@openrig/cli 0.5.15 → 0.5.17

package/node_modules/@openrig/daemon/dist/domain/agent-resolver.d.ts

@@ -1,77 +0,0 @@
-import type { AgentSpec } from "./types.js";
-export interface AgentResolverFsOps {
-    readFile(path: string): string;
-    exists(path: string): boolean;
-}
-export interface ResolvedAgentSpec {
-    spec: AgentSpec;
-    sourcePath: string;
-    hash: string;
-}
-export interface ResourceCollision {
-    category: string;
-    resourceId: string;
-    sources: Array<{
-        specName: string;
-        qualifiedId: string;
-    }>;
-}
-export interface ShippableSubstanceSource {
-    path: string;
-    bytes: string | Uint8Array;
-}
-export type ResolveResult = {
-    ok: true;
-    resolved: ResolvedAgentSpec;
-    imports: ResolvedAgentSpec[];
-    collisions: ResourceCollision[];
-} | {
-    ok: false;
-    code: "not_found";
-    error: string;
-} | {
-    ok: false;
-    code: "parse_error";
-    error: string;
-} | {
-    ok: false;
-    code: "validation_failed";
-    errors: string[];
-} | {
-    ok: false;
-    code: "version_mismatch";
-    error: string;
-} | {
-    ok: false;
-    code: "import_error";
-    error: string;
-    importRef: string;
-} | {
-    ok: false;
-    code: "cycle_detected";
-    error: string;
-};
-/**
- * Resolve an agent_ref to a concrete AgentSpec, including flat imports.
- * @param ref - agent_ref string (e.g. "local:agents/impl" or "path:/abs/agents/impl")
- * @param rigRoot - absolute path to rig root directory
- * @param fsOps - injectable filesystem operations
- * @returns structured resolve result
- */
-export declare function resolveAgentRef(ref: string, rigRoot: string, fsOps: AgentResolverFsOps): ResolveResult;
-/**
- * Resolve imports for an already-loaded AgentSpec.
- * Import local: refs resolve relative to the spec's own directory.
- * @param resolved - already-resolved base spec
- * @param fsOps - injectable filesystem operations
- * @returns structured resolve result with imports and collisions
- */
-export declare function resolveImports(resolved: ResolvedAgentSpec, fsOps: AgentResolverFsOps): ResolveResult;
-/**
- * Deterministic refusal floor for content crossing a public artifact boundary.
- * The broader generic-vs-instance call remains a human judgment recorded by
- * the substance-gate receipt; this helper only enforces the two classes whose
- * answer is structural: private shared-docs paths and taxonomy: lore.
- */
-export declare function assertShippableSubstance(sources: readonly ShippableSubstanceSource[]): void;
-//# sourceMappingURL=agent-resolver.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/agent-resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-resolver.d.ts","sourceRoot":"","sources":["../../src/domain/agent-resolver.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,YAAY,CAAC;AAI5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;CAC5B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,UAAU,EAAE,iBAAiB,EAAE,CAAA;CAAE,GACxG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAUzD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,kBAAkB,GACxB,aAAa,CAWf;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,kBAAkB,GACxB,aAAa,CAEf;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,wBAAwB,EAAE,GAAG,IAAI,CA2B3F"}

package/node_modules/@openrig/daemon/dist/domain/agent-resolver.js

@@ -1,248 +0,0 @@
-import nodePath from "node:path";
-import { createHash } from "node:crypto";
-import { parse as parseYaml } from "yaml";
-import { parseAgentSpec, validateAgentSpec, normalizeAgentSpec } from "./agent-manifest.js";
-// -- Resource category keys --
-const RESOURCE_CATEGORIES = [
-    "skills", "guidance", "subagents", "plugins", "runtimeResources",
-];
-// -- Public API --
-/**
- * Resolve an agent_ref to a concrete AgentSpec, including flat imports.
- * @param ref - agent_ref string (e.g. "local:agents/impl" or "path:/abs/agents/impl")
- * @param rigRoot - absolute path to rig root directory
- * @param fsOps - injectable filesystem operations
- * @returns structured resolve result
- */
-export function resolveAgentRef(ref, rigRoot, fsOps) {
-    const dirPath = resolveRefToAbsPath(ref, rigRoot);
-    if (!dirPath) {
-        return { ok: false, code: "not_found", error: `Cannot resolve agent_ref "${ref}"` };
-    }
-    const baseResult = loadSpec(dirPath, fsOps);
-    if (!baseResult.ok)
-        return baseResult;
-    // Resolve flat imports — import local: refs resolve relative to the base spec's directory
-    return resolveWithImports(baseResult.resolved, baseResult.resolved.sourcePath, fsOps, new Set([baseResult.resolved.sourcePath]));
-}
-/**
- * Resolve imports for an already-loaded AgentSpec.
- * Import local: refs resolve relative to the spec's own directory.
- * @param resolved - already-resolved base spec
- * @param fsOps - injectable filesystem operations
- * @returns structured resolve result with imports and collisions
- */
-export function resolveImports(resolved, fsOps) {
-    return resolveWithImports(resolved, resolved.sourcePath, fsOps, new Set([resolved.sourcePath]));
-}
-/**
- * Deterministic refusal floor for content crossing a public artifact boundary.
- * The broader generic-vs-instance call remains a human judgment recorded by
- * the substance-gate receipt; this helper only enforces the two classes whose
- * answer is structural: private shared-docs paths and taxonomy: lore.
- */
-export function assertShippableSubstance(sources) {
-    const findings = [];
-    for (const source of sources) {
-        const normalizedPath = source.path.replaceAll("\\", "/");
-        const text = Buffer.from(source.bytes).toString("utf8");
-        if (text.toLowerCase().includes("substrate/shared-docs/")) {
-            findings.push({
-                path: normalizedPath,
-                kind: "internal-path",
-                detail: "contains substrate/shared-docs/",
-            });
-        }
-        if (declaresLoreTaxonomy(normalizedPath, text)) {
-            findings.push({
-                path: normalizedPath,
-                kind: "lore-class",
-                detail: "declares taxonomy: lore",
-            });
-        }
-    }
-    if (findings.length === 0)
-        return;
-    throw new Error([
-        "Public artifact substance refusal:",
-        ...findings.map(({ path, kind, detail }) => `  ${kind}: ${path} ${detail}`),
-        "Fix: genericize the content, cite its public home, or re-home it to the internal pack root.",
-    ].join("\n"));
-}
-function declaresLoreTaxonomy(path, text) {
-    let yamlText;
-    if (/\.ya?ml$/i.test(path)) {
-        yamlText = text;
-    }
-    else if (/\.(?:md|markdown)$/i.test(path)) {
-        const frontmatter = text.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
-        yamlText = frontmatter?.[1];
-    }
-    if (yamlText === undefined)
-        return false;
-    try {
-        const parsed = parseYaml(yamlText);
-        return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
-            && parsed["taxonomy"] === "lore";
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Resolve a single agent_ref without following imports. Used for import targets.
- * @param ref - import ref string
- * @param basePath - directory to resolve local: refs relative to
- * @param fsOps - filesystem ops
- * @returns resolved spec or error
- */
-function loadSpec(dirPath, fsOps) {
-    const manifestPath = nodePath.join(dirPath, "agent.yaml");
-    if (!fsOps.exists(manifestPath)) {
-        return { ok: false, code: "not_found", error: `No agent.yaml found at ${manifestPath}` };
-    }
-    let rawYaml;
-    try {
-        rawYaml = fsOps.readFile(manifestPath);
-    }
-    catch (err) {
-        return { ok: false, code: "parse_error", error: `Cannot read ${manifestPath}: ${err.message}` };
-    }
-    let raw;
-    try {
-        raw = parseAgentSpec(rawYaml);
-    }
-    catch (err) {
-        return { ok: false, code: "parse_error", error: `Cannot parse ${manifestPath}: ${err.message}` };
-    }
-    const validation = validateAgentSpec(raw);
-    if (!validation.valid) {
-        return { ok: false, code: "validation_failed", errors: validation.errors };
-    }
-    const spec = normalizeAgentSpec(raw);
-    const hash = createHash("sha256").update(rawYaml).digest("hex");
-    return {
-        ok: true,
-        resolved: { spec, sourcePath: dirPath, hash },
-    };
-}
-/**
- * Resolve base spec + flat imports, detect collisions, enforce v1 constraints.
- */
-/**
- * Resolve base spec + flat imports. Import local: refs resolve relative to specDir
- * (the importing spec's own directory), not the rig root.
- */
-function resolveWithImports(base, specDir, fsOps, visitedPaths) {
-    const resolvedImports = [];
-    const importNames = new Set();
-    for (const imp of base.spec.imports) {
-        // Remote sources already rejected by AS-T01 validation, but double-check at resolve time
-        if (!imp.ref.startsWith("local:") && !imp.ref.startsWith("path:")) {
-            return { ok: false, code: "import_error", error: `Remote import source not supported in v1: "${imp.ref}"`, importRef: imp.ref };
-        }
-        const importDir = resolveRefToAbsPath(imp.ref, specDir);
-        if (!importDir) {
-            return { ok: false, code: "import_error", error: `Cannot resolve import ref "${imp.ref}"`, importRef: imp.ref };
-        }
-        // Cycle detection
-        if (visitedPaths.has(importDir)) {
-            return { ok: false, code: "cycle_detected", error: `Import cycle detected: "${imp.ref}" resolves to already-visited path ${importDir}` };
-        }
-        const importResult = loadSpec(importDir, fsOps);
-        if (!importResult.ok) {
-            if (importResult.code === "not_found") {
-                return { ok: false, code: "import_error", error: importResult.error, importRef: imp.ref };
-            }
-            if (importResult.code === "validation_failed") {
-                return { ok: false, code: "import_error", error: `Imported spec at "${imp.ref}" has validation errors: ${importResult.errors.join("; ")}`, importRef: imp.ref };
-            }
-            return { ok: false, code: "import_error", error: importResult.error, importRef: imp.ref };
-        }
-        const importedSpec = importResult.resolved;
-        // Version check
-        if (imp.version && importedSpec.spec.version !== imp.version) {
-            return {
-                ok: false, code: "version_mismatch",
-                error: `Import "${imp.ref}" requires version "${imp.version}" but spec declares "${importedSpec.spec.version}"`,
-            };
-        }
-        // v1: imported specs must not declare their own imports (no transitive)
-        if (importedSpec.spec.imports.length > 0) {
-            return {
-                ok: false, code: "import_error",
-                error: `Imported spec "${importedSpec.spec.name}" declares nested imports, which are not supported in v1`,
-                importRef: imp.ref,
-            };
-        }
-        // Imported spec name must not contain colon (conflicts with qualified ref syntax)
-        if (importedSpec.spec.name.includes(":")) {
-            return {
-                ok: false, code: "import_error",
-                error: `Imported spec name "${importedSpec.spec.name}" contains colon, which conflicts with qualified ref syntax (namespace:id)`,
-                importRef: imp.ref,
-            };
-        }
-        // Duplicate import names
-        if (importNames.has(importedSpec.spec.name)) {
-            return {
-                ok: false, code: "import_error",
-                error: `Duplicate import name: two imports resolve to specs both named "${importedSpec.spec.name}"`,
-                importRef: imp.ref,
-            };
-        }
-        importNames.add(importedSpec.spec.name);
-        resolvedImports.push(importedSpec);
-    }
-    // Detect resource collisions
-    const collisions = detectCollisions(base, resolvedImports);
-    return { ok: true, resolved: base, imports: resolvedImports, collisions };
-}
-// -- Collision detection --
-function detectCollisions(base, imports) {
-    const collisions = [];
-    for (const category of RESOURCE_CATEGORIES) {
-        // Build a map of resourceId -> sources
-        const idSources = new Map();
-        // Base spec resources (unqualified id)
-        const baseResources = base.spec.resources[category];
-        for (const r of baseResources) {
-            const sources = idSources.get(r.id) ?? [];
-            sources.push({ specName: base.spec.name, qualifiedId: r.id });
-            idSources.set(r.id, sources);
-        }
-        // Imported spec resources (qualified id)
-        for (const imp of imports) {
-            const importResources = imp.spec.resources[category];
-            for (const r of importResources) {
-                const sources = idSources.get(r.id) ?? [];
-                sources.push({ specName: imp.spec.name, qualifiedId: `${imp.spec.name}:${r.id}` });
-                idSources.set(r.id, sources);
-            }
-        }
-        // Record collisions (any id with 2+ sources)
-        for (const [resourceId, sources] of idSources) {
-            if (sources.length >= 2) {
-                collisions.push({ category, resourceId, sources });
-            }
-        }
-    }
-    return collisions;
-}
-// -- Path resolution --
-function resolveRefToAbsPath(ref, baseDir) {
-    if (ref.startsWith("local:")) {
-        const relPath = ref.slice("local:".length);
-        if (!relPath)
-            return null;
-        return nodePath.resolve(baseDir, relPath);
-    }
-    if (ref.startsWith("path:")) {
-        const absPath = ref.slice("path:".length);
-        if (!absPath)
-            return null;
-        return absPath;
-    }
-    return null;
-}
-//# sourceMappingURL=agent-resolver.js.map

package/node_modules/@openrig/daemon/dist/domain/agent-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-resolver.js","sourceRoot":"","sources":["../../src/domain/agent-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAoC5F,+BAA+B;AAE/B,MAAM,mBAAmB,GAA6B;IACpD,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB;CACjE,CAAC;AAEF,mBAAmB;AAEnB;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,OAAe,EACf,KAAyB;IAEzB,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,6BAA6B,GAAG,GAAG,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC;IAEtC,0FAA0F;IAC1F,OAAO,kBAAkB,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACnI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA2B,EAC3B,KAAyB;IAEzB,OAAO,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA4C;IACnF,MAAM,QAAQ,GAAkF,EAAE,CAAC;IACnG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,iCAAiC;aAC1C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,yBAAyB;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,IAAI,KAAK,CAAC;QACd,oCAAoC;QACpC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,IAAI,IAAI,MAAM,EAAE,CAAC;QAC3E,6FAA6F;KAC9F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,IAAY;IACtD,IAAI,QAA4B,CAAC;IACjC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACzE,QAAQ,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;eACxE,MAAkC,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,OAAe,EACf,KAAyB;IAEzB,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE1D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,0BAA0B,YAAY,EAAE,EAAE,CAAC;IAC3F,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7G,CAAC;IAED,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9G,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAuB,EACvB,OAAe,EACf,KAAyB,EACzB,YAAyB;IAEzB,MAAM,eAAe,GAAwB,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,yFAAyF;QACzF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,8CAA8C,GAAG,CAAC,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAClI,CAAC;QAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,8BAA8B,GAAG,CAAC,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAClH,CAAC;QAED,kBAAkB;QAClB,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,2BAA2B,GAAG,CAAC,GAAG,sCAAsC,SAAS,EAAE,EAAE,CAAC;QAC3I,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,IAAI,YAAY,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAC5F,CAAC;YACD,IAAI,YAAY,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,qBAAqB,GAAG,CAAC,GAAG,4BAA4B,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAClK,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC;QAE3C,gBAAgB;QAChB,IAAI,GAAG,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB;gBACnC,KAAK,EAAE,WAAW,GAAG,CAAC,GAAG,uBAAuB,GAAG,CAAC,OAAO,wBAAwB,YAAY,CAAC,IAAI,CAAC,OAAO,GAAG;aAChH,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc;gBAC/B,KAAK,EAAE,kBAAkB,YAAY,CAAC,IAAI,CAAC,IAAI,0DAA0D;gBACzG,SAAS,EAAE,GAAG,CAAC,GAAG;aACnB,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc;gBAC/B,KAAK,EAAE,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,4EAA4E;gBAChI,SAAS,EAAE,GAAG,CAAC,GAAG;aACnB,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc;gBAC/B,KAAK,EAAE,mEAAmE,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG;gBACnG,SAAS,EAAE,GAAG,CAAC,GAAG;aACnB,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAE3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAC5E,CAAC;AAED,4BAA4B;AAE5B,SAAS,gBAAgB,CAAC,IAAuB,EAAE,OAA4B;IAC7E,MAAM,UAAU,GAAwB,EAAE,CAAC;IAE3C,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,uCAAuC;QACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4D,CAAC;QAEtF,uCAAuC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAA0B,CAAC;QAC7E,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9D,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QAED,yCAAyC;QACzC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAA0B,CAAC;YAC9E,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnF,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,KAAK,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,wBAAwB;AAExB,SAAS,mBAAmB,CAAC,GAAW,EAAE,OAAe;IACvD,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/agent-starter-resolver.d.ts

@@ -1,94 +0,0 @@
-import type { ResolvedStartupFile } from "./runtime-adapter.js";
-/**
- * Daemon-side productized resolver for the Agent Starter v1 vertical (M1).
- * Mirrors the v0 wrapper-tier `bin/agent-starter-resolve` semantics:
- * read the named registry entry; run the path-aware no-credentials scan;
- * THROW on a failed scan (the orchestrator MUST treat any throw as a
- * hard launch failure); on a clean scan, emit a `ResolvedStartupFile[]` rooted at the
- * registry directory.
- *
- * v0 wrapper references:
- * - Schema spec: `specs/agent-starters/SCHEMA.md` § No-Credentials Proof
- *   (path-aware + content-aware; allowlist for transcript_path under
- *   ~/.claude/projects/ or ~/.openrig/transcripts/).
- * - Refusal verb: `specs/agent-starters/bin/agent-starter-resolve` lines
- *   22-31 (preflights via `scan_starter_file`; refuses with
- *   credential_path_disallowed / credential_content_disallowed).
- *
- * Pattern reference for the resolver shape:
- * `session-source-rebuild-resolver.ts:31-90`.
- */
-export type ExistsFn = (path: string) => boolean;
-export type ReadFileFn = (path: string) => string;
-export interface AgentStarterResolverOpts {
-    /** Optional absolute override; bypasses the lookup chain. */
-    registryRoot?: string;
-    /**
-     * Env var consulted second in the lookup chain. Defaults to
-     * `OPENRIG_AGENT_STARTER_ROOT`.
-     */
-    envVarName?: string;
-    /**
-     * Home-directory root consulted third. Defaults to
-     * `~/.openrig/agent-starters/` (resolved against `process.env.HOME` or
-     * `os.homedir()`).
-     */
-    homeDirRoot?: string;
-    /** Optional fallback consulted last when the home registry is absent. */
-    fallbackRoot?: string;
-    exists?: ExistsFn;
-    readFile?: ReadFileFn;
-    /** Test seam: lets unit tests inject a controlled env map. */
-    env?: Record<string, string | undefined>;
-}
-export interface AgentStarterResolveResult {
-    files: ResolvedStartupFile[];
-    registryPath: string;
-}
-/**
- * Thrown by `resolveStarter` when the no-credentials scan fails. The
- * resolver MUST throw rather than
- * return a structured "ok: false" result the orchestrator could ignore;
- * a failed scan is a hard refusal point that aborts the launch.
- */
-export declare class AgentStarterCredentialScanFailedError extends Error {
-    readonly starterName: string;
-    readonly reason: string;
-    constructor(starterName: string, reason: string);
-}
-export declare class AgentStarterResolver {
-    private readonly registryRoot;
-    private readonly exists;
-    private readonly readFile;
-    constructor(opts?: AgentStarterResolverOpts);
-    /** Exposed for tests + diagnostics. */
-    getRegistryRoot(): string;
-    /**
-     * Look up the registry root via the documented chain:
-     *   opts.registryRoot > env[envVarName] > homeDirRoot (if exists) > fallbackRoot
-     *
-     * The fallback returns even if the path doesn't exist. `resolveStarter`
-     * throws a missing-entry error when the selected root is dead. This keeps
-     * the constructor side-effect-free; the file-existence check lives inside
-     * `resolveStarter`.
-     */
-    static resolveRegistryRoot(opts: AgentStarterResolverOpts, exists: ExistsFn): string;
-    /**
-     * Resolve a starter by registry name. THROWS on:
-     * - missing registry entry (no `<root>/<name>.yaml`);
-     * - malformed YAML (best-effort detection — empty file, unparseable
-     *   front-matter shape — driver does not pull in a YAML parser at
-     *   M1 to keep the dependency surface narrow);
-     * - failed no-credentials scan (`AgentStarterCredentialScanFailedError`).
-     *
-     * On a clean scan, emits `ResolvedStartupFile[]`. v1 M1 scaffolding
-     * shape: one entry per registry-relative file the starter declares
-     * (currently the registry entry YAML itself, treated as guidance_merge
-     * content; later milestones can extend the resolver to walk the
-     * priming-pack manifest's `read_full` paths once M2/M3 wiring is in
-     * place). All emitted files are tagged `appliesOn: ["fresh_start"]`
-     * because starter context seeds a fresh-launch conversation.
-     */
-    resolveStarter(name: string): AgentStarterResolveResult;
-}
-//# sourceMappingURL=agent-starter-resolver.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/agent-starter-resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-starter-resolver.d.ts","sourceRoot":"","sources":["../../src/domain/agent-starter-resolver.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;AACjD,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;AAElD,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMhD;AAID,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAa;gBAE1B,IAAI,GAAE,wBAA6B;IAM/C,uCAAuC;IACvC,eAAe,IAAI,MAAM;IAIzB;;;;;;;;OAQG;IACH,MAAM,CAAC,mBAAmB,CACxB,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,QAAQ,GACf,MAAM;IAkBT;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB;CAgExD"}

package/node_modules/@openrig/daemon/dist/domain/agent-starter-resolver.js

@@ -1,198 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join, basename } from "node:path";
-import os from "node:os";
-/**
- * Thrown by `resolveStarter` when the no-credentials scan fails. The
- * resolver MUST throw rather than
- * return a structured "ok: false" result the orchestrator could ignore;
- * a failed scan is a hard refusal point that aborts the launch.
- */
-export class AgentStarterCredentialScanFailedError extends Error {
-    starterName;
-    reason;
-    constructor(starterName, reason) {
-        super(`Agent Starter "${starterName}" credential scan failed: ${reason}`);
-        this.name = "AgentStarterCredentialScanFailedError";
-        this.starterName = starterName;
-        this.reason = reason;
-    }
-}
-const DEFAULT_ENV_VAR = "OPENRIG_AGENT_STARTER_ROOT";
-const DEFAULT_HOME_SUBPATH = ".openrig/agent-starters";
-export class AgentStarterResolver {
-    registryRoot;
-    exists;
-    readFile;
-    constructor(opts = {}) {
-        this.exists = opts.exists ?? existsSync;
-        this.readFile = opts.readFile ?? ((p) => readFileSync(p, "utf-8"));
-        this.registryRoot = AgentStarterResolver.resolveRegistryRoot(opts, this.exists);
-    }
-    /** Exposed for tests + diagnostics. */
-    getRegistryRoot() {
-        return this.registryRoot;
-    }
-    /**
-     * Look up the registry root via the documented chain:
-     *   opts.registryRoot > env[envVarName] > homeDirRoot (if exists) > fallbackRoot
-     *
-     * The fallback returns even if the path doesn't exist. `resolveStarter`
-     * throws a missing-entry error when the selected root is dead. This keeps
-     * the constructor side-effect-free; the file-existence check lives inside
-     * `resolveStarter`.
-     */
-    static resolveRegistryRoot(opts, exists) {
-        if (typeof opts.registryRoot === "string" && opts.registryRoot !== "") {
-            return opts.registryRoot;
-        }
-        const env = opts.env ?? process.env;
-        const envVarName = opts.envVarName ?? DEFAULT_ENV_VAR;
-        const fromEnv = env[envVarName];
-        if (typeof fromEnv === "string" && fromEnv !== "") {
-            return fromEnv;
-        }
-        const homeBase = opts.homeDirRoot
-            ?? join(env.HOME ?? os.homedir(), DEFAULT_HOME_SUBPATH);
-        if (exists(homeBase)) {
-            return homeBase;
-        }
-        return opts.fallbackRoot ?? homeBase;
-    }
-    /**
-     * Resolve a starter by registry name. THROWS on:
-     * - missing registry entry (no `<root>/<name>.yaml`);
-     * - malformed YAML (best-effort detection — empty file, unparseable
-     *   front-matter shape — driver does not pull in a YAML parser at
-     *   M1 to keep the dependency surface narrow);
-     * - failed no-credentials scan (`AgentStarterCredentialScanFailedError`).
-     *
-     * On a clean scan, emits `ResolvedStartupFile[]`. v1 M1 scaffolding
-     * shape: one entry per registry-relative file the starter declares
-     * (currently the registry entry YAML itself, treated as guidance_merge
-     * content; later milestones can extend the resolver to walk the
-     * priming-pack manifest's `read_full` paths once M2/M3 wiring is in
-     * place). All emitted files are tagged `appliesOn: ["fresh_start"]`
-     * because starter context seeds a fresh-launch conversation.
-     */
-    resolveStarter(name) {
-        if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(name)) {
-            throw new Error(`Agent Starter resolver: invalid name ${JSON.stringify(name)} (must be alphanumeric with optional "_" or "-")`);
-        }
-        const registryPath = join(this.registryRoot, `${name}.yaml`);
-        if (!this.exists(registryPath)) {
-            throw new Error(`Agent Starter resolver: no registry entry found at ${registryPath}`);
-        }
-        let content;
-        try {
-            content = this.readFile(registryPath);
-        }
-        catch (err) {
-            throw new Error(`Agent Starter resolver: failed to read ${registryPath}: ${err.message}`);
-        }
-        if (typeof content !== "string" || content.trim() === "") {
-            throw new Error(`Agent Starter resolver: ${registryPath} is empty or unreadable`);
-        }
-        // Smoke check that the file parses as YAML front-matter shape: it must
-        // contain `starter_id:` line. Keeps M1 dependency surface narrow (no
-        // yaml parser pulled in); M2 can swap in a real parser when it walks
-        // the priming-pack manifest.
-        if (!/^starter_id:\s*\S+/m.test(content)) {
-            throw new Error(`Agent Starter resolver: ${registryPath} does not match registry-entry shape (missing "starter_id:" field)`);
-        }
-        // Path-aware + content-aware credential scan. Mirrors the v0 wrapper
-        // helper at `specs/agent-starters/lib/agent-starter-helpers.sh`
-        // `scan_starter_file`. THROWS on match instead of returning a
-        // recoverable result.
-        const scanResult = scanForCredentials(content, registryPath);
-        if (!scanResult.ok) {
-            throw new AgentStarterCredentialScanFailedError(name, scanResult.reason);
-        }
-        // M1 scaffolding shape: one ResolvedStartupFile pointing at the
-        // registry entry itself. The orchestrator's `deliverStartup` seam
-        // already accepts `deliveryHint: "guidance_merge"`. Later milestones
-        // (M2 instantiator integration; M3 Claude e2e; M4 Codex parity) can
-        // extend the resolver to walk the priming-pack manifest's `read_full`
-        // paths if the e2e proof requires richer per-layer artifacts. The
-        // type contract and refusal semantics are what M1 is locking in.
-        const files = [
-            {
-                path: basename(registryPath),
-                absolutePath: registryPath,
-                ownerRoot: this.registryRoot,
-                deliveryHint: "guidance_merge",
-                required: true,
-                appliesOn: ["fresh_start"],
-            },
-        ];
-        return { files, registryPath };
-    }
-}
-// --- No-credentials scan (mirrors `lib/agent-starter-helpers.sh::scan_starter_file`) ---
-const CRED_PATH_LITERALS = [
-    ".claude/.credentials.json",
-    ".codex/auth.json",
-    ".aws/credentials",
-    ".ssh/",
-];
-const CRED_PATH_RE = /(credentials|auth\.json|secrets|tokens?\.json)([^a-zA-Z0-9._-]|$)/;
-const CRED_STRING_RE = /(api[_-]?key|secret[_-]?key|bearer[_-]?token|sk-[A-Za-z0-9]{20,}|gh[ps]_[A-Za-z0-9]{20,}|password[\s]*[:=])/i;
-function scanForCredentials(content, filePath) {
-    // Allowlist exception: `transcript_path` field values under
-    // `~/.claude/projects/` or `~/.openrig/transcripts/` are accepted
-    // (mirrors the v0 wrapper); same paths under any other field/key/comment
-    // are rejected as suspicious copying.
-    const transcriptPath = extractFieldValue(content, "transcript_path");
-    let lineNo = 0;
-    for (const rawLine of content.split("\n")) {
-        lineNo += 1;
-        const line = rawLine;
-        // Allowlist check for transcript_path's own line.
-        const stripped = line.replace(/^\s+/, "");
-        let isAllowlistedTranscript = false;
-        if (transcriptPath && stripped.startsWith("transcript_path:")) {
-            if (transcriptPath.includes("/.claude/projects/")
-                || transcriptPath.includes("/.openrig/transcripts/")) {
-                isAllowlistedTranscript = true;
-            }
-        }
-        // 1. Literal credential paths.
-        // Refusal reason intentionally REDACTS the matched line content. The
-        // daemon-tier resolver flows error messages into logs/API responses;
-        // echoing the matched line would leak the credential-bearing content
-        // the deny-list is meant to catch. Operators see refusal code + line
-        // number + file path; that's enough to triage. Closes the v0 wrapper
-        // diagnostic-`match`-field caveat at the daemon-tier productization
-        // layer.
-        for (const literal of CRED_PATH_LITERALS) {
-            if (line.includes(literal)) {
-                return {
-                    ok: false,
-                    reason: `credential_path_disallowed: line ${lineNo} of ${filePath} matches a deny-list literal credential path (content redacted)`,
-                };
-            }
-        }
-        // 2. Path regex (credentials|auth.json|secrets|tokens.json).
-        if (!isAllowlistedTranscript && CRED_PATH_RE.test(line)) {
-            return {
-                ok: false,
-                reason: `credential_path_disallowed: line ${lineNo} of ${filePath} matches credential path pattern (content redacted)`,
-            };
-        }
-        // 3. Credential string regex (case-insensitive).
-        if (CRED_STRING_RE.test(line)) {
-            return {
-                ok: false,
-                reason: `credential_content_disallowed: line ${lineNo} of ${filePath} matches credential content pattern (content redacted)`,
-            };
-        }
-    }
-    return { ok: true };
-}
-function extractFieldValue(content, field) {
-    const re = new RegExp(`^\\s*${field}:\\s*(.*?)\\s*$`, "m");
-    const match = content.match(re);
-    if (!match || !match[1])
-        return "";
-    return match[1].replace(/^['"]|['"]$/g, "").trim();
-}
-//# sourceMappingURL=agent-starter-resolver.js.map

package/node_modules/@openrig/daemon/dist/domain/agent-starter-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-starter-resolver.js","sourceRoot":"","sources":["../../src/domain/agent-starter-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AAqDzB;;;;;GAKG;AACH,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IACrD,WAAW,CAAS;IACpB,MAAM,CAAS;IACxB,YAAY,WAAmB,EAAE,MAAc;QAC7C,KAAK,CAAC,kBAAkB,WAAW,6BAA6B,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AACvD,MAAM,OAAO,oBAAoB;IACd,YAAY,CAAS;IACrB,MAAM,CAAW;IACjB,QAAQ,CAAa;IAEtC,YAAY,OAAiC,EAAE;QAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,uCAAuC;IACvC,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,mBAAmB,CACxB,IAA8B,EAC9B,MAAgB;QAEhB,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW;eAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kDAAkD,CAC/G,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,sDAAsD,YAAY,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,0CAA0C,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,2BAA2B,YAAY,yBAAyB,CACjE,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,6BAA6B;QAC7B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,YAAY,oEAAoE,CAC5G,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,gEAAgE;QAChE,8DAA8D;QAC9D,sBAAsB;QACtB,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,qCAAqC,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC;QAED,gEAAgE;QAChE,kEAAkE;QAClE,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,kEAAkE;QAClE,iEAAiE;QACjE,MAAM,KAAK,GAA0B;YACnC;gBACE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC;gBAC5B,YAAY,EAAE,YAAY;gBAC1B,SAAS,EAAE,IAAI,CAAC,YAAY;gBAC5B,YAAY,EAAE,gBAAgB;gBAC9B,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,CAAC,aAAa,CAAC;aAC3B;SACF,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;CACF;AAED,0FAA0F;AAE1F,MAAM,kBAAkB,GAAG;IACzB,2BAA2B;IAC3B,kBAAkB;IAClB,kBAAkB;IAClB,OAAO;CACR,CAAC;AAEF,MAAM,YAAY,GAAG,mEAAmE,CAAC;AACzF,MAAM,cAAc,GAAG,8GAA8G,CAAC;AAEtI,SAAS,kBAAkB,CACzB,OAAe,EACf,QAAgB;IAEhB,4DAA4D;IAC5D,kEAAkE;IAClE,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAErE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC;QAErB,kDAAkD;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC9D,IACE,cAAc,CAAC,QAAQ,CAAC,oBAAoB,CAAC;mBAC1C,cAAc,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EACpD,CAAC;gBACD,uBAAuB,GAAG,IAAI,CAAC;YACjC,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,SAAS;QACT,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,oCAAoC,MAAM,OAAO,QAAQ,iEAAiE;iBACnI,CAAC;YACJ,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,uBAAuB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,oCAAoC,MAAM,OAAO,QAAQ,qDAAqD;aACvH,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,uCAAuC,MAAM,OAAO,QAAQ,wDAAwD;aAC7H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAa;IACvD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC"}