\nimport { delimiter, join } from \"node:path\";\nimport { getgid, getuid } from \"node:process\";\nimport { encodeAgentInput, parseAgentOutput } from \"./protocol\";\nimport {\n  HARNESS_PROTOCOL_VERSION,\n  type HarnessAgentInput,\n  type HarnessAgentOutput,\n  type HarnessTaskSpec,\n} from \"./types\";\n\nconst DIGEST_IMAGE = /^[a-z0-9][a-z0-9._/-]*(?::[a-zA-Z0-9._-]+)?@sha256:[0-9a-f]{64}$/;\n\n/** Supported command-line container engines for isolated harness attempts. */\nexport type ContainerEngine = \"container\" | \"podman\" | \"docker\";\n\n/** Host facts and executable probe used while selecting a safe container engine. */\nexport interface ContainerEngineSelectionOptions {\n  platform?: NodeJS.Platform;\n  arch?: string;\n  uid?: number;\n  available?: (engine: ContainerEngine) => Promise<boolean>;\n}\n\n/** Host facts and rootless probe used to verify the selected engine boundary. */\nexport interface ContainerEngineVerificationOptions {\n  platform?: NodeJS.Platform;\n  arch?: string;\n  uid?: number;\n  podmanRootless?: () => Promise<boolean>;\n}\n\n/** Optional CPU, memory, process, and temporary-filesystem limits for an attempt. */\nexport interface ContainerLimits {\n  cpus?: number;\n  memory?: string;\n  pids?: number;\n  tmpfsBytes?: number;\n}\n\n/** Container, task, callback, and cancellation settings for one agent attempt. */\nexport interface ContainerRunOptions {\n  engine: ContainerEngine;\n  image: string;\n  workspaceDir: string;\n  workspaceAccess?: \"read-write\" | \"read-only\" | \"none\";\n  task: HarnessTaskSpec;\n  limits?: ContainerLimits;\n  allowUnpinnedImage?: boolean;\n  signal?: AbortSignal;\n  onMessage(message: HarnessAgentOutput): Promise<HarnessAgentInput | void>;\n  onStderr?(text: string): Promise<void> | void;\n}\n\n/** Terminal container outcome and bounded diagnostic output returned to the runner. */\nexport interface ContainerRunResult {\n  exitCode: number;\n  status: \"completed\" | \"failed\" | \"cancelled\";\n  result?: unknown;\n  stderr: string;\n}\n\n/** Require an immutable OCI image reference pinned to a SHA-256 digest. */\nexport function assertPinnedImage(image: string): void {\n  if (!DIGEST_IMAGE.test(image)) throw new TypeError(\"container image must be pinned by sha256 digest\");\n}\n\nasync function commandAvailable(engine: ContainerEngine): Promise<boolean> {\n  for (const directory of (process.env.PATH ?? \"\").split(delimiter).filter(Boolean)) {\n    try { await access(join(directory, engine), constants.X_OK); return true; } catch { /* try the next PATH entry */ }\n  }\n  return false;\n}\n\n/** Choose the strongest installed local default without silently selecting a\n * rootful Linux daemon. Apple container is a per-container VM boundary;\n * rootless Podman is the Linux default; Docker remains explicit. */\nexport async function selectContainerEngine(\n  requested: ContainerEngine | \"auto\" = \"auto\",\n  options: ContainerEngineSelectionOptions = {},\n): Promise<ContainerEngine> {\n  const platform = options.platform ?? process.platform;\n  const arch = options.arch ?? process.arch;\n  const uid = options.uid ?? (typeof getuid === \"function\" ? getuid() : 1000);\n  const available = options.available ?? commandAvailable;\n  const validate = async (engine: ContainerEngine): Promise<ContainerEngine> => {\n    if (engine === \"container\" && (platform !== \"darwin\" || arch !== \"arm64\")) {\n      throw new TypeError(\"Apple container requires Apple Silicon macOS\");\n    }\n    if (engine === \"podman\" && platform === \"linux\" && uid === 0) {\n      throw new TypeError(\"the Linux harness requires rootless Podman; do not run the runner as root\");\n    }\n    if (!(await available(engine))) throw new TypeError(`${engine} is not installed or executable`);\n    return engine;\n  };\n  if (requested !== \"auto\") return validate(requested);\n  const candidates: ContainerEngine[] = platform === \"darwin\"\n    ? arch === \"arm64\" ? [\"container\", \"podman\"] : [\"podman\"]\n    : platform === \"linux\" ? [\"podman\"] : [];\n  for (const engine of candidates) {\n    if (await available(engine)) return validate(engine);\n  }\n  if (platform === \"linux\") {\n    throw new TypeError(\"no rootless Podman found; install Podman or explicitly choose --engine docker after reviewing its daemon boundary\");\n  }\n  if (platform === \"darwin\") {\n    throw new TypeError(\"Apple container is not installed; on Apple Silicon macOS 26 run `brew install container`, then retry (Podman Machine is the fallback)\");\n  }\n  throw new TypeError(\"no supported container engine found\");\n}\n\nfunction inspectRootlessPodman(): Promise<boolean> {\n  return new Promise((resolve, reject) => {\n    execFile(\n      \"podman\",\n      [\"info\", \"--format\", \"{{.Host.Security.Rootless}}\"],\n      { encoding: \"utf8\", maxBuffer: 16 * 1024, timeout: 10_000 },\n      (error, stdout) => {\n        if (error) {\n          reject(new TypeError(\"could not verify that the active Podman service is rootless\"));\n          return;\n        }\n        resolve(stdout.trim() === \"true\");\n      },\n    );\n  });\n}\n\n/** Fail closed if the selected engine cannot provide the promised host\n * boundary. This is checked for every attempt so a changed Podman connection\n * cannot silently turn a rootless Linux runner into a rootful one. */\nexport async function verifyContainerEngineBoundary(\n  engine: ContainerEngine,\n  options: ContainerEngineVerificationOptions = {},\n): Promise<void> {\n  const platform = options.platform ?? process.platform;\n  const arch = options.arch ?? process.arch;\n  const uid = options.uid ?? (typeof getuid === \"function\" ? getuid() : 1000);\n  if (engine === \"container\" && (platform !== \"darwin\" || arch !== \"arm64\")) {\n    throw new TypeError(\"Apple container requires Apple Silicon macOS\");\n  }\n  if (engine !== \"podman\" || platform !== \"linux\") return;\n  if (uid === 0) throw new TypeError(\"the Linux harness requires rootless Podman; do not run the runner as root\");\n  const rootless = await (options.podmanRootless ?? inspectRootlessPodman)();\n  if (!rootless) throw new TypeError(\"the active Podman service is not rootless; refusing to run the harness\");\n}\n\n/** Build hardened, networkless engine arguments without starting the container. */\nexport function buildContainerRunArgs(options: Omit<ContainerRunOptions, \"onMessage\" | \"onStderr\" | \"signal\">): string[] {\n  if (!options.allowUnpinnedImage) assertPinnedImage(options.image);\n  if (/[,\\r\\n]/.test(options.workspaceDir)) throw new TypeError(\"workspace path contains unsupported mount characters\");\n  const uid = typeof getuid === \"function\" ? getuid() : 1000;\n  const gid = typeof getgid === \"function\" ? getgid() : 1000;\n  const safeAttempt = options.task.attemptId.toLowerCase().replace(/[^a-z0-9_.-]/g, \"-\").slice(0, 40);\n  const name = `odla-harness-${safeAttempt}-${crypto.randomUUID().slice(0, 8)}`;\n  const limits = options.limits ?? {};\n  const access = options.workspaceAccess ?? \"read-write\";\n  const appleMount = access === \"none\" ? [] : [`--mount=type=bind,source=${options.workspaceDir},target=/workspace${access === \"read-only\" ? \",readonly\" : \"\"}`];\n  const ociMount = access === \"none\" ? [] : [`--mount=type=bind,src=${options.workspaceDir},dst=/workspace${access === \"read-only\" ? \",readonly\" : \"\"}`];\n  if (options.engine === \"container\") {\n    return [\n      \"run\", \"--rm\", \"--interactive\", `--name=${name}`,\n      \"--network=none\", \"--read-only\", \"--cap-drop=ALL\",\n      `--memory=${limits.memory ?? \"1g\"}`, `--cpus=${limits.cpus ?? 1}`,\n      `--user=${uid}:${gid}`, \"--tmpfs=/tmp\",\n      ...appleMount,\n      \"--workdir=/workspace\", `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,\n      `--label=ai.odla.harness.attempt=${options.task.attemptId}`,\n      options.image,\n    ];\n  }\n  return [\n    \"run\", \"--rm\", \"--interactive\", `--name=${name}`, \"--pull=never\",\n    \"--network=none\", \"--read-only\", \"--cap-drop=ALL\",\n    \"--security-opt=no-new-privileges\", `--pids-limit=${limits.pids ?? 256}`,\n    `--memory=${limits.memory ?? \"1g\"}`, `--cpus=${limits.cpus ?? 1}`,\n    `--user=${uid}:${gid}`,\n    `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfsBytes ?? 64 * 1024 * 1024}`,\n    ...ociMount,\n    \"--workdir=/workspace\", `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,\n    `--label=ai.odla.harness.attempt=${options.task.attemptId}`,\n    options.image,\n  ];\n}\n\nfunction containerName(args: string[]): string {\n  return args.find((arg) => arg.startsWith(\"--name=\"))!.slice(\"--name=\".length);\n}\n\n/** Execute one JSONL agent inside a hardened Apple container, Podman, or Docker\n * boundary. The\n * container has no network and receives no credentials; inference requests are\n * bridged over stdin/stdout to the trusted runner process. */\nexport async function runContainerAttempt(options: ContainerRunOptions): Promise<ContainerRunResult> {\n  if (options.signal?.aborted) return { exitCode: 1, status: \"cancelled\", stderr: \"\" };\n  await verifyContainerEngineBoundary(options.engine);\n  const args = buildContainerRunArgs(options);\n  const name = containerName(args);\n  const child = spawn(options.engine, args, { stdio: [\"pipe\", \"pipe\", \"pipe\"], shell: false });\n  let stderr = \"\";\n  let outputBytes = 0;\n  let complete: Extract<HarnessAgentOutput, { type: \"attempt.complete\" }> | null = null;\n  let stopped = false;\n  let exited = false;\n\n  child.stderr.setEncoding(\"utf8\");\n  child.stderr.on(\"data\", (text: string) => {\n    if (stderr.length < 64 * 1024) stderr += text.slice(0, 64 * 1024 - stderr.length);\n  });\n\n  const stop = (reason: string) => {\n    if (stopped || exited) return;\n    stopped = true;\n    if (!child.stdin.destroyed) {\n      const cancel: HarnessAgentInput = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: \"attempt.cancel\", reason };\n      child.stdin.write(encodeAgentInput(cancel));\n    }\n    const removeArgs = options.engine === \"container\" ? [\"delete\", \"--force\", name] : [\"rm\", \"-f\", name];\n    const killer = spawn(options.engine, removeArgs, { stdio: \"ignore\", shell: false });\n    killer.unref();\n  };\n  const abort = () => stop(\"runner_cancelled\");\n  options.signal?.addEventListener(\"abort\", abort, { once: true });\n\n  const timeout = setTimeout(() => stop(\"timeout\"), options.task.policy.timeoutMs);\n  const start: HarnessAgentInput = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: \"task.start\", task: options.task };\n  if (!stopped && !options.signal?.aborted) child.stdin.write(encodeAgentInput(start));\n\n  const consume = (async () => {\n    let pending = Buffer.alloc(0);\n    const handleLine = async (raw: Buffer) => {\n      const bytes = raw.at(-1) === 13 ? raw.subarray(0, -1) : raw;\n      if (bytes.byteLength > 1_000_000) throw new Error(\"agent message exceeds 1 MB\");\n      const line = bytes.toString(\"utf8\");\n      if (!line.trim()) return;\n      const message = parseAgentOutput(line);\n      if (message.type === \"attempt.complete\") complete = message;\n      const response = await options.onMessage(message);\n      if (response && !child.stdin.destroyed) child.stdin.write(encodeAgentInput(response));\n    };\n    try {\n      for await (const raw of child.stdout) {\n        const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);\n        outputBytes += chunk.byteLength;\n        if (outputBytes > options.task.policy.maxOutputBytes) {\n          throw new Error(`agent output exceeds ${options.task.policy.maxOutputBytes} bytes`);\n        }\n        pending = Buffer.concat([pending, chunk]);\n        let newline = pending.indexOf(10);\n        while (newline >= 0) {\n          await handleLine(pending.subarray(0, newline));\n          pending = pending.subarray(newline + 1);\n          newline = pending.indexOf(10);\n        }\n        if (pending.byteLength > 1_000_000) throw new Error(\"agent message exceeds 1 MB\");\n      }\n      if (pending.byteLength) await handleLine(pending);\n    } catch (error) {\n      stop(\"protocol_error\");\n      throw error;\n    }\n  })();\n\n  const exit = new Promise<number>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", (code) => { exited = true; accept(code ?? 1); });\n  });\n  try {\n    const [exitCode] = await Promise.all([exit, consume]);\n    if (stderr && options.onStderr) await options.onStderr(stderr);\n    if (options.signal?.aborted) return { exitCode, status: \"cancelled\", stderr };\n    const terminal = complete as Extract<HarnessAgentOutput, { type: \"attempt.complete\" }> | null;\n    if (!terminal) return { exitCode, status: \"failed\", result: { error: \"agent exited without completion\" }, stderr };\n    return { exitCode, status: exitCode === 0 ? terminal.status : \"failed\", result: terminal.result, stderr };\n  } catch (error) {\n    stop(\"runner_error\");\n    await exit.catch(() => 1);\n    throw error;\n  } finally {\n    clearTimeout(timeout);\n    options.signal?.removeEventListener(\"abort\", abort);\n  }\n}\n","import { mkdir, mkdtemp, realpath, rm, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join, resolve, sep } from \"node:path\";\nimport { spawn } from \"node:child_process\";\nimport { allowedWorkspacePath } from \"./workspace-policy\";\nimport type { StageWorkspaceOptions } from \"./workspace\";\n\n/** Disposable, filtered materialization of one committed Git tree. */\nexport interface MaterializedGitTree {\n  root: string;\n  sourceDir: string;\n  fileCount: number;\n  byteCount: number;\n  cleanup(): Promise<void>;\n}\n\nasync function gitOutput(cwd: string, args: string[], maxBytes: number): Promise<Buffer> {\n  const child = spawn(\"git\", args, { cwd, stdio: [\"ignore\", \"pipe\", \"pipe\"], shell: false });\n  const stdout: Buffer[] = [];\n  const stderr: Buffer[] = [];\n  let bytes = 0;\n  child.stdout.on(\"data\", (chunk: Buffer) => {\n    bytes += chunk.byteLength;\n    if (bytes > maxBytes) child.kill(\"SIGKILL\");\n    else stdout.push(chunk);\n  });\n  child.stderr.on(\"data\", (chunk: Buffer) => {\n    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16_384) stderr.push(chunk);\n  });\n  const code = await new Promise<number | null>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", accept);\n  });\n  if (bytes > maxBytes) throw new Error(`git output exceeds ${maxBytes} bytes`);\n  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr).toString(\"utf8\").slice(0, 1_000)}`);\n  return Buffer.concat(stdout);\n}\n\nasync function gitBlobs(cwd: string, entries: Array<{ hash: string }>, maxBytes: number): Promise<Buffer[]> {\n  const child = spawn(\"git\", [\"cat-file\", \"--batch\"], { cwd, stdio: [\"pipe\", \"pipe\", \"pipe\"], shell: false });\n  const stdout: Buffer[] = [];\n  const stderr: Buffer[] = [];\n  let bytes = 0;\n  child.stdout.on(\"data\", (chunk: Buffer) => {\n    bytes += chunk.byteLength;\n    if (bytes > maxBytes + entries.length * 100) child.kill(\"SIGKILL\");\n    else stdout.push(chunk);\n  });\n  child.stderr.on(\"data\", (chunk: Buffer) => {\n    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16_384) stderr.push(chunk);\n  });\n  child.stdin.end(`${entries.map((entry) => entry.hash).join(\"\\n\")}\\n`);\n  const code = await new Promise<number | null>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", accept);\n  });\n  if (bytes > maxBytes + entries.length * 100) throw new Error(`Git tree exceeds ${maxBytes} bytes`);\n  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr).toString(\"utf8\").slice(0, 1_000)}`);\n  const output = Buffer.concat(stdout);\n  const blobs: Buffer[] = [];\n  let offset = 0;\n  let total = 0;\n  for (const entry of entries) {\n    const newline = output.indexOf(0x0a, offset);\n    if (newline < 0) throw new Error(\"git object output is truncated\");\n    const match = /^([0-9a-f]{40,64}) blob ([0-9]+)$/.exec(output.subarray(offset, newline).toString(\"utf8\"));\n    if (!match || match[1] !== entry.hash) throw new Error(\"git object output does not match its inventory\");\n    const length = Number(match[2]);\n    if (!Number.isSafeInteger(length) || length < 0 || newline + 1 + length >= output.length) {\n      throw new Error(\"git object output has an invalid length\");\n    }\n    const content = output.subarray(newline + 1, newline + 1 + length);\n    if (output[newline + 1 + length] !== 0x0a) throw new Error(\"git object output is malformed\");\n    total += content.byteLength;\n    if (total > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);\n    blobs.push(content);\n    offset = newline + 1 + length + 1;\n  }\n  return blobs;\n}\n\n/** Materialize ordinary files from an exact commit without copying secrets,\n * symlinks, ignored local files, or Git metadata. */\nexport async function materializeGitTree(\n  source: string, commitSha: string,\n  options: Pick<StageWorkspaceOptions, \"maxFiles\" | \"maxBytes\" | \"tempRoot\"> = {},\n): Promise<MaterializedGitTree> {\n  if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new TypeError(\"Git tree requires an exact commit SHA\");\n  const sourceDir = await realpath(resolve(source));\n  const maxFiles = options.maxFiles ?? 20_000;\n  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;\n  const inventory = (await gitOutput(sourceDir, [\"ls-tree\", \"-rz\", commitSha], 16 * 1024 * 1024))\n    .toString(\"utf8\").split(\"\\0\").filter(Boolean);\n  const entries = inventory.flatMap((record) => {\n    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\\t([\\s\\S]+)$/.exec(record);\n    return match && allowedWorkspacePath(match[3]!)\n      ? [{ mode: match[1]!, hash: match[2]!, path: match[3]! }]\n      : [];\n  });\n  if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);\n  const root = await mkdtemp(join(options.tempRoot ?? tmpdir(), \"odla-git-tree-\"));\n  const targetRoot = join(root, \"source\");\n  await mkdir(targetRoot);\n  let byteCount = 0;\n  try {\n    const blobs = await gitBlobs(sourceDir, entries, maxBytes);\n    for (const [index, entry] of entries.entries()) {\n      const content = blobs[index]!;\n      byteCount += content.byteLength;\n      if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);\n      const target = resolve(targetRoot, entry.path);\n      if (!target.startsWith(`${resolve(targetRoot)}${sep}`)) throw new TypeError(\"Git tree path escapes workspace\");\n      await mkdir(resolve(target, \"..\"), { recursive: true });\n      await writeFile(target, content, { flag: \"wx\", mode: entry.mode === \"100755\" ? 0o755 : 0o644 });\n    }\n    return { root, sourceDir: targetRoot, fileCount: entries.length, byteCount,\n      cleanup: () => rm(root, { recursive: true, force: true }) };\n  } catch (error) {\n    await rm(root, { recursive: true, force: true });\n    throw error;\n  }\n}\n","import { isAbsolute } from \"node:path\";\n\nexport const SKIP_WORKSPACE_DIRS = new Set([\n  \".git\", \".odla\", \".wrangler\", \"node_modules\", \"dist\", \"coverage\",\n]);\nexport const SECRET_WORKSPACE_FILE = /^(?:\\.env(?:\\..+)?|\\.dev\\.vars|\\.dev-token(?:\\..+)?|credentials(?:\\..+)?\\.json|dev-token(?:\\..+)?(?:\\.json)?)$/i;\n\n/** Reject paths that are unsafe or reserved at either the local or Git-tree boundary. */\nexport function allowedWorkspacePath(relativePath: string): boolean {\n  const parts = relativePath.split(\"/\");\n  return !isAbsolute(relativePath) && !relativePath.includes(\"\\\\\") && !relativePath.includes(\"\\0\")\n    && !parts.some((part) => !part || part === \".\" || part === \"..\" || SKIP_WORKSPACE_DIRS.has(part))\n    && !SECRET_WORKSPACE_FILE.test(parts.at(-1) ?? \"\");\n}\n","import { chmod, copyFile, lstat, mkdir, mkdtemp, readdir, realpath, rm, stat } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { basename, join, relative, resolve, sep } from \"node:path\";\nimport { spawn } from \"node:child_process\";\nimport { allowedWorkspacePath, SECRET_WORKSPACE_FILE, SKIP_WORKSPACE_DIRS } from \"./workspace-policy\";\nexport { materializeGitTree, type MaterializedGitTree } from \"./workspace-git-tree\";\n\n/** File, byte, and temporary-directory limits applied while staging a workspace. */\nexport interface StageWorkspaceOptions {\n  maxFiles?: number;\n  maxBytes?: number;\n  tempRoot?: string;\n  /** Stage tracked files plus non-ignored untracked files from a Git checkout. */\n  gitTrackedAndUnignored?: boolean;\n}\n\n/** Disposable baseline and mutable workspace copy used to generate a bounded patch. */\nexport interface StagedWorkspace {\n  root: string;\n  baselineDir: string;\n  workspaceDir: string;\n  fileCount: number;\n  byteCount: number;\n  patch(maxBytes: number): Promise<string>;\n  cleanup(): Promise<void>;\n}\n\ninterface SourceFile {\n  source: string;\n  relativePath: string;\n  mode: number;\n  bytes: number;\n}\n\nasync function sourceFiles(sourceDir: string, maxFiles: number, maxBytes: number): Promise<SourceFile[]> {\n  const files: SourceFile[] = [];\n  let bytes = 0;\n  const walk = async (dir: string): Promise<void> => {\n    for (const entry of await readdir(dir, { withFileTypes: true })) {\n      if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;\n      if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;\n      const path = join(dir, entry.name);\n      if (entry.isSymbolicLink()) continue;\n      if (entry.isDirectory()) {\n        await walk(path);\n        continue;\n      }\n      if (!entry.isFile()) continue;\n      const metadata = await stat(path);\n      bytes += metadata.size;\n      if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);\n      if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);\n      files.push({\n        source: path,\n        relativePath: relative(sourceDir, path),\n        mode: metadata.mode & 0o777,\n        bytes: metadata.size,\n      });\n    }\n  };\n  await walk(sourceDir);\n  return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));\n}\n\nasync function gitSourceFiles(sourceDir: string, maxFiles: number, maxBytes: number): Promise<SourceFile[]> {\n  const child = spawn(\"git\", [\"ls-files\", \"-z\", \"--cached\", \"--others\", \"--exclude-standard\"], {\n    cwd: sourceDir, stdio: [\"ignore\", \"pipe\", \"pipe\"], shell: false,\n  });\n  const stdout: Buffer[] = [];\n  const stderr: Buffer[] = [];\n  let outputBytes = 0;\n  child.stdout.on(\"data\", (chunk: Buffer) => {\n    outputBytes += chunk.byteLength;\n    if (outputBytes > 8 * 1024 * 1024) child.kill(\"SIGKILL\");\n    else stdout.push(chunk);\n  });\n  child.stderr.on(\"data\", (chunk: Buffer) => {\n    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16_384) stderr.push(chunk);\n  });\n  const code = await new Promise<number | null>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", accept);\n  });\n  if (outputBytes > 8 * 1024 * 1024) throw new Error(\"git file inventory exceeds 8 MiB\");\n  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString(\"utf8\").slice(0, 1_000)}`);\n  const paths = Buffer.concat(stdout).toString(\"utf8\").split(\"\\0\").filter(Boolean).sort();\n  if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);\n  const root = resolve(sourceDir);\n  const files: SourceFile[] = [];\n  let bytes = 0;\n  for (const relativePath of paths) {\n    if (!allowedWorkspacePath(relativePath)) continue;\n    const source = resolve(root, relativePath);\n    if (!source.startsWith(`${root}${sep}`)) throw new TypeError(\"git file path escapes workspace\");\n    let metadata;\n    try { metadata = await lstat(source); }\n    catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") continue;\n      throw error;\n    }\n    if (metadata.isSymbolicLink() || !metadata.isFile()) continue;\n    bytes += metadata.size;\n    if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);\n    files.push({ source, relativePath, mode: metadata.mode & 0o777, bytes: metadata.size });\n  }\n  return files;\n}\n\nasync function copyTree(files: SourceFile[], destination: string): Promise<void> {\n  for (const file of files) {\n    const target = join(destination, file.relativePath);\n    await mkdir(resolve(target, \"..\"), { recursive: true });\n    await copyFile(file.source, target);\n    await chmod(target, file.mode);\n  }\n}\n\nasync function captureGitDiff(root: string, maxBytes: number): Promise<string> {\n  const child = spawn(\"git\", [\n    \"diff\", \"--no-index\", \"--binary\", \"--no-ext-diff\",\n    \"--src-prefix=a/\", \"--dst-prefix=b/\", \"--\", \"baseline\", \"workspace\",\n  ], { cwd: root, stdio: [\"ignore\", \"pipe\", \"pipe\"], shell: false });\n  const stdout: Buffer[] = [];\n  const stderr: Buffer[] = [];\n  let bytes = 0;\n  child.stdout.on(\"data\", (chunk: Buffer) => {\n    bytes += chunk.byteLength;\n    if (bytes > maxBytes) child.kill(\"SIGKILL\");\n    else stdout.push(chunk);\n  });\n  child.stderr.on(\"data\", (chunk: Buffer) => {\n    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16_384) stderr.push(chunk);\n  });\n  const code = await new Promise<number | null>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", accept);\n  });\n  if (bytes > maxBytes) throw new Error(`patch exceeds ${maxBytes} bytes`);\n  if (code !== 0 && code !== 1) {\n    throw new Error(`git diff failed: ${Buffer.concat(stderr).toString(\"utf8\").slice(0, 1_000)}`);\n  }\n  return Buffer.concat(stdout).toString(\"utf8\")\n    .replaceAll(\"a/baseline/\", \"a/\")\n    .replaceAll(\"a/workspace/\", \"a/\")\n    .replaceAll(\"b/baseline/\", \"b/\")\n    .replaceAll(\"b/workspace/\", \"b/\")\n    .replaceAll(\"--- a/baseline\", \"--- a\")\n    .replaceAll(\"+++ b/workspace\", \"+++ b\");\n}\n\n/** Copy a bounded, secret-filtered workspace twice: one immutable baseline and\n * one disposable directory mounted into the container. The developer checkout\n * itself is never mounted. */\nexport async function stageWorkspace(source: string, options: StageWorkspaceOptions = {}): Promise<StagedWorkspace> {\n  const sourceDir = await realpath(resolve(source));\n  const sourceStat = await stat(sourceDir);\n  if (!sourceStat.isDirectory()) throw new TypeError(\"workspace source must be a directory\");\n  const root = await mkdtemp(join(options.tempRoot ?? tmpdir(), \"odla-harness-\"));\n  const baselineDir = join(root, \"baseline\");\n  const workspaceDir = join(root, \"workspace\");\n  await Promise.all([mkdir(baselineDir), mkdir(workspaceDir)]);\n  try {\n    const maxFiles = options.maxFiles ?? 20_000;\n    const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;\n    const files = options.gitTrackedAndUnignored\n      ? await gitSourceFiles(sourceDir, maxFiles, maxBytes)\n      : await sourceFiles(sourceDir, maxFiles, maxBytes);\n    await Promise.all([copyTree(files, baselineDir), copyTree(files, workspaceDir)]);\n    return {\n      root,\n      baselineDir,\n      workspaceDir,\n      fileCount: files.length,\n      byteCount: files.reduce((sum, file) => sum + file.bytes, 0),\n      patch: (maxBytes) => captureGitDiff(root, maxBytes),\n      cleanup: () => rm(root, { recursive: true, force: true }),\n    };\n  } catch (error) {\n    await rm(root, { recursive: true, force: true });\n    throw error;\n  }\n}\n\n/** Create a disposable workspace whose diff base and initial editable tree\n * intentionally come from different already-filtered sources. */\nexport async function stageWorkspacePair(\n  baselineSource: string, workspaceSource: string, options: StageWorkspaceOptions = {},\n): Promise<StagedWorkspace> {\n  const baselineDirSource = await realpath(resolve(baselineSource));\n  const workspaceDirSource = await realpath(resolve(workspaceSource));\n  const maxFiles = options.maxFiles ?? 20_000;\n  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;\n  const [baselineFiles, workspaceFiles] = await Promise.all([\n    sourceFiles(baselineDirSource, maxFiles, maxBytes),\n    sourceFiles(workspaceDirSource, maxFiles, maxBytes),\n  ]);\n  const root = await mkdtemp(join(options.tempRoot ?? tmpdir(), \"odla-harness-\"));\n  const baselineDir = join(root, \"baseline\");\n  const workspaceDir = join(root, \"workspace\");\n  await Promise.all([mkdir(baselineDir), mkdir(workspaceDir)]);\n  try {\n    await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);\n    return {\n      root, baselineDir, workspaceDir,\n      fileCount: workspaceFiles.length,\n      byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),\n      patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),\n      cleanup: () => rm(root, { recursive: true, force: true }),\n    };\n  } catch (error) {\n    await rm(root, { recursive: true, force: true });\n    throw error;\n  }\n}\n\n/** Convert a path-like value into a bounded lowercase label safe for runner metadata. */\nexport function safeWorkspaceLabel(value: string): string {\n  const label = basename(value).toLowerCase().replace(/[^a-z0-9_-]+/g, \"-\").replace(/^-+|-+$/g, \"\");\n  if (!label) throw new TypeError(\"workspace label is empty\");\n  return label.slice(0, 80);\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,UAAU,aAAa;AAChC,SAAS,iBAAiB;AAC1B,SAAS,cAAc;AACvB,SAAS,WAAW,YAAY;AAChC,SAAS,QAAQ,cAAc;AAS/B,IAAM,eAAe;AAoDd,SAAS,kBAAkB,OAAqB;AACrD,MAAI,CAAC,aAAa,KAAK,KAAK,EAAG,OAAM,IAAI,UAAU,iDAAiD;AACtG;AAEA,eAAe,iBAAiB,QAA2C;AACzE,aAAW,cAAc,QAAQ,IAAI,QAAQ,IAAI,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AACjF,QAAI;AAAE,YAAM,OAAO,KAAK,WAAW,MAAM,GAAG,UAAU,IAAI;AAAG,aAAO;AAAA,IAAM,QAAQ;AAAA,IAAgC;AAAA,EACpH;AACA,SAAO;AACT;AAKA,eAAsB,sBACpB,YAAsC,QACtC,UAA2C,CAAC,GAClB;AAC1B,QAAM,WAAW,QAAQ,YAAY,QAAQ;AAC7C,QAAM,OAAO,QAAQ,QAAQ,QAAQ;AACrC,QAAM,MAAM,QAAQ,QAAQ,OAAO,WAAW,aAAa,OAAO,IAAI;AACtE,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,WAAW,OAAO,WAAsD;AAC5E,QAAI,WAAW,gBAAgB,aAAa,YAAY,SAAS,UAAU;AACzE,YAAM,IAAI,UAAU,8CAA8C;AAAA,IACpE;AACA,QAAI,WAAW,YAAY,aAAa,WAAW,QAAQ,GAAG;AAC5D,YAAM,IAAI,UAAU,2EAA2E;AAAA,IACjG;AACA,QAAI,CAAE,MAAM,UAAU,MAAM,EAAI,OAAM,IAAI,UAAU,GAAG,MAAM,iCAAiC;AAC9F,WAAO;AAAA,EACT;AACA,MAAI,cAAc,OAAQ,QAAO,SAAS,SAAS;AACnD,QAAM,aAAgC,aAAa,WAC/C,SAAS,UAAU,CAAC,aAAa,QAAQ,IAAI,CAAC,QAAQ,IACtD,aAAa,UAAU,CAAC,QAAQ,IAAI,CAAC;AACzC,aAAW,UAAU,YAAY;AAC/B,QAAI,MAAM,UAAU,MAAM,EAAG,QAAO,SAAS,MAAM;AAAA,EACrD;AACA,MAAI,aAAa,SAAS;AACxB,UAAM,IAAI,UAAU,mHAAmH;AAAA,EACzI;AACA,MAAI,aAAa,UAAU;AACzB,UAAM,IAAI,UAAU,uIAAuI;AAAA,EAC7J;AACA,QAAM,IAAI,UAAU,qCAAqC;AAC3D;AAEA,SAAS,wBAA0C;AACjD,SAAO,IAAI,QAAQ,CAACA,UAAS,WAAW;AACtC;AAAA,MACE;AAAA,MACA,CAAC,QAAQ,YAAY,6BAA6B;AAAA,MAClD,EAAE,UAAU,QAAQ,WAAW,KAAK,MAAM,SAAS,IAAO;AAAA,MAC1D,CAAC,OAAO,WAAW;AACjB,YAAI,OAAO;AACT,iBAAO,IAAI,UAAU,6DAA6D,CAAC;AACnF;AAAA,QACF;AACA,QAAAA,SAAQ,OAAO,KAAK,MAAM,MAAM;AAAA,MAClC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAKA,eAAsB,8BACpB,QACA,UAA8C,CAAC,GAChC;AACf,QAAM,WAAW,QAAQ,YAAY,QAAQ;AAC7C,QAAM,OAAO,QAAQ,QAAQ,QAAQ;AACrC,QAAM,MAAM,QAAQ,QAAQ,OAAO,WAAW,aAAa,OAAO,IAAI;AACtE,MAAI,WAAW,gBAAgB,aAAa,YAAY,SAAS,UAAU;AACzE,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,MAAI,WAAW,YAAY,aAAa,QAAS;AACjD,MAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,2EAA2E;AAC9G,QAAM,WAAW,OAAO,QAAQ,kBAAkB,uBAAuB;AACzE,MAAI,CAAC,SAAU,OAAM,IAAI,UAAU,wEAAwE;AAC7G;AAGO,SAAS,sBAAsB,SAAmF;AACvH,MAAI,CAAC,QAAQ,mBAAoB,mBAAkB,QAAQ,KAAK;AAChE,MAAI,UAAU,KAAK,QAAQ,YAAY,EAAG,OAAM,IAAI,UAAU,sDAAsD;AACpH,QAAM,MAAM,OAAO,WAAW,aAAa,OAAO,IAAI;AACtD,QAAM,MAAM,OAAO,WAAW,aAAa,OAAO,IAAI;AACtD,QAAM,cAAc,QAAQ,KAAK,UAAU,YAAY,EAAE,QAAQ,iBAAiB,GAAG,EAAE,MAAM,GAAG,EAAE;AAClG,QAAM,OAAO,gBAAgB,WAAW,IAAI,OAAO,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC;AAC3E,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,QAAMC,UAAS,QAAQ,mBAAmB;AAC1C,QAAM,aAAaA,YAAW,SAAS,CAAC,IAAI,CAAC,4BAA4B,QAAQ,YAAY,qBAAqBA,YAAW,cAAc,cAAc,EAAE,EAAE;AAC7J,QAAM,WAAWA,YAAW,SAAS,CAAC,IAAI,CAAC,yBAAyB,QAAQ,YAAY,kBAAkBA,YAAW,cAAc,cAAc,EAAE,EAAE;AACrJ,MAAI,QAAQ,WAAW,aAAa;AAClC,WAAO;AAAA,MACL;AAAA,MAAO;AAAA,MAAQ;AAAA,MAAiB,UAAU,IAAI;AAAA,MAC9C;AAAA,MAAkB;AAAA,MAAe;AAAA,MACjC,YAAY,OAAO,UAAU,IAAI;AAAA,MAAI,UAAU,OAAO,QAAQ,CAAC;AAAA,MAC/D,UAAU,GAAG,IAAI,GAAG;AAAA,MAAI;AAAA,MACxB,GAAG;AAAA,MACH;AAAA,MAAwB,+BAA+B,wBAAwB;AAAA,MAC/E,mCAAmC,QAAQ,KAAK,SAAS;AAAA,MACzD,QAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IAAO;AAAA,IAAQ;AAAA,IAAiB,UAAU,IAAI;AAAA,IAAI;AAAA,IAClD;AAAA,IAAkB;AAAA,IAAe;AAAA,IACjC;AAAA,IAAoC,gBAAgB,OAAO,QAAQ,GAAG;AAAA,IACtE,YAAY,OAAO,UAAU,IAAI;AAAA,IAAI,UAAU,OAAO,QAAQ,CAAC;AAAA,IAC/D,UAAU,GAAG,IAAI,GAAG;AAAA,IACpB,4CAA4C,OAAO,cAAc,KAAK,OAAO,IAAI;AAAA,IACjF,GAAG;AAAA,IACH;AAAA,IAAwB,+BAA+B,wBAAwB;AAAA,IAC/E,mCAAmC,QAAQ,KAAK,SAAS;AAAA,IACzD,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,cAAc,MAAwB;AAC7C,SAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,SAAS,CAAC,EAAG,MAAM,UAAU,MAAM;AAC9E;AAMA,eAAsB,oBAAoB,SAA2D;AACnG,MAAI,QAAQ,QAAQ,QAAS,QAAO,EAAE,UAAU,GAAG,QAAQ,aAAa,QAAQ,GAAG;AACnF,QAAM,8BAA8B,QAAQ,MAAM;AAClD,QAAM,OAAO,sBAAsB,OAAO;AAC1C,QAAM,OAAO,cAAc,IAAI;AAC/B,QAAM,QAAQ,MAAM,QAAQ,QAAQ,MAAM,EAAE,OAAO,CAAC,QAAQ,QAAQ,MAAM,GAAG,OAAO,MAAM,CAAC;AAC3F,MAAI,SAAS;AACb,MAAI,cAAc;AAClB,MAAI,WAA6E;AACjF,MAAI,UAAU;AACd,MAAI,SAAS;AAEb,QAAM,OAAO,YAAY,MAAM;AAC/B,QAAM,OAAO,GAAG,QAAQ,CAAC,SAAiB;AACxC,QAAI,OAAO,SAAS,KAAK,KAAM,WAAU,KAAK,MAAM,GAAG,KAAK,OAAO,OAAO,MAAM;AAAA,EAClF,CAAC;AAED,QAAM,OAAO,CAAC,WAAmB;AAC/B,QAAI,WAAW,OAAQ;AACvB,cAAU;AACV,QAAI,CAAC,MAAM,MAAM,WAAW;AAC1B,YAAM,SAA4B,EAAE,iBAAiB,0BAA0B,MAAM,kBAAkB,OAAO;AAC9G,YAAM,MAAM,MAAM,iBAAiB,MAAM,CAAC;AAAA,IAC5C;AACA,UAAM,aAAa,QAAQ,WAAW,cAAc,CAAC,UAAU,WAAW,IAAI,IAAI,CAAC,MAAM,MAAM,IAAI;AACnG,UAAM,SAAS,MAAM,QAAQ,QAAQ,YAAY,EAAE,OAAO,UAAU,OAAO,MAAM,CAAC;AAClF,WAAO,MAAM;AAAA,EACf;AACA,QAAM,QAAQ,MAAM,KAAK,kBAAkB;AAC3C,UAAQ,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAE/D,QAAM,UAAU,WAAW,MAAM,KAAK,SAAS,GAAG,QAAQ,KAAK,OAAO,SAAS;AAC/E,QAAM,QAA2B,EAAE,iBAAiB,0BAA0B,MAAM,cAAc,MAAM,QAAQ,KAAK;AACrH,MAAI,CAAC,WAAW,CAAC,QAAQ,QAAQ,QAAS,OAAM,MAAM,MAAM,iBAAiB,KAAK,CAAC;AAEnF,QAAM,WAAW,YAAY;AAC3B,QAAI,UAAU,OAAO,MAAM,CAAC;AAC5B,UAAM,aAAa,OAAO,QAAgB;AACxC,YAAM,QAAQ,IAAI,GAAG,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG,EAAE,IAAI;AACxD,UAAI,MAAM,aAAa,IAAW,OAAM,IAAI,MAAM,4BAA4B;AAC9E,YAAM,OAAO,MAAM,SAAS,MAAM;AAClC,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,YAAM,UAAU,iBAAiB,IAAI;AACrC,UAAI,QAAQ,SAAS,mBAAoB,YAAW;AACpD,YAAM,WAAW,MAAM,QAAQ,UAAU,OAAO;AAChD,UAAI,YAAY,CAAC,MAAM,MAAM,UAAW,OAAM,MAAM,MAAM,iBAAiB,QAAQ,CAAC;AAAA,IACtF;AACA,QAAI;AACF,uBAAiB,OAAO,MAAM,QAAQ;AACpC,cAAM,QAAQ,OAAO,SAAS,GAAG,IAAI,MAAM,OAAO,KAAK,GAAG;AAC1D,uBAAe,MAAM;AACrB,YAAI,cAAc,QAAQ,KAAK,OAAO,gBAAgB;AACpD,gBAAM,IAAI,MAAM,wBAAwB,QAAQ,KAAK,OAAO,cAAc,QAAQ;AAAA,QACpF;AACA,kBAAU,OAAO,OAAO,CAAC,SAAS,KAAK,CAAC;AACxC,YAAI,UAAU,QAAQ,QAAQ,EAAE;AAChC,eAAO,WAAW,GAAG;AACnB,gBAAM,WAAW,QAAQ,SAAS,GAAG,OAAO,CAAC;AAC7C,oBAAU,QAAQ,SAAS,UAAU,CAAC;AACtC,oBAAU,QAAQ,QAAQ,EAAE;AAAA,QAC9B;AACA,YAAI,QAAQ,aAAa,IAAW,OAAM,IAAI,MAAM,4BAA4B;AAAA,MAClF;AACA,UAAI,QAAQ,WAAY,OAAM,WAAW,OAAO;AAAA,IAClD,SAAS,OAAO;AACd,WAAK,gBAAgB;AACrB,YAAM;AAAA,IACR;AAAA,EACF,GAAG;AAEH,QAAM,OAAO,IAAI,QAAgB,CAAC,QAAQ,WAAW;AACnD,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,CAAC,SAAS;AAAE,eAAS;AAAM,aAAO,QAAQ,CAAC;AAAA,IAAG,CAAC;AAAA,EACpE,CAAC;AACD,MAAI;AACF,UAAM,CAAC,QAAQ,IAAI,MAAM,QAAQ,IAAI,CAAC,MAAM,OAAO,CAAC;AACpD,QAAI,UAAU,QAAQ,SAAU,OAAM,QAAQ,SAAS,MAAM;AAC7D,QAAI,QAAQ,QAAQ,QAAS,QAAO,EAAE,UAAU,QAAQ,aAAa,OAAO;AAC5E,UAAM,WAAW;AACjB,QAAI,CAAC,SAAU,QAAO,EAAE,UAAU,QAAQ,UAAU,QAAQ,EAAE,OAAO,kCAAkC,GAAG,OAAO;AACjH,WAAO,EAAE,UAAU,QAAQ,aAAa,IAAI,SAAS,SAAS,UAAU,QAAQ,SAAS,QAAQ,OAAO;AAAA,EAC1G,SAAS,OAAO;AACd,SAAK,cAAc;AACnB,UAAM,KAAK,MAAM,MAAM,CAAC;AACxB,UAAM;AAAA,EACR,UAAE;AACA,iBAAa,OAAO;AACpB,YAAQ,QAAQ,oBAAoB,SAAS,KAAK;AAAA,EACpD;AACF;;;AC5RA,SAAS,OAAO,SAAS,UAAU,IAAI,iBAAiB;AACxD,SAAS,cAAc;AACvB,SAAS,QAAAC,OAAM,SAAS,WAAW;AACnC,SAAS,SAAAC,cAAa;;;ACHtB,SAAS,kBAAkB;AAEpB,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EACzC;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAa;AAAA,EAAgB;AAAA,EAAQ;AACxD,CAAC;AACM,IAAM,wBAAwB;AAG9B,SAAS,qBAAqB,cAA+B;AAClE,QAAM,QAAQ,aAAa,MAAM,GAAG;AACpC,SAAO,CAAC,WAAW,YAAY,KAAK,CAAC,aAAa,SAAS,IAAI,KAAK,CAAC,aAAa,SAAS,IAAI,KAC1F,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,QAAQ,oBAAoB,IAAI,IAAI,CAAC,KAC7F,CAAC,sBAAsB,KAAK,MAAM,GAAG,EAAE,KAAK,EAAE;AACrD;;;ADGA,eAAe,UAAU,KAAa,MAAgB,UAAmC;AACvF,QAAM,QAAQC,OAAM,OAAO,MAAM,EAAE,KAAK,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,OAAO,MAAM,CAAC;AACzF,QAAM,SAAmB,CAAC;AAC1B,QAAM,SAAmB,CAAC;AAC1B,MAAI,QAAQ;AACZ,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,aAAS,MAAM;AACf,QAAI,QAAQ,SAAU,OAAM,KAAK,SAAS;AAAA,QACrC,QAAO,KAAK,KAAK;AAAA,EACxB,CAAC;AACD,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,QAAI,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC,IAAI,MAAQ,QAAO,KAAK,KAAK;AAAA,EAC1F,CAAC;AACD,QAAM,OAAO,MAAM,IAAI,QAAuB,CAAC,QAAQ,WAAW;AAChE,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,MAAM;AAAA,EAC3B,CAAC;AACD,MAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,sBAAsB,QAAQ,QAAQ;AAC5E,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAK,CAAC,EAAE;AAC/G,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,eAAe,SAAS,KAAa,SAAkC,UAAqC;AAC1G,QAAM,QAAQA,OAAM,OAAO,CAAC,YAAY,SAAS,GAAG,EAAE,KAAK,OAAO,CAAC,QAAQ,QAAQ,MAAM,GAAG,OAAO,MAAM,CAAC;AAC1G,QAAM,SAAmB,CAAC;AAC1B,QAAM,SAAmB,CAAC;AAC1B,MAAI,QAAQ;AACZ,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,aAAS,MAAM;AACf,QAAI,QAAQ,WAAW,QAAQ,SAAS,IAAK,OAAM,KAAK,SAAS;AAAA,QAC5D,QAAO,KAAK,KAAK;AAAA,EACxB,CAAC;AACD,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,QAAI,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC,IAAI,MAAQ,QAAO,KAAK,KAAK;AAAA,EAC1F,CAAC;AACD,QAAM,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,CAAI;AACpE,QAAM,OAAO,MAAM,IAAI,QAAuB,CAAC,QAAQ,WAAW;AAChE,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,MAAM;AAAA,EAC3B,CAAC;AACD,MAAI,QAAQ,WAAW,QAAQ,SAAS,IAAK,OAAM,IAAI,MAAM,oBAAoB,QAAQ,QAAQ;AACjG,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,2BAA2B,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAK,CAAC,EAAE;AACnH,QAAM,SAAS,OAAO,OAAO,MAAM;AACnC,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,aAAW,SAAS,SAAS;AAC3B,UAAM,UAAU,OAAO,QAAQ,IAAM,MAAM;AAC3C,QAAI,UAAU,EAAG,OAAM,IAAI,MAAM,gCAAgC;AACjE,UAAM,QAAQ,oCAAoC,KAAK,OAAO,SAAS,QAAQ,OAAO,EAAE,SAAS,MAAM,CAAC;AACxG,QAAI,CAAC,SAAS,MAAM,CAAC,MAAM,MAAM,KAAM,OAAM,IAAI,MAAM,gDAAgD;AACvG,UAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,KAAK,UAAU,IAAI,UAAU,OAAO,QAAQ;AACxF,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AACA,UAAM,UAAU,OAAO,SAAS,UAAU,GAAG,UAAU,IAAI,MAAM;AACjE,QAAI,OAAO,UAAU,IAAI,MAAM,MAAM,GAAM,OAAM,IAAI,MAAM,gCAAgC;AAC3F,aAAS,QAAQ;AACjB,QAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAC3E,UAAM,KAAK,OAAO;AAClB,aAAS,UAAU,IAAI,SAAS;AAAA,EAClC;AACA,SAAO;AACT;AAIA,eAAsB,mBACpB,QAAgB,WAChB,UAA6E,CAAC,GAChD;AAC9B,MAAI,CAAC,iBAAiB,KAAK,SAAS,EAAG,OAAM,IAAI,UAAU,uCAAuC;AAClG,QAAM,YAAY,MAAM,SAAS,QAAQ,MAAM,CAAC;AAChD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,WAAW,QAAQ,YAAY,MAAM,OAAO;AAClD,QAAM,aAAa,MAAM,UAAU,WAAW,CAAC,WAAW,OAAO,SAAS,GAAG,KAAK,OAAO,IAAI,GAC1F,SAAS,MAAM,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO;AAC9C,QAAM,UAAU,UAAU,QAAQ,CAAC,WAAW;AAC5C,UAAM,QAAQ,sDAAsD,KAAK,MAAM;AAC/E,WAAO,SAAS,qBAAqB,MAAM,CAAC,CAAE,IAC1C,CAAC,EAAE,MAAM,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC,EAAG,CAAC,IACtD,CAAC;AAAA,EACP,CAAC;AACD,MAAI,QAAQ,SAAS,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AACpF,QAAM,OAAO,MAAM,QAAQC,MAAK,QAAQ,YAAY,OAAO,GAAG,gBAAgB,CAAC;AAC/E,QAAM,aAAaA,MAAK,MAAM,QAAQ;AACtC,QAAM,MAAM,UAAU;AACtB,MAAI,YAAY;AAChB,MAAI;AACF,UAAM,QAAQ,MAAM,SAAS,WAAW,SAAS,QAAQ;AACzD,eAAW,CAAC,OAAO,KAAK,KAAK,QAAQ,QAAQ,GAAG;AAC9C,YAAM,UAAU,MAAM,KAAK;AAC3B,mBAAa,QAAQ;AACrB,UAAI,YAAY,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAC/E,YAAM,SAAS,QAAQ,YAAY,MAAM,IAAI;AAC7C,UAAI,CAAC,OAAO,WAAW,GAAG,QAAQ,UAAU,CAAC,GAAG,GAAG,EAAE,EAAG,OAAM,IAAI,UAAU,iCAAiC;AAC7G,YAAM,MAAM,QAAQ,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AACtD,YAAM,UAAU,QAAQ,SAAS,EAAE,MAAM,MAAM,MAAM,MAAM,SAAS,WAAW,MAAQ,IAAM,CAAC;AAAA,IAChG;AACA,WAAO;AAAA,MAAE;AAAA,MAAM,WAAW;AAAA,MAAY,WAAW,QAAQ;AAAA,MAAQ;AAAA,MAC/D,SAAS,MAAM,GAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IAAE;AAAA,EAC9D,SAAS,OAAO;AACd,UAAM,GAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,UAAM;AAAA,EACR;AACF;;;AEzHA,SAAS,OAAO,UAAU,OAAO,SAAAC,QAAO,WAAAC,UAAS,SAAS,YAAAC,WAAU,MAAAC,KAAI,YAAY;AACpF,SAAS,UAAAC,eAAc;AACvB,SAAS,UAAU,QAAAC,OAAM,UAAU,WAAAC,UAAS,OAAAC,YAAW;AACvD,SAAS,SAAAC,cAAa;AA+BtB,eAAe,YAAY,WAAmB,UAAkB,UAAyC;AACvG,QAAM,QAAsB,CAAC;AAC7B,MAAI,QAAQ;AACZ,QAAM,OAAO,OAAO,QAA+B;AACjD,eAAW,SAAS,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC,GAAG;AAC/D,UAAI,MAAM,YAAY,KAAK,oBAAoB,IAAI,MAAM,IAAI,EAAG;AAChE,UAAI,CAAC,MAAM,YAAY,KAAK,sBAAsB,KAAK,MAAM,IAAI,EAAG;AACpE,YAAM,OAAOC,MAAK,KAAK,MAAM,IAAI;AACjC,UAAI,MAAM,eAAe,EAAG;AAC5B,UAAI,MAAM,YAAY,GAAG;AACvB,cAAM,KAAK,IAAI;AACf;AAAA,MACF;AACA,UAAI,CAAC,MAAM,OAAO,EAAG;AACrB,YAAM,WAAW,MAAM,KAAK,IAAI;AAChC,eAAS,SAAS;AAClB,UAAI,MAAM,SAAS,IAAI,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AACtF,UAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAC3E,YAAM,KAAK;AAAA,QACT,QAAQ;AAAA,QACR,cAAc,SAAS,WAAW,IAAI;AAAA,QACtC,MAAM,SAAS,OAAO;AAAA,QACtB,OAAO,SAAS;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,KAAK,SAAS;AACpB,SAAO,MAAM,KAAK,CAAC,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;AACxF;AAEA,eAAe,eAAe,WAAmB,UAAkB,UAAyC;AAC1G,QAAM,QAAQC,OAAM,OAAO,CAAC,YAAY,MAAM,YAAY,YAAY,oBAAoB,GAAG;AAAA,IAC3F,KAAK;AAAA,IAAW,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAAG,OAAO;AAAA,EAC5D,CAAC;AACD,QAAM,SAAmB,CAAC;AAC1B,QAAM,SAAmB,CAAC;AAC1B,MAAI,cAAc;AAClB,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,mBAAe,MAAM;AACrB,QAAI,cAAc,IAAI,OAAO,KAAM,OAAM,KAAK,SAAS;AAAA,QAClD,QAAO,KAAK,KAAK;AAAA,EACxB,CAAC;AACD,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,QAAI,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC,IAAI,MAAQ,QAAO,KAAK,KAAK;AAAA,EAC1F,CAAC;AACD,QAAM,OAAO,MAAM,IAAI,QAAuB,CAAC,QAAQ,WAAW;AAChE,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,MAAM;AAAA,EAC3B,CAAC;AACD,MAAI,cAAc,IAAI,OAAO,KAAM,OAAM,IAAI,MAAM,kCAAkC;AACrF,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,8BAA8B,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAK,CAAC,EAAE;AACtH,QAAM,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK;AACtF,MAAI,MAAM,SAAS,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAClF,QAAM,OAAOC,SAAQ,SAAS;AAC9B,QAAM,QAAsB,CAAC;AAC7B,MAAI,QAAQ;AACZ,aAAW,gBAAgB,OAAO;AAChC,QAAI,CAAC,qBAAqB,YAAY,EAAG;AACzC,UAAM,SAASA,SAAQ,MAAM,YAAY;AACzC,QAAI,CAAC,OAAO,WAAW,GAAG,IAAI,GAAGC,IAAG,EAAE,EAAG,OAAM,IAAI,UAAU,iCAAiC;AAC9F,QAAI;AACJ,QAAI;AAAE,iBAAW,MAAM,MAAM,MAAM;AAAA,IAAG,SAC/B,OAAO;AACZ,UAAK,MAAgC,SAAS,SAAU;AACxD,YAAM;AAAA,IACR;AACA,QAAI,SAAS,eAAe,KAAK,CAAC,SAAS,OAAO,EAAG;AACrD,aAAS,SAAS;AAClB,QAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAC3E,UAAM,KAAK,EAAE,QAAQ,cAAc,MAAM,SAAS,OAAO,KAAO,OAAO,SAAS,KAAK,CAAC;AAAA,EACxF;AACA,SAAO;AACT;AAEA,eAAe,SAAS,OAAqB,aAAoC;AAC/E,aAAW,QAAQ,OAAO;AACxB,UAAM,SAASH,MAAK,aAAa,KAAK,YAAY;AAClD,UAAMI,OAAMF,SAAQ,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AACtD,UAAM,SAAS,KAAK,QAAQ,MAAM;AAClC,UAAM,MAAM,QAAQ,KAAK,IAAI;AAAA,EAC/B;AACF;AAEA,eAAe,eAAe,MAAc,UAAmC;AAC7E,QAAM,QAAQD,OAAM,OAAO;AAAA,IACzB;AAAA,IAAQ;AAAA,IAAc;AAAA,IAAY;AAAA,IAClC;AAAA,IAAmB;AAAA,IAAmB;AAAA,IAAM;AAAA,IAAY;AAAA,EAC1D,GAAG,EAAE,KAAK,MAAM,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,OAAO,MAAM,CAAC;AACjE,QAAM,SAAmB,CAAC;AAC1B,QAAM,SAAmB,CAAC;AAC1B,MAAI,QAAQ;AACZ,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,aAAS,MAAM;AACf,QAAI,QAAQ,SAAU,OAAM,KAAK,SAAS;AAAA,QACrC,QAAO,KAAK,KAAK;AAAA,EACxB,CAAC;AACD,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,QAAI,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC,IAAI,MAAQ,QAAO,KAAK,KAAK;AAAA,EAC1F,CAAC;AACD,QAAM,OAAO,MAAM,IAAI,QAAuB,CAAC,QAAQ,WAAW;AAChE,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,MAAM;AAAA,EAC3B,CAAC;AACD,MAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,iBAAiB,QAAQ,QAAQ;AACvE,MAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,UAAM,IAAI,MAAM,oBAAoB,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAK,CAAC,EAAE;AAAA,EAC9F;AACA,SAAO,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EACzC,WAAW,eAAe,IAAI,EAC9B,WAAW,gBAAgB,IAAI,EAC/B,WAAW,eAAe,IAAI,EAC9B,WAAW,gBAAgB,IAAI,EAC/B,WAAW,kBAAkB,OAAO,EACpC,WAAW,mBAAmB,OAAO;AAC1C;AAKA,eAAsB,eAAe,QAAgB,UAAiC,CAAC,GAA6B;AAClH,QAAM,YAAY,MAAMI,UAASH,SAAQ,MAAM,CAAC;AAChD,QAAM,aAAa,MAAM,KAAK,SAAS;AACvC,MAAI,CAAC,WAAW,YAAY,EAAG,OAAM,IAAI,UAAU,sCAAsC;AACzF,QAAM,OAAO,MAAMI,SAAQN,MAAK,QAAQ,YAAYO,QAAO,GAAG,eAAe,CAAC;AAC9E,QAAM,cAAcP,MAAK,MAAM,UAAU;AACzC,QAAM,eAAeA,MAAK,MAAM,WAAW;AAC3C,QAAM,QAAQ,IAAI,CAACI,OAAM,WAAW,GAAGA,OAAM,YAAY,CAAC,CAAC;AAC3D,MAAI;AACF,UAAM,WAAW,QAAQ,YAAY;AACrC,UAAM,WAAW,QAAQ,YAAY,MAAM,OAAO;AAClD,UAAM,QAAQ,QAAQ,yBAClB,MAAM,eAAe,WAAW,UAAU,QAAQ,IAClD,MAAM,YAAY,WAAW,UAAU,QAAQ;AACnD,UAAM,QAAQ,IAAI,CAAC,SAAS,OAAO,WAAW,GAAG,SAAS,OAAO,YAAY,CAAC,CAAC;AAC/E,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,OAAO,CAAC;AAAA,MAC1D,OAAO,CAACI,cAAa,eAAe,MAAMA,SAAQ;AAAA,MAClD,SAAS,MAAMC,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IAC1D;AAAA,EACF,SAAS,OAAO;AACd,UAAMA,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,UAAM;AAAA,EACR;AACF;AAIA,eAAsB,mBACpB,gBAAwB,iBAAyB,UAAiC,CAAC,GACzD;AAC1B,QAAM,oBAAoB,MAAMJ,UAASH,SAAQ,cAAc,CAAC;AAChE,QAAM,qBAAqB,MAAMG,UAASH,SAAQ,eAAe,CAAC;AAClE,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,WAAW,QAAQ,YAAY,MAAM,OAAO;AAClD,QAAM,CAAC,eAAe,cAAc,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxD,YAAY,mBAAmB,UAAU,QAAQ;AAAA,IACjD,YAAY,oBAAoB,UAAU,QAAQ;AAAA,EACpD,CAAC;AACD,QAAM,OAAO,MAAMI,SAAQN,MAAK,QAAQ,YAAYO,QAAO,GAAG,eAAe,CAAC;AAC9E,QAAM,cAAcP,MAAK,MAAM,UAAU;AACzC,QAAM,eAAeA,MAAK,MAAM,WAAW;AAC3C,QAAM,QAAQ,IAAI,CAACI,OAAM,WAAW,GAAGA,OAAM,YAAY,CAAC,CAAC;AAC3D,MAAI;AACF,UAAM,QAAQ,IAAI,CAAC,SAAS,eAAe,WAAW,GAAG,SAAS,gBAAgB,YAAY,CAAC,CAAC;AAChG,WAAO;AAAA,MACL;AAAA,MAAM;AAAA,MAAa;AAAA,MACnB,WAAW,eAAe;AAAA,MAC1B,WAAW,eAAe,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,OAAO,CAAC;AAAA,MACnE,OAAO,CAAC,kBAAkB,eAAe,MAAM,aAAa;AAAA,MAC5D,SAAS,MAAMK,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IAC1D;AAAA,EACF,SAAS,OAAO;AACd,UAAMA,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,UAAM;AAAA,EACR;AACF;AAGO,SAAS,mBAAmB,OAAuB;AACxD,QAAM,QAAQ,SAAS,KAAK,EAAE,YAAY,EAAE,QAAQ,iBAAiB,GAAG,EAAE,QAAQ,YAAY,EAAE;AAChG,MAAI,CAAC,MAAO,OAAM,IAAI,UAAU,0BAA0B;AAC1D,SAAO,MAAM,MAAM,GAAG,EAAE;AAC1B;","names":["resolve","access","join","spawn","spawn","join","mkdir","mkdtemp","realpath","rm","tmpdir","join","resolve","sep","spawn","join","spawn","resolve","sep","mkdir","realpath","mkdtemp","tmpdir","maxBytes","rm"]}