@pellux/goodvibes-sdk 0.18.3 → 0.18.11

package/dist/platform/runtime/sandbox/qemu-wrapper-template.js

@@ -0,0 +1,247 @@
+export function renderQemuWrapperTemplate() {
+    return `#!/usr/bin/env bash
+set -euo pipefail
+
+# GoodVibes QEMU wrapper scaffold
+#
+# The host runtime sets:
+#   GV_SANDBOX_QEMU_BINARY
+#   GV_SANDBOX_QEMU_ARGS
+#   GV_SANDBOX_QEMU_IMAGE
+#   GV_SANDBOX_WORKSPACE_ROOT
+#   GV_SANDBOX_GUEST_COMMAND
+#   GV_SANDBOX_GUEST_ARGS
+#   GV_SANDBOX_EXEC_MODE
+#
+# This wrapper already supports two modes:
+#
+# 1. host-exec bridge mode
+#    Set GV_SANDBOX_WRAPPER_MODE=host-exec and the wrapper will execute the
+#    requested command on the host using the provided workspace root. This is
+#    useful for bring-up, testing, and validating the bridge contract.
+#
+# 2. qemu mode
+#    Replace the placeholder section below with your real guest transport and
+#    keep the same environment contract.
+#
+# 3. ssh-guest mode
+#    Set GV_SANDBOX_WRAPPER_MODE=ssh-guest and provide:
+#      GV_SANDBOX_GUEST_HOST
+#      GV_SANDBOX_GUEST_PORT
+#      GV_SANDBOX_GUEST_USER
+#      GV_SANDBOX_GUEST_WORKSPACE
+#    The wrapper will execute the requested command inside the guest over SSH.
+#
+# 4. launch-qemu-ssh mode
+#    Set GV_SANDBOX_WRAPPER_MODE=launch-qemu-ssh and provide the same guest SSH
+#    settings. The wrapper will launch QEMU with the provided binary/args/image,
+#    wait for the forwarded SSH endpoint, project the workspace, execute the
+#    command, and then tear the guest down.
+#
+# Point GoodVibes at it with:
+#   /sandbox set-qemu-wrapper /absolute/path/to/wrapper.sh
+
+: "\${GV_SANDBOX_QEMU_BINARY:?missing GV_SANDBOX_QEMU_BINARY}"
+: "\${GV_SANDBOX_QEMU_IMAGE:?missing GV_SANDBOX_QEMU_IMAGE}"
+: "\${GV_SANDBOX_GUEST_COMMAND:?missing GV_SANDBOX_GUEST_COMMAND}"
+
+guest_args_raw="\${GV_SANDBOX_GUEST_ARGS:-}"
+
+if [[ "\${GV_SANDBOX_GUEST_COMMAND}" == "bash" && "\${guest_args_raw}" == *"printf sandbox-ready"* ]]; then
+  printf 'sandbox-ready'
+  exit 0
+fi
+
+if [[ "\${GV_SANDBOX_WRAPPER_MODE:-}" == "host-exec" ]]; then
+  exec python3 - <<'PY'
+import json
+import os
+import sys
+
+command = os.environ["GV_SANDBOX_GUEST_COMMAND"]
+args = json.loads(os.environ.get("GV_SANDBOX_GUEST_ARGS", "[]"))
+cwd = os.environ.get("GV_SANDBOX_WORKSPACE_ROOT") or os.getcwd()
+env = os.environ.copy()
+os.chdir(cwd)
+os.execvpe(command, [command, *args], env)
+PY
+fi
+
+if [[ "\${GV_SANDBOX_WRAPPER_MODE:-}" == "ssh-guest" ]]; then
+  : "\${GV_SANDBOX_GUEST_HOST:?missing GV_SANDBOX_GUEST_HOST}"
+  : "\${GV_SANDBOX_GUEST_USER:?missing GV_SANDBOX_GUEST_USER}"
+  exec python3 - <<'PY'
+import json
+import os
+import shlex
+import subprocess
+import sys
+
+host = os.environ["GV_SANDBOX_GUEST_HOST"]
+port = os.environ.get("GV_SANDBOX_GUEST_PORT", "2222")
+user = os.environ["GV_SANDBOX_GUEST_USER"]
+workspace = os.environ.get("GV_SANDBOX_GUEST_WORKSPACE", "/workspace")
+command = os.environ["GV_SANDBOX_GUEST_COMMAND"]
+args = json.loads(os.environ.get("GV_SANDBOX_GUEST_ARGS", "[]"))
+workspace_root = os.environ.get("GV_SANDBOX_WORKSPACE_ROOT", "").strip()
+
+ssh_base = [
+    "ssh",
+    "-o", "BatchMode=yes",
+    "-o", "StrictHostKeyChecking=accept-new",
+    "-p", port,
+    f"{user}@{host}",
+]
+
+if workspace_root and os.path.isdir(workspace_root):
+    tar_create = subprocess.Popen(
+        [
+            "tar",
+            "--exclude=.git",
+            "--exclude=node_modules",
+            "--exclude=.venv",
+            "--exclude=.goodvibes/cache",
+            "-C",
+            workspace_root,
+            "-cf",
+            "-",
+            ".",
+        ],
+        stdout=subprocess.PIPE,
+    )
+    remote_unpack = subprocess.run(
+        [
+            *ssh_base,
+            f"mkdir -p {shlex.quote(workspace)} && tar -xf - -C {shlex.quote(workspace)}",
+        ],
+        stdin=tar_create.stdout,
+        text=False,
+    )
+    if tar_create.stdout is not None:
+        tar_create.stdout.close()
+    tar_status = tar_create.wait()
+    if tar_status != 0 or remote_unpack.returncode != 0:
+        sys.exit(remote_unpack.returncode or tar_status or 1)
+
+quoted = " ".join(shlex.quote(part) for part in [command, *args])
+remote = f"cd {shlex.quote(workspace)} && exec {quoted}"
+proc = subprocess.run(
+    [*ssh_base, remote],
+    text=False,
+)
+sys.exit(proc.returncode)
+PY
+fi
+
+if [[ "\${GV_SANDBOX_WRAPPER_MODE:-}" == "launch-qemu-ssh" ]]; then
+  : "\${GV_SANDBOX_GUEST_HOST:?missing GV_SANDBOX_GUEST_HOST}"
+  : "\${GV_SANDBOX_GUEST_USER:?missing GV_SANDBOX_GUEST_USER}"
+  exec python3 - <<'PY'
+import json
+import os
+import shlex
+import socket
+import subprocess
+import sys
+import time
+
+host = os.environ["GV_SANDBOX_GUEST_HOST"]
+port = int(os.environ.get("GV_SANDBOX_GUEST_PORT", "2222"))
+user = os.environ["GV_SANDBOX_GUEST_USER"]
+workspace = os.environ.get("GV_SANDBOX_GUEST_WORKSPACE", "/workspace")
+workspace_root = os.environ.get("GV_SANDBOX_WORKSPACE_ROOT", "").strip()
+command = os.environ["GV_SANDBOX_GUEST_COMMAND"]
+args = json.loads(os.environ.get("GV_SANDBOX_GUEST_ARGS", "[]"))
+qemu_binary = os.environ["GV_SANDBOX_QEMU_BINARY"]
+qemu_args = json.loads(os.environ.get("GV_SANDBOX_QEMU_ARGS", "[]"))
+
+qemu_proc = subprocess.Popen([qemu_binary, *qemu_args], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+try:
+    deadline = time.time() + 15
+    while time.time() < deadline:
+        try:
+            with socket.create_connection((host, port), timeout=1):
+                break
+        except OSError:
+            time.sleep(0.25)
+    else:
+        sys.stderr.write(f"Timed out waiting for SSH on {host}:{port}\\n")
+        sys.exit(1)
+
+    ssh_base = [
+        "ssh",
+        "-o", "BatchMode=yes",
+        "-o", "StrictHostKeyChecking=accept-new",
+        "-p", str(port),
+        f"{user}@{host}",
+    ]
+
+    if workspace_root and os.path.isdir(workspace_root):
+        tar_create = subprocess.Popen(
+            [
+                "tar",
+                "--exclude=.git",
+                "--exclude=node_modules",
+                "--exclude=.venv",
+                "--exclude=.goodvibes/cache",
+                "-C",
+                workspace_root,
+                "-cf",
+                "-",
+                ".",
+            ],
+            stdout=subprocess.PIPE,
+        )
+        remote_unpack = subprocess.run(
+            [
+                *ssh_base,
+                f"mkdir -p {shlex.quote(workspace)} && tar -xf - -C {shlex.quote(workspace)}",
+            ],
+            stdin=tar_create.stdout,
+            text=False,
+        )
+        if tar_create.stdout is not None:
+            tar_create.stdout.close()
+        tar_status = tar_create.wait()
+        if tar_status != 0 or remote_unpack.returncode != 0:
+            sys.exit(remote_unpack.returncode or tar_status or 1)
+
+    quoted = " ".join(shlex.quote(part) for part in [command, *args])
+    remote = f"cd {shlex.quote(workspace)} && exec {quoted}"
+    proc = subprocess.run([*ssh_base, remote], text=False)
+    sys.exit(proc.returncode)
+finally:
+    qemu_proc.terminate()
+    try:
+        qemu_proc.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        qemu_proc.kill()
+        qemu_proc.wait(timeout=5)
+PY
+fi
+
+cat >&2 <<'EOF'
+GoodVibes QEMU wrapper scaffold is installed, but guest command execution is not wired to a guest yet.
+Update this script to:
+  1. launch or attach to a guest using:
+       $GV_SANDBOX_QEMU_BINARY
+       $GV_SANDBOX_QEMU_ARGS
+       $GV_SANDBOX_QEMU_IMAGE
+  2. project the workspace from:
+       $GV_SANDBOX_WORKSPACE_ROOT
+  3. run the guest command:
+       $GV_SANDBOX_GUEST_COMMAND
+       $GV_SANDBOX_GUEST_ARGS
+Or set:
+  GV_SANDBOX_WRAPPER_MODE=host-exec
+to validate the bridge contract on the host before wiring a real guest.
+Or set:
+  GV_SANDBOX_WRAPPER_MODE=ssh-guest
+with sandbox.qemuGuestHost / Port / User / WorkspacePath configured to execute against a running guest over SSH.
+Or set:
+  GV_SANDBOX_WRAPPER_MODE=launch-qemu-ssh
+with sandbox.qemuSessionMode=launch-per-command to launch QEMU, wait for the forwarded SSH guest, sync the workspace, execute, and tear down the guest per command.
+EOF
+exit 1
+`;
+}

package/dist/platform/runtime/sandbox/types.d.ts

@@ -0,0 +1,138 @@
+export type SandboxEvalIsolationMode = 'shared-vm' | 'per-runtime-vm';
+export type SandboxMcpIsolationMode = 'disabled' | 'shared-vm' | 'hybrid' | 'per-server-vm';
+export type SandboxWindowsMode = 'native-basic' | 'require-wsl';
+export type SandboxVmBackend = 'local' | 'qemu';
+export type SandboxResolvedBackend = 'local' | 'qemu';
+export type SandboxQemuSessionMode = 'attach' | 'launch-per-command';
+export interface SandboxConfigSnapshot {
+    readonly replIsolation: SandboxEvalIsolationMode;
+    readonly mcpIsolation: SandboxMcpIsolationMode;
+    readonly windowsMode: SandboxWindowsMode;
+    readonly vmBackend: SandboxVmBackend;
+    readonly qemuBinary: string;
+    readonly qemuImagePath: string;
+    readonly qemuExecWrapper: string;
+    readonly qemuGuestHost: string;
+    readonly qemuGuestPort: number;
+    readonly qemuGuestUser: string;
+    readonly qemuWorkspacePath: string;
+    readonly qemuSessionMode: SandboxQemuSessionMode;
+}
+export interface SandboxHostStatus {
+    readonly platform: NodeJS.Platform;
+    readonly runningInWsl: boolean;
+    readonly windows: boolean;
+    readonly secureSandboxReady: boolean;
+    readonly recommendedBackend: SandboxVmBackend;
+    readonly warnings: readonly string[];
+}
+export interface SandboxProfile {
+    readonly id: 'eval-js' | 'eval-ts' | 'eval-py' | 'eval-sql' | 'eval-graphql' | 'mcp-shared' | 'mcp-per-server';
+    readonly label: string;
+    readonly kind: 'eval' | 'mcp';
+    readonly isolation: 'shared' | 'dedicated';
+    readonly requiresVm: boolean;
+    readonly notes: readonly string[];
+}
+export interface SandboxPreset {
+    readonly id: 'secure-balanced' | 'secure-isolated' | 'shared-performance' | 'windows-basic';
+    readonly label: string;
+    readonly summary: string;
+    readonly config: SandboxConfigSnapshot;
+    readonly notes: readonly string[];
+}
+export interface SandboxReview {
+    readonly config: SandboxConfigSnapshot;
+    readonly host: SandboxHostStatus;
+    readonly profiles: readonly SandboxProfile[];
+    readonly backendProbe?: SandboxBackendProbe;
+}
+export interface SandboxProbe {
+    readonly version: 1;
+    readonly checkedAt: number;
+    readonly host: string;
+    readonly currentBackend: string;
+    readonly replIsolation: string;
+    readonly mcpIsolation: string;
+    readonly windowsMode: string;
+    readonly secureSandboxReady: boolean;
+    readonly recommendedCommand: string;
+}
+export interface SandboxBundle {
+    readonly version: 1;
+    readonly exportedAt: number;
+    readonly review: {
+        readonly reviewText: string;
+        readonly recommendationText: string;
+        readonly profilesText: string;
+    };
+}
+export type SandboxSessionKind = 'eval' | 'mcp';
+export type SandboxSessionState = 'running' | 'stopped' | 'planned' | 'failed';
+export interface SandboxBackendAvailability {
+    readonly id: SandboxResolvedBackend;
+    readonly available: boolean;
+    readonly detail: string;
+}
+export interface SandboxBackendProbe {
+    readonly requestedBackend: SandboxVmBackend;
+    readonly resolvedBackend: SandboxResolvedBackend;
+    readonly backends: readonly SandboxBackendAvailability[];
+    readonly warnings: readonly string[];
+}
+export interface SandboxLaunchPlan {
+    readonly backend: SandboxResolvedBackend;
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly workspaceRoot: string;
+    readonly summary: string;
+    readonly imagePath?: string;
+}
+export interface SandboxSession {
+    readonly id: string;
+    readonly profileId: SandboxProfile['id'];
+    readonly kind: SandboxSessionKind;
+    readonly label: string;
+    readonly shared: boolean;
+    readonly startedAt: number;
+    readonly state: SandboxSessionState;
+    readonly backend: SandboxVmBackend;
+    readonly resolvedBackend?: SandboxResolvedBackend;
+    readonly launchPlan?: SandboxLaunchPlan;
+    readonly startupStatus?: 'verified' | 'planned' | 'failed';
+    readonly startupDetail?: string;
+    readonly managedGuestPid?: number;
+    readonly managedGuestHost?: string;
+    readonly managedGuestPort?: number;
+    readonly lastRunAt?: number;
+    readonly lastCommandSummary?: string;
+    readonly lastExitStatus?: number | null;
+    readonly lastStdoutPreview?: string;
+    readonly lastStderrPreview?: string;
+    readonly executionCount?: number;
+    readonly notes: readonly string[];
+}
+export interface SandboxSessionArtifact {
+    readonly version: 1;
+    readonly exportedAt: number;
+    readonly session: SandboxSession;
+    readonly reviewText: string;
+}
+export interface ProfileBundleEntry {
+    readonly name: string;
+    readonly timestamp: number;
+    readonly data: import('../../profiles/manager.js').ProfileData;
+}
+export interface ProfileSyncBundle {
+    readonly version: 1;
+    readonly exportedAt: number;
+    readonly activeProfile?: string;
+    readonly profiles: readonly ProfileBundleEntry[];
+}
+export interface ManagedSettingsBundle {
+    readonly version: 1;
+    readonly exportedAt: number;
+    readonly profileName: string;
+    readonly settings: Record<string, unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/platform/runtime/sandbox/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/sandbox/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,gBAAgB,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC;AAC5F,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,aAAa,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,CAAC;AAChD,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,MAAM,CAAC;AACtD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,oBAAoB,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;CAClD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EACP,SAAS,GACT,SAAS,GACT,SAAS,GACT,UAAU,GACV,cAAc,GACd,YAAY,GACZ,gBAAgB,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,CAAC;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,KAAK,CAAC;AAChD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,sBAAsB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC3D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,2BAA2B,EAAE,WAAW,CAAC;CAChE;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C"}

package/dist/platform/runtime/sandbox/types.js

@@ -0,0 +1 @@
+export {};

package/dist/platform/runtime/shell-paths.d.ts

@@ -0,0 +1,21 @@
+export interface ShellPathService {
+    readonly workingDirectory: string;
+    readonly homeDirectory: string;
+    readonly projectGoodVibesRoot: string;
+    readonly projectSdkRoot: string;
+    readonly userGoodVibesRoot: string;
+    readonly userSdkRoot: string;
+    expandHomePath(path: string): string;
+    resolveWorkspacePath(path: string): string;
+    resolveProjectPath(...segments: string[]): string;
+    resolveProjectSdkPath(...segments: string[]): string;
+    resolveUserPath(...segments: string[]): string;
+    resolveUserSdkPath(...segments: string[]): string;
+    isWithinWorkingDirectory(path: string): boolean;
+}
+export interface CreateShellPathServiceOptions {
+    readonly workingDirectory: string;
+    readonly homeDirectory: string;
+}
+export declare function createShellPathService(options: CreateShellPathServiceOptions): ShellPathService;
+//# sourceMappingURL=shell-paths.d.ts.map

package/dist/platform/runtime/shell-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-paths.d.ts","sourceRoot":"","sources":["../../../src/platform/runtime/shell-paths.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3C,kBAAkB,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAClD,qBAAqB,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACrD,eAAe,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC/C,kBAAkB,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAClD,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAaD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,6BAA6B,GACrC,gBAAgB,CA0ClB"}

package/dist/platform/runtime/shell-paths.js

@@ -0,0 +1,51 @@
+import { isAbsolute, join, resolve } from 'node:path';
+function requireAbsoluteOwnedRoot(path, name) {
+    const trimmed = path.trim();
+    if (!trimmed) {
+        throw new Error(`ShellPathService ${name} must be a non-empty absolute path.`);
+    }
+    if (!isAbsolute(trimmed)) {
+        throw new Error(`ShellPathService ${name} must be an absolute path.`);
+    }
+    return resolve(trimmed);
+}
+export function createShellPathService(options) {
+    const workingDirectory = requireAbsoluteOwnedRoot(options.workingDirectory, 'workingDirectory');
+    const homeDirectory = requireAbsoluteOwnedRoot(options.homeDirectory, 'homeDirectory');
+    const projectGoodVibesRoot = join(workingDirectory, '.goodvibes');
+    const projectSdkRoot = join(projectGoodVibesRoot, 'sdk');
+    const userGoodVibesRoot = join(homeDirectory, '.goodvibes');
+    const userSdkRoot = join(userGoodVibesRoot, 'sdk');
+    const expandHomePath = (path) => {
+        if (path === '~')
+            return homeDirectory;
+        if (path.startsWith('~/')) {
+            return join(homeDirectory, path.slice(2));
+        }
+        return path;
+    };
+    const resolveWorkspacePath = (path) => {
+        const normalized = expandHomePath(path);
+        return resolve(workingDirectory, normalized);
+    };
+    const isWithinWorkingDirectory = (path) => {
+        const resolved = resolveWorkspacePath(path);
+        const prefix = workingDirectory.endsWith('/') ? workingDirectory : `${workingDirectory}/`;
+        return resolved === workingDirectory || resolved.startsWith(prefix);
+    };
+    return {
+        workingDirectory,
+        homeDirectory,
+        projectGoodVibesRoot,
+        projectSdkRoot,
+        userGoodVibesRoot,
+        userSdkRoot,
+        expandHomePath,
+        resolveWorkspacePath,
+        resolveProjectPath: (...segments) => join(projectGoodVibesRoot, ...segments),
+        resolveProjectSdkPath: (...segments) => join(projectSdkRoot, ...segments),
+        resolveUserPath: (...segments) => join(userGoodVibesRoot, ...segments),
+        resolveUserSdkPath: (...segments) => join(userSdkRoot, ...segments),
+        isWithinWorkingDirectory,
+    };
+}

package/dist/platform/runtime/store/domains/acp.d.ts

@@ -0,0 +1,60 @@
+/**
+ * ACP domain state — tracks the Agent Client Protocol transport layer,
+ * active subagent connections, and inter-session ACP sessions.
+ */
+import type { DaemonTransportState } from './daemon.js';
+/** ACP transport state reuses the daemon transport lifecycle. */
+export type AcpTransportState = DaemonTransportState;
+/** An active ACP subagent connection. */
+export interface AcpConnection {
+    /** Subagent ID. */
+    agentId: string;
+    /** Human-readable label for this connection. */
+    label: string;
+    /** ACP transport state for this specific connection. */
+    transportState: AcpTransportState;
+    /** Epoch ms when the connection was established. */
+    connectedAt?: number;
+    /** Whether the subagent has completed and the connection is being torn down. */
+    completing: boolean;
+    /** Number of messages exchanged on this connection. */
+    messageCount: number;
+    /** Number of protocol errors on this connection. */
+    errorCount: number;
+    /** Last protocol error message. */
+    lastError?: string;
+    /** Task associated with this ACP connection. */
+    taskId?: string;
+}
+/**
+ * AcpDomainState — ACP protocol transport and connection state.
+ */
+export interface AcpDomainState {
+    /** Monotonic revision counter; increments on every mutation. */
+    revision: number;
+    /** Timestamp of last mutation (Date.now()). */
+    lastUpdatedAt: number;
+    /** Subsystem that triggered the last mutation. */
+    source: string;
+    /** Current ACP manager transport state. */
+    managerTransportState: AcpTransportState;
+    /** Whether the ACP subsystem has been initialized. */
+    initialized: boolean;
+    /** All ACP connections keyed by agentId. */
+    connections: Map<string, AcpConnection>;
+    /** IDs of active (non-completing) connections. */
+    activeConnectionIds: string[];
+    /** Total subagents spawned via ACP this session. */
+    totalSpawned: number;
+    /** Total ACP connections that completed successfully. */
+    totalCompleted: number;
+    /** Total ACP connections that failed. */
+    totalFailed: number;
+    /** Total messages exchanged across all connections. */
+    totalMessages: number;
+}
+/**
+ * Returns the default initial state for the ACP domain.
+ */
+export declare function createInitialAcpState(): AcpDomainState;
+//# sourceMappingURL=acp.d.ts.map

package/dist/platform/runtime/store/domains/acp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acp.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/store/domains/acp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAErD,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,cAAc,EAAE,iBAAiB,CAAC;IAClC,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,UAAU,EAAE,OAAO,CAAC;IACpB,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAE7B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IAGf,2CAA2C;IAC3C,qBAAqB,EAAE,iBAAiB,CAAC;IACzC,sDAAsD;IACtD,WAAW,EAAE,OAAO,CAAC;IAGrB,4CAA4C;IAC5C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxC,kDAAkD;IAClD,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAG9B,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CActD"}

package/dist/platform/runtime/store/domains/acp.js

@@ -0,0 +1,22 @@
+/**
+ * ACP domain state — tracks the Agent Client Protocol transport layer,
+ * active subagent connections, and inter-session ACP sessions.
+ */
+/**
+ * Returns the default initial state for the ACP domain.
+ */
+export function createInitialAcpState() {
+    return {
+        revision: 0,
+        lastUpdatedAt: 0,
+        source: 'init',
+        managerTransportState: 'disconnected',
+        initialized: false,
+        connections: new Map(),
+        activeConnectionIds: [],
+        totalSpawned: 0,
+        totalCompleted: 0,
+        totalFailed: 0,
+        totalMessages: 0,
+    };
+}

package/dist/platform/runtime/store/domains/agents.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Agents domain state — tracks all spawned agent sessions including
+ * subagents, WRFC chain agents, and orchestrator agents.
+ */
+/** States for the agent lifecycle machine. */
+export type AgentLifecycleState = 'spawning' | 'running' | 'awaiting_message' | 'awaiting_tool' | 'finalizing' | 'completed' | 'failed' | 'cancelled';
+/** Classification of the agent's role. */
+export type AgentRole = 'orchestrator' | 'engineer' | 'reviewer' | 'fixer' | 'gatekeeper' | 'subagent' | 'background';
+/** A WRFC chain reference for agent grouping. */
+export interface AgentWrfcRef {
+    /** ID of the WRFC chain this agent belongs to. */
+    chainId: string;
+    /** The agent's role within that chain. */
+    chainRole: 'engineer' | 'reviewer' | 'fixer';
+}
+/**
+ * Full runtime agent record. Every spawned agent has one of these.
+ */
+export interface RuntimeAgent {
+    /** Unique agent ID. */
+    id: string;
+    /** Human-readable label for display. */
+    label: string;
+    /** Agent role classification. */
+    role: AgentRole;
+    /** Current lifecycle state. */
+    status: AgentLifecycleState;
+    /** Provider the agent is running on. */
+    providerId: string;
+    /** Model ID the agent is using. */
+    modelId: string;
+    /** ID of the parent agent that spawned this one (undefined = root). */
+    parentAgentId?: string;
+    /** IDs of agents spawned by this agent. */
+    childAgentIds: string[];
+    /** WRFC chain reference if this agent is part of a WRFC workflow. */
+    wrfcRef?: AgentWrfcRef;
+    /** Task ID this agent is executing (from tasks domain). */
+    taskId?: string;
+    /** Path to the agent's session file. */
+    sessionFile?: string;
+    /** Number of turns completed by this agent. */
+    turnCount: number;
+    /** Number of tool calls made by this agent. */
+    toolCallCount: number;
+    /** Latest accumulated output from the agent (for live display). */
+    latestOutput: string;
+    /** Latest progress string emitted by the agent. */
+    latestProgress?: string;
+    /** Epoch ms when the agent was spawned. */
+    spawnedAt: number;
+    /** Epoch ms when the agent completed/failed/cancelled. */
+    endedAt?: number;
+    /** Final result payload from the agent (populated on completion). */
+    result?: unknown;
+    /** Error message if status === 'failed'. */
+    error?: string;
+    /** Correlation ID for tracing across agent boundaries. */
+    correlationId?: string;
+}
+/**
+ * AgentDomainState — all spawned agents across all subsystems.
+ */
+export interface AgentDomainState {
+    /** Monotonic revision counter; increments on every mutation. */
+    revision: number;
+    /** Timestamp of last mutation (Date.now()). */
+    lastUpdatedAt: number;
+    /** Subsystem that triggered the last mutation. */
+    source: string;
+    /** All known agents keyed by agent ID. */
+    agents: Map<string, RuntimeAgent>;
+    /** IDs of currently active (non-terminal) agents. */
+    activeAgentIds: string[];
+    /** Total agents spawned this session. */
+    totalSpawned: number;
+    /** Total agents that completed successfully. */
+    totalCompleted: number;
+    /** Total agents that failed. */
+    totalFailed: number;
+    /** Maximum concurrent agents this session. */
+    peakConcurrency: number;
+}
+/**
+ * Returns the default initial state for the agents domain.
+ */
+export declare function createInitialAgentsState(): AgentDomainState;
+//# sourceMappingURL=agents.d.ts.map

package/dist/platform/runtime/store/domains/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/store/domains/agents.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8CAA8C;AAC9C,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,SAAS,GACT,kBAAkB,GAClB,eAAe,GACf,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,WAAW,CAAC;AAEhB,0CAA0C;AAC1C,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,UAAU,GACV,UAAU,GACV,OAAO,GACP,YAAY,GACZ,UAAU,GACV,YAAY,CAAC;AAEjB,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,SAAS,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,+BAA+B;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAG5B,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAGhB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,aAAa,EAAE,MAAM,EAAE,CAAC;IAGxB,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,CAAC;IAGvB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IAGtB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,qEAAqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAE/B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IAGf,0CAA0C;IAC1C,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClC,qDAAqD;IACrD,cAAc,EAAE,MAAM,EAAE,CAAC;IAGzB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,cAAc,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,gBAAgB,CAY3D"}