@pome-sh/cli 0.20.0 → 0.21.1

package/dist/src/recorder/inspect.js

@@ -1,195 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-import { eventSchema, isLegacyEventRow, } from "../types/shared.js";
-export const LEGACY_EVENTS_MESSAGE = "this run was produced by an older CLI version (pre-M0); rerun against current CLI to view";
-export async function readEventsJsonl(runDir) {
-    let raw;
-    try {
-        raw = await readFile(join(runDir, "events.jsonl"), "utf8");
-    }
-    catch (err) {
-        if (err.code === "ENOENT") {
-            return { kind: "missing" };
-        }
-        throw err;
-    }
-    const rows = raw
-        .split("\n")
-        .map((line) => line.trim())
-        .filter((line) => line.length > 0)
-        .map((line) => JSON.parse(line));
-    if (rows.some(isLegacyEventRow)) {
-        return { kind: "legacy" };
-    }
-    const events = rows.map((row) => eventSchema.parse(row));
-    return { kind: "events", events };
-}
-export function computeTraceHealth(input) {
-    const counts = countByKind(input.events);
-    // proxy layer — LLM calls captured by the HTTP_PROXY CONNECT tunnel.
-    // Default heuristic: presence implies it was expected (so a populated layer
-    // never warns). When the scenario manifest declares LLM usage we expect at
-    // least one row even with zero observed; absence then surfaces as a warning
-    // ("capture-server may not have started").
-    const proxyExpected = input.taskExpectsLlm
-        ? 1
-        : counts.LlmCallEvent > 0
-            ? 1
-            : 0;
-    const proxy = {
-        name: "proxy",
-        count: counts.LlmCallEvent,
-        expectedAtLeast: proxyExpected,
-        status: layerStatus(counts.LlmCallEvent, proxyExpected),
-        note: proxyExpected > 0 && counts.LlmCallEvent === 0
-            ? "warning: capture-server may not have started"
-            : null,
-    };
-    // twin layer — TwinHttpEvent rows. A scenario always declares ≥1 twin in
-    // `config.twins`, so when we know the scenario we expect ≥1 row.
-    const twinExpectedBool = input.taskUsesTwin ?? counts.TwinHttpEvent > 0;
-    const twinExpected = twinExpectedBool ? 1 : 0;
-    const twin = {
-        name: "twin",
-        count: counts.TwinHttpEvent,
-        expectedAtLeast: twinExpected,
-        status: layerStatus(counts.TwinHttpEvent, twinExpected),
-        note: twinExpected > 0 && counts.TwinHttpEvent === 0
-            ? "warning: twin runtime emitted no HTTP events"
-            : null,
-    };
-    // CAS adapter layer — only active when the agent is wired through
-    // `@pome-sh/claude-agent-sdk`. Heuristic: any of ToolUse/ToolResult/
-    // SubagentSpawn/Hook/LlmTurn indicates adapter is live. LlmTurnEvent (F-766)
-    // is adapter-emitted like its siblings, so it counts toward this layer.
-    const casCount = counts.ToolUseEvent +
-        counts.ToolResultEvent +
-        counts.SubagentSpawnEvent +
-        counts.HookEvent +
-        counts.LlmTurnEvent;
-    const casExpected = input.taskExpectsCas ? 1 : casCount > 0 ? 1 : 0;
-    const cas = {
-        name: "CAS adapter",
-        count: casCount,
-        expectedAtLeast: casExpected,
-        status: layerStatus(casCount, casExpected),
-        note: casExpected > 0 && casCount === 0
-            ? "warning: task flagged adapter but no adapter events recorded"
-            : null,
-    };
-    return [proxy, twin, cas];
-}
-function layerStatus(count, expected) {
-    if (expected === 0)
-        return count > 0 ? "ok" : "none";
-    return count >= expected ? "ok" : "warning";
-}
-function emptyCounts() {
-    return {
-        TwinHttpEvent: 0,
-        LlmCallEvent: 0,
-        ToolUseEvent: 0,
-        ToolResultEvent: 0,
-        SubagentSpawnEvent: 0,
-        HookEvent: 0,
-        LlmTurnEvent: 0,
-    };
-}
-function countByKind(events) {
-    const counts = emptyCounts();
-    for (const event of events) {
-        counts[event.kind] += 1;
-    }
-    return counts;
-}
-// ─────────────────────────────────────────────────────────────────────────────
-// Rendering
-//
-// Lines are emitted into a string array so tests can snapshot the full output
-// without intercepting console.log. The inspect command joins on "\n".
-// ─────────────────────────────────────────────────────────────────────────────
-export function renderTraceHealth(layers) {
-    const lines = ["Trace health:"];
-    for (const layer of layers) {
-        const expected = layer.expectedAtLeast > 0 ? `expected≥${layer.expectedAtLeast}` : "no expectation";
-        const tail = layer.note ? ` (${layer.note})` : "";
-        lines.push(`  ${layer.name}: ${layer.count}/${expected} [${layer.status}]${tail}`);
-    }
-    return lines;
-}
-export function renderEvents(events) {
-    if (events.length === 0) {
-        return ["Events: (none)"];
-    }
-    const lines = [`Events (${events.length}):`];
-    for (const event of events) {
-        lines.push(...renderEventLines(event));
-    }
-    return lines;
-}
-function renderEventLines(event) {
-    switch (event.kind) {
-        case "TwinHttpEvent":
-            return renderTwinHttp(event);
-        case "LlmCallEvent":
-            return renderLlmCall(event);
-        case "ToolUseEvent":
-            return renderToolUse(event);
-        case "ToolResultEvent":
-            return renderToolResult(event);
-        case "SubagentSpawnEvent":
-            return renderSubagentSpawn(event);
-        case "HookEvent":
-            return renderHook(event);
-        case "LlmTurnEvent":
-            return renderLlmTurn(event);
-    }
-}
-function renderTwinHttp(event) {
-    const status = event.error ? `ERR ${event.status}` : `${event.status}`;
-    const dedupe = event.idempotency_dedupe ? " [dedupe-replay]" : "";
-    const mutation = event.state_mutation ? " [mutation]" : "";
-    return [
-        `- TwinHttpEvent  ${event.method} ${event.path} → ${status} (${event.latency_ms}ms)${mutation}${dedupe}`,
-        `    twin=${event.twin}  fidelity=${event.fidelity}${event.error ? `  error=${event.error}` : ""}`,
-    ];
-}
-function renderLlmCall(event) {
-    const model = event.model ? ` model=${event.model}` : "";
-    const status = event.status !== null ? ` status=${event.status}` : "";
-    const tokens = event.prompt_tokens !== null || event.completion_tokens !== null
-        ? ` tokens=${event.prompt_tokens ?? "?"}/${event.completion_tokens ?? "?"}`
-        : "";
-    return [
-        `- LlmCallEvent   ${event.host}:${event.port}${status} (${event.latency_ms}ms)`,
-        `    bytes=${event.bytes_in}/${event.bytes_out}${model}${tokens}`,
-    ];
-}
-function renderToolUse(event) {
-    return [`- ToolUseEvent   ${event.tool_name} (id=${event.tool_use_id})`];
-}
-function renderToolResult(event) {
-    const status = event.is_error ? "error" : "ok";
-    return [`- ToolResultEvent ${status} (use_id=${event.tool_use_id})`];
-}
-function renderSubagentSpawn(event) {
-    return [`- SubagentSpawnEvent parent_tool_use_id=${event.parent_tool_use_id}`];
-}
-function renderHook(event) {
-    const tool = event.tool_name ? ` tool=${event.tool_name}` : "";
-    return [`- HookEvent      ${event.hook_name}${tool}`];
-}
-function renderLlmTurn(event) {
-    const model = event.model ?? "unknown";
-    const tokens = `${event.input_tokens ?? "?"}/${event.output_tokens ?? "?"}`;
-    const cache = `${event.cache_read_input_tokens ?? "?"}/${event.cache_creation_input_tokens ?? "?"}`;
-    const est = event.latency_ms_estimated ? "~" : "";
-    const finish = event.finish_reasons && event.finish_reasons.length > 0
-        ? `  finish=${event.finish_reasons.join(",")}`
-        : "";
-    return [
-        `- LlmTurnEvent   turn ${event.turn_index}  model=${model}  tokens=${tokens} (${est}${event.latency_ms}ms)`,
-        `    cache read/create=${cache}${finish}`,
-    ];
-}

package/dist/src/recorder/recorder.d.ts

@@ -1,14 +0,0 @@
-import { type RecorderStore } from "@pome-sh/sdk/server";
-/**
- * The CLI's event buffer. Structurally the engine's `RecorderStore` — the
- * ported twins (F-682) no longer export a per-twin Recorder type to borrow.
- *
- * F-698: when `eventsPath` is set, uses the twin-core durable store so twin
- * HTTP events stream to `events.jsonl` during the run (crash-safe).
- */
-export type Recorder = RecorderStore;
-export declare function createRecorder(options?: {
-    eventsPath?: string;
-    maxEvents?: number;
-}): Recorder;
-export declare function createRequestId(): string;

package/dist/src/recorder/recorder.js

@@ -1,16 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-import { randomUUID } from "node:crypto";
-import { createFileBackedRecorderStore, createRecorderStore, } from "@pome-sh/sdk/server";
-export function createRecorder(options = {}) {
-    if (options.eventsPath) {
-        return createFileBackedRecorderStore({
-            path: options.eventsPath,
-            maxEvents: options.maxEvents,
-            fsync: true,
-        });
-    }
-    return createRecorderStore({ maxEvents: options.maxEvents });
-}
-export function createRequestId() {
-    return `req_${randomUUID()}`;
-}

package/dist/src/recorder/redaction.d.ts

@@ -1 +0,0 @@
-export { redactEvent, redactSecrets } from "@pome-sh/shared-types/redaction";

package/dist/src/recorder/redaction.js

@@ -1,2 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-export { redactEvent, redactSecrets } from "@pome-sh/shared-types/redaction";

package/dist/src/recorder/specMeta.d.ts

@@ -1,8 +0,0 @@
-export declare const META_SPEC_VERSION = 1;
-/** Resolve installed twin package versions for the given twin ids (e.g.
- *  `scenario.config.twins`). A twin with no resolvable installed package
- *  (unknown id, or a dev checkout that hasn't installed dependencies) is
- *  OMITTED — never fabricated. */
-export declare function resolveTwinPackageVersions(twinIds: readonly string[]): Record<string, string>;
-/** Test-only escape hatch: clear the resolved-version cache. */
-export declare function resetTwinVersionCacheForTests(): void;

package/dist/src/recorder/specMeta.js

@@ -1,79 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//
-// meta.json contract constants (D18.1 / F-689 remainder). `spec_version` and
-// the twin package versions let cloud's ingest (a parallel PR) validate that
-// a run's meta.json matches a shape it knows how to parse, and lets the
-// dashboard attribute a run's captured behavior to the exact twin build that
-// produced it.
-//
-// Versions are read from the INSTALLED twin package's own package.json
-// `version` field (resolved via node module resolution), never from the
-// dependency SPEC in this package's own package.json — that spec can be a
-// semver range, a `workspace:*` link, or (pre-first-npm-publish / cli-ci.yml)
-// a rewritten `file:...tgz` path (`scripts/use-local-pome-tarballs.mjs`).
-// Reading the twin's own manifest gives the true resolved version no matter
-// how the dependency was satisfied.
-import { existsSync, readFileSync } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
-// Bump when the meta.json SHAPE changes in a way a consumer must branch on
-// (new required field, renamed key, etc.). Purely additive fields don't need
-// a bump.
-export const META_SPEC_VERSION = 1;
-const TWIN_PACKAGE_PREFIX = "@pome-sh/twin-";
-// Bound the upward package.json search so a resolution oddity can't spin.
-const MAX_WALK_UP = 8;
-const twinVersionCache = new Map();
-/** Resolve the installed twin package's OWN version by requiring the bare
- *  specifier (never a `/package.json` subpath — several twins' `exports`
- *  map restricts subpaths to `.`, so that would 404 the resolver) and
- *  walking up from the resolved entry file until a `package.json` whose
- *  `name` matches is found. Returns null when the package can't be
- *  resolved (unknown twin id) or its manifest can't be located/parsed —
- *  NEVER fabricated. */
-function readInstalledTwinVersion(twinId) {
-    const pkgName = `${TWIN_PACKAGE_PREFIX}${twinId}`;
-    if (twinVersionCache.has(pkgName))
-        return twinVersionCache.get(pkgName);
-    let version = null;
-    try {
-        const require = createRequire(import.meta.url);
-        let dir = dirname(require.resolve(pkgName));
-        for (let i = 0; i < MAX_WALK_UP; i += 1) {
-            const candidate = join(dir, "package.json");
-            if (existsSync(candidate)) {
-                const pkg = JSON.parse(readFileSync(candidate, "utf8"));
-                if (pkg.name === pkgName && typeof pkg.version === "string") {
-                    version = pkg.version;
-                    break;
-                }
-            }
-            const parent = dirname(dir);
-            if (parent === dir)
-                break;
-            dir = parent;
-        }
-    }
-    catch {
-        /* unresolvable (unknown twin id, or no node_modules reachable) */
-    }
-    twinVersionCache.set(pkgName, version);
-    return version;
-}
-/** Resolve installed twin package versions for the given twin ids (e.g.
- *  `scenario.config.twins`). A twin with no resolvable installed package
- *  (unknown id, or a dev checkout that hasn't installed dependencies) is
- *  OMITTED — never fabricated. */
-export function resolveTwinPackageVersions(twinIds) {
-    const out = {};
-    for (const id of twinIds) {
-        const version = readInstalledTwinVersion(id);
-        if (version)
-            out[id] = version;
-    }
-    return out;
-}
-/** Test-only escape hatch: clear the resolved-version cache. */
-export function resetTwinVersionCacheForTests() {
-    twinVersionCache.clear();
-}

package/dist/src/runner/agentRunner.d.ts

@@ -1,12 +0,0 @@
-export type AgentRunResult = {
-    stdout: string;
-    stderr: string;
-    exitCode: number | null;
-    timedOut: boolean;
-};
-export declare function runAgentCommand(input: {
-    command: string;
-    env: Record<string, string>;
-    timeoutSeconds: number;
-    preflight?: boolean;
-}): Promise<AgentRunResult>;

package/dist/src/runner/agentRunner.js

@@ -1,163 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-import { spawn } from "node:child_process";
-export async function runAgentCommand(input) {
-    return new Promise((resolve) => {
-        const inheritAllEnv = process.env.POME_INHERIT_AGENT_ENV === "1";
-        const useShell = process.env.POME_TRUST_AGENT_COMMAND === "1";
-        const childEnv = buildAgentEnv(input.env, inheritAllEnv, Boolean(input.preflight));
-        const command = useShell ? null : splitCommand(input.command);
-        if (!useShell && !command) {
-            resolve({
-                stdout: "",
-                stderr: "Could not parse agent command. Use POME_TRUST_AGENT_COMMAND=1 to run it through a shell.\n",
-                exitCode: 2,
-                timedOut: false,
-            });
-            return;
-        }
-        if (useShell) {
-            console.warn("[pome] POME_TRUST_AGENT_COMMAND=1: running agent command through a shell.");
-        }
-        if (inheritAllEnv) {
-            console.warn("[pome] POME_INHERIT_AGENT_ENV=1: passing the full parent environment to the agent.");
-        }
-        const child = useShell
-            ? spawn(input.command, {
-                shell: true,
-                stdio: ["ignore", "pipe", "pipe"],
-                env: childEnv,
-            })
-            : spawn(command.file, command.args, {
-                shell: false,
-                stdio: ["ignore", "pipe", "pipe"],
-                env: childEnv,
-            });
-        let stdout = "";
-        let stderr = "";
-        let timedOut = false;
-        let settled = false;
-        const timer = setTimeout(() => {
-            timedOut = true;
-            child.kill("SIGTERM");
-            setTimeout(() => child.kill("SIGKILL"), 1000).unref();
-        }, input.timeoutSeconds * 1000);
-        child.stdout?.on("data", (chunk) => {
-            stdout += chunk.toString();
-        });
-        child.stderr?.on("data", (chunk) => {
-            stderr += chunk.toString();
-        });
-        child.on("error", (error) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            resolve({
-                stdout,
-                stderr: `${stderr}${error.message}\n`,
-                exitCode: 2,
-                timedOut,
-            });
-        });
-        child.on("close", (exitCode) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            resolve({ stdout, stderr, exitCode, timedOut });
-        });
-    });
-}
-const SAFE_PARENT_ENV = new Set([
-    "PATH",
-    "HOME",
-    "USERPROFILE",
-    "SystemRoot",
-    "COMSPEC",
-    "TMPDIR",
-    "TEMP",
-    "TMP",
-    "LANG",
-    "LC_ALL",
-]);
-const DEFAULT_AGENT_ENV_ALLOWLIST = new Set([
-    "AI_GATEWAY_API_KEY",
-    "ANTHROPIC_API_KEY",
-    // FDRS-667 — Claude subscription auth (`claude setup-token`). Without
-    // this the Claude Agent SDK inside the agent subprocess only sees an API
-    // key, and subscription-only users fail auth under `pome run` while the
-    // same agent works when launched by hand.
-    "CLAUDE_CODE_OAUTH_TOKEN",
-    "GOOGLE_API_KEY",
-    "GOOGLE_GENERATIVE_AI_API_KEY",
-    "OPENAI_API_KEY",
-    "OPENROUTER_API_KEY",
-]);
-function buildAgentEnv(inputEnv, inheritAll, preflight) {
-    const base = {};
-    if (inheritAll) {
-        Object.assign(base, process.env);
-    }
-    else {
-        for (const key of [...SAFE_PARENT_ENV, ...DEFAULT_AGENT_ENV_ALLOWLIST]) {
-            const value = process.env[key];
-            if (value !== undefined)
-                base[key] = value;
-        }
-        for (const key of (process.env.POME_AGENT_ENV_ALLOWLIST ?? "").split(",")) {
-            const trimmed = key.trim();
-            if (!trimmed)
-                continue;
-            const value = process.env[trimmed];
-            if (value !== undefined)
-                base[trimmed] = value;
-        }
-    }
-    return {
-        ...base,
-        ...inputEnv,
-        ...(preflight ? { POME_PREFLIGHT: "1" } : {}),
-    };
-}
-function splitCommand(command) {
-    const parts = [];
-    let current = "";
-    let quote = null;
-    let escaping = false;
-    for (const char of command.trim()) {
-        if (escaping) {
-            current += char;
-            escaping = false;
-            continue;
-        }
-        if (char === "\\") {
-            escaping = true;
-            continue;
-        }
-        if (quote) {
-            if (char === quote)
-                quote = null;
-            else
-                current += char;
-            continue;
-        }
-        if (char === "'" || char === "\"") {
-            quote = char;
-            continue;
-        }
-        if (/\s/.test(char)) {
-            if (current.length > 0) {
-                parts.push(current);
-                current = "";
-            }
-            continue;
-        }
-        current += char;
-    }
-    if (escaping || quote)
-        return null;
-    if (current.length > 0)
-        parts.push(current);
-    const [file, ...args] = parts;
-    return file ? { file, args } : null;
-}

package/dist/src/runner/captureServerChild.d.ts

@@ -1,16 +0,0 @@
-export interface SpawnCaptureServerChildOptions {
-    eventsOut: string;
-    allowHosts?: readonly string[];
-    egressOut?: string;
-    execPath?: string;
-    binArgs?: string[];
-    readyTimeoutMs?: number;
-    shutdownGraceMs?: number;
-}
-export interface CaptureServerChildHandle {
-    port: number;
-    pid: number;
-    shutdown(): Promise<void>;
-}
-export declare function spawnCaptureServerChild(options: SpawnCaptureServerChildOptions): Promise<CaptureServerChildHandle>;
-export declare function egressArgs(allowHosts?: readonly string[], egressOut?: string): string[];

package/dist/src/runner/captureServerChild.js

@@ -1,148 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// FDRS-399 — spawn `pome capture-server` as a child process for `pome run`.
-//
-// The runner needs an out-of-process CONNECT proxy so the agent subprocess
-// can be pointed at it via HTTPS_PROXY. Running capture-server in-process is
-// possible but the ticket scope requires child-process isolation (capture
-// crashes don't take the runner down; standalone deployment parity).
-//
-// Contract with `cli/src/capture-server/run.ts`:
-//   - On boot the server writes
-//       pome capture-server listening on 127.0.0.1:<port> (events → <path>)
-//     to stderr. We parse the port from that line.
-//   - SIGTERM triggers a drain + exit 0. We send SIGTERM and await `exit`,
-//     falling back to SIGKILL after `shutdownGraceMs` so a buggy build can't
-//     leak processes.
-import { spawn } from "node:child_process";
-const LISTENING_REGEX = /listening on 127\.0\.0\.1:(\d+)/;
-export async function spawnCaptureServerChild(options) {
-    const execPath = options.execPath ?? process.execPath;
-    const binArgs = options.binArgs ??
-        defaultBinArgs(options.eventsOut, options.allowHosts, options.egressOut);
-    const readyTimeoutMs = options.readyTimeoutMs ?? 5_000;
-    const shutdownGraceMs = options.shutdownGraceMs ?? 5_000;
-    const child = spawn(execPath, binArgs, {
-        stdio: ["ignore", "ignore", "pipe"],
-        env: process.env,
-    });
-    let stderrBuf = "";
-    let resolved = false;
-    const readyPromise = new Promise((resolve, reject) => {
-        const onData = (chunk) => {
-            stderrBuf += chunk.toString("utf8");
-            // Cap at 8KB to avoid unbounded buffering if the child spews logs.
-            if (stderrBuf.length > 8_192)
-                stderrBuf = stderrBuf.slice(-8_192);
-            const match = LISTENING_REGEX.exec(stderrBuf);
-            if (match) {
-                resolved = true;
-                cleanup();
-                resolve(Number(match[1]));
-            }
-        };
-        const onExit = (code, signal) => {
-            if (resolved)
-                return;
-            cleanup();
-            const detail = stderrBuf.trim().slice(0, 2_048);
-            reject(new Error(`pome capture-server exited (code=${code} signal=${signal}) before printing the listening line.${detail ? `\nstderr: ${detail}` : ""}`));
-        };
-        const timer = setTimeout(() => {
-            if (resolved)
-                return;
-            cleanup();
-            reject(new Error(`pome capture-server did not start listening within ${readyTimeoutMs}ms.${stderrBuf ? `\nstderr: ${stderrBuf.trim().slice(0, 2_048)}` : ""}`));
-        }, readyTimeoutMs);
-        const cleanup = () => {
-            clearTimeout(timer);
-            child.stderr?.off("data", onData);
-            child.off("exit", onExit);
-        };
-        child.stderr?.on("data", onData);
-        child.once("exit", onExit);
-    });
-    let port;
-    try {
-        port = await readyPromise;
-    }
-    catch (err) {
-        // Best-effort cleanup so a boot failure doesn't leak a process.
-        if (!child.killed)
-            child.kill("SIGKILL");
-        throw err;
-    }
-    // After the listening line we keep draining stderr to /dev/null so the
-    // child's pipe buffer doesn't fill and block its writes mid-run.
-    child.stderr?.on("data", () => { });
-    const pid = child.pid;
-    if (pid === undefined) {
-        // Practically unreachable — spawn always returns a pid once the child has
-        // emitted output. Guard anyway so the type narrows.
-        child.kill("SIGKILL");
-        throw new Error("pome capture-server child has no pid after boot");
-    }
-    return {
-        port,
-        pid,
-        shutdown: makeShutdown(child, shutdownGraceMs),
-    };
-}
-function defaultBinArgs(eventsOut, allowHosts, egressOut) {
-    // process.argv[1] is the script path we were invoked with. Re-invoking it
-    // gives us the same binary (and the same code) without depending on PATH
-    // having a `pome` shim — important when running from the dev tree
-    // (`tsx src/cli/main.ts`).
-    const script = process.argv[1];
-    if (typeof script !== "string" || script.length === 0) {
-        throw new Error("Cannot determine pome binary path (process.argv[1] is empty). Pass `binArgs` explicitly.");
-    }
-    return [script, "capture-server", "--port", "0", "--events-out", eventsOut, ...egressArgs(allowHosts, egressOut)];
-}
-// Shared by defaultBinArgs and runTask's test-override path so the two
-// spawn shapes can't drift.
-export function egressArgs(allowHosts, egressOut) {
-    const args = [];
-    if (allowHosts && allowHosts.length > 0)
-        args.push("--allow", allowHosts.join(","));
-    if (egressOut)
-        args.push("--egress-out", egressOut);
-    return args;
-}
-function makeShutdown(child, graceMs) {
-    let done = null;
-    return () => {
-        if (done)
-            return done;
-        done = new Promise((resolve) => {
-            if (child.exitCode !== null || child.signalCode !== null) {
-                resolve();
-                return;
-            }
-            const onExit = () => {
-                clearTimeout(killTimer);
-                resolve();
-            };
-            child.once("exit", onExit);
-            try {
-                child.kill("SIGTERM");
-            }
-            catch {
-                // Already gone.
-                child.off("exit", onExit);
-                resolve();
-                return;
-            }
-            const killTimer = setTimeout(() => {
-                if (child.exitCode === null && child.signalCode === null) {
-                    try {
-                        child.kill("SIGKILL");
-                    }
-                    catch {
-                        // ignore
-                    }
-                }
-            }, graceMs);
-        });
-        return done;
-    };
-}