@quickchatai/pi-quickreview 0.0.0-stage → 1.2.0

package/dist/src/engine/tooluid.js

@@ -0,0 +1,401 @@
+// The separate tool uid: the image's entrypoint (docker/entrypoint.sh)
+// runs the engine as an unprivileged run uid that holds the GitHub token, with
+// CAP_SETUID/CAP_SETGID as ambient capabilities, and names the uid the model's
+// tools run as in QCR_TOOL_UID/QCR_TOOL_GID. This module is the one place that
+// turns those names into a spawn:
+//
+//   - `toolIsolation` wraps a child (pi, or anything else that runs the model's
+//     bash) in setpriv, which switches to the tool uid and drops every
+//     capability and the ability to gain one back, so the kernel refuses the
+//     tools /proc/<this pid>/mem and /environ. Node's own `uid` spawn option is
+//     not used: it would leave the ambient capabilities on the child.
+//   - `isolatedBashOperations` is the same for the SDK session's bash tool: the
+//     model's command is run through setpriv, and stopped through it too (the
+//     run uid may not signal a process of another uid).
+//   - `checkToolUid` is the gate in front of a host: one that arranges the
+//     split passes, one that cannot (a host whose tools are children of a
+//     process with no split of its own) refuses rather than run without it,
+//     unless the shared uid is accepted.
+//
+// `QCR_TOOL_UID_REQUIRED` is set by the same entrypoint when it could not
+// arrange the separation (it was not started as root): nothing that runs the
+// model's tools is started then, unless QCR_ALLOW_SHARED_TOOL_UID=1 says the
+// shared uid is accepted. Outside the image none of these names is set and
+// nothing changes.
+import { spawn } from "node:child_process";
+import { chmodSync, chownSync, existsSync, lstatSync, readdirSync } from "node:fs";
+import { access } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { constants as osConstants } from "node:os";
+/** The names the image's entrypoint sets when the model's tools must run as
+ * another uid than this process. */
+export const TOOL_UID_ENVS = ["QCR_TOOL_UID", "QCR_TOOL_GID", "QCR_TOOL_UID_REQUIRED"];
+const ID = /^[1-9][0-9]*$/;
+/** What the environment says about the tool uid: the ids to run the tools as, or
+ * null where nothing asks for a separation, or why none can be made. Where the
+ * ids are named they win, whatever else is set. */
+export function toolIdsOf(env) {
+    const uid = env["QCR_TOOL_UID"];
+    const gid = env["QCR_TOOL_GID"];
+    if (uid || gid) {
+        if (!ID.test(uid ?? "") || !ID.test(gid ?? ""))
+            return { refused: `QCR_TOOL_UID/QCR_TOOL_GID must be non-zero numeric ids (${uid}:${gid})` };
+        return { uid: uid, gid: gid };
+    }
+    if (env["QCR_TOOL_UID_REQUIRED"] && env["QCR_ALLOW_SHARED_TOOL_UID"] !== "1")
+        return {
+            refused: "the model's tools would share this process's uid and could read its token through /proc: " +
+                "start the container as root with --cap-drop ALL --cap-add SETUID --cap-add SETGID " +
+                "(docker/entrypoint.sh drops to QCR_RUN_UID and runs the tools as QCR_TOOL_UID), " +
+                "or set QCR_ALLOW_SHARED_TOOL_UID=1 to accept the shared uid",
+        };
+    return null;
+}
+/** setpriv's switches for the tool uid: its uid and gid with no supplementary
+ * groups, no capability, and no way to gain one. Does not include `--`. */
+export function setprivSwitches(ids) {
+    return [
+        `--reuid=${ids.uid}`,
+        `--regid=${ids.gid}`,
+        "--clear-groups",
+        "--inh-caps=-all",
+        "--ambient-caps=-all",
+        "--no-new-privs",
+    ];
+}
+/** How a child that runs the model's tools is started: through setpriv where the
+ * image asks for the tool uid, unchanged where nothing does, refused where the
+ * entrypoint could not arrange it. */
+export function toolIsolation(bin, argv, procEnv = process.env) {
+    const ids = toolIdsOf(procEnv);
+    if (ids === null)
+        return { bin, argv, isolated: false };
+    if ("refused" in ids)
+        return ids;
+    // The bot's setid helper where the image names one, else setpriv itself.
+    const helper = setidHelperOf(procEnv);
+    if (helper !== null && "refused" in helper)
+        return helper;
+    return {
+        bin: helper?.path ?? "setpriv",
+        argv: [...setprivSwitches(ids), "--", bin, ...argv],
+        isolated: true,
+    };
+}
+/** The gate in front of a host that runs the model's tools.
+ *
+ * A host that starts them itself through the tool uid (`isolated`: the SDK
+ * runtime's bash, a debug round's pi) passes where the ids are numeric and
+ * non-zero, and is refused where the entrypoint could not arrange the split.
+ *
+ * A host that cannot (its tools are children of a process that runs in this
+ * uid, such as the native lens tool's pi children) refuses wherever the image
+ * asks for the separation, unless the shared uid is accepted. `host` words the
+ * refusal for the caller. */
+export function checkToolUid(env, host = {
+    what: "the SDK runtime",
+    instead: "",
+}) {
+    if (host.isolated === true) {
+        const ids = toolIdsOf(env);
+        if (ids !== null && "refused" in ids)
+            throw new Error(`${host.what}: ${ids.refused}`);
+        return;
+    }
+    if (env["QCR_ALLOW_SHARED_TOOL_UID"] === "1")
+        return;
+    if (TOOL_UID_ENVS.some((n) => env[n]))
+        throw new Error(`${host.what} runs the model's tools in this process, so it cannot run them as another uid, ` +
+            `which this container asks for: ${host.instead === "" ? "" : `${host.instead}, or `}set ` +
+            "QCR_ALLOW_SHARED_TOOL_UID=1 to accept the shared uid");
+}
+/**
+ * Opens `dir` and everything in it to the tool uid's group: group read and
+ * write on files, and group access on directories, each entry handed to the
+ * tool gid (`QCR_TOOL_GID`) where that is not this process's own gid (the
+ * bot's tools run in a gid of their own; the cli's share the run
+ * gid). For a process that runs as the tool uid and needs what the run uid
+ * made private (a debug round's pi reading its agent dir); the owner's bits
+ * stay. Symbolic links are left as they are, and a missing dir is nothing to
+ * share.
+ */
+export function shareWithToolGroup(dir, env = process.env) {
+    const st = lstatSync(dir, { throwIfNoEntry: false });
+    if (st === undefined || st.isSymbolicLink())
+        return;
+    // An entry another uid owns (the tool uid's own, made under its group-writable
+    // umask) is not this process's to change, and needs no sharing.
+    if (typeof process.getuid === "function" && st.uid !== process.getuid())
+        return;
+    const gid = env["QCR_TOOL_GID"];
+    if (gid !== undefined && /^[1-9][0-9]*$/.test(gid) && st.gid !== Number(gid))
+        chownSync(dir, st.uid, Number(gid));
+    if (st.isDirectory()) {
+        chmodSync(dir, (st.mode & 0o7777) | 0o070);
+        for (const name of readdirSync(dir))
+            shareWithToolGroup(join(dir, name), env);
+    }
+    else if (st.isFile()) {
+        chmodSync(dir, (st.mode & 0o7777) | 0o060);
+    }
+}
+/**
+ * The environment a command run as the tool uid needs on top of the one it was
+ * given: git's `safe.directory = *` in the command scope.
+ *
+ * The repositories the model reads (the worktrees, the base clone) belong to the
+ * run uid, and git refuses a repository another uid owns ("dubious ownership").
+ * The image's system config says `*`, but a review session pins git's system
+ * scope off (src/sessions.ts sessionGitConfigPins), and `safe.directory` is read
+ * only from a protected scope: system, global or command. So it rides the
+ * command scope (GIT_CONFIG_COUNT/KEY_n/VALUE_n), appended after any entries the
+ * env already carries, never in place of them. It widens nothing: the
+ * repositories are the run uid's, which the tool uid trusts by construction.
+ */
+export function toolUidEnv(env) {
+    const given = env["GIT_CONFIG_COUNT"];
+    const n = given !== undefined && /^\d{1,3}$/.test(given) ? Number(given) : 0;
+    return {
+        ...env,
+        GIT_CONFIG_COUNT: String(n + 1),
+        [`GIT_CONFIG_KEY_${n}`]: "safe.directory",
+        [`GIT_CONFIG_VALUE_${n}`]: "*",
+    };
+}
+/** The umask a tool-uid command runs under: group-writable files, which is how
+ * the run uid and the tool uid (one gid, two uids) share what either writes. */
+export const TOOL_UMASK = 0o002;
+/** The shell program that runs a tool-uid command: it sets the umask and
+ * replaces itself with the shell on the command, so the command is still
+ * `<shell> -c <command>` (one argument, the same $0) under the same pid, which
+ * leads its process group. */
+const UMASK_THEN_RUN = `umask 002 && exec "$0" -c "$1"`;
+/** Where setpriv is looked for: root-owned system dirs, never the model's PATH. */
+const SETPRIV_DIRS = ["/usr/bin", "/bin", "/usr/sbin", "/sbin"];
+const SETPRIV_PATH = SETPRIV_DIRS.join(":");
+/** The setpriv the spawner runs, which holds the ambient SETUID/SETGID: an
+ * absolute path in a system dir. A PATH entry the tool uid can write must not
+ * be able to plant the binary the next command runs with those capabilities.
+ * Null where no system dir has one. */
+export function trustedSetpriv(exists = existsSync, env = process.env) {
+    const helper = setidHelperOf(env);
+    if (helper !== null)
+        return "path" in helper ? helper.path : null;
+    return SETPRIV_DIRS.map((d) => join(d, "setpriv")).find(exists) ?? null;
+}
+/**
+ * The bot's setid helper, named by `QCR_SETPRIV_BIN`: the image's
+ * own copy of setpriv that carries CAP_SETUID/CAP_SETGID as FILE capabilities
+ * and only a gate group may run (docker/Dockerfile). The always-on bot runs as
+ * its own uid, not root, so `docker exec` into it keeps landing as that uid; it
+ * reaches the tool uid through this helper instead of ambient capabilities
+ * (docker/entrypoint.sh's daemon mode). The model's tools never get it: they run
+ * with no_new_privs, under which a file capability grants nothing, and without
+ * the gate group.
+ *
+ * Trusted only as a root-owned regular file in a root-owned directory, neither
+ * writable by group or others: the run uid must not be able to swap the binary
+ * it hands its capabilities to. Null where the env names none; `refused` where
+ * it names one that fails those checks.
+ */
+export function setidHelperOf(env, stat = (p) => lstatSync(p, { throwIfNoEntry: false })) {
+    const named = env["QCR_SETPRIV_BIN"]?.trim();
+    if (named === undefined || named === "")
+        return null;
+    const refuse = (why) => ({ refused: `QCR_SETPRIV_BIN ${named}: ${why}` });
+    if (!named.startsWith("/"))
+        return refuse("not an absolute path");
+    const file = stat(named);
+    if (file === undefined || !file.isFile())
+        return refuse("not a regular file");
+    const dir = stat(dirname(named));
+    if (dir === undefined || !dir.isDirectory())
+        return refuse("its directory is not a directory");
+    for (const [what, st] of [
+        ["it", file],
+        ["its directory", dir],
+    ]) {
+        if (st.uid !== 0)
+            return refuse(`${what} is not owned by root`);
+        if ((st.mode & 0o022) !== 0)
+            return refuse(`${what} is writable by group or others`);
+    }
+    return { path: named };
+}
+/** The shell the model's commands run in: pi's own choice on Unix. */
+function shellPath() {
+    return existsSync("/bin/bash") ? "/bin/bash" : "sh";
+}
+/** After the shell exits, how long output still arriving on a pipe a descendant
+ * holds open is waited for (pi's own grace). */
+const EXIT_STDIO_GRACE_MS = 100;
+/** The stdio of a command: nothing in, its output out, and each of `inherit`
+ * handed to it at the SAME fd number. Node closes every descriptor a child is
+ * not listed with, so an fd a command (or a script under it) must read has to be
+ * named here. */
+export function commandStdio(inherit) {
+    const stdio = ["ignore", "pipe", "pipe"];
+    for (const fd of inherit) {
+        if (!Number.isInteger(fd) || fd < 3)
+            throw new Error(`cannot hand a command fd ${fd}`);
+        while (stdio.length < fd)
+            stdio.push("ignore");
+        stdio[fd] = fd;
+    }
+    return stdio;
+}
+function shellOperations(plan, inherit) {
+    const stdio = commandStdio(inherit);
+    return {
+        exec: async (command, cwd, { onData, signal, timeout, env }) => {
+            plan.ready();
+            if (signal?.aborted)
+                throw new Error("aborted");
+            if (timeout !== undefined && !(Number.isFinite(timeout) && timeout > 0))
+                throw new Error("Invalid timeout: must be a finite number of seconds");
+            try {
+                await access(cwd);
+            }
+            catch {
+                throw new Error(`Working directory does not exist: ${cwd}\nCannot execute bash commands.`);
+            }
+            const { bin, argv } = plan.start(command);
+            const given = env ?? process.env;
+            const child = spawn(bin, argv, {
+                cwd,
+                env: plan.env ? plan.env(given) : given,
+                detached: true,
+                stdio,
+            });
+            const pgid = child.pid;
+            const killGroup = () => {
+                if (pgid !== undefined)
+                    plan.killGroup(pgid);
+            };
+            let timedOut = false;
+            const timer = timeout === undefined
+                ? undefined
+                : setTimeout(() => {
+                    timedOut = true;
+                    killGroup();
+                }, timeout * 1000);
+            const onAbort = () => killGroup();
+            signal?.addEventListener("abort", onAbort, { once: true });
+            // an abort during the cwd check fired before the listener existed
+            if (signal?.aborted)
+                onAbort();
+            try {
+                child.stdout.on("data", onData);
+                child.stderr.on("data", onData);
+                const exitCode = await new Promise((resolve, reject) => {
+                    let exited = false;
+                    let code = null;
+                    let idle;
+                    const done = () => {
+                        if (idle)
+                            clearTimeout(idle);
+                        child.stdout.destroy();
+                        child.stderr.destroy();
+                        resolve(code);
+                    };
+                    const arm = () => {
+                        if (idle)
+                            clearTimeout(idle);
+                        idle = setTimeout(done, EXIT_STDIO_GRACE_MS);
+                    };
+                    child.once("error", reject);
+                    child.once("exit", (c) => {
+                        exited = true;
+                        code = c;
+                        arm();
+                    });
+                    child.once("close", (c) => {
+                        code = c ?? code;
+                        done();
+                    });
+                    // output still arriving after the exit keeps the wait open
+                    child.stdout.on("data", () => exited && arm());
+                    child.stderr.on("data", () => exited && arm());
+                });
+                if (signal?.aborted)
+                    throw new Error("aborted");
+                if (timedOut)
+                    throw new Error(`timeout:${timeout}`);
+                // A signal-killed shell has no exit code: the shell convention, as pi has it.
+                const signalled = child.signalCode ? 128 + (osConstants.signals[child.signalCode] ?? 0) : 1;
+                return { exitCode: exitCode ?? signalled };
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+                signal?.removeEventListener("abort", onAbort);
+            }
+        },
+    };
+}
+/**
+ * The SDK bash tool's execution, with the model's command run as the tool uid.
+ *
+ * The command is `setpriv … -- bash -c <command>` in a process group of its
+ * own, the umask set first (TOOL_UMASK) and git's safe.directory in its env
+ * (toolUidEnv). A timeout or an abort ends that group through setpriv too: the run uid
+ * may not signal a process of another uid (kill(2): the sender's uid must match
+ * the target's real or saved uid, and this process holds no CAP_KILL), so pi's
+ * own kill of the tree would silently do nothing and the command would run on.
+ * The saved uid cannot be left as the run uid to allow it: the tool could then
+ * switch back.
+ *
+ * `inherit` lists descriptors every command gets at the same number (the
+ * bot worker's IPC capability).
+ */
+export function isolatedBashOperations(ids, setprivBin, inherit = []) {
+    const switches = setprivSwitches(ids);
+    const setpriv = setprivBin ?? trustedSetpriv();
+    const helper = setprivBin === undefined ? setidHelperOf(process.env) : null;
+    return shellOperations({
+        ready: () => {
+            if (helper !== null && "refused" in helper)
+                throw new Error(`${helper.refused}: the tool uid cannot be used`);
+            if (setpriv === null)
+                throw new Error("setpriv is in none of " + SETPRIV_PATH + ": the tool uid cannot be used");
+        },
+        start: (command) => ({
+            bin: setpriv,
+            argv: [...switches, "--", shellPath(), "-c", UMASK_THEN_RUN, shellPath(), command],
+        }),
+        env: toolUidEnv,
+        // The group's end, as the tool uid. Best effort: a failure leaves the
+        // command running, as pi's own kill does when it cannot signal.
+        killGroup: (pgid) => {
+            try {
+                spawn(setpriv, [...switches, "--", shellPath(), "-c", 'kill -KILL -- "-$0" 2>/dev/null', String(pgid)], 
+                // the killing shell needs no PATH of the model's
+                { stdio: "ignore", env: { PATH: SETPRIV_PATH } })
+                    .once("error", () => { })
+                    .unref();
+            }
+            catch {
+                // setpriv could not be started: nothing more can be done from here
+            }
+        },
+    }, inherit);
+}
+/** The same execution with no uid change, for a host whose commands must
+ * inherit descriptors (`inherit`): pi's own local operations start a command
+ * with nothing but stdio. The command runs in a process group of its own, which
+ * a timeout or an abort ends. */
+export function inheritingBashOperations(inherit) {
+    return shellOperations({
+        ready: () => { },
+        start: (command) => ({ bin: shellPath(), argv: ["-c", command] }),
+        killGroup: (pgid) => {
+            try {
+                process.kill(-pgid, "SIGKILL");
+            }
+            catch {
+                // already gone
+            }
+        },
+    }, inherit);
+}
+//# sourceMappingURL=tooluid.js.map

package/dist/src/engine/tooluid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tooluid.js","sourceRoot":"","sources":["../../../src/engine/tooluid.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,kCAAkC;AAClC,EAAE;AACF,gFAAgF;AAChF,uEAAuE;AACvE,6EAA6E;AAC7E,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAChF,8EAA8E;AAC9E,wDAAwD;AACxD,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,yCAAyC;AACzC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,mBAAmB;AACnB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAGnD;oCACoC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,uBAAuB,CAAU,CAAC;AAQhG,MAAM,EAAE,GAAG,eAAe,CAAC;AAE3B;;mDAEmD;AACnD,MAAM,UAAU,SAAS,CAAC,GAAsB;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IAChC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;YAC5C,OAAO,EAAE,OAAO,EAAE,2DAA2D,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;QAC/F,OAAO,EAAE,GAAG,EAAE,GAAa,EAAE,GAAG,EAAE,GAAa,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,GAAG,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,KAAK,GAAG;QAC1E,OAAO;YACL,OAAO,EACL,2FAA2F;gBAC3F,oFAAoF;gBACpF,kFAAkF;gBAClF,6DAA6D;SAChE,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,OAAO;QACL,WAAW,GAAG,CAAC,GAAG,EAAE;QACpB,WAAW,GAAG,CAAC,GAAG,EAAE;QACpB,gBAAgB;QAChB,iBAAiB;QACjB,qBAAqB;QACrB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED;;sCAEsC;AACtC,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,IAAc,EACd,UAA6B,OAAO,CAAC,GAAG;IAExC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxD,IAAI,SAAS,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACjC,yEAAyE;IACzE,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1D,OAAO;QACL,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS;QAC9B,IAAI,EAAE,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACnD,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;6BAS6B;AAC7B,MAAM,UAAU,YAAY,CAC1B,GAAsB,EACtB,OAA8D;IAC5D,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,EAAE;CACZ;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,IAAI,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,2BAA2B,CAAC,KAAK,GAAG;QAAE,OAAO;IACrD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,iFAAiF;YAC3F,kCAAkC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM;YACzF,sDAAsD,CACzD,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAAyB,OAAO,CAAC,GAAG;IAClF,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,cAAc,EAAE;QAAE,OAAO;IACpD,+EAA+E;IAC/E,gEAAgE;IAChE,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;QAAE,OAAO;IAChF,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC;QAC1E,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;SAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,GAAsB;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,gBAAgB;QACzC,CAAC,oBAAoB,CAAC,EAAE,CAAC,EAAE,GAAG;KAC/B,CAAC;AACJ,CAAC;AAED;gFACgF;AAChF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAEhC;;;8BAG8B;AAC9B,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD,mFAAmF;AACnF,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAChE,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE5C;;;uCAGuC;AACvC,MAAM,UAAU,cAAc,CAC5B,SAAiC,UAAU,EAC3C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAsB,EACtB,OAE4F,CAAC,CAAC,EAAE,EAAE,CAChG,SAAS,CAAC,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAEzC,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,KAAK,KAAK,GAAG,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;QAAE,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC/F,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;QACvB,CAAC,IAAI,EAAE,IAAI,CAAC;QACZ,CAAC,eAAe,EAAE,GAAG,CAAC;KACd,EAAE,CAAC;QACX,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,IAAI,iCAAiC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,sEAAsE;AACtE,SAAS,SAAS;IAChB,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;gDACgD;AAChD,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAchC;;;iBAGiB;AACjB,MAAM,UAAU,YAAY,CAAC,OAA0B;IACrD,MAAM,KAAK,GAAsC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,KAAK,CAAC,MAAM,GAAG,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAe,EAAE,OAA0B;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;YAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,iCAAiC,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;YACjC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;gBAC7B,GAAG;gBACH,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;gBACvC,QAAQ,EAAE,IAAI;gBACd,KAAK;aACN,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC;YACvB,MAAM,SAAS,GAAG,GAAS,EAAE;gBAC3B,IAAI,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC,CAAC;YACF,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,KAAK,GACT,OAAO,KAAK,SAAS;gBACnB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,SAAS,EAAE,CAAC;gBACd,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;YACzB,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,kEAAkE;YAClE,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACjC,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBACpE,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,IAAI,IAAI,GAAkB,IAAI,CAAC;oBAC/B,IAAI,IAAgC,CAAC;oBACrC,MAAM,IAAI,GAAG,GAAS,EAAE;wBACtB,IAAI,IAAI;4BAAE,YAAY,CAAC,IAAI,CAAC,CAAC;wBAC7B,KAAK,CAAC,MAAO,CAAC,OAAO,EAAE,CAAC;wBACxB,KAAK,CAAC,MAAO,CAAC,OAAO,EAAE,CAAC;wBACxB,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC,CAAC;oBACF,MAAM,GAAG,GAAG,GAAS,EAAE;wBACrB,IAAI,IAAI;4BAAE,YAAY,CAAC,IAAI,CAAC,CAAC;wBAC7B,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;oBAC/C,CAAC,CAAC;oBACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;wBACvB,MAAM,GAAG,IAAI,CAAC;wBACd,IAAI,GAAG,CAAC,CAAC;wBACT,GAAG,EAAE,CAAC;oBACR,CAAC,CAAC,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;wBACxB,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC;wBACjB,IAAI,EAAE,CAAC;oBACT,CAAC,CAAC,CAAC;oBACH,2DAA2D;oBAC3D,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;oBAChD,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;gBAClD,CAAC,CAAC,CAAC;gBACH,IAAI,MAAM,EAAE,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChD,IAAI,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;gBACpD,8EAA8E;gBAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5F,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC7C,CAAC;oBAAS,CAAC;gBACT,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAY,EACZ,UAAmB,EACnB,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,IAAI,cAAc,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,OAAO,eAAe,CACpB;QACE,KAAK,EAAE,GAAG,EAAE;YACV,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM;gBACxC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,+BAA+B,CAAC,CAAC;YACpE,IAAI,OAAO,KAAK,IAAI;gBAClB,MAAM,IAAI,KAAK,CACb,wBAAwB,GAAG,YAAY,GAAG,+BAA+B,CAC1E,CAAC;QACN,CAAC;QACD,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACnB,GAAG,EAAE,OAAQ;YACb,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC;SACnF,CAAC;QACF,GAAG,EAAE,UAAU;QACf,sEAAsE;QACtE,gEAAgE;QAChE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAClB,IAAI,CAAC;gBACH,KAAK,CACH,OAAQ,EACR,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACvF,iDAAiD;gBACjD,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CACjD;qBACE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC;qBACvB,KAAK,EAAE,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;QACH,CAAC;KACF,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;iCAGiC;AACjC,MAAM,UAAU,wBAAwB,CAAC,OAA0B;IACjE,OAAO,eAAe,CACpB;QACE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QACjE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAClB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;KACF,EACD,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/src/envstrip.d.ts

@@ -0,0 +1,10 @@
+export declare const GITHUB_TOKEN_ENVS: readonly ["GITHUB_TOKEN", "GH_TOKEN", "GH_ENTERPRISE_TOKEN"];
+/** Git without any system or global config and never prompting: every
+ * environment a reviewer's model or a harness git call runs in carries it. */
+export declare const GIT_ISOLATION_ENV: {
+    readonly GIT_CONFIG_NOSYSTEM: "1";
+    readonly GIT_CONFIG_SYSTEM: "/dev/null";
+    readonly GIT_CONFIG_GLOBAL: "/dev/null";
+    readonly GIT_TERMINAL_PROMPT: "0";
+};
+//# sourceMappingURL=envstrip.d.ts.map

package/dist/src/envstrip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envstrip.d.ts","sourceRoot":"","sources":["../../src/envstrip.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,iBAAiB,8DAA+D,CAAC;AAE9F;8EAC8E;AAC9E,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC"}

package/dist/src/envstrip.js

@@ -0,0 +1,15 @@
+// Env names that carry a GitHub credential. A process that runs a model's
+// tools, or hands an env to a child that does, drops every one of these
+// first: the token never reaches a process the model can read. And git's
+// isolation, which every such env carries. No imports, so engine code, scan
+// and the daemon can all take it.
+export const GITHUB_TOKEN_ENVS = ["GITHUB_TOKEN", "GH_TOKEN", "GH_ENTERPRISE_TOKEN"];
+/** Git without any system or global config and never prompting: every
+ * environment a reviewer's model or a harness git call runs in carries it. */
+export const GIT_ISOLATION_ENV = {
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_SYSTEM: "/dev/null",
+    GIT_CONFIG_GLOBAL: "/dev/null",
+    GIT_TERMINAL_PROMPT: "0",
+};
+//# sourceMappingURL=envstrip.js.map

package/dist/src/envstrip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envstrip.js","sourceRoot":"","sources":["../../src/envstrip.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,kCAAkC;AAClC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,qBAAqB,CAAU,CAAC;AAE9F;8EAC8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,mBAAmB,EAAE,GAAG;IACxB,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,mBAAmB,EAAE,GAAG;CAChB,CAAC"}

package/dist/src/escalationprompt.d.ts

@@ -0,0 +1,22 @@
+import type { EscalationConfig } from "./reviewconfig.js";
+/**
+ * The targets a round order carries, or none.
+ *
+ * A round order gets this list ONLY when the feature is enabled AND the
+ * operator turned session judgement on — so with escalation off (the default)
+ * the field is absent, the note below renders `""`, and the round prompt is
+ * identical in behaviour to a build without the feature (whitespace aside —
+ * see the pin in tests/escalation.test.ts).
+ */
+export declare function promptTargetsFor(cfg: EscalationConfig): string[] | undefined;
+/**
+ * The round-prompt block, rendered into `{{escalation_note}}` by
+ * `packages/pi-plugin/src/templates.ts`.
+ *
+ * The deterministic rules need no prompt at all: the daemon evaluates and
+ * delivers them itself. This block exists only so a session that MAY escalate
+ * on its own judgement knows the shape, the bound and — above all — that
+ * escalating never changes its job.
+ */
+export declare function renderEscalationPromptNote(targets: readonly string[] | undefined): string;
+//# sourceMappingURL=escalationprompt.d.ts.map

package/dist/src/escalationprompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalationprompt.d.ts","sourceRoot":"","sources":["../../src/escalationprompt.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,EAAE,GAAG,SAAS,CAG5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,CA4BzF"}

package/dist/src/escalationprompt.js

@@ -0,0 +1,54 @@
+/**
+ * The targets a round order carries, or none.
+ *
+ * A round order gets this list ONLY when the feature is enabled AND the
+ * operator turned session judgement on — so with escalation off (the default)
+ * the field is absent, the note below renders `""`, and the round prompt is
+ * identical in behaviour to a build without the feature (whitespace aside —
+ * see the pin in tests/escalation.test.ts).
+ */
+export function promptTargetsFor(cfg) {
+    if (!cfg.enabled || !cfg.session_judgement || cfg.targets.length === 0)
+        return undefined;
+    return [...cfg.targets];
+}
+/**
+ * The round-prompt block, rendered into `{{escalation_note}}` by
+ * `packages/pi-plugin/src/templates.ts`.
+ *
+ * The deterministic rules need no prompt at all: the daemon evaluates and
+ * delivers them itself. This block exists only so a session that MAY escalate
+ * on its own judgement knows the shape, the bound and — above all — that
+ * escalating never changes its job.
+ */
+export function renderEscalationPromptNote(targets) {
+    if (!targets || targets.length === 0)
+        return "";
+    return [
+        "ESCALATION (optional, and it never changes your job).",
+        "",
+        "You always decide this PR on the merits and post the review — escalation is a note that goes",
+        "out BESIDE your verdict, never instead of it, and never a reason to withhold or defer one.",
+        "",
+        "If one specific thing in this change genuinely needs a named person's eyes, add an",
+        "`escalations` array to your verdict file. Each entry:",
+        "",
+        "```json",
+        '{ "target": "<one of the logins below>",',
+        '  "scope": { "kind": "code", "path": "<repo-relative file>", "start_line": 12, "end_line": 30 },',
+        '  "question": "<one or two sentences about THAT code>",',
+        '  "why": "<why this person>" }',
+        "```",
+        "",
+        `Targets you may name (any other login is dropped by the daemon): ${targets.map((t) => `@${t}`).join(", ")}`,
+        "",
+        "`scope.kind` is `code` (path plus line range), `migration` (path, optionally the migration",
+        'id) or `decision` (a named decision). There is no way to escalate "the PR" and you must not',
+        "try: an entry with no concrete scope, or a question that asks someone to review the change,",
+        "is dropped. Think of it exactly as a `[check this]` item with a name on it — the smallest",
+        "thing that actually needs a person, phrased so they can answer it in minutes.",
+        "",
+        "Escalating is rare. Omitting the array entirely is the normal outcome.",
+    ].join("\n");
+}
+//# sourceMappingURL=escalationprompt.js.map

package/dist/src/escalationprompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalationprompt.js","sourceRoot":"","sources":["../../src/escalationprompt.ts"],"names":[],"mappings":"AAMA;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAqB;IACpD,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,OAAO,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAsC;IAC/E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO;QACL,uDAAuD;QACvD,EAAE;QACF,8FAA8F;QAC9F,4FAA4F;QAC5F,EAAE;QACF,oFAAoF;QACpF,uDAAuD;QACvD,EAAE;QACF,SAAS;QACT,0CAA0C;QAC1C,kGAAkG;QAClG,yDAAyD;QACzD,gCAAgC;QAChC,KAAK;QACL,EAAE;QACF,oEAAoE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5G,EAAE;QACF,4FAA4F;QAC5F,6FAA6F;QAC7F,6FAA6F;QAC7F,2FAA2F;QAC3F,+EAA+E;QAC/E,EAAE;QACF,wEAAwE;KACzE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/src/execfn.d.ts

@@ -0,0 +1,29 @@
+export interface ExecOpts {
+    cwd?: string;
+    /** Fully-constructed environment. Callers pass an explicit env — never a
+     * spread of process.env — so no personal credential can leak into a
+     * session. */
+    env?: NodeJS.ProcessEnv;
+    input?: string;
+    timeoutMs?: number;
+    /** Stops the command: the child is killed and the call rejects with the
+     * signal's AbortError. */
+    signal?: AbortSignal;
+}
+export interface ExecResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type ExecFn = (cmd: string, args: string[], opts?: ExecOpts) => Promise<ExecResult>;
+export declare class ExecError extends Error {
+    readonly cmd: string;
+    readonly args: string[];
+    readonly result: ExecResult;
+    constructor(cmd: string, args: string[], result: ExecResult);
+}
+/** Default ExecFn: spawn, capture, never inherit a shell. */
+export declare const nodeExec: ExecFn;
+/** Run and throw on a non-zero exit. */
+export declare function runOrThrow(exec: ExecFn, cmd: string, args: string[], opts?: ExecOpts): Promise<ExecResult>;
+//# sourceMappingURL=execfn.d.ts.map

package/dist/src/execfn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execfn.d.ts","sourceRoot":"","sources":["../../src/execfn.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,QAAQ;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;kBAEc;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;8BAC0B;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3F,qBAAa,SAAU,SAAQ,KAAK;IAEhC,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU;gBAFlB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,UAAU;CAO9B;AAED,6DAA6D;AAC7D,eAAO,MAAM,QAAQ,EAAE,MA0BnB,CAAC;AAEL,wCAAwC;AACxC,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAAC,UAAU,CAAC,CAIrB"}

package/dist/src/execfn.js

@@ -0,0 +1,55 @@
+// The process-exec primitive every git, tmux and pi command goes through: an
+// injectable ExecFn, so tests can record invocations instead of spawning
+// anything. A leaf with no repo imports, so the review core (the delta reader,
+// packages/pi-plugin/src/prdelta.ts) and the CLI use it without reaching src/tmux.ts.
+import { spawn } from "node:child_process";
+export class ExecError extends Error {
+    cmd;
+    args;
+    result;
+    constructor(cmd, args, result) {
+        super(`${cmd} ${args.join(" ")} exited ${result.code}: ${result.stderr.trim() || result.stdout.trim()}`);
+        this.cmd = cmd;
+        this.args = args;
+        this.result = result;
+        this.name = "ExecError";
+    }
+}
+/** Default ExecFn: spawn, capture, never inherit a shell. */
+export const nodeExec = (cmd, args, opts = {}) => new Promise((resolvePromise, reject) => {
+    const child = spawn(cmd, args, {
+        cwd: opts.cwd,
+        env: opts.env,
+        stdio: [opts.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+        ...(opts.signal ? { signal: opts.signal, killSignal: "SIGKILL" } : {}),
+    });
+    let stdout = "";
+    let stderr = "";
+    let timer;
+    if (opts.timeoutMs)
+        timer = setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs);
+    child.stdout?.on("data", (d) => (stdout += String(d)));
+    child.stderr?.on("data", (d) => (stderr += String(d)));
+    child.on("error", (err) => {
+        if (timer)
+            clearTimeout(timer);
+        reject(err);
+    });
+    child.on("close", (code) => {
+        if (timer)
+            clearTimeout(timer);
+        resolvePromise({ code: code ?? -1, stdout, stderr });
+    });
+    if (opts.input !== undefined) {
+        child.stdin?.write(opts.input);
+        child.stdin?.end();
+    }
+});
+/** Run and throw on a non-zero exit. */
+export async function runOrThrow(exec, cmd, args, opts) {
+    const res = await exec(cmd, args, opts);
+    if (res.code !== 0)
+        throw new ExecError(cmd, args, res);
+    return res;
+}
+//# sourceMappingURL=execfn.js.map

package/dist/src/execfn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execfn.js","sourceRoot":"","sources":["../../src/execfn.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,sFAAsF;AACtF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAuB3C,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEvB;IACA;IACA;IAHX,YACW,GAAW,EACX,IAAc,EACd,MAAkB;QAE3B,KAAK,CACH,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAClG,CAAC;QANO,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAU;QACd,WAAM,GAAN,MAAM,CAAY;QAK3B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,QAAQ,GAAW,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CACvD,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAiC,CAAC;IACtC,IAAI,IAAI,CAAC,SAAS;QAAE,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACpF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACxB,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,GAAW,EACX,IAAc,EACd,IAAe;IAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC"}