@probelabs/visor 0.1.144-ee → 0.1.145-ee

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-process.env.VISOR_VERSION = '0.1.144';
-process.env.PROBE_VERSION = '0.6.0-rc259';
-process.env.VISOR_COMMIT_SHA = '0f8df6f53e18e9ad94507e1761debabaf533c0df';
-process.env.VISOR_COMMIT_SHORT = '0f8df6f';
+process.env.VISOR_VERSION = '0.1.145';
+process.env.PROBE_VERSION = '0.6.0-rc260';
+process.env.VISOR_COMMIT_SHA = '7f399fc32c663ce91b7adbb19c6f29bcd7f41931';
+process.env.VISOR_COMMIT_SHORT = '7f399fc';
 /******/ (() => { // webpackBootstrap
 /******/ 	var __webpack_modules__ = ({
 
@@ -164445,99 +164445,131 @@ class ConfigManager {
                 message: `Sandbox name '${name}' contains invalid characters. Only letters, numbers, dots, hyphens, underscores allowed.`,
             });
         }
-        // Must have exactly one mode
-        const modes = [
-            config.image ? 'image' : null,
-            config.dockerfile || config.dockerfile_inline ? 'dockerfile' : null,
-            config.compose ? 'compose' : null,
-        ].filter(Boolean);
-        if (modes.length === 0) {
+        // Validate engine field if present
+        if (config.engine && !['docker', 'bubblewrap', 'seatbelt'].includes(config.engine)) {
             errors.push({
-                field: `sandboxes.${name}`,
-                message: `Sandbox '${name}' must specify one of: image, dockerfile, dockerfile_inline, or compose`,
-            });
-        }
-        else if (modes.length > 1) {
-            errors.push({
-                field: `sandboxes.${name}`,
-                message: `Sandbox '${name}' has multiple modes (${modes.join(', ')}). Specify exactly one.`,
+                field: `sandboxes.${name}.engine`,
+                message: `Sandbox '${name}' has invalid engine '${config.engine}'. Must be 'docker', 'bubblewrap', or 'seatbelt'.`,
             });
         }
-        // Compose mode requires service
-        if (config.compose && !config.service) {
-            errors.push({
-                field: `sandboxes.${name}.service`,
-                message: `Sandbox '${name}' uses compose mode but is missing required 'service' field`,
-            });
-        }
-        // Validate file paths don't contain traversal
-        if (config.dockerfile && /\.\./.test(config.dockerfile)) {
-            errors.push({
-                field: `sandboxes.${name}.dockerfile`,
-                message: `Dockerfile path '${config.dockerfile}' in sandbox '${name}' must not contain '..' path traversal`,
-            });
-        }
-        if (config.compose && /\.\./.test(config.compose)) {
-            errors.push({
-                field: `sandboxes.${name}.compose`,
-                message: `Compose file path '${config.compose}' in sandbox '${name}' must not contain '..' path traversal`,
-            });
+        const isNativeEngine = config.engine === 'bubblewrap' || config.engine === 'seatbelt';
+        if (isNativeEngine) {
+            // Native engine (bubblewrap/seatbelt): reject Docker-only fields
+            const dockerOnlyFields = [
+                ['image', config.image],
+                ['dockerfile', config.dockerfile],
+                ['dockerfile_inline', config.dockerfile_inline],
+                ['compose', config.compose],
+                ['service', config.service],
+                ['cache', config.cache],
+                ['visor_path', config.visor_path],
+                ['resources', config.resources],
+            ];
+            for (const [field, value] of dockerOnlyFields) {
+                if (value !== undefined) {
+                    errors.push({
+                        field: `sandboxes.${name}.${field}`,
+                        message: `Sandbox '${name}' uses ${config.engine} engine but has Docker-only field '${field}'. Remove it or switch to engine: docker.`,
+                    });
+                }
+            }
         }
-        // Validate container paths are absolute and safe
-        if (config.workdir) {
-            if (!config.workdir.startsWith('/')) {
+        else {
+            // Docker engine (default): must have exactly one mode
+            const modes = [
+                config.image ? 'image' : null,
+                config.dockerfile || config.dockerfile_inline ? 'dockerfile' : null,
+                config.compose ? 'compose' : null,
+            ].filter(Boolean);
+            if (modes.length === 0) {
                 errors.push({
-                    field: `sandboxes.${name}.workdir`,
-                    message: `Workdir '${config.workdir}' in sandbox '${name}' must be an absolute path (start with /)`,
+                    field: `sandboxes.${name}`,
+                    message: `Sandbox '${name}' must specify one of: image, dockerfile, dockerfile_inline, or compose`,
                 });
             }
-            if (/\.\./.test(config.workdir)) {
+            else if (modes.length > 1) {
                 errors.push({
-                    field: `sandboxes.${name}.workdir`,
-                    message: `Workdir '${config.workdir}' in sandbox '${name}' must not contain '..' path traversal`,
+                    field: `sandboxes.${name}`,
+                    message: `Sandbox '${name}' has multiple modes (${modes.join(', ')}). Specify exactly one.`,
                 });
             }
-        }
-        if (config.visor_path) {
-            if (!config.visor_path.startsWith('/')) {
+            // Compose mode requires service
+            if (config.compose && !config.service) {
                 errors.push({
-                    field: `sandboxes.${name}.visor_path`,
-                    message: `visor_path '${config.visor_path}' in sandbox '${name}' must be an absolute path (start with /)`,
+                    field: `sandboxes.${name}.service`,
+                    message: `Sandbox '${name}' uses compose mode but is missing required 'service' field`,
                 });
             }
-            if (/\.\./.test(config.visor_path)) {
+            // Validate file paths don't contain traversal
+            if (config.dockerfile && /\.\./.test(config.dockerfile)) {
                 errors.push({
-                    field: `sandboxes.${name}.visor_path`,
-                    message: `visor_path '${config.visor_path}' in sandbox '${name}' must not contain '..' path traversal`,
+                    field: `sandboxes.${name}.dockerfile`,
+                    message: `Dockerfile path '${config.dockerfile}' in sandbox '${name}' must not contain '..' path traversal`,
                 });
             }
-        }
-        // Validate cache paths are absolute and safe
-        if (config.cache?.paths) {
-            for (const p of config.cache.paths) {
-                if (!p.startsWith('/')) {
+            if (config.compose && /\.\./.test(config.compose)) {
+                errors.push({
+                    field: `sandboxes.${name}.compose`,
+                    message: `Compose file path '${config.compose}' in sandbox '${name}' must not contain '..' path traversal`,
+                });
+            }
+            // Validate visor_path
+            if (config.visor_path) {
+                if (!config.visor_path.startsWith('/')) {
                     errors.push({
-                        field: `sandboxes.${name}.cache.paths`,
-                        message: `Cache path '${p}' in sandbox '${name}' must be absolute (start with /)`,
-                        value: p,
+                        field: `sandboxes.${name}.visor_path`,
+                        message: `visor_path '${config.visor_path}' in sandbox '${name}' must be an absolute path (start with /)`,
                     });
                 }
-                if (/\.\./.test(p)) {
+                if (/\.\./.test(config.visor_path)) {
+                    errors.push({
+                        field: `sandboxes.${name}.visor_path`,
+                        message: `visor_path '${config.visor_path}' in sandbox '${name}' must not contain '..' path traversal`,
+                    });
+                }
+            }
+            // Validate cache paths are absolute and safe
+            if (config.cache?.paths) {
+                for (const p of config.cache.paths) {
+                    if (!p.startsWith('/')) {
+                        errors.push({
+                            field: `sandboxes.${name}.cache.paths`,
+                            message: `Cache path '${p}' in sandbox '${name}' must be absolute (start with /)`,
+                            value: p,
+                        });
+                    }
+                    if (/\.\./.test(p)) {
+                        errors.push({
+                            field: `sandboxes.${name}.cache.paths`,
+                            message: `Cache path '${p}' in sandbox '${name}' must not contain '..' path traversal`,
+                            value: p,
+                        });
+                    }
+                }
+            }
+            // Validate resource limits
+            if (config.resources?.cpu !== undefined) {
+                if (typeof config.resources.cpu !== 'number' || config.resources.cpu <= 0) {
                     errors.push({
-                        field: `sandboxes.${name}.cache.paths`,
-                        message: `Cache path '${p}' in sandbox '${name}' must not contain '..' path traversal`,
-                        value: p,
+                        field: `sandboxes.${name}.resources.cpu`,
+                        message: `CPU limit in sandbox '${name}' must be a positive number`,
+                        value: config.resources.cpu,
                     });
                 }
             }
         }
-        // Validate resource limits
-        if (config.resources?.cpu !== undefined) {
-            if (typeof config.resources.cpu !== 'number' || config.resources.cpu <= 0) {
+        // Common validations for all engines
+        if (config.workdir) {
+            if (!config.workdir.startsWith('/')) {
                 errors.push({
-                    field: `sandboxes.${name}.resources.cpu`,
-                    message: `CPU limit in sandbox '${name}' must be a positive number`,
-                    value: config.resources.cpu,
+                    field: `sandboxes.${name}.workdir`,
+                    message: `Workdir '${config.workdir}' in sandbox '${name}' must be an absolute path (start with /)`,
+                });
+            }
+            if (/\.\./.test(config.workdir)) {
+                errors.push({
+                    field: `sandboxes.${name}.workdir`,
+                    message: `Workdir '${config.workdir}' in sandbox '${name}' must not contain '..' path traversal`,
                 });
             }
         }
@@ -173132,6 +173164,11 @@ exports.configSchema = {
         SandboxConfig: {
             type: 'object',
             properties: {
+                engine: {
+                    type: 'string',
+                    enum: ['docker', 'bubblewrap', 'seatbelt'],
+                    description: "Sandbox engine type: 'docker' (default), 'bubblewrap' (Linux namespaces), or 'seatbelt' (macOS sandbox-exec)",
+                },
                 image: {
                     type: 'string',
                     description: 'Docker image to use (e.g., "node:20-alpine")',
@@ -188304,6 +188341,7 @@ class McpCheckProvider extends check_provider_interface_1.CheckProvider {
                 outputs: this.buildOutputContext(dependencyResults),
                 args: sessionInfo?.args || {},
                 env: this.getSafeEnvironmentVariables(),
+                inputs: config.workflowInputs || sessionInfo?.workflowInputs || {},
             };
             // Render method arguments if needed
             let methodArgs = cfg.methodArgs || {};
@@ -191865,6 +191903,150 @@ class PRReviewer {
 exports.PRReviewer = PRReviewer;
 
 
+/***/ }),
+
+/***/ 11207:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+/**
+ * Bubblewrap-based sandbox implementation.
+ * Uses Linux kernel namespaces for lightweight process isolation (~5-50ms overhead).
+ * Requires the `bwrap` binary to be installed on the host.
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.BubblewrapSandbox = void 0;
+const util_1 = __nccwpck_require__(39023);
+const child_process_1 = __nccwpck_require__(35317);
+const fs_1 = __nccwpck_require__(79896);
+const path_1 = __nccwpck_require__(16928);
+const logger_1 = __nccwpck_require__(86999);
+const sandbox_telemetry_1 = __nccwpck_require__(34826);
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+const EXEC_MAX_BUFFER = 50 * 1024 * 1024; // 50MB
+class BubblewrapSandbox {
+    name;
+    config;
+    repoPath;
+    constructor(name, config, repoPath) {
+        this.name = name;
+        this.config = config;
+        this.repoPath = (0, path_1.resolve)(repoPath);
+    }
+    /**
+     * Check if bwrap binary is available on the system.
+     */
+    static async isAvailable() {
+        try {
+            await execFileAsync('which', ['bwrap'], { timeout: 5000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Execute a command inside a bubblewrap sandbox.
+     * Each exec creates a fresh namespace — no persistent container.
+     */
+    async exec(options) {
+        const args = this.buildArgs(options);
+        args.push('--', '/bin/sh', '-c', options.command);
+        logger_1.logger.debug(`[BubblewrapSandbox] Executing in sandbox '${this.name}': ${options.command.slice(0, 100)}`);
+        try {
+            const { stdout, stderr } = await execFileAsync('bwrap', args, {
+                maxBuffer: options.maxBuffer || EXEC_MAX_BUFFER,
+                timeout: options.timeoutMs || 600000,
+            });
+            (0, sandbox_telemetry_1.addEvent)('visor.sandbox.bwrap.exec', {
+                'visor.sandbox.name': this.name,
+                'visor.sandbox.exit_code': 0,
+            });
+            return { stdout, stderr, exitCode: 0 };
+        }
+        catch (err) {
+            const execErr = err;
+            const exitCode = typeof execErr.code === 'number' ? execErr.code : 1;
+            (0, sandbox_telemetry_1.addEvent)('visor.sandbox.bwrap.exec', {
+                'visor.sandbox.name': this.name,
+                'visor.sandbox.exit_code': exitCode,
+            });
+            return {
+                stdout: execErr.stdout || '',
+                stderr: execErr.stderr || '',
+                exitCode,
+            };
+        }
+    }
+    /**
+     * No-op: bubblewrap processes are ephemeral (no persistent container to stop).
+     */
+    async stop() {
+        // Nothing to clean up — bwrap processes exit when the command finishes,
+        // and --die-with-parent ensures cleanup if the parent dies.
+    }
+    /**
+     * Build the bwrap command-line arguments.
+     */
+    buildArgs(options) {
+        const workdir = this.config.workdir || '/workspace';
+        const args = [];
+        // Read-only system directories
+        args.push('--ro-bind', '/usr', '/usr');
+        args.push('--ro-bind', '/bin', '/bin');
+        // /lib and /lib64 may not exist on all distros (e.g., Alpine uses /usr/lib)
+        if ((0, fs_1.existsSync)('/lib')) {
+            args.push('--ro-bind', '/lib', '/lib');
+        }
+        if ((0, fs_1.existsSync)('/lib64')) {
+            args.push('--ro-bind', '/lib64', '/lib64');
+        }
+        // DNS resolution and TLS certificates
+        if ((0, fs_1.existsSync)('/etc/resolv.conf')) {
+            args.push('--ro-bind', '/etc/resolv.conf', '/etc/resolv.conf');
+        }
+        if ((0, fs_1.existsSync)('/etc/ssl')) {
+            args.push('--ro-bind', '/etc/ssl', '/etc/ssl');
+        }
+        // Virtual filesystems
+        args.push('--dev', '/dev');
+        args.push('--proc', '/proc');
+        args.push('--tmpfs', '/tmp');
+        args.push('--tmpfs', '/root');
+        // Workspace mount — the only writable directory (unless read_only)
+        if (this.config.read_only) {
+            args.push('--ro-bind', this.repoPath, workdir);
+        }
+        else {
+            args.push('--bind', this.repoPath, workdir);
+        }
+        // Working directory inside sandbox
+        args.push('--chdir', workdir);
+        // Namespace isolation
+        args.push('--unshare-pid');
+        args.push('--new-session');
+        args.push('--die-with-parent');
+        // Network isolation
+        if (this.config.network === false) {
+            args.push('--unshare-net');
+        }
+        // Clean environment — only explicitly passed vars are visible
+        args.push('--clearenv');
+        // Pass filtered environment variables.
+        // Safe: execFile passes each arg as a separate argv entry — no shell interpretation.
+        for (const [key, value] of Object.entries(options.env)) {
+            if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
+                throw new Error(`Invalid environment variable name: '${key}'`);
+            }
+            args.push('--setenv', key, value);
+        }
+        return args;
+    }
+}
+exports.BubblewrapSandbox = BubblewrapSandbox;
+
+
 /***/ }),
 
 /***/ 10878:
@@ -192691,8 +192873,9 @@ function filterEnvForSandbox(checkEnv, hostEnv, passthroughPatterns, defaultPatt
 "use strict";
 
 /**
- * SandboxManager — lifecycle management for Docker sandbox environments.
- * Handles lazy container startup, reuse, exec routing, and cleanup.
+ * SandboxManager — lifecycle management for sandbox environments.
+ * Handles lazy container/process startup, reuse, exec routing, and cleanup.
+ * Supports Docker (image, compose), Bubblewrap (Linux namespaces), and Seatbelt (macOS sandbox-exec) engines.
  */
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.SandboxManager = void 0;
@@ -192756,6 +192939,20 @@ class SandboxManager {
             throw new Error(`Sandbox '${name}' is not defined`);
         }
         const mode = config.compose ? 'compose' : 'image';
+        // Bubblewrap engine: ephemeral per-exec, no persistent container
+        if (config.engine === 'bubblewrap') {
+            const { BubblewrapSandbox } = __nccwpck_require__(11207);
+            const instance = new BubblewrapSandbox(name, config, this.repoPath);
+            this.instances.set(name, instance);
+            return instance;
+        }
+        // Seatbelt engine: macOS sandbox-exec, ephemeral per-exec
+        if (config.engine === 'seatbelt') {
+            const { SeatbeltSandbox } = __nccwpck_require__(46429);
+            const instance = new SeatbeltSandbox(name, config, this.repoPath);
+            this.instances.set(name, instance);
+            return instance;
+        }
         return (0, sandbox_telemetry_1.withActiveSpan)('visor.sandbox.start', {
             'visor.sandbox.name': name,
             'visor.sandbox.mode': mode,
@@ -192884,6 +193081,165 @@ function setSpanError(err) {
 }
 
 
+/***/ }),
+
+/***/ 46429:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+/**
+ * macOS Seatbelt sandbox implementation.
+ * Uses Apple's sandbox-exec with dynamically-generated SBPL profiles
+ * for lightweight process isolation on macOS.
+ * Requires the `sandbox-exec` binary (ships with macOS).
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.SeatbeltSandbox = void 0;
+const util_1 = __nccwpck_require__(39023);
+const child_process_1 = __nccwpck_require__(35317);
+const path_1 = __nccwpck_require__(16928);
+const fs_1 = __nccwpck_require__(79896);
+const logger_1 = __nccwpck_require__(86999);
+const sandbox_telemetry_1 = __nccwpck_require__(34826);
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+const EXEC_MAX_BUFFER = 50 * 1024 * 1024; // 50MB
+class SeatbeltSandbox {
+    name;
+    config;
+    repoPath;
+    constructor(name, config, repoPath) {
+        this.name = name;
+        this.config = config;
+        // Resolve symlinks — macOS has /var → /private/var, /tmp → /private/tmp etc.
+        // sandbox-exec operates on real paths, so we must resolve before building profiles.
+        this.repoPath = (0, fs_1.realpathSync)((0, path_1.resolve)(repoPath));
+    }
+    /**
+     * Check if sandbox-exec binary is available on the system.
+     */
+    static async isAvailable() {
+        try {
+            await execFileAsync('which', ['sandbox-exec'], { timeout: 5000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Execute a command inside a macOS seatbelt sandbox.
+     * Each exec creates a fresh sandbox process — no persistent container.
+     */
+    async exec(options) {
+        const profile = this.buildProfile();
+        // Validate env var names
+        for (const key of Object.keys(options.env)) {
+            if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
+                throw new Error(`Invalid environment variable name: '${key}'`);
+            }
+        }
+        // Build args: sandbox-exec -p '<profile>' /usr/bin/env -i KEY=VAL ... /bin/sh -c '<command>'
+        const args = ['-p', profile];
+        // Use env -i to clear inherited environment, then set explicit vars
+        args.push('/usr/bin/env', '-i');
+        for (const [key, value] of Object.entries(options.env)) {
+            args.push(`${key}=${value}`);
+        }
+        args.push('/bin/sh', '-c', options.command);
+        logger_1.logger.debug(`[SeatbeltSandbox] Executing in sandbox '${this.name}': ${options.command.slice(0, 100)}`);
+        try {
+            const { stdout, stderr } = await execFileAsync('sandbox-exec', args, {
+                maxBuffer: options.maxBuffer || EXEC_MAX_BUFFER,
+                timeout: options.timeoutMs || 600000,
+                cwd: this.repoPath,
+            });
+            (0, sandbox_telemetry_1.addEvent)('visor.sandbox.seatbelt.exec', {
+                'visor.sandbox.name': this.name,
+                'visor.sandbox.exit_code': 0,
+            });
+            return { stdout, stderr, exitCode: 0 };
+        }
+        catch (err) {
+            const execErr = err;
+            const exitCode = typeof execErr.code === 'number' ? execErr.code : 1;
+            (0, sandbox_telemetry_1.addEvent)('visor.sandbox.seatbelt.exec', {
+                'visor.sandbox.name': this.name,
+                'visor.sandbox.exit_code': exitCode,
+            });
+            return {
+                stdout: execErr.stdout || '',
+                stderr: execErr.stderr || '',
+                exitCode,
+            };
+        }
+    }
+    /**
+     * No-op: sandbox-exec processes are ephemeral (no persistent container to stop).
+     */
+    async stop() {
+        // Nothing to clean up — sandbox-exec processes exit when the command finishes.
+    }
+    /**
+     * Escape a path for use inside an SBPL profile string.
+     * Escapes backslashes and double quotes.
+     */
+    escapePath(p) {
+        return p.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    }
+    /**
+     * Build the SBPL (Seatbelt Profile Language) profile string.
+     */
+    buildProfile() {
+        const repoPath = this.escapePath(this.repoPath);
+        const lines = [];
+        lines.push('(version 1)');
+        lines.push('(deny default)');
+        // Allow basic process execution
+        lines.push('(allow process-exec)');
+        lines.push('(allow process-fork)');
+        // Allow read access to system paths.
+        // macOS uses symlinks: /var → /private/var, /tmp → /private/tmp, /etc → /private/etc.
+        // We include both the symlink paths and /private to cover resolution.
+        lines.push('(allow file-read*');
+        lines.push('  (literal "/")');
+        lines.push('  (subpath "/usr")');
+        lines.push('  (subpath "/bin")');
+        lines.push('  (subpath "/sbin")');
+        lines.push('  (subpath "/Library")');
+        lines.push('  (subpath "/System")');
+        lines.push('  (subpath "/private")');
+        lines.push('  (subpath "/var")');
+        lines.push('  (subpath "/etc")');
+        lines.push('  (subpath "/dev")');
+        lines.push('  (subpath "/tmp"))');
+        // Allow write to /tmp and /dev
+        lines.push('(allow file-write*');
+        lines.push('  (subpath "/tmp")');
+        lines.push('  (subpath "/private/tmp")');
+        lines.push('  (subpath "/dev"))');
+        // Allow xcrun cache writes (macOS git/Xcode tools write to /var/folders/.../T/xcrun_db-*)
+        lines.push('(allow file-write* (regex #"/private/var/folders/.*/T/xcrun_db"))');
+        // Workspace read access
+        lines.push(`(allow file-read* (subpath "${repoPath}"))`);
+        // Workspace write access (unless read_only)
+        if (!this.config.read_only) {
+            lines.push(`(allow file-write* (subpath "${repoPath}"))`);
+        }
+        // Network access (unless explicitly disabled)
+        if (this.config.network !== false) {
+            lines.push('(allow network*)');
+        }
+        // Allow sysctl, mach lookups, signal for basic process operation
+        lines.push('(allow sysctl-read)');
+        lines.push('(allow mach-lookup)');
+        lines.push('(allow signal)');
+        return lines.join('\n');
+    }
+}
+exports.SeatbeltSandbox = SeatbeltSandbox;
+
+
 /***/ }),
 
 /***/ 50504:
@@ -198456,7 +198812,9 @@ const cache_prewarmer_1 = __nccwpck_require__(50200);
 const rate_limiter_1 = __nccwpck_require__(53065);
 const trace_helpers_1 = __nccwpck_require__(75338);
 const scheduler_1 = __nccwpck_require__(28404);
+const crypto_1 = __nccwpck_require__(76982);
 const slack_output_adapter_1 = __nccwpck_require__(45330);
+const workspace_manager_1 = __nccwpck_require__(6134);
 class SlackSocketRunner {
     appToken;
     endpoint;
@@ -198587,6 +198945,8 @@ class SlackSocketRunner {
         }
         const url = await this.openConnection();
         await this.connect(url);
+        // Clean up stale workspace directories from previous runs
+        workspace_manager_1.WorkspaceManager.cleanupStale().catch(() => { });
     }
     async openConnection() {
         const resp = await fetch('https://slack.com/api/apps.connections.open', {
@@ -198882,6 +199242,22 @@ class SlackSocketRunner {
                 return this.cfg;
             }
         })();
+        // Derive stable workspace name from Slack thread identity so all messages
+        // in the same thread share the same workspace directory (git checkouts persist).
+        const wsChannel = String(ev.channel || '');
+        const wsThreadTs = String(ev.thread_ts || ev.ts || ev.event_ts || '');
+        if (wsChannel && wsThreadTs) {
+            const hash = (0, crypto_1.createHash)('sha256')
+                .update(`${wsChannel}:${wsThreadTs}`)
+                .digest('hex')
+                .slice(0, 8);
+            const workspaceName = `slack-${hash}`;
+            if (!cfgForRun.workspace) {
+                cfgForRun.workspace = {};
+            }
+            cfgForRun.workspace.name = workspaceName;
+            cfgForRun.workspace.cleanup_on_exit = false;
+        }
         // Seed first message for this thread to allow initial human-input to consume it exactly once
         try {
             const { getPromptStateManager } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(27716)));
@@ -222022,17 +222398,36 @@ class WorkspaceManager {
         // Check if original path is a git repository
         const isGitRepo = await this.isGitRepository(this.originalPath);
         if (isGitRepo) {
-            // Create worktree for main project
-            await this.createMainProjectWorktree(mainProjectPath);
+            // Check if main project worktree already exists (reused workspace, e.g. Slack thread)
+            const exists = await this.pathExists(mainProjectPath);
+            if (exists) {
+                logger_1.logger.info(`[Workspace] Reusing existing main project worktree: ${mainProjectPath}`);
+                const isValid = await this.isGitRepository(mainProjectPath);
+                if (!isValid) {
+                    logger_1.logger.warn(`[Workspace] Existing path is not a valid git dir, recreating`);
+                    await fsp.rm(mainProjectPath, { recursive: true, force: true });
+                    try {
+                        await command_executor_1.commandExecutor.execute(`git -C ${shellEscape(this.originalPath)} worktree prune`, { timeout: 10000 });
+                    }
+                    catch { }
+                    await this.createMainProjectWorktree(mainProjectPath);
+                }
+            }
+            else {
+                await this.createMainProjectWorktree(mainProjectPath);
+            }
         }
         else {
             // If not a git repo, create a symlink instead
             logger_1.logger.debug(`Original path is not a git repo, creating symlink`);
-            try {
-                await fsp.symlink(this.originalPath, mainProjectPath);
-            }
-            catch (error) {
-                throw new Error(`Failed to create symlink for main project: ${error}`);
+            const exists = await this.pathExists(mainProjectPath);
+            if (!exists) {
+                try {
+                    await fsp.symlink(this.originalPath, mainProjectPath);
+                }
+                catch (error) {
+                    throw new Error(`Failed to create symlink for main project: ${error}`);
+                }
             }
         }
         // Register cleanup handlers
@@ -222102,6 +222497,16 @@ class WorkspaceManager {
      * @param timeout Maximum time to wait for active operations (default: 60s)
      */
     async cleanup(timeout = 60000) {
+        // Respect cleanupOnExit flag — persisted workspaces (e.g. Slack threads) should not be cleaned up
+        if (!this.config.cleanupOnExit) {
+            logger_1.logger.debug(`[Workspace] Skipping cleanup (cleanupOnExit=false): ${this.workspacePath}`);
+            WorkspaceManager.instances.delete(this.sessionId);
+            this.initialized = false;
+            this.mainProjectInfo = null;
+            this.projects.clear();
+            this.usedNames.clear();
+            return;
+        }
         logger_1.logger.info(`Cleaning up workspace: ${this.workspacePath} (active operations: ${this.activeOperations})`);
         // If there are active operations, wait for them to complete
         if (this.activeOperations > 0) {
@@ -222157,6 +222562,70 @@ class WorkspaceManager {
             logger_1.logger.warn(`Failed to cleanup workspace: ${error}`);
         }
     }
+    /**
+     * Check if a path exists (file or directory).
+     */
+    async pathExists(p) {
+        try {
+            await fsp.access(p);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Clean up stale workspace directories older than maxAge.
+     * Call periodically (e.g. at socket-runner startup) to prevent disk bloat.
+     */
+    static async cleanupStale(basePath = process.env.VISOR_WORKSPACE_PATH || '/tmp/visor-workspaces', maxAgeMs = 24 * 60 * 60 * 1000) {
+        let cleaned = 0;
+        try {
+            const entries = await fsp.readdir(basePath, { withFileTypes: true });
+            const now = Date.now();
+            for (const entry of entries) {
+                if (!entry.isDirectory())
+                    continue;
+                const dirPath = path.join(basePath, entry.name);
+                try {
+                    const stat = await fsp.stat(dirPath);
+                    if (now - stat.mtimeMs > maxAgeMs) {
+                        // Prune any git worktrees before removing the directory
+                        try {
+                            const subdirs = await fsp.readdir(dirPath, { withFileTypes: true });
+                            for (const sub of subdirs) {
+                                if (!sub.isDirectory())
+                                    continue;
+                                const subPath = path.join(dirPath, sub.name);
+                                const gitFilePath = path.join(subPath, '.git');
+                                try {
+                                    const gitContent = await fsp.readFile(gitFilePath, 'utf-8');
+                                    const match = gitContent.match(/gitdir:\s*(.+)/);
+                                    if (match) {
+                                        const worktreeGitDir = match[1].trim();
+                                        const repoGitDir = worktreeGitDir.replace(/\/\.git\/worktrees\/.*$/, '');
+                                        await command_executor_1.commandExecutor.execute(`git -C ${shellEscape(repoGitDir)} worktree remove ${shellEscape(subPath)} --force`, { timeout: 10000 });
+                                    }
+                                }
+                                catch { }
+                            }
+                        }
+                        catch { }
+                        await fsp.rm(dirPath, { recursive: true, force: true });
+                        cleaned++;
+                    }
+                }
+                catch { }
+            }
+            if (cleaned > 0) {
+                logger_1.logger.info(`[Workspace] Cleaned up ${cleaned} stale workspace(s) from ${basePath}`);
+            }
+        }
+        catch (error) {
+            logger_1.logger.debug(`[Workspace] Stale cleanup error: ${error}`);
+        }
+        return cleaned;
+    }
     /**
      * Create worktree for the main project
      *
@@ -265589,7 +266058,7 @@ var require_package2 = __commonJS({
     module2.exports = {
       name: "@aws-sdk/client-bedrock-runtime",
       description: "AWS SDK for JavaScript Bedrock Runtime Client for Node.js, Browser and React Native",
-      version: "3.997.0",
+      version: "3.998.0",
       scripts: {
         build: "concurrently 'yarn:build:types' 'yarn:build:es' && yarn build:cjs",
         "build:cjs": "node ../../scripts/compilation/inline client-bedrock-runtime",
@@ -265609,49 +266078,49 @@ var require_package2 = __commonJS({
       dependencies: {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.973.13",
-        "@aws-sdk/credential-provider-node": "^3.972.12",
-        "@aws-sdk/eventstream-handler-node": "^3.972.7",
-        "@aws-sdk/middleware-eventstream": "^3.972.4",
-        "@aws-sdk/middleware-host-header": "^3.972.4",
-        "@aws-sdk/middleware-logger": "^3.972.4",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.4",
-        "@aws-sdk/middleware-user-agent": "^3.972.13",
-        "@aws-sdk/middleware-websocket": "^3.972.8",
-        "@aws-sdk/region-config-resolver": "^3.972.4",
-        "@aws-sdk/token-providers": "3.997.0",
-        "@aws-sdk/types": "^3.973.2",
-        "@aws-sdk/util-endpoints": "^3.996.1",
-        "@aws-sdk/util-user-agent-browser": "^3.972.4",
-        "@aws-sdk/util-user-agent-node": "^3.972.12",
-        "@smithy/config-resolver": "^4.4.7",
-        "@smithy/core": "^3.23.4",
-        "@smithy/eventstream-serde-browser": "^4.2.9",
-        "@smithy/eventstream-serde-config-resolver": "^4.3.9",
-        "@smithy/eventstream-serde-node": "^4.2.9",
-        "@smithy/fetch-http-handler": "^5.3.10",
-        "@smithy/hash-node": "^4.2.9",
-        "@smithy/invalid-dependency": "^4.2.9",
-        "@smithy/middleware-content-length": "^4.2.9",
-        "@smithy/middleware-endpoint": "^4.4.18",
-        "@smithy/middleware-retry": "^4.4.35",
-        "@smithy/middleware-serde": "^4.2.10",
-        "@smithy/middleware-stack": "^4.2.9",
-        "@smithy/node-config-provider": "^4.3.9",
-        "@smithy/node-http-handler": "^4.4.11",
-        "@smithy/protocol-http": "^5.3.9",
-        "@smithy/smithy-client": "^4.11.7",
-        "@smithy/types": "^4.12.1",
-        "@smithy/url-parser": "^4.2.9",
+        "@aws-sdk/core": "^3.973.14",
+        "@aws-sdk/credential-provider-node": "^3.972.13",
+        "@aws-sdk/eventstream-handler-node": "^3.972.8",
+        "@aws-sdk/middleware-eventstream": "^3.972.5",
+        "@aws-sdk/middleware-host-header": "^3.972.5",
+        "@aws-sdk/middleware-logger": "^3.972.5",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.5",
+        "@aws-sdk/middleware-user-agent": "^3.972.14",
+        "@aws-sdk/middleware-websocket": "^3.972.9",
+        "@aws-sdk/region-config-resolver": "^3.972.5",
+        "@aws-sdk/token-providers": "3.998.0",
+        "@aws-sdk/types": "^3.973.3",
+        "@aws-sdk/util-endpoints": "^3.996.2",
+        "@aws-sdk/util-user-agent-browser": "^3.972.5",
+        "@aws-sdk/util-user-agent-node": "^3.972.13",
+        "@smithy/config-resolver": "^4.4.9",
+        "@smithy/core": "^3.23.6",
+        "@smithy/eventstream-serde-browser": "^4.2.10",
+        "@smithy/eventstream-serde-config-resolver": "^4.3.10",
+        "@smithy/eventstream-serde-node": "^4.2.10",
+        "@smithy/fetch-http-handler": "^5.3.11",
+        "@smithy/hash-node": "^4.2.10",
+        "@smithy/invalid-dependency": "^4.2.10",
+        "@smithy/middleware-content-length": "^4.2.10",
+        "@smithy/middleware-endpoint": "^4.4.20",
+        "@smithy/middleware-retry": "^4.4.37",
+        "@smithy/middleware-serde": "^4.2.11",
+        "@smithy/middleware-stack": "^4.2.10",
+        "@smithy/node-config-provider": "^4.3.10",
+        "@smithy/node-http-handler": "^4.4.12",
+        "@smithy/protocol-http": "^5.3.10",
+        "@smithy/smithy-client": "^4.12.0",
+        "@smithy/types": "^4.13.0",
+        "@smithy/url-parser": "^4.2.10",
         "@smithy/util-base64": "^4.3.1",
         "@smithy/util-body-length-browser": "^4.2.1",
         "@smithy/util-body-length-node": "^4.2.2",
-        "@smithy/util-defaults-mode-browser": "^4.3.34",
-        "@smithy/util-defaults-mode-node": "^4.2.37",
-        "@smithy/util-endpoints": "^3.2.9",
-        "@smithy/util-middleware": "^4.2.9",
-        "@smithy/util-retry": "^4.2.9",
-        "@smithy/util-stream": "^4.5.14",
+        "@smithy/util-defaults-mode-browser": "^4.3.36",
+        "@smithy/util-defaults-mode-node": "^4.2.39",
+        "@smithy/util-endpoints": "^3.3.1",
+        "@smithy/util-middleware": "^4.2.10",
+        "@smithy/util-retry": "^4.2.10",
+        "@smithy/util-stream": "^4.5.15",
         "@smithy/util-utf8": "^4.2.1",
         tslib: "^2.6.2"
       },
@@ -266370,7 +266839,7 @@ var init_package = __esm({
   "node_modules/@aws-sdk/nested-clients/package.json"() {
     package_default = {
       name: "@aws-sdk/nested-clients",
-      version: "3.996.1",
+      version: "3.996.2",
       description: "Nested clients for AWS SDK packages.",
       main: "./dist-cjs/index.js",
       module: "./dist-es/index.js",
@@ -266399,40 +266868,40 @@ var init_package = __esm({
       dependencies: {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.973.13",
-        "@aws-sdk/middleware-host-header": "^3.972.4",
-        "@aws-sdk/middleware-logger": "^3.972.4",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.4",
-        "@aws-sdk/middleware-user-agent": "^3.972.13",
-        "@aws-sdk/region-config-resolver": "^3.972.4",
-        "@aws-sdk/types": "^3.973.2",
-        "@aws-sdk/util-endpoints": "^3.996.1",
-        "@aws-sdk/util-user-agent-browser": "^3.972.4",
-        "@aws-sdk/util-user-agent-node": "^3.972.12",
-        "@smithy/config-resolver": "^4.4.7",
-        "@smithy/core": "^3.23.4",
-        "@smithy/fetch-http-handler": "^5.3.10",
-        "@smithy/hash-node": "^4.2.9",
-        "@smithy/invalid-dependency": "^4.2.9",
-        "@smithy/middleware-content-length": "^4.2.9",
-        "@smithy/middleware-endpoint": "^4.4.18",
-        "@smithy/middleware-retry": "^4.4.35",
-        "@smithy/middleware-serde": "^4.2.10",
-        "@smithy/middleware-stack": "^4.2.9",
-        "@smithy/node-config-provider": "^4.3.9",
-        "@smithy/node-http-handler": "^4.4.11",
-        "@smithy/protocol-http": "^5.3.9",
-        "@smithy/smithy-client": "^4.11.7",
-        "@smithy/types": "^4.12.1",
-        "@smithy/url-parser": "^4.2.9",
+        "@aws-sdk/core": "^3.973.14",
+        "@aws-sdk/middleware-host-header": "^3.972.5",
+        "@aws-sdk/middleware-logger": "^3.972.5",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.5",
+        "@aws-sdk/middleware-user-agent": "^3.972.14",
+        "@aws-sdk/region-config-resolver": "^3.972.5",
+        "@aws-sdk/types": "^3.973.3",
+        "@aws-sdk/util-endpoints": "^3.996.2",
+        "@aws-sdk/util-user-agent-browser": "^3.972.5",
+        "@aws-sdk/util-user-agent-node": "^3.972.13",
+        "@smithy/config-resolver": "^4.4.9",
+        "@smithy/core": "^3.23.6",
+        "@smithy/fetch-http-handler": "^5.3.11",
+        "@smithy/hash-node": "^4.2.10",
+        "@smithy/invalid-dependency": "^4.2.10",
+        "@smithy/middleware-content-length": "^4.2.10",
+        "@smithy/middleware-endpoint": "^4.4.20",
+        "@smithy/middleware-retry": "^4.4.37",
+        "@smithy/middleware-serde": "^4.2.11",
+        "@smithy/middleware-stack": "^4.2.10",
+        "@smithy/node-config-provider": "^4.3.10",
+        "@smithy/node-http-handler": "^4.4.12",
+        "@smithy/protocol-http": "^5.3.10",
+        "@smithy/smithy-client": "^4.12.0",
+        "@smithy/types": "^4.13.0",
+        "@smithy/url-parser": "^4.2.10",
         "@smithy/util-base64": "^4.3.1",
         "@smithy/util-body-length-browser": "^4.2.1",
         "@smithy/util-body-length-node": "^4.2.2",
-        "@smithy/util-defaults-mode-browser": "^4.3.34",
-        "@smithy/util-defaults-mode-node": "^4.2.37",
-        "@smithy/util-endpoints": "^3.2.9",
-        "@smithy/util-middleware": "^4.2.9",
-        "@smithy/util-retry": "^4.2.9",
+        "@smithy/util-defaults-mode-browser": "^4.3.36",
+        "@smithy/util-defaults-mode-node": "^4.2.39",
+        "@smithy/util-endpoints": "^3.3.1",
+        "@smithy/util-middleware": "^4.2.10",
+        "@smithy/util-retry": "^4.2.10",
         "@smithy/util-utf8": "^4.2.1",
         tslib: "^2.6.2"
       },
@@ -286423,7 +286892,11 @@ var init_esm3 = __esm({
       #matchGlobstar(file, pattern, partial, fileIndex, patternIndex) {
         const firstgs = pattern.indexOf(GLOBSTAR, patternIndex);
         const lastgs = pattern.lastIndexOf(GLOBSTAR);
-        const [head2, body, tail] = [
+        const [head2, body, tail] = partial ? [
+          pattern.slice(patternIndex, firstgs),
+          pattern.slice(firstgs + 1),
+          []
+        ] : [
           pattern.slice(patternIndex, firstgs),
           pattern.slice(firstgs + 1, lastgs),
           pattern.slice(lastgs + 1)
@@ -286460,7 +286933,7 @@ var init_esm3 = __esm({
               return false;
             }
           }
-          return sawSome;
+          return partial || sawSome;
         }
         const bodySegments = [[[], 0]];
         let currentBody = bodySegments[0];
@@ -286509,7 +286982,7 @@ var init_esm3 = __esm({
           }
           fileIndex++;
         }
-        return null;
+        return partial || null;
       }
       #matchOne(file, pattern, partial, fileIndex, patternIndex) {
         let fi;
@@ -328993,6 +329466,15 @@ function normalizeJsonQuotes(str) {
   }
   return result;
 }
+function isCodeBlockEmbeddedInDocument(text, match2) {
+  const beforeBlock = text.substring(0, match2.index).trim();
+  const afterBlock = text.substring(match2.index + match2[0].length).trim();
+  const hasMarkdownHeadings = /^#{1,6}\s/m.test(beforeBlock) || /^#{1,6}\s/m.test(afterBlock);
+  if (hasMarkdownHeadings) {
+    return true;
+  }
+  return false;
+}
 function cleanSchemaResponse(response) {
   if (!response || typeof response !== "string") {
     return response;
@@ -329012,11 +329494,11 @@ function cleanSchemaResponse(response) {
     return cleanSchemaResponse(innerContent);
   }
   const jsonBlockMatch = trimmed.match(/```json\s*\n([\s\S]*?)\n```/);
-  if (jsonBlockMatch) {
+  if (jsonBlockMatch && !isCodeBlockEmbeddedInDocument(trimmed, jsonBlockMatch)) {
     return normalizeJsonQuotes(jsonBlockMatch[1].trim());
   }
   const anyBlockMatch = trimmed.match(/```\s*\n([{\[][\s\S]*?[}\]])\s*```/);
-  if (anyBlockMatch) {
+  if (anyBlockMatch && !isCodeBlockEmbeddedInDocument(trimmed, anyBlockMatch)) {
     return normalizeJsonQuotes(anyBlockMatch[1].trim());
   }
   const codeBlockPatterns = [
@@ -329025,7 +329507,7 @@ function cleanSchemaResponse(response) {
   ];
   for (const pattern of codeBlockPatterns) {
     const match2 = trimmed.match(pattern);
-    if (match2) {
+    if (match2 && !isCodeBlockEmbeddedInDocument(trimmed, match2)) {
       return normalizeJsonQuotes(match2[1].trim());
     }
   }
@@ -329036,7 +329518,7 @@ function cleanSchemaResponse(response) {
   }
   const codeBlockStartPattern = /```(?:json)?\s*\n?\s*([{\[])/;
   const codeBlockMatch = trimmed.match(codeBlockStartPattern);
-  if (codeBlockMatch) {
+  if (codeBlockMatch && !isCodeBlockEmbeddedInDocument(trimmed, codeBlockMatch)) {
     const startIndex = codeBlockMatch.index + codeBlockMatch[0].length - 1;
     const openChar = codeBlockMatch[1];
     const closeChar = openChar === "{" ? "}" : "]";
@@ -350734,6 +351216,10 @@ function parseSimpleCommand(command) {
     // Logical OR
     /(?<!\\);/,
     // Command separator (but not escaped \;)
+    /\n/,
+    // Newline command separator (multi-line commands)
+    /\r/,
+    // Carriage return (CRLF line endings)
     /&$/,
     // Background execution
     /\$\(/,
@@ -350840,6 +351326,8 @@ function isComplexPattern(pattern) {
     // Logical OR
     /;/,
     // Command separator
+    /\n/,
+    // Newline command separator
     /&$/,
     // Background execution
     /\$\(/,
@@ -351212,6 +351700,26 @@ var init_bashPermissions = __esm({
               i5++;
               continue;
             }
+            if (char === "\n" || char === "\r" && nextChar === "\n") {
+              if (current2.trim()) {
+                components.push(current2.trim());
+              }
+              current2 = "";
+              if (char === "\r") {
+                i5 += 2;
+              } else {
+                i5++;
+              }
+              continue;
+            }
+            if (char === "\r") {
+              if (current2.trim()) {
+                components.push(current2.trim());
+              }
+              current2 = "";
+              i5++;
+              continue;
+            }
           }
           current2 += char;
           i5++;
@@ -396052,7 +396560,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"100":"Continue","101":"Switching Pro
 /***/ ((module) => {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@probelabs/visor","version":"0.1.42","main":"dist/index.js","bin":{"visor":"./dist/index.js"},"exports":{".":{"require":"./dist/index.js","import":"./dist/index.js"},"./sdk":{"types":"./dist/sdk/sdk.d.ts","import":"./dist/sdk/sdk.mjs","require":"./dist/sdk/sdk.js"},"./cli":{"require":"./dist/index.js"}},"files":["dist/","defaults/","action.yml","README.md","LICENSE"],"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"scripts":{"build:cli":"ncc build src/index.ts -o dist && cp -r defaults dist/ && cp -r output dist/ && cp -r docs dist/ && cp -r examples dist/ && cp -r src/debug-visualizer/ui dist/debug-visualizer/ && node scripts/inject-version.js && echo \'#!/usr/bin/env node\' | cat - dist/index.js > temp && mv temp dist/index.js && chmod +x dist/index.js","build:sdk":"tsup src/sdk.ts --dts --sourcemap --format esm,cjs --out-dir dist/sdk","build":"./scripts/build-oss.sh","build:ee":"npm run build:cli && npm run build:sdk","test":"jest && npm run test:yaml","test:unit":"jest","prepublishOnly":"npm run build","test:watch":"jest --watch","test:coverage":"jest --coverage","test:ee":"jest --testPathPatterns=\'tests/ee\' --testPathIgnorePatterns=\'/node_modules/\' --no-coverage","test:manual:bash":"RUN_MANUAL_TESTS=true jest tests/manual/bash-config-manual.test.ts","lint":"eslint src tests --ext .ts","lint:fix":"eslint src tests --ext .ts --fix","format":"prettier --write src tests","format:check":"prettier --check src tests","clean":"","clean:traces":"node scripts/clean-traces.js","prebuild":"npm run clean && node scripts/generate-config-schema.js","pretest":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","pretest:unit":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","test:with-build":"npm run build:cli && jest","test:yaml":"node dist/index.js test --progress compact","test:yaml:parallel":"node dist/index.js test --progress compact --max-parallel 4","prepare":"husky","pre-commit":"lint-staged","deploy:site":"cd site && npx wrangler pages deploy . --project-name=visor-site --commit-dirty=true","deploy:worker":"npx wrangler deploy","deploy":"npm run deploy:site && npm run deploy:worker","publish:ee":"./scripts/publish-ee.sh","release":"./scripts/release.sh","release:patch":"./scripts/release.sh patch","release:minor":"./scripts/release.sh minor","release:major":"./scripts/release.sh major","release:prerelease":"./scripts/release.sh prerelease","docs:validate":"node scripts/validate-readme-links.js","workshop:setup":"npm install -D reveal-md@6.1.2","workshop:serve":"cd workshop && reveal-md slides.md -w","workshop:export":"reveal-md workshop/slides.md --static workshop/build","workshop:pdf":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter","workshop:pdf:ci":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter --puppeteer-launch-args=\\"--no-sandbox --disable-dev-shm-usage\\"","workshop:pdf:a4":"reveal-md workshop/slides.md --print workshop/Visor-Workshop-A4.pdf --print-size A4","workshop:build":"npm run workshop:export && npm run workshop:pdf","simulate:issue":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issues --action opened --debug","simulate:comment":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issue_comment --action created --debug"},"keywords":["code-review","ai","github-action","cli","pr-review","visor"],"author":"Probe Labs","license":"MIT","description":"AI workflow engine for code review, assistants, and automation — orchestrate checks, MCP tools, and AI providers with YAML-driven pipelines","repository":{"type":"git","url":"git+https://github.com/probelabs/visor.git"},"bugs":{"url":"https://github.com/probelabs/visor/issues"},"homepage":"https://github.com/probelabs/visor#readme","dependencies":{"@actions/core":"^1.11.1","@apidevtools/swagger-parser":"^12.1.0","@modelcontextprotocol/sdk":"^1.25.3","@nyariv/sandboxjs":"github:probelabs/SandboxJS#f1c13b8eee98734a8ea024061eada4aa9a9ff2e9","@octokit/action":"^8.0.2","@octokit/auth-app":"^8.1.0","@octokit/core":"^7.0.3","@octokit/rest":"^22.0.0","@opentelemetry/api":"^1.9.0","@opentelemetry/core":"^1.30.1","@opentelemetry/exporter-trace-otlp-grpc":"^0.203.0","@opentelemetry/exporter-trace-otlp-http":"^0.203.0","@opentelemetry/instrumentation":"^0.203.0","@opentelemetry/resources":"^1.30.1","@opentelemetry/sdk-metrics":"^1.30.1","@opentelemetry/sdk-node":"^0.203.0","@opentelemetry/sdk-trace-base":"^1.30.1","@opentelemetry/semantic-conventions":"^1.30.1","@probelabs/probe":"^0.6.0-rc259","@types/commander":"^2.12.0","@types/uuid":"^10.0.0","acorn":"^8.16.0","acorn-walk":"^8.3.5","ajv":"^8.17.1","ajv-formats":"^3.0.1","better-sqlite3":"^11.0.0","blessed":"^0.1.81","cli-table3":"^0.6.5","commander":"^14.0.0","deepmerge":"^4.3.1","dotenv":"^17.2.3","ignore":"^7.0.5","js-yaml":"^4.1.0","jsonpath-plus":"^10.4.0","liquidjs":"^10.21.1","minimatch":"^10.2.2","node-cron":"^3.0.3","open":"^9.1.0","simple-git":"^3.28.0","uuid":"^11.1.0","ws":"^8.18.3"},"optionalDependencies":{"@anthropic/claude-code-sdk":"npm:null@*","@open-policy-agent/opa-wasm":"^1.10.0","knex":"^3.1.0","mysql2":"^3.11.0","pg":"^8.13.0","tedious":"^19.0.0"},"devDependencies":{"@eslint/js":"^9.34.0","@kie/act-js":"^2.6.2","@kie/mock-github":"^2.0.1","@swc/core":"^1.13.2","@swc/jest":"^0.2.37","@types/better-sqlite3":"^7.6.0","@types/blessed":"^0.1.27","@types/jest":"^30.0.0","@types/js-yaml":"^4.0.9","@types/node":"^24.3.0","@types/node-cron":"^3.0.11","@types/ws":"^8.18.1","@typescript-eslint/eslint-plugin":"^8.42.0","@typescript-eslint/parser":"^8.42.0","@vercel/ncc":"^0.38.4","eslint":"^9.34.0","eslint-config-prettier":"^10.1.8","eslint-plugin-prettier":"^5.5.4","husky":"^9.1.7","jest":"^30.1.3","lint-staged":"^16.1.6","prettier":"^3.6.2","reveal-md":"^6.1.2","ts-json-schema-generator":"^1.5.1","ts-node":"^10.9.2","tsup":"^8.5.0","typescript":"^5.9.2","wrangler":"^3.0.0"},"peerDependenciesMeta":{"@anthropic/claude-code-sdk":{"optional":true}},"directories":{"test":"tests"},"lint-staged":{"src/**/*.{ts,js}":["eslint --fix","prettier --write"],"tests/**/*.{ts,js}":["eslint --fix","prettier --write"],"*.{json,md,yml,yaml}":["prettier --write"]}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@probelabs/visor","version":"0.1.42","main":"dist/index.js","bin":{"visor":"./dist/index.js"},"exports":{".":{"require":"./dist/index.js","import":"./dist/index.js"},"./sdk":{"types":"./dist/sdk/sdk.d.ts","import":"./dist/sdk/sdk.mjs","require":"./dist/sdk/sdk.js"},"./cli":{"require":"./dist/index.js"}},"files":["dist/","defaults/","action.yml","README.md","LICENSE"],"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"scripts":{"build:cli":"ncc build src/index.ts -o dist && cp -r defaults dist/ && cp -r output dist/ && cp -r docs dist/ && cp -r examples dist/ && cp -r src/debug-visualizer/ui dist/debug-visualizer/ && node scripts/inject-version.js && echo \'#!/usr/bin/env node\' | cat - dist/index.js > temp && mv temp dist/index.js && chmod +x dist/index.js","build:sdk":"tsup src/sdk.ts --dts --sourcemap --format esm,cjs --out-dir dist/sdk","build":"./scripts/build-oss.sh","build:ee":"npm run build:cli && npm run build:sdk","test":"jest && npm run test:yaml","test:unit":"jest","prepublishOnly":"npm run build","test:watch":"jest --watch","test:coverage":"jest --coverage","test:ee":"jest --testPathPatterns=\'tests/ee\' --testPathIgnorePatterns=\'/node_modules/\' --no-coverage","test:manual:bash":"RUN_MANUAL_TESTS=true jest tests/manual/bash-config-manual.test.ts","lint":"eslint src tests --ext .ts","lint:fix":"eslint src tests --ext .ts --fix","format":"prettier --write src tests","format:check":"prettier --check src tests","clean":"","clean:traces":"node scripts/clean-traces.js","prebuild":"npm run clean && node scripts/generate-config-schema.js","pretest":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","pretest:unit":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","test:with-build":"npm run build:cli && jest","test:yaml":"node dist/index.js test --progress compact","test:yaml:parallel":"node dist/index.js test --progress compact --max-parallel 4","prepare":"husky","pre-commit":"lint-staged","deploy:site":"cd site && npx wrangler pages deploy . --project-name=visor-site --commit-dirty=true","deploy:worker":"npx wrangler deploy","deploy":"npm run deploy:site && npm run deploy:worker","publish:ee":"./scripts/publish-ee.sh","release":"./scripts/release.sh","release:patch":"./scripts/release.sh patch","release:minor":"./scripts/release.sh minor","release:major":"./scripts/release.sh major","release:prerelease":"./scripts/release.sh prerelease","docs:validate":"node scripts/validate-readme-links.js","workshop:setup":"npm install -D reveal-md@6.1.2","workshop:serve":"cd workshop && reveal-md slides.md -w","workshop:export":"reveal-md workshop/slides.md --static workshop/build","workshop:pdf":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter","workshop:pdf:ci":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter --puppeteer-launch-args=\\"--no-sandbox --disable-dev-shm-usage\\"","workshop:pdf:a4":"reveal-md workshop/slides.md --print workshop/Visor-Workshop-A4.pdf --print-size A4","workshop:build":"npm run workshop:export && npm run workshop:pdf","simulate:issue":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issues --action opened --debug","simulate:comment":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issue_comment --action created --debug"},"keywords":["code-review","ai","github-action","cli","pr-review","visor"],"author":"Probe Labs","license":"MIT","description":"AI workflow engine for code review, assistants, and automation — orchestrate checks, MCP tools, and AI providers with YAML-driven pipelines","repository":{"type":"git","url":"git+https://github.com/probelabs/visor.git"},"bugs":{"url":"https://github.com/probelabs/visor/issues"},"homepage":"https://github.com/probelabs/visor#readme","dependencies":{"@actions/core":"^1.11.1","@apidevtools/swagger-parser":"^12.1.0","@modelcontextprotocol/sdk":"^1.25.3","@nyariv/sandboxjs":"github:probelabs/SandboxJS#f1c13b8eee98734a8ea024061eada4aa9a9ff2e9","@octokit/action":"^8.0.2","@octokit/auth-app":"^8.1.0","@octokit/core":"^7.0.3","@octokit/rest":"^22.0.0","@opentelemetry/api":"^1.9.0","@opentelemetry/core":"^1.30.1","@opentelemetry/exporter-trace-otlp-grpc":"^0.203.0","@opentelemetry/exporter-trace-otlp-http":"^0.203.0","@opentelemetry/instrumentation":"^0.203.0","@opentelemetry/resources":"^1.30.1","@opentelemetry/sdk-metrics":"^1.30.1","@opentelemetry/sdk-node":"^0.203.0","@opentelemetry/sdk-trace-base":"^1.30.1","@opentelemetry/semantic-conventions":"^1.30.1","@probelabs/probe":"^0.6.0-rc260","@types/commander":"^2.12.0","@types/uuid":"^10.0.0","acorn":"^8.16.0","acorn-walk":"^8.3.5","ajv":"^8.17.1","ajv-formats":"^3.0.1","better-sqlite3":"^11.0.0","blessed":"^0.1.81","cli-table3":"^0.6.5","commander":"^14.0.0","deepmerge":"^4.3.1","dotenv":"^17.2.3","ignore":"^7.0.5","js-yaml":"^4.1.0","jsonpath-plus":"^10.4.0","liquidjs":"^10.21.1","minimatch":"^10.2.2","node-cron":"^3.0.3","open":"^9.1.0","simple-git":"^3.28.0","uuid":"^11.1.0","ws":"^8.18.3"},"optionalDependencies":{"@anthropic/claude-code-sdk":"npm:null@*","@open-policy-agent/opa-wasm":"^1.10.0","knex":"^3.1.0","mysql2":"^3.11.0","pg":"^8.13.0","tedious":"^19.0.0"},"devDependencies":{"@eslint/js":"^9.34.0","@kie/act-js":"^2.6.2","@kie/mock-github":"^2.0.1","@swc/core":"^1.13.2","@swc/jest":"^0.2.37","@types/better-sqlite3":"^7.6.0","@types/blessed":"^0.1.27","@types/jest":"^30.0.0","@types/js-yaml":"^4.0.9","@types/node":"^24.3.0","@types/node-cron":"^3.0.11","@types/ws":"^8.18.1","@typescript-eslint/eslint-plugin":"^8.42.0","@typescript-eslint/parser":"^8.42.0","@vercel/ncc":"^0.38.4","eslint":"^9.34.0","eslint-config-prettier":"^10.1.8","eslint-plugin-prettier":"^5.5.4","husky":"^9.1.7","jest":"^30.1.3","lint-staged":"^16.1.6","prettier":"^3.6.2","reveal-md":"^6.1.2","ts-json-schema-generator":"^1.5.1","ts-node":"^10.9.2","tsup":"^8.5.0","typescript":"^5.9.2","wrangler":"^3.0.0"},"peerDependenciesMeta":{"@anthropic/claude-code-sdk":{"optional":true}},"directories":{"test":"tests"},"lint-staged":{"src/**/*.{ts,js}":["eslint --fix","prettier --write"],"tests/**/*.{ts,js}":["eslint --fix","prettier --write"],"*.{json,md,yml,yaml}":["prettier --write"]}}');
 
 /***/ })