@provos/ironcurtain 0.11.0 → 0.13.0

package/dist/observe/observe-command.js

@@ -9,14 +9,10 @@
  * Otherwise (pipe, --json, --no-tui), it falls back to the plain
  * line-oriented renderer.
  */
-import { parseArgs } from 'node:util';
-import { readFileSync } from 'node:fs';
 import chalk from 'chalk';
-import { WebSocket } from 'ws';
-import { checkHelp } from '../cli-help.js';
-import { getWebUiStatePath } from '../config/paths.js';
+import { checkHelp, parseArgsStrict } from '../cli-help.js';
+import { createDaemonClient, discoverDaemon, } from '../daemon-client/daemon-client.js';
 import { renderEventBatch, renderConnected, renderSessionEnded } from './observe-renderer.js';
-import { wsDataToString } from '../web-ui/ws-utils.js';
 import { createObserveTui } from './observe-tui.js';
 // ---------------------------------------------------------------------------
 // Command spec (for --help)
@@ -44,25 +40,6 @@ const observeSpec = {
         'ironcurtain observe --all --json      # NDJSON output for piping',
     ],
 };
-/** Reads daemon connection info from the well-known state file. */
-function loadWebUiState() {
-    try {
-        const raw = readFileSync(getWebUiStatePath(), 'utf-8');
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-// ---------------------------------------------------------------------------
-// JSON-RPC helpers
-// ---------------------------------------------------------------------------
-let rpcIdCounter = 0;
-function sendRpc(ws, method, params = {}) {
-    const id = `observe-${++rpcIdCounter}`;
-    ws.send(JSON.stringify({ id, method, params }));
-    return id;
-}
 // ---------------------------------------------------------------------------
 // Plain renderer adapter
 // ---------------------------------------------------------------------------
@@ -118,7 +95,7 @@ function handlePushEvent(event, payload, sink, targetLabel, cleanup) {
 // Main command
 // ---------------------------------------------------------------------------
 export async function runObserveCommand(argv) {
-    const { values, positionals } = parseArgs({
+    const { values, positionals } = parseArgsStrict({
         args: argv,
         options: {
             all: { type: 'boolean' },
@@ -129,8 +106,7 @@ export async function runObserveCommand(argv) {
             help: { type: 'boolean', short: 'h' },
         },
         allowPositionals: true,
-        strict: false,
-    });
+    }, observeSpec.name);
     if (checkHelp(values, observeSpec))
         return;
     const allMode = values.all;
@@ -171,47 +147,70 @@ export async function runObserveCommand(argv) {
     else {
         sink = createPlainSink(renderOptions);
     }
-    // Load daemon connection info
-    const state = loadWebUiState();
-    if (!state) {
+    // Discover daemon connection info; "no daemon" surfaces identically to before.
+    const endpoint = discoverDaemon();
+    if (!endpoint) {
+        tui?.destroy();
+        printConnectionError();
+        process.exit(1);
+    }
+    const client = createDaemonClient({ endpoint });
+    try {
+        await client.connect();
+    }
+    catch {
+        // A connect failure is presentationally identical to "no daemon".
         tui?.destroy();
-        process.stderr.write(chalk.red('Error: cannot connect to daemon. Is the daemon running with --web-ui?\n') +
-            chalk.dim('Start with: ironcurtain daemon --web-ui\n'));
+        printConnectionError();
         process.exit(1);
     }
-    // Connect to the daemon WebSocket
-    const wsUrl = `ws://${state.host}:${state.port}/ws?token=${state.token}`;
-    const ws = new WebSocket(wsUrl);
-    await new Promise((resolve, reject) => {
-        let subscribeId = null;
-        let unsubscribeId = null;
+    await runObserveSession(client, { label, useTui, tui, sink });
+}
+/**
+ * Drives a connected {@link DaemonClient}: subscribes to the token stream,
+ * routes push events to the sink, and tears down on session end, involuntary
+ * disconnect, or Ctrl+C. Resolves exactly once.
+ */
+async function runObserveSession(client, ctx) {
+    const { label, useTui, tui, sink } = ctx;
+    await new Promise((resolve) => {
         let closing = false;
+        let unsubscribeEvents = null;
+        let unsubscribeClose = null;
+        let sigHandler = null;
+        const removeSignalHandlers = () => {
+            if (sigHandler) {
+                process.off('SIGINT', sigHandler);
+                process.off('SIGTERM', sigHandler);
+                sigHandler = null;
+            }
+        };
+        // Deliberate teardown: destroy TUI, unsubscribe, then close the client.
+        // `client.close()` is what suppresses any onClose for this self-initiated
+        // disconnect, so connectionLost never fires for our own cleanup.
         const cleanup = () => {
             if (closing)
                 return;
             closing = true;
-            // Destroy TUI before unsubscribing (restores terminal state)
+            // Destroy TUI before unsubscribing (restores terminal state).
             tui?.destroy();
-            // Unsubscribe before closing
-            if (ws.readyState === WebSocket.OPEN) {
-                if (label !== undefined) {
-                    unsubscribeId = sendRpc(ws, 'sessions.unsubscribeTokenStream', { label });
-                }
-                else {
-                    unsubscribeId = sendRpc(ws, 'sessions.unsubscribeAllTokenStreams');
-                }
-                // Give a moment for the unsubscribe to send, then close
-                setTimeout(() => {
-                    ws.close();
-                    resolve();
-                }, 100);
-            }
-            else {
-                resolve();
-            }
+            unsubscribeEvents?.();
+            unsubscribeClose?.();
+            removeSignalHandlers();
+            const unsubscribe = label !== undefined
+                ? client.call('sessions.unsubscribeTokenStream', { label })
+                : client.call('sessions.unsubscribeAllTokenStreams');
+            void unsubscribe
+                .catch(() => {
+                /* best-effort: we are tearing down regardless */
+            })
+                .then(() => client.close())
+                .catch(() => {
+                /* close() is idempotent and never throws meaningfully here */
+            })
+                .finally(resolve);
         };
-        // Handle Ctrl+C -- only register for plain mode; TUI handles its own signals
-        let sigHandler = null;
+        // Handle Ctrl+C -- only register for plain mode; TUI handles its own signals.
         if (!useTui) {
             sigHandler = () => {
                 process.stderr.write(chalk.dim('\n'));
@@ -220,79 +219,67 @@ export async function runObserveCommand(argv) {
             process.on('SIGINT', sigHandler);
             process.on('SIGTERM', sigHandler);
         }
-        ws.on('open', () => {
-            // Subscribe
-            if (label !== undefined) {
-                subscribeId = sendRpc(ws, 'sessions.subscribeTokenStream', { label });
-            }
-            else {
-                subscribeId = sendRpc(ws, 'sessions.subscribeAllTokenStreams');
-            }
+        unsubscribeEvents = client.onEvent((e) => {
+            handlePushEvent(e.event, e.payload, sink, label, cleanup);
         });
-        ws.on('message', (data) => {
-            const text = wsDataToString(data);
-            let frame;
-            try {
-                frame = JSON.parse(text);
-            }
-            catch {
-                return;
-            }
-            // Response to a request
-            if ('id' in frame && typeof frame.id === 'string') {
-                if (frame.id === subscribeId) {
-                    if (frame.ok) {
-                        // In TUI mode the text panel shows state; in plain mode write to stderr
-                        if (!useTui) {
-                            process.stderr.write(renderConnected(label));
-                        }
-                    }
-                    else {
-                        const err = frame.error;
-                        if (!useTui) {
-                            process.stderr.write(chalk.red(`Error: ${err?.message ?? 'subscription failed'}\n`));
-                        }
-                        cleanup();
-                    }
-                    return;
-                }
-                if (frame.id === unsubscribeId) {
-                    // Unsubscribe response -- close handled by timeout
-                    return;
-                }
+        unsubscribeClose = client.onClose((info) => {
+            // An *involuntary* disconnect (our own cleanup uses client.close(), which
+            // never fires onClose). Mirror the old ws 'error'/'close' behavior.
+            if (closing)
                 return;
-            }
-            // Push event
-            if ('event' in frame && typeof frame.event === 'string') {
-                handlePushEvent(frame.event, frame.payload, sink, label, cleanup);
-            }
+            closing = true;
+            removeSignalHandlers();
+            sink.connectionLost(info.reason);
+            // In TUI mode the TUI's own 3-second exit timer manages shutdown; the
+            // promise resolves so runObserveCommand returns, but the TUI's frame loop
+            // and stdin keep the event loop alive until its destroy() fires.
+            resolve();
         });
-        ws.on('error', (err) => {
-            // Notify the sink of the connection loss
-            sink.connectionLost(err.message);
-            if (tui) {
-                // TUI manages its own 3-second exit timer; do not destroy immediately.
-                // The promise resolves so runObserveCommand returns, but the TUI's
-                // frame loop and stdin keep the event loop alive until destroy() fires.
-                resolve();
+        void subscribe(client, label, useTui)
+            .then((ok) => {
+            if (closing)
+                return;
+            if (ok) {
+                // In TUI mode the text panel shows state; in plain mode write to stderr.
+                if (!useTui)
+                    process.stderr.write(renderConnected(label));
             }
             else {
-                reject(err);
-            }
-        });
-        ws.on('close', (code) => {
-            // Remove signal handlers if we registered them (plain mode only)
-            if (sigHandler) {
-                process.off('SIGINT', sigHandler);
-                process.off('SIGTERM', sigHandler);
-            }
-            // If not a clean close triggered by our cleanup, notify the sink
-            if (!closing) {
-                sink.connectionLost(`WebSocket closed (code ${code})`);
-                // In TUI mode, the 3-second exit timer handles cleanup
+                cleanup();
             }
-            resolve();
+        })
+            .catch(() => {
+            // `subscribe()` awaits `client.call()`, which REJECTS on a transport
+            // failure (e.g. the socket drops in the subscribe window). Without this
+            // handler that becomes an unhandled rejection. The onClose path already
+            // tears down on involuntary disconnect, so here we only need to clean up
+            // if we are not already closing (mirrors awaitDecisionPoint's guard).
+            if (closing)
+                return;
+            cleanup();
         });
     });
 }
+/**
+ * Subscribes to the token stream for `label` (or all sessions). Returns true on
+ * success; on an RPC error, writes the plain-mode error and returns false.
+ */
+async function subscribe(client, label, useTui) {
+    const result = label !== undefined
+        ? await client.call('sessions.subscribeTokenStream', { label })
+        : await client.call('sessions.subscribeAllTokenStreams');
+    if (result.ok)
+        return true;
+    // Match the old plain-mode behavior: TUI mode swallows the message (the panel
+    // surfaces state); plain mode prints it. Cleanup is the caller's job.
+    if (!useTui) {
+        process.stderr.write(chalk.red(`Error: ${result.message || 'subscription failed'}\n`));
+    }
+    return false;
+}
+/** Prints the shared "cannot connect to daemon" guidance to stderr. */
+function printConnectionError() {
+    process.stderr.write(chalk.red('Error: cannot connect to daemon. Is the daemon running with --web-ui?\n') +
+        chalk.dim('Start with: ironcurtain daemon --web-ui\n'));
+}
 //# sourceMappingURL=observe-command.js.map

package/dist/observe/observe-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"observe-command.js","sourceRoot":"","sources":["../../src/observe/observe-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAE,SAAS,EAAoB,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAsB,MAAM,uBAAuB,CAAC;AAClH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AAErE,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,WAAW,GAAgB;IAC/B,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,kDAAkD;IAC/D,KAAK,EAAE;QACL,yEAAyE;QACzE,mEAAmE;KACpE;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,6BAA6B,EAAE;QAC3D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,qCAAqC,EAAE;QACnE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0DAA0D,EAAE;QAC1F,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,yCAAyC,EAAE;QACxE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;KACxE;IACD,QAAQ,EAAE;QACR,qEAAqE;QACrE,4DAA4D;QAC5D,2DAA2D;QAC3D,gFAAgF;QAChF,kFAAkF;QAClF,kEAAkE;KACnE;CACF,CAAC;AAYF,mEAAmE;AACnE,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,EAAE,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,SAAS,OAAO,CAAC,EAAa,EAAE,MAAc,EAAE,SAAkC,EAAE;IAClF,MAAM,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,eAAe,CAAC,aAA4B;IACnD,OAAO;QACL,UAAU,CAAC,KAAa,EAAE,MAAmC;YAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;YAC9D,IAAI,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,YAAY,CAAC,KAAa,EAAE,MAAc;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,cAAc,CAAC,MAAc;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;GAEG;AACH,SAAS,eAAe,CACtB,KAAa,EACb,OAAgC,EAChC,IAAsB,EACtB,WAA+B,EAC/B,OAAmB;IAEnB,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAe,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAA4B,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,KAAe,CAAC;QAC3C,MAAM,MAAM,GAAI,OAAO,CAAC,MAA6B,IAAI,SAAS,CAAC;QAEnE,8DAA8D;QAC9D,IAAI,WAAW,KAAK,SAAS,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YAC5D,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACtC,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,2DAA2D;QAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAc;IACpD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACxB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACtC;QACD,gBAAgB,EAAE,IAAI;QACtB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAA4B,EAAE,WAAW,CAAC;QAAE,OAAO;IAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAA0B,CAAC;IAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAwB,CAAC;IAEtD,iCAAiC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,QAAQ,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,QAAQ,kCAAkC,CAAC,CAAC,CAAC;QAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC;IAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAEjC,MAAM,aAAa,GAAkB;QACnC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;QACnB,SAAS;KACV,CAAC;IAEF,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;IAEtD,wBAAwB;IACxB,IAAI,IAAsB,CAAC;IAC3B,IAAI,GAAG,GAAsB,IAAI,CAAC;IAElC,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,IAAI,GAAG,GAAG,CAAC;IACb,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,8BAA8B;IAC9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,EAAE,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,CAAC,GAAG,CAAC,yEAAyE,CAAC;YAClF,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CACzD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kCAAkC;IAClC,MAAM,KAAK,GAAG,QAAQ,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,KAAK,EAAE,CAAC;IACzE,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,6DAA6D;YAC7D,GAAG,EAAE,OAAO,EAAE,CAAC;YAEf,6BAA6B;YAC7B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,aAAa,GAAG,OAAO,CAAC,EAAE,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5E,CAAC;qBAAM,CAAC;oBACN,aAAa,GAAG,OAAO,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAC;gBACrE,CAAC;gBACD,wDAAwD;gBACxD,UAAU,CAAC,GAAG,EAAE;oBACd,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,EAAE,CAAC;gBACZ,CAAC,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QAEF,6EAA6E;QAC7E,IAAI,UAAU,GAAwB,IAAI,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,UAAU,GAAG,GAAG,EAAE;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACjC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,YAAY;YACZ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,WAAW,GAAG,OAAO,CAAC,EAAE,EAAE,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,OAAO,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAqC,EAAE,EAAE;YACzD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YAElC,IAAI,KAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YAED,wBAAwB;YACxB,IAAI,IAAI,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAClD,IAAI,KAAK,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;oBAC7B,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;wBACb,wEAAwE;wBACxE,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC/C,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,GAAG,KAAK,CAAC,KAAyC,CAAC;wBAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,EAAE,OAAO,IAAI,qBAAqB,IAAI,CAAC,CAAC,CAAC;wBACvF,CAAC;wBACD,OAAO,EAAE,CAAC;oBACZ,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;oBAC/B,mDAAmD;oBACnD,OAAO;gBACT,CAAC;gBACD,OAAO;YACT,CAAC;YAED,aAAa;YACb,IAAI,OAAO,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxD,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAkC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC5B,yCAAyC;YACzC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,GAAG,EAAE,CAAC;gBACR,uEAAuE;gBACvE,mEAAmE;gBACnE,wEAAwE;gBACxE,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE;YAC9B,iEAAiE;YACjE,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACrC,CAAC;YAED,iEAAiE;YACjE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,cAAc,CAAC,0BAA0B,IAAI,GAAG,CAAC,CAAC;gBACvD,uDAAuD;YACzD,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"observe-command.js","sourceRoot":"","sources":["../../src/observe/observe-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAoB,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,cAAc,GAGf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAsB,MAAM,uBAAuB,CAAC;AAGlH,OAAO,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AAErE,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,WAAW,GAAgB;IAC/B,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,kDAAkD;IAC/D,KAAK,EAAE;QACL,yEAAyE;QACzE,mEAAmE;KACpE;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,6BAA6B,EAAE;QAC3D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,qCAAqC,EAAE;QACnE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0DAA0D,EAAE;QAC1F,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,yCAAyC,EAAE;QACxE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;KACxE;IACD,QAAQ,EAAE;QACR,qEAAqE;QACrE,4DAA4D;QAC5D,2DAA2D;QAC3D,gFAAgF;QAChF,kFAAkF;QAClF,kEAAkE;KACnE;CACF,CAAC;AAEF,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,eAAe,CAAC,aAA4B;IACnD,OAAO;QACL,UAAU,CAAC,KAAa,EAAE,MAAmC;YAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;YAC9D,IAAI,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,YAAY,CAAC,KAAa,EAAE,MAAc;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,cAAc,CAAC,MAAc;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;GAEG;AACH,SAAS,eAAe,CACtB,KAAa,EACb,OAAgC,EAChC,IAAsB,EACtB,WAA+B,EAC/B,OAAmB;IAEnB,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAe,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAA4B,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,KAAe,CAAC;QAC3C,MAAM,MAAM,GAAI,OAAO,CAAC,MAA6B,IAAI,SAAS,CAAC;QAEnE,8DAA8D;QAC9D,IAAI,WAAW,KAAK,SAAS,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YAC5D,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACtC,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,2DAA2D;QAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAc;IACpD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,CAC7C;QACE,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACxB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACtC;QACD,gBAAgB,EAAE,IAAI;KACvB,EACD,WAAW,CAAC,IAAI,CACjB,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC;QAAE,OAAO;IAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,GAA0B,CAAC;IAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAwB,CAAC;IAEtD,iCAAiC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,QAAQ,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,QAAQ,kCAAkC,CAAC,CAAC,CAAC;QAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC;IAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAEjC,MAAM,aAAa,GAAkB;QACnC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;QACnB,SAAS;KACV,CAAC;IAEF,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;IAEtD,wBAAwB;IACxB,IAAI,IAAsB,CAAC;IAC3B,IAAI,GAAG,GAAsB,IAAI,CAAC;IAElC,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,GAAG,CAAC,KAAK,EAAE,CAAC;QACZ,IAAI,GAAG,GAAG,CAAC;IACb,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,EAAE,OAAO,EAAE,CAAC;QACf,oBAAoB,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,GAAG,EAAE,OAAO,EAAE,CAAC;QACf,oBAAoB,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAaD;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,MAAoB,EAAE,GAA0B;IAC/E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IAEzC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,iBAAiB,GAAwB,IAAI,CAAC;QAClD,IAAI,gBAAgB,GAAwB,IAAI,CAAC;QACjD,IAAI,UAAU,GAAwB,IAAI,CAAC;QAE3C,MAAM,oBAAoB,GAAG,GAAG,EAAE;YAChC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBACnC,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YAEf,8DAA8D;YAC9D,GAAG,EAAE,OAAO,EAAE,CAAC;YACf,iBAAiB,EAAE,EAAE,CAAC;YACtB,gBAAgB,EAAE,EAAE,CAAC;YACrB,oBAAoB,EAAE,CAAC;YAEvB,MAAM,WAAW,GACf,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC;gBAC3D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YAEzD,KAAK,WAAW;iBACb,KAAK,CAAC,GAAG,EAAE;gBACV,iDAAiD;YACnD,CAAC,CAAC;iBACD,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;iBAC1B,KAAK,CAAC,GAAG,EAAE;gBACV,8DAA8D;YAChE,CAAC,CAAC;iBACD,OAAO,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC,CAAC;QAEF,8EAA8E;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,UAAU,GAAG,GAAG,EAAE;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACjC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACvC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAkC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;QAEH,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAqB,EAAE,EAAE;YAC1D,0EAA0E;YAC1E,oEAAoE;YACpE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,oBAAoB,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,sEAAsE;YACtE,0EAA0E;YAC1E,iEAAiE;YACjE,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;aAClC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YACX,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,EAAE,EAAE,CAAC;gBACP,yEAAyE;gBACzE,IAAI,CAAC,MAAM;oBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,MAAoB,EAAE,KAAyB,EAAE,MAAe;IACvF,MAAM,MAAM,GACV,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAE7D,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE3B,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,IAAI,qBAAqB,IAAI,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,SAAS,oBAAoB;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,CAAC,GAAG,CAAC,yEAAyE,CAAC;QAClF,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CACzD,CAAC;AACJ,CAAC"}

package/dist/persona/broad-policy-validator.d.ts

@@ -0,0 +1,95 @@
+/**
+ * src/persona/broad-policy-validator.ts
+ *
+ * Broad-policy validator (Phase 1c, §7). Passed as the `validateCompiled` hook
+ * to `compilePersonaPolicy` by the persona-compile orchestrator. It runs on the
+ * in-memory `CompiledPolicyFile` BEFORE any artifact is written, so a rejection
+ * leaves the prior generation's files intact (no partial write).
+ *
+ * It defeats constitution prompt-injection toward an over-permissive policy in a
+ * way that is fully LLM-independent: it inspects the COMPILED rules, not the
+ * constitution text. A persona may only emit a "broad" policy if it has been
+ * explicitly opted in via the gated `personas.setBroadPolicyOptIn` flow
+ * (`persona.allowBroadPolicy === true`). Otherwise the following are rejected:
+ *
+ *   - any "broad wildcard" `domains.allowed` entry (see isBroadDomainPattern),
+ *   - any "broad wildcard" `lists[].allowed` entry,
+ *   - any `paths.within` that resolves OUTSIDE the persona's workspace dir.
+ *
+ * A "broad wildcard" is not just the literal `*`. The runtime matcher
+ * (domainMatchesAllowlist in trusted-process/domain-utils.ts) treats any
+ * `*.`-prefixed pattern as a hostname suffix match, and the compiler is
+ * explicitly allowed to emit prefix wildcards (`*.example.com`). A TLD-level
+ * wildcard like `*.com`, `*.gov`, or the empty-suffix `*.` therefore grants
+ * near-wildcard egress and must be treated as broad — only a wildcard whose
+ * suffix has TWO OR MORE labels (e.g. `*.github.com`, scoped to a single
+ * registered domain) is considered narrow and allowed without opt-in.
+ *
+ * Rejection throws {@link BroadPolicyRejectedError}; the orchestrator maps the
+ * `code` (`BROAD_POLICY_REJECTED`) onto a terminal `persona.compile.failed`
+ * event.
+ *
+ * ZERO runtime value-imports from src/pipeline — the `CompiledPolicyFile` shape
+ * is a type-only import. Path containment uses the live-layer `resolveRealPath`
+ * helper (symlink-aware), consistent with the policy engine.
+ *
+ * @see docs/designs/web-ui-policy-persona-management.md §7
+ */
+import type { ErrorCode } from '../web-ui/web-ui-types.js';
+import type { CompiledPolicyFile, DynamicListsFile } from '../pipeline/types.js';
+/** Thrown when a compiled policy is "broad" but the persona is not opted in. */
+export declare class BroadPolicyRejectedError extends Error {
+    readonly data?: {
+        broadenedDomains: string[];
+        outOfWorkspacePaths: string[];
+    } | undefined;
+    readonly code: ErrorCode;
+    constructor(message: string, data?: {
+        broadenedDomains: string[];
+        outOfWorkspacePaths: string[];
+    } | undefined);
+}
+/** Findings produced by inspecting a compiled policy for broadening. */
+export interface BroadPolicyFindings {
+    /**
+     * Broad-wildcard entries found in any `domains.allowed` or `lists[].allowed`
+     * (the literal pattern, e.g. `*`, `*.`, `*.com`). See {@link isBroadDomainPattern}.
+     */
+    readonly broadenedDomains: string[];
+    /** `paths.within` values resolving outside the workspace dir. */
+    readonly outOfWorkspacePaths: string[];
+}
+/**
+ * Returns true iff `pattern` grants near-wildcard egress and therefore requires
+ * the broad-policy opt-in. This mirrors the runtime matcher semantics in
+ * `domainMatchesAllowlist` (trusted-process/domain-utils.ts), where `*` matches
+ * any non-IP host and `*.<suffix>` matches every host ending in `.<suffix>`.
+ *
+ * Broad (rejected without opt-in):
+ *   - `*`            — matches every (non-IP) host
+ *   - `*.`           — empty suffix; `endsWith('.')` matches ~everything
+ *   - `*.com`/`*.gov`— TLD-only suffix (<= 1 label after the `*.`)
+ *
+ * Narrow (allowed without opt-in):
+ *   - `*.github.com` — suffix has >= 2 labels (one registered domain)
+ *   - `github.com`   — bare hostname (no wildcard)
+ */
+export declare function isBroadDomainPattern(pattern: string): boolean;
+/**
+ * Inspects a compiled policy and returns the set of "broad" findings. Pure /
+ * side-effect-free so it can also feed the ruleDelta computation. A path is
+ * "out of workspace" iff its real-resolved form is neither the workspace dir nor
+ * a descendant of it. When `dynamicLists` is supplied, `@list` references in
+ * `domains.allowed` / `lists[].allowed` are resolved to their concrete values so
+ * a list that resolves to a broad wildcard is detected (the validator passes it;
+ * callers without the resolved lists — e.g. the rule-delta report — still get the
+ * literal-pattern findings).
+ */
+export declare function findBroadPolicy(policy: CompiledPolicyFile, workspaceDir: string, dynamicLists?: DynamicListsFile): BroadPolicyFindings;
+/**
+ * Builds a `validateCompiled` hook bound to a persona's workspace dir and
+ * opt-in flag. When `allowBroadPolicy` is true the hook is a no-op (broadening
+ * is permitted); otherwise it throws {@link BroadPolicyRejectedError} on any
+ * broad finding.
+ */
+export declare function makeBroadPolicyValidator(workspaceDir: string, allowBroadPolicy: boolean): (policy: CompiledPolicyFile, dynamicLists?: DynamicListsFile) => void;

package/dist/persona/broad-policy-validator.js

@@ -0,0 +1,171 @@
+/**
+ * src/persona/broad-policy-validator.ts
+ *
+ * Broad-policy validator (Phase 1c, §7). Passed as the `validateCompiled` hook
+ * to `compilePersonaPolicy` by the persona-compile orchestrator. It runs on the
+ * in-memory `CompiledPolicyFile` BEFORE any artifact is written, so a rejection
+ * leaves the prior generation's files intact (no partial write).
+ *
+ * It defeats constitution prompt-injection toward an over-permissive policy in a
+ * way that is fully LLM-independent: it inspects the COMPILED rules, not the
+ * constitution text. A persona may only emit a "broad" policy if it has been
+ * explicitly opted in via the gated `personas.setBroadPolicyOptIn` flow
+ * (`persona.allowBroadPolicy === true`). Otherwise the following are rejected:
+ *
+ *   - any "broad wildcard" `domains.allowed` entry (see isBroadDomainPattern),
+ *   - any "broad wildcard" `lists[].allowed` entry,
+ *   - any `paths.within` that resolves OUTSIDE the persona's workspace dir.
+ *
+ * A "broad wildcard" is not just the literal `*`. The runtime matcher
+ * (domainMatchesAllowlist in trusted-process/domain-utils.ts) treats any
+ * `*.`-prefixed pattern as a hostname suffix match, and the compiler is
+ * explicitly allowed to emit prefix wildcards (`*.example.com`). A TLD-level
+ * wildcard like `*.com`, `*.gov`, or the empty-suffix `*.` therefore grants
+ * near-wildcard egress and must be treated as broad — only a wildcard whose
+ * suffix has TWO OR MORE labels (e.g. `*.github.com`, scoped to a single
+ * registered domain) is considered narrow and allowed without opt-in.
+ *
+ * Rejection throws {@link BroadPolicyRejectedError}; the orchestrator maps the
+ * `code` (`BROAD_POLICY_REJECTED`) onto a terminal `persona.compile.failed`
+ * event.
+ *
+ * ZERO runtime value-imports from src/pipeline — the `CompiledPolicyFile` shape
+ * is a type-only import. Path containment uses the live-layer `resolveRealPath`
+ * helper (symlink-aware), consistent with the policy engine.
+ *
+ * @see docs/designs/web-ui-policy-persona-management.md §7
+ */
+import { resolveRealPath } from '../types/argument-roles.js';
+/** Thrown when a compiled policy is "broad" but the persona is not opted in. */
+export class BroadPolicyRejectedError extends Error {
+    data;
+    code = 'BROAD_POLICY_REJECTED';
+    constructor(message, data) {
+        super(message);
+        this.data = data;
+        this.name = 'BroadPolicyRejectedError';
+    }
+}
+/**
+ * Returns true iff `pattern` grants near-wildcard egress and therefore requires
+ * the broad-policy opt-in. This mirrors the runtime matcher semantics in
+ * `domainMatchesAllowlist` (trusted-process/domain-utils.ts), where `*` matches
+ * any non-IP host and `*.<suffix>` matches every host ending in `.<suffix>`.
+ *
+ * Broad (rejected without opt-in):
+ *   - `*`            — matches every (non-IP) host
+ *   - `*.`           — empty suffix; `endsWith('.')` matches ~everything
+ *   - `*.com`/`*.gov`— TLD-only suffix (<= 1 label after the `*.`)
+ *
+ * Narrow (allowed without opt-in):
+ *   - `*.github.com` — suffix has >= 2 labels (one registered domain)
+ *   - `github.com`   — bare hostname (no wildcard)
+ */
+export function isBroadDomainPattern(pattern) {
+    if (pattern === '*')
+        return true;
+    if (!pattern.startsWith('*.'))
+        return false;
+    const suffix = pattern.slice(2); // drop the leading "*."
+    // Empty or single-label suffix (TLD-only) => broad. Count non-empty labels.
+    const labels = suffix.split('.').filter((l) => l.length > 0);
+    return labels.length <= 1;
+}
+/**
+ * Expands an `allowed` array (from `domains.allowed` or `lists[].allowed`) into
+ * the concrete values to test for breadth. A `@list` reference contributes its
+ * EFFECTIVE values (values + manualAdditions − manualRemovals), mirroring
+ * `PolicyEngine.getEffectiveListValues` — so a list that RESOLVES to a broad
+ * wildcard (e.g. a "major news sites" list containing `*.com`) is caught even
+ * though the rule only stores the `@list` symbol and the resolved values live
+ * separately in dynamic-lists.json. A missing list contributes nothing: the
+ * runtime fails closed (missing `@list` => empty => deny), so there is nothing
+ * broad to flag. `via` records the originating `@list` for a clear message.
+ */
+function expandAllowedForBreadth(allowed, dynamicLists) {
+    const out = [];
+    for (const entry of allowed) {
+        if (!entry.startsWith('@')) {
+            out.push({ value: entry });
+            continue;
+        }
+        const list = dynamicLists?.lists[entry.slice(1)];
+        if (!list)
+            continue;
+        const removals = new Set(list.manualRemovals);
+        for (const v of new Set([...list.values, ...list.manualAdditions])) {
+            if (!removals.has(v))
+                out.push({ value: v, via: entry });
+        }
+    }
+    return out;
+}
+/**
+ * Inspects a compiled policy and returns the set of "broad" findings. Pure /
+ * side-effect-free so it can also feed the ruleDelta computation. A path is
+ * "out of workspace" iff its real-resolved form is neither the workspace dir nor
+ * a descendant of it. When `dynamicLists` is supplied, `@list` references in
+ * `domains.allowed` / `lists[].allowed` are resolved to their concrete values so
+ * a list that resolves to a broad wildcard is detected (the validator passes it;
+ * callers without the resolved lists — e.g. the rule-delta report — still get the
+ * literal-pattern findings).
+ */
+export function findBroadPolicy(policy, workspaceDir, dynamicLists) {
+    const broadenedDomains = new Set();
+    const outOfWorkspacePaths = new Set();
+    const workspaceReal = resolveRealPath(workspaceDir);
+    const flagBroad = (entries) => {
+        for (const { value, via } of expandAllowedForBreadth(entries, dynamicLists)) {
+            if (isBroadDomainPattern(value))
+                broadenedDomains.add(via ? `${value} (via ${via})` : value);
+        }
+    };
+    for (const rule of policy.rules) {
+        const cond = rule.if;
+        // Wildcard domains — incl. those reached through a resolved @list.
+        if (cond.domains?.allowed)
+            flagBroad(cond.domains.allowed);
+        // Wildcard list allowances.
+        if (cond.lists) {
+            for (const list of cond.lists)
+                flagBroad(list.allowed);
+        }
+        // Out-of-workspace path containment.
+        if (cond.paths?.within) {
+            const within = cond.paths.within;
+            const withinReal = resolveRealPath(within);
+            const contained = withinReal === workspaceReal || withinReal.startsWith(workspaceReal + '/');
+            if (!contained)
+                outOfWorkspacePaths.add(within);
+        }
+    }
+    return {
+        broadenedDomains: [...broadenedDomains],
+        outOfWorkspacePaths: [...outOfWorkspacePaths],
+    };
+}
+/**
+ * Builds a `validateCompiled` hook bound to a persona's workspace dir and
+ * opt-in flag. When `allowBroadPolicy` is true the hook is a no-op (broadening
+ * is permitted); otherwise it throws {@link BroadPolicyRejectedError} on any
+ * broad finding.
+ */
+export function makeBroadPolicyValidator(workspaceDir, allowBroadPolicy) {
+    return (policy, dynamicLists) => {
+        if (allowBroadPolicy)
+            return;
+        const findings = findBroadPolicy(policy, workspaceDir, dynamicLists);
+        if (findings.broadenedDomains.length === 0 && findings.outOfWorkspacePaths.length === 0) {
+            return;
+        }
+        const parts = [];
+        if (findings.broadenedDomains.length > 0) {
+            parts.push(`broad wildcard domain/list access: ${findings.broadenedDomains.join(', ')}`);
+        }
+        if (findings.outOfWorkspacePaths.length > 0) {
+            parts.push(`out-of-workspace path(s): ${findings.outOfWorkspacePaths.join(', ')}`);
+        }
+        throw new BroadPolicyRejectedError(`Compiled policy is too broad (${parts.join('; ')}). Enable broad policy for this persona to allow it.`, { broadenedDomains: findings.broadenedDomains, outOfWorkspacePaths: findings.outOfWorkspacePaths });
+    };
+}
+//# sourceMappingURL=broad-policy-validator.js.map

package/dist/persona/broad-policy-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broad-policy-validator.js","sourceRoot":"","sources":["../../src/persona/broad-policy-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAK7D,gFAAgF;AAChF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAItC;IAHF,IAAI,GAAc,uBAAuB,CAAC;IACnD,YACE,OAAe,EACN,IAAoE;QAE7E,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,SAAI,GAAJ,IAAI,CAAgE;QAG7E,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAaD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;IACzD,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAC9B,OAA0B,EAC1B,YAA0C;IAE1C,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,YAAoB,EACpB,YAA+B;IAE/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAQ,EAAE;QACrD,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5E,IAAI,oBAAoB,CAAC,KAAK,CAAC;gBAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrB,mEAAmE;QACnE,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,4BAA4B;QAC5B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;QACD,qCAAqC;QACrC,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,UAAU,KAAK,aAAa,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;YAC7F,IAAI,CAAC,SAAS;gBAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,mBAAmB,EAAE,CAAC,GAAG,mBAAmB,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,gBAAyB;IAEzB,OAAO,CAAC,MAA0B,EAAE,YAA+B,EAAQ,EAAE;QAC3E,IAAI,gBAAgB;YAAE,OAAO;QAC7B,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,sCAAsC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,6BAA6B,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD,EACvG,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,EAAE,CACnG,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}