@oscharko-dev/keiko 0.1.6 → 0.1.7

package/dist/tools/terminal-policy.js

@@ -1,306 +1,4 @@
-// ADR-0018 D3 — permitted-command policy for the UI terminal tool. A separate, narrower allowlist
-// than the harness DEFAULT_COMMAND_RULES so the human-facing terminal cannot widen the agent surface.
-// The CommandRule schema (allowedSubcommands / denyFlags / valueFlags) handles the structural
-// shape; `isTerminalCommandAllowed` adds a thin Layer-2 pass for flag policies that `CommandRule`
-// cannot express (node's positional-arg ban, git branch/remote mutation).
-// Pure module: no IO, no spawn, no fs.
-import { isCommandAllowed } from "./sandbox.js";
-const FROZEN_NONE = Object.freeze([]);
-// Read-only inspection commands. Each rule is conservative: omitted subcommands are denied by the
-// allowlist mode; the only flag policy expressed here is what CommandRule already supports.
-export const TERMINAL_COMMAND_RULES = Object.freeze([
-    { executable: "ls" },
-    { executable: "cat" },
-    { executable: "head" },
-    { executable: "tail" },
-    { executable: "wc", denyFlags: Object.freeze(["--files0-from"]) },
-    { executable: "grep" },
-    { executable: "pwd" },
-    { executable: "echo" },
-    {
-        executable: "find",
-        denyFlags: Object.freeze([
-            "-exec",
-            "-execdir",
-            "-ok",
-            "-okdir",
-            "-delete",
-            "-fprint",
-            "-fprint0",
-            "-fprintf",
-            "-fls",
-            "-files0-from",
-        ]),
-    },
-    {
-        executable: "tree",
-        denyFlags: Object.freeze(["-o", "--output"]),
-    },
-    // node: only --version/-v allowed. Enforced positionally in Layer 2 (a per-arg policy is not
-    // expressible in CommandRule).
-    { executable: "node" },
-    {
-        executable: "npm",
-        allowedSubcommands: Object.freeze(["ls", "list", "help"]),
-        denyFlags: Object.freeze(["-c", "--call", "--prefix", "--global", "-g", "--location"]),
-    },
-    {
-        executable: "git",
-        allowedSubcommands: Object.freeze([
-            "status",
-            "diff",
-            "log",
-            "show",
-            "rev-parse",
-            "ls-files",
-            "describe",
-            "blame",
-            "cat-file",
-            "branch",
-            "remote",
-        ]),
-        valueFlags: Object.freeze([
-            "-C",
-            "-c",
-            "--git-dir",
-            "--work-tree",
-            "--namespace",
-            "--exec-path",
-        ]),
-        denyFlags: Object.freeze([
-            "-C",
-            "-c",
-            "--git-dir",
-            "--work-tree",
-            "--namespace",
-            "--exec-path",
-            "--ext-diff",
-            "--textconv",
-            "--output",
-            "--no-index",
-            "--contents",
-        ]),
-    },
-]);
-// Flags that delete, write, or execute via find. Any of these anywhere in args denies.
-const FIND_DENY_FLAGS = new Set([
-    "-exec",
-    "-execdir",
-    "-ok",
-    "-okdir",
-    "-delete",
-    "-fprint",
-    "-fprint0",
-    "-fprintf",
-    "-fls",
-    "-files0-from",
-]);
-const TREE_DENY_FLAGS = new Set(["-o", "--output"]);
-// Only --version and -v are accepted for node. Every other positional or flag is denied.
-const NODE_ALLOWED_ARGS = new Set(["--version", "-v"]);
-// Branch mutation flags (A2). Scoped to `git branch` only — these deny branch creation, deletion,
-// copy, rename, and force operations. `-c`/`-C` are included here because for `branch` they mean
-// copy, not the git-global config flag (which is caught by A5 before we reach here).
-const GIT_BRANCH_DENY_FLAGS = new Set([
-    "-D",
-    "-d",
-    "-m",
-    "-M",
-    "--delete",
-    "-c",
-    "-C",
-    "-f",
-    "--copy",
-    "--force",
-    "--set-upstream-to",
-    "--unset-upstream",
-    "--edit-description",
-]);
-// Global git flags that modify git's own config, working-tree, cwd, or execution path (A5 /
-// ADR-0018 S-H2). These are checked BEFORE subcommand resolution so they cannot be smuggled via a
-// value-flag value that happens to look like a subcommand.
-const GIT_GLOBAL_DENY_FLAGS = new Set([
-    "-C",
-    "-c",
-    "--git-dir",
-    "--work-tree",
-    "--namespace",
-    "--exec-path",
-]);
-const GIT_UNSAFE_FLAGS = new Set([
-    "--ext-diff",
-    "--textconv",
-    "--output",
-    "--no-index",
-    "--contents",
-]);
-function denied(reason) {
-    return { allowed: false, reason };
-}
-function checkFind(args) {
-    for (const arg of args) {
-        if (FIND_DENY_FLAGS.has(arg)) {
-            return denied(`find: denied flag ${arg}`);
-        }
-    }
-    return { allowed: true };
-}
-function checkTree(args) {
-    for (const arg of args) {
-        const flag = arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg;
-        if (TREE_DENY_FLAGS.has(flag) || arg.startsWith("-o")) {
-            return denied(`tree: denied write flag ${flag}`);
-        }
-    }
-    return { allowed: true };
-}
-function checkNode(args) {
-    for (const arg of args) {
-        if (!NODE_ALLOWED_ARGS.has(arg)) {
-            return denied("node: only --version/-v is permitted");
-        }
-    }
-    return { allowed: true };
-}
-// Shared value-flags used by gitSubcommand and argsAfterSubcommand. Kept as a module-level
-// constant (not re-created per call) so the hot-path doesn't allocate on every invocation.
-const GIT_VALUE_FLAGS = new Set([
-    "-C",
-    "-c",
-    "--git-dir",
-    "--work-tree",
-    "--namespace",
-    "--exec-path",
-]);
-// Resolves the git subcommand (first non-flag arg, skipping value-flag pairs). Returns undefined
-// when the subcommand can't be determined — the caller treats that as not-a-mutation.
-function gitSubcommand(args) {
-    let skipNext = false;
-    for (const arg of args) {
-        if (skipNext) {
-            skipNext = false;
-            continue;
-        }
-        if (!arg.startsWith("-")) {
-            return arg;
-        }
-        if (!arg.includes("=") && GIT_VALUE_FLAGS.has(arg)) {
-            skipNext = true;
-        }
-    }
-    return undefined;
-}
-// Returns the slice of args that appears AFTER the first token equal to `subcommand`, skipping
-// value-flag pairs using the same walk as gitSubcommand. Returns undefined when not found.
-function argsAfterSubcommand(args, subcommand) {
-    // Convert to a mutable array for indexed access so we can use a for...of without a C-style loop
-    // (avoids noUncheckedIndexedAccess while remaining tsc-clean under no-non-null-assertion).
-    const arr = Array.from(args);
-    let skipNext = false;
-    for (const [i, arg] of arr.entries()) {
-        if (skipNext) {
-            skipNext = false;
-            continue;
-        }
-        if (arg === subcommand) {
-            return args.slice(i + 1);
-        }
-        if (arg.startsWith("-") && !arg.includes("=") && GIT_VALUE_FLAGS.has(arg)) {
-            skipNext = true;
-        }
-    }
-    return undefined;
-}
-// A2 — After resolving the `branch` subcommand, walk the remaining args. Any non-flag positional
-// (a branch name operand) denies creation/switching. Deny all known mutation flags.
-function checkGitBranch(argsAfterBranch) {
-    for (const arg of argsAfterBranch) {
-        const flag = arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg;
-        if (GIT_BRANCH_DENY_FLAGS.has(flag)) {
-            return denied(`git branch: denied mutation flag ${flag}`);
-        }
-        if (!arg.startsWith("-")) {
-            // A bare positional after `branch` is a branch name operand — implies creation or mutation.
-            return denied("git branch: positional operand denied (read-only listing only)");
-        }
-    }
-    return { allowed: true };
-}
-// A1 — After resolving the `remote` subcommand, walk the remaining args. No non-flag positional is
-// allowed: `show`, `update`, and `prune` can contact remotes, while add/rm/rename/set-url mutate
-// config. `git remote` and `git remote -v` remain local read-only inspection.
-function checkGitRemote(argsAfterRemote) {
-    for (const arg of argsAfterRemote) {
-        if (arg.startsWith("-")) {
-            // Pure flag (e.g. -v / --verbose) — already covered by the CommandRule valueFlags/denyFlags
-            // at Layer 1, but we allow flags through here to avoid double-denying them.
-            continue;
-        }
-        return denied(`git remote: subcommand "${arg}" is denied (read-only: use flags only)`);
-    }
-    return { allowed: true };
-}
-function deniedGitFlag(arg) {
-    const flag = arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg;
-    // A5 — Deny global config/env-injection and cwd-shifting flags before resolving the subcommand.
-    if (GIT_GLOBAL_DENY_FLAGS.has(flag) ||
-        arg.startsWith("-C") ||
-        (arg.startsWith("-c") && !arg.startsWith("--"))) {
-        return `git: denied global flag ${flag}`;
-    }
-    if (GIT_UNSAFE_FLAGS.has(flag)) {
-        return `git: denied unsafe flag ${flag}`;
-    }
-    return undefined;
-}
-function checkGitFlags(args) {
-    for (const arg of args) {
-        const reason = deniedGitFlag(arg);
-        if (reason !== undefined)
-            return denied(reason);
-    }
-    return { allowed: true };
-}
-function checkGitSubcommand(args) {
-    const sub = gitSubcommand(args);
-    if (sub === "branch") {
-        const rest = argsAfterSubcommand(args, "branch") ?? [];
-        return checkGitBranch(rest);
-    }
-    if (sub === "remote") {
-        const rest = argsAfterSubcommand(args, "remote") ?? [];
-        return checkGitRemote(rest);
-    }
-    return { allowed: true };
-}
-function checkGit(args) {
-    const flags = checkGitFlags(args);
-    if (!flags.allowed)
-        return flags;
-    return checkGitSubcommand(args);
-}
-// Pure deny-by-default decision for a terminal command. Layer 1 is the shared `isCommandAllowed`
-// (validates the executable and applies CommandRule's subcommand allowlist/denyFlags/valueFlags).
-// Layer 2 here adds the per-command flag policies that CommandRule cannot express (find / tree /
-// node / git branch and remote mutation flags).
-export function isTerminalCommandAllowed(command, args) {
-    const layer1 = isCommandAllowed(TERMINAL_COMMAND_RULES, command, args);
-    if (!layer1.allowed) {
-        return { allowed: false, reason: layer1.reason };
-    }
-    if (command === "find") {
-        return checkFind(args);
-    }
-    if (command === "tree") {
-        return checkTree(args);
-    }
-    if (command === "node") {
-        return checkNode(args);
-    }
-    if (command === "git") {
-        return checkGit(args);
-    }
-    return { allowed: true };
-}
-// Re-export so callers don't have to import from sandbox.ts directly.
-export { FROZEN_NONE as TERMINAL_NO_FLAGS };
+// Re-export shim: the terminal-policy command-allowlist gate lives in
+// @oscharko-dev/keiko-tools (issue #162, ADR-0019). All existing import sites
+// (`from "../tools/terminal-policy.js"`) keep resolving unchanged via this barrel.
+export { TERMINAL_COMMAND_RULES, TERMINAL_NO_FLAGS, isTerminalCommandAllowed, } from "@oscharko-dev/keiko-tools";

package/dist/tools/types.d.ts

@@ -1,99 +1,2 @@
-export type NetworkPolicy = "inherit" | "none";
-export interface SandboxPolicy {
-    readonly envAllowlist: readonly string[];
-    readonly network: NetworkPolicy;
-    readonly maxOutputBytes: number;
-    readonly defaultTimeoutMs: number;
-    readonly terminationGraceMs: number;
-}
-export declare const DEFAULT_ENV_ALLOWLIST: readonly string[];
-export declare const DEFAULT_SANDBOX_POLICY: SandboxPolicy;
-export interface CommandRule {
-    readonly executable: string;
-    readonly allowedSubcommands?: readonly string[] | undefined;
-    readonly deniedSubcommands?: readonly string[] | undefined;
-    readonly valueFlags?: readonly string[] | undefined;
-    readonly denyFlags?: readonly string[] | undefined;
-    readonly knownSubcommands?: readonly string[] | undefined;
-}
-export declare const DEFAULT_COMMAND_RULES: readonly CommandRule[];
-export interface CommandRunInput {
-    readonly command: string;
-    readonly args?: readonly string[] | undefined;
-    readonly cwd?: string | undefined;
-    readonly timeoutMs?: number | undefined;
-    readonly signal: AbortSignal;
-}
-export interface CommandResult {
-    readonly command: string;
-    readonly args: readonly string[];
-    readonly exitCode: number | null;
-    readonly signal: string | null;
-    readonly stdout: string;
-    readonly stderr: string;
-    readonly durationMs: number;
-    readonly timedOut: boolean;
-    readonly truncated: boolean;
-}
-export type PatchChangeKind = "create" | "modify" | "delete";
-export interface PatchHunk {
-    readonly oldStart: number;
-    readonly oldLines: number;
-    readonly newStart: number;
-    readonly newLines: number;
-    readonly lines: readonly string[];
-}
-export interface PatchFileChange {
-    readonly path: string;
-    readonly kind: PatchChangeKind;
-    readonly hunks: readonly PatchHunk[];
-    readonly addedLines: number;
-    readonly removedLines: number;
-}
-export type PatchRejectionCode = "size-limit" | "binary" | "path-unsafe" | "path-denied" | "line-limit" | "file-limit" | "malformed";
-export interface PatchRejection {
-    readonly code: PatchRejectionCode;
-    readonly message: string;
-    readonly path?: string | undefined;
-}
-export interface PatchConflict {
-    readonly path: string;
-    readonly hunkIndex: number;
-    readonly reason: string;
-}
-export interface PatchValidation {
-    readonly ok: boolean;
-    readonly files: readonly PatchFileChange[];
-    readonly totalChangedLines: number;
-    readonly totalBytes: number;
-    readonly normalizedDiff?: string | undefined;
-    readonly reasons: readonly PatchRejection[];
-    readonly conflicts: readonly PatchConflict[];
-}
-export interface PatchLimits {
-    readonly maxPatchBytes: number;
-    readonly maxChangedLines: number;
-    readonly maxFilesChanged: number;
-}
-export declare const DEFAULT_PATCH_LIMITS: PatchLimits;
-export interface PatchApplyResult {
-    readonly changedFiles: readonly string[];
-    readonly created: readonly string[];
-    readonly deleted: readonly string[];
-}
-export interface ToolHostConfig {
-    readonly sandbox: SandboxPolicy;
-    readonly commandRules: readonly CommandRule[];
-    readonly patchLimits: PatchLimits;
-    readonly applyEnabled: boolean;
-    readonly maxReadBytes: number;
-}
-export declare const DEFAULT_TOOL_HOST_CONFIG: ToolHostConfig;
-export interface ToolHostConfigInput {
-    readonly sandbox?: Partial<SandboxPolicy> | undefined;
-    readonly commandRules?: readonly CommandRule[] | undefined;
-    readonly patchLimits?: Partial<PatchLimits> | undefined;
-    readonly applyEnabled?: boolean | undefined;
-    readonly maxReadBytes?: number | undefined;
-}
-export declare function resolveToolHostConfig(input: ToolHostConfigInput | undefined): ToolHostConfig;
+export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "@oscharko-dev/keiko-tools";
+export type { CommandResult, CommandRule, CommandRunInput, NetworkPolicy, PatchApplyResult, PatchChangeKind, PatchConflict, PatchFileChange, PatchHunk, PatchLimits, PatchRejection, PatchRejectionCode, PatchValidation, SandboxPolicy, ToolHostConfig, ToolHostConfigInput, } from "@oscharko-dev/keiko-tools";

package/dist/tools/types.js

@@ -1,118 +1,4 @@
-// All tool-layer interfaces and the frozen default tables (env allowlist, command rules,
-// sandbox policy, limits, host config). No runtime logic lives here beyond the frozen
-// constant tables the type layer exposes as values, mirroring the ADR-0003/0004/0005
-// `types.ts` precedent. `readonly` everywhere; optional props are `| undefined` because
-// exactOptionalPropertyTypes is on. Imports end `.js`, double quotes, `type` keyword.
-// Cross-platform name allowlist. Only names that are PRESENT in the parent are copied, so an
-// absent Windows var on POSIX (or vice versa) is simply skipped.
-//
-// HOME and USERPROFILE are deliberately ABSENT (C5). Forwarding the developer's real home would let
-// a subprocess read ~/.npmrc (npm tokens), ~/.git-credentials, and ~/.aws/… by standard home-dir
-// lookup. runCommand instead injects an ephemeral, EMPTY per-run dir as HOME/USERPROFILE so those
-// lookups resolve to nothing (ADR-0006 D2 Dimension 1).
-export const DEFAULT_ENV_ALLOWLIST = Object.freeze([
-    "PATH",
-    "LANG",
-    "LC_ALL",
-    "LC_CTYPE",
-    "TZ",
-    "TERM",
-    "TMPDIR",
-    // Windows essentials so spawned tools resolve the shell-less executable correctly.
-    "SystemRoot",
-    "SystemDrive",
-    "PATHEXT",
-    "COMSPEC",
-    "NUMBER_OF_PROCESSORS",
-    "WINDIR",
-]);
-export const DEFAULT_SANDBOX_POLICY = {
-    envAllowlist: DEFAULT_ENV_ALLOWLIST,
-    network: "inherit",
-    maxOutputBytes: 262_144,
-    defaultTimeoutMs: 30_000,
-    terminationGraceMs: 2_000,
-};
-// Minimal, justified default rules. Everything not listed is denied (deny-by-default).
-export const DEFAULT_COMMAND_RULES = Object.freeze([
-    {
-        executable: "npm",
-        // Read-only npm only. Mutating/package-installing subcommands are excluded by omission.
-        allowedSubcommands: Object.freeze([
-            "audit",
-            "ls",
-            "list",
-            "outdated",
-            "view",
-            "info",
-            "help",
-            "ping",
-        ]),
-        // `-c`/`--call` execute a command string in a shell; deny outright (S-H2).
-        denyFlags: Object.freeze(["-c", "--call"]),
-    },
-    {
-        executable: "git",
-        // READ-ONLY git only; push/reset/checkout/commit/merge/rebase/clean/config/remote denied.
-        allowedSubcommands: Object.freeze([
-            "status",
-            "diff",
-            "log",
-            "show",
-            "rev-parse",
-            "ls-files",
-            "describe",
-            "blame",
-            "cat-file",
-        ]),
-        // Global value flags that precede the subcommand (`git -C DIR <sub>`). Skipping them prevents
-        // the value (DIR) from being read as the subcommand (S-H2).
-        valueFlags: Object.freeze([
-            "-C",
-            "-c",
-            "--git-dir",
-            "--work-tree",
-            "--namespace",
-            "--exec-path",
-        ]),
-        // Deny git's code-execution / external-driver flags. `git -c diff.external=<cmd> diff` (and
-        // --config-env/--ext-diff/--textconv) make git spawn an arbitrary command via its OWN shell,
-        // defeating the Node spawn's shell:false; --exec-path redirects git to attacker-supplied sub-binaries.
-        // hasDeniedFlag runs BEFORE subcommand resolution and matches both `--flag value` and
-        // `--flag=value`. `-C`/--git-dir/--work-tree stay value-flags (location only, not execution).
-        denyFlags: Object.freeze([
-            "-c",
-            "--config-env",
-            "--exec-path",
-            "--ext-diff",
-            "--textconv",
-            "--no-index",
-            "--output",
-            "--contents",
-        ]),
-    },
-]);
-export const DEFAULT_PATCH_LIMITS = {
-    maxPatchBytes: 65_536,
-    maxChangedLines: 2_000,
-    maxFilesChanged: 50,
-};
-export const DEFAULT_TOOL_HOST_CONFIG = {
-    sandbox: DEFAULT_SANDBOX_POLICY,
-    commandRules: DEFAULT_COMMAND_RULES,
-    patchLimits: DEFAULT_PATCH_LIMITS,
-    applyEnabled: false,
-    maxReadBytes: 262_144,
-};
-// Deep-merges a caller override over the defaults: the nested sandbox/patchLimits objects merge
-// field-by-field so a partial override never drops an unspecified default (S-M2).
-export function resolveToolHostConfig(input) {
-    const base = DEFAULT_TOOL_HOST_CONFIG;
-    return {
-        sandbox: { ...base.sandbox, ...input?.sandbox },
-        commandRules: input?.commandRules ?? base.commandRules,
-        patchLimits: { ...base.patchLimits, ...input?.patchLimits },
-        applyEnabled: input?.applyEnabled ?? base.applyEnabled,
-        maxReadBytes: input?.maxReadBytes ?? base.maxReadBytes,
-    };
-}
+// Re-export shim: tool contract types + frozen defaults + resolveToolHostConfig live in
+// @oscharko-dev/keiko-tools (issue #162, ADR-0019). All existing import sites
+// (`from "../tools/types.js"`) keep resolving unchanged via this barrel.
+export { DEFAULT_COMMAND_RULES, DEFAULT_ENV_ALLOWLIST, DEFAULT_PATCH_LIMITS, DEFAULT_SANDBOX_POLICY, DEFAULT_TOOL_HOST_CONFIG, resolveToolHostConfig, } from "@oscharko-dev/keiko-tools";

package/dist/tools/writer.d.ts

@@ -1,7 +1,2 @@
-export interface WorkspaceWriter {
-    readonly writeFileUtf8: (absolutePath: string, content: string) => void;
-    readonly mkdirp: (absoluteDir: string) => void;
-    readonly remove: (absolutePath: string) => void;
-    readonly rename: (fromAbsolute: string, toAbsolute: string) => void;
-}
-export declare const nodeWorkspaceWriter: WorkspaceWriter;
+export { nodeWorkspaceWriter } from "@oscharko-dev/keiko-tools/internal/writer";
+export type { WorkspaceWriter } from "@oscharko-dev/keiko-tools";

package/dist/tools/writer.js

@@ -1,20 +1,4 @@
-// The single controlled filesystem-WRITE boundary (ADR-0006 D2). WorkspaceFs stays read-only
-// (ADR-0005); all mutation goes through this port so the apply phase is auditable and testable
-// with an in-memory fake. Callers (patch.ts) MUST pre-validate every absolute path via
-// resolveWithinWorkspace + isDenied before handing it here; this adapter does no validation
-// itself — it is the effectful edge, kept deliberately thin. Synchronous, mirroring nodeWorkspaceFs.
-import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
-export const nodeWorkspaceWriter = {
-    writeFileUtf8: (absolutePath, content) => {
-        writeFileSync(absolutePath, content, "utf8");
-    },
-    mkdirp: (absoluteDir) => {
-        mkdirSync(absoluteDir, { recursive: true });
-    },
-    remove: (absolutePath) => {
-        rmSync(absolutePath, { force: true });
-    },
-    rename: (fromAbsolute, toAbsolute) => {
-        renameSync(fromAbsolute, toAbsolute);
-    },
-};
+// Re-export shim: the WorkspaceWriter port + nodeWorkspaceWriter adapter live in
+// @oscharko-dev/keiko-tools (issue #162, ADR-0019). All existing import sites
+// (`from "../tools/writer.js"`) keep resolving unchanged via this barrel.
+export { nodeWorkspaceWriter } from "@oscharko-dev/keiko-tools/internal/writer";

package/dist/ui/csp-hashes.json

@@ -1,17 +1,17 @@
 [
-  "'sha256-2RZA1N+nLgvl8WcE8JsSdNjQ5MQUhxR2msRW7usAVlM='",
-  "'sha256-6JBR+C4qigE40tMbninopqoSguR9H/AhsfWgllRr6y0='",
-  "'sha256-C8fp9ZeiwdGAbedIsOvEa2BMkNdJdGys5/hhETqHGL4='",
+  "'sha256-8Z4Z+tjtqOpf9IkKgja9HQTmYAzAluKQ7v5YK1VLdh4='",
+  "'sha256-By6X/nqbcheRxOwZGvcE1kaAVOhNEOv8zjIVZP6z6Yk='",
+  "'sha256-DTrkCCDEpewxQAb9QQbYxBqLzUkzW2T1APLwv7rjnVE='",
   "'sha256-FhLHRUQz4c4ntLU9VkfEesX7PnzNLENSe/16Hi523Kk='",
   "'sha256-NMmsYxPlvKu6BMNDUuiUA/0HWXXhODWSkUJ3CrerHAI='",
   "'sha256-OBTN3RiyCV4Bq7dFqZ5a2pAXjnCcCYeTJMO2I/LYKeo='",
+  "'sha256-T+2LxIAfAUbQKB4rHfIoISxlvXPOMITf6Mh0ckB7HLQ='",
   "'sha256-U9W+ZoRW19rf6ohEfUh2oSN8UmJ8mZjCoxp31AbEGYM='",
-  "'sha256-WS6pJFhpUaJbGkmmJZnnoqzb3ZD6Hp3TSAsAkiW/1JA='",
-  "'sha256-aWdClXArxjcSI0zen9sFWmTTb6X31A25YJP9LyQG2ZI='",
   "'sha256-bg+CWjI8RppcgHYH6RuW4z4OnLAUEUPDXRoYUo9Tyok='",
-  "'sha256-gZGxfXq2015S5Q+DB4YqyrPelc2Pxtxzxpv6HBl/Ogg='",
+  "'sha256-o9M85GAiJ6Bm+Ofj4zn9NmYWR7RfAzXi+izVXuL4NRA='",
   "'sha256-qBQ7RdQKJEJuW7Fj1MbGjDbF6lnRdfu+KV0V4A5MTRg='",
   "'sha256-qjuzziE6xLU3Cras89VlShlRYHgYZuOxceXUDmuvClo='",
+  "'sha256-vu8dq5kQw842BLsoPEH7vZjVBX+xgIiY5gkHJqYHKRg='",
   "'sha256-xLP5QIbvR88RAxDKoSWqs6CVxNIRu17hhr7S/Q6hlU0='",
   "'sha256-xz80fPjhAczg/tByXnm3xfZrdAUWODPmQtD4solyj1c='"
 ]

package/dist/ui/index.d.ts

@@ -1,20 +1,20 @@
-export { createUiServer, DEFAULT_UI_PORT, UI_HOST, type UiServerDeps } from "./server.js";
-export { buildCspHeader, extractInlineScriptHashes } from "./csp.js";
-export { loadCspHeader } from "./load-csp.js";
-export { applySecurityHeaders } from "./headers.js";
-export { isAllowedHost } from "./host-check.js";
-export { resolveContainedPath, serveFile } from "./static.js";
-export { API_ROUTES, isApiPath, matchRoute, errorBody, STREAMING, type ApiError, type HandlerOutcome, type RouteContext, type RouteDefinition, type RouteHandler, type RouteMatch, type RouteResult, } from "./routes.js";
-export { buildUiHandlerDeps, buildRedactor, type UiHandlerDeps, type BuildHandlerDepsOptions, type Redactor, type ModelPortFactory, } from "./deps.js";
-export { createRunRegistry, ActiveRunLimitError, type RunRegistry, type RunRecord, type RunStatus, type AppliableSnapshot, } from "./runs.js";
-export { QueueEventSink, type StreamEvent, type SseWriter } from "./sink.js";
-export { parseRunRequest, type RunRequest, type RunKind } from "./run-request.js";
-export { startRun, applyRun, type StartRunResult } from "./run-engine.js";
-export { handleCreateRun, handleRunEvents, handleCancelRun, handleGetRun, handleApplyRun, } from "./run-handlers.js";
-export { persistWorkflowEvidence, persistExplainEvidence, type EvidencePersistContext, type RunIdentity, } from "./evidence.js";
-export { createInMemoryUiStore, createNodeUiStore, isProjectAvailable, resolveUiDbPath, runMigrations, SCHEMA_VERSION, UI_DB_DIRNAME, UI_DB_FILENAME, UiStoreError, validateProjectPath, type Chat, type ChatMessage, type ChatRole, type CreateChatOptions, type NewChatMessage, type Project, type UiStore, type UiStoreErrorCode, type UiStoreFactoryOptions, type UpdateChatPatch, type UpdateProjectPatch, type WorkflowStatus, } from "./store/index.js";
-export { handleListProjects, handleCreateProject, handleUpdateProject, handleDeleteProject, handleListChats, handleCreateChat, handleUpdateChat, handleDeleteChat, handleListMessages, handleCreateMessage, } from "./store-handlers.js";
-export { createTerminalExecutionManager, buildTerminalPolicySummary, listDirectories, type TerminalDirectoryListing, type TerminalExecutionInput, type TerminalExecutionManager, type TerminalExecutionResult, type TerminalEventEmitter, type TerminalEventEnvelope, type TerminalEventKind, type TerminalPolicySummary, } from "./terminal.js";
-export { TerminalToolError, type TerminalErrorCode } from "./terminal-errors.js";
-export { buildTerminalEvidenceEntry, appendTerminalEvidence, type TerminalEvidenceEntry, } from "./terminal-evidence.js";
-export { listFilesDirectories, readFilesPreview, readFilesTree, type FilesDirectoryEntry, type FilesDirectoryListing, type FilesDirectoryRoot, type FilesEntryKind, type FilesPreviewResponse, type FilesTreeEntry, type FilesTreeResponse, } from "./files.js";
+export { createUiServer, DEFAULT_UI_PORT, UI_HOST, type UiServerDeps, } from "@oscharko-dev/keiko-server";
+export { buildCspHeader, extractInlineScriptHashes } from "@oscharko-dev/keiko-server";
+export { loadCspHeader } from "@oscharko-dev/keiko-server";
+export { applySecurityHeaders } from "@oscharko-dev/keiko-server";
+export { isAllowedHost } from "@oscharko-dev/keiko-server";
+export { resolveContainedPath, serveFile } from "@oscharko-dev/keiko-server";
+export { API_ROUTES, isApiPath, matchRoute, errorBody, STREAMING, type ApiError, type HandlerOutcome, type RouteContext, type RouteDefinition, type RouteHandler, type RouteMatch, type RouteResult, } from "@oscharko-dev/keiko-server";
+export { buildUiHandlerDeps, buildRedactor, type UiHandlerDeps, type BuildHandlerDepsOptions, type Redactor, type ModelPortFactory, } from "@oscharko-dev/keiko-server";
+export { createRunRegistry, ActiveRunLimitError, type RunRegistry, type RunRecord, type RunStatus, type AppliableSnapshot, } from "@oscharko-dev/keiko-server";
+export { QueueEventSink, type StreamEvent, type SseWriter } from "@oscharko-dev/keiko-server";
+export { parseRunRequest, type RunRequest, type RunKind } from "@oscharko-dev/keiko-server";
+export { startRun, applyRun, type StartRunResult } from "@oscharko-dev/keiko-server";
+export { handleCreateRun, handleRunEvents, handleCancelRun, handleGetRun, handleApplyRun, } from "@oscharko-dev/keiko-server";
+export { persistWorkflowEvidence, persistExplainEvidence, type EvidencePersistContext, type RunIdentity, } from "@oscharko-dev/keiko-server";
+export { createInMemoryUiStore, createNodeUiStore, isProjectAvailable, resolveUiDbPath, runMigrations, SCHEMA_VERSION, UI_DB_DIRNAME, UI_DB_FILENAME, UiStoreError, validateProjectPath, type Chat, type ChatMessage, type ChatRole, type CreateChatOptions, type NewChatMessage, type Project, type UiStore, type UiStoreErrorCode, type UiStoreFactoryOptions, type UpdateChatPatch, type UpdateProjectPatch, type WorkflowStatus, } from "@oscharko-dev/keiko-server";
+export { handleListProjects, handleCreateProject, handleUpdateProject, handleDeleteProject, handleListChats, handleCreateChat, handleUpdateChat, handleDeleteChat, handleListMessages, handleCreateMessage, } from "@oscharko-dev/keiko-server";
+export { createTerminalExecutionManager, buildTerminalPolicySummary, listDirectories, type TerminalDirectoryListing, type TerminalExecutionInput, type TerminalExecutionManager, type TerminalExecutionResult, type TerminalEventEmitter, type TerminalEventEnvelope, type TerminalEventKind, type TerminalPolicySummary, } from "@oscharko-dev/keiko-server";
+export { TerminalToolError, type TerminalErrorCode } from "@oscharko-dev/keiko-server";
+export { buildTerminalEvidenceEntry, appendTerminalEvidence, type TerminalEvidenceEntry, } from "@oscharko-dev/keiko-server";
+export { listFilesDirectories, readFilesPreview, readFilesTree, type FilesDirectoryEntry, type FilesDirectoryListing, type FilesDirectoryRoot, type FilesEntryKind, type FilesPreviewResponse, type FilesTreeEntry, type FilesTreeResponse, } from "@oscharko-dev/keiko-server";