@rallycry/conveyor-agent 10.13.9 → 10.13.11

package/dist/chunk-IE7EOKMD.js

@@ -0,0 +1,55 @@
+// src/workbench/protocol.ts
+import crypto from "crypto";
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function parseLine(line) {
+  if (!line) return null;
+  try {
+    const parsed = JSON.parse(line);
+    return isRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+var FrameReader = class {
+  constructor(onFrame) {
+    this.onFrame = onFrame;
+  }
+  onFrame;
+  buffer = "";
+  push(chunk) {
+    this.buffer += chunk.toString();
+    let index = this.buffer.indexOf("\n");
+    while (index >= 0) {
+      const line = this.buffer.slice(0, index);
+      this.buffer = this.buffer.slice(index + 1);
+      const frame = parseLine(line);
+      if (frame) this.onFrame(frame);
+      index = this.buffer.indexOf("\n");
+    }
+  }
+};
+function writeFrame(socket, frame) {
+  try {
+    socket.write(`${JSON.stringify(frame)}
+`);
+  } catch {
+  }
+}
+var DEFAULT_WORKBENCH_PORT = 7411;
+function timingSafeTokenEqual(a, b) {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ab.length !== bb.length) return false;
+  return crypto.timingSafeEqual(ab, bb);
+}
+
+export {
+  parseLine,
+  FrameReader,
+  writeFrame,
+  DEFAULT_WORKBENCH_PORT,
+  timingSafeTokenEqual
+};
+//# sourceMappingURL=chunk-IE7EOKMD.js.map

package/dist/chunk-IE7EOKMD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/workbench/protocol.ts"],"sourcesContent":["/**\n * Wire protocol for the workbench launcher — the loopback control channel\n * between the protected agent container and the restartable workbench\n * container (see docs/superpowers/specs/2026-07-16-workbench-container-split-design.md).\n *\n * Newline-delimited JSON frames over a plain TCP socket. Every connection\n * carries exactly ONE operation: the first client frame is a WorkbenchRequest\n * (with the shared token); everything after is a WorkbenchFrame in either\n * direction. Binary payloads (pty bytes, file contents, snapshot tarballs)\n * ride base64 `d` fields — intra-pod loopback makes the 33% inflation cheap,\n * and NDJSON keeps the framing trivially robust across partial reads.\n */\n\nimport crypto from \"node:crypto\";\nimport type { Socket } from \"node:net\";\n\n/** First frame of every connection (client → server). */\nexport type WorkbenchRequest =\n  | { op: \"ping\"; token: string }\n  | {\n      op: \"exec\";\n      token: string;\n      /** Shell form — spawned as `sh -c command` (setup/start commands). */\n      command?: string;\n      /** Argv form — spawned directly, no shell (git and friends). */\n      argv?: string[];\n      cwd: string;\n      env?: Record<string, string>;\n    }\n  | {\n      op: \"pty\";\n      token: string;\n      file: string;\n      args: string[];\n      cwd: string;\n      env: Record<string, string>;\n      cols: number;\n      rows: number;\n    }\n  | { op: \"snapshotBuild\"; token: string; cwd: string }\n  | { op: \"snapshotExtract\"; token: string; cwd: string }\n  | { op: \"readFile\"; token: string; path: string }\n  | { op: \"stat\"; token: string; path: string }\n  | { op: \"readdir\"; token: string; path: string };\n\n/** Mid-stream frames (either direction after the opening request). */\nexport type WorkbenchFrame =\n  | { t: \"out\"; s: \"stdout\" | \"stderr\"; d: string }\n  | { t: \"exit\"; code: number | null; signal: string | null }\n  | { t: \"data\"; d: string }\n  | { t: \"end\" }\n  | { t: \"input\"; d: string }\n  | { t: \"resize\"; cols: number; rows: number }\n  | { t: \"kill\"; sig?: string }\n  | { t: \"signal\"; mode: \"term-group\" }\n  | {\n      t: \"meta\";\n      sizeBytes: number;\n      fileCount: number;\n      deletionCount: number;\n      capturedAt: number;\n    }\n  | { t: \"result\"; value: unknown }\n  | {\n      t: \"stat\";\n      exists: boolean;\n      isFile: boolean;\n      isDirectory: boolean;\n      size: number;\n      mtimeMs: number;\n    }\n  | { t: \"entries\"; names: string[] }\n  | { t: \"pong\"; version: string }\n  | { t: \"error\"; message: string; code?: string };\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\n/** Parse one NDJSON line into a frame-shaped record, or null when malformed. */\nexport function parseLine(line: string): Record<string, unknown> | null {\n  if (!line) return null;\n  try {\n    const parsed: unknown = JSON.parse(line);\n    return isRecord(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Incremental NDJSON reader. Feed raw socket chunks; complete lines are\n * parsed and handed to the callback (malformed lines are dropped — the same\n * contract as the hook socket's envelope parsing).\n */\nexport class FrameReader {\n  private buffer = \"\";\n\n  constructor(private readonly onFrame: (frame: Record<string, unknown>) => void) {}\n\n  push(chunk: Buffer | string): void {\n    this.buffer += chunk.toString();\n    let index = this.buffer.indexOf(\"\\n\");\n    while (index >= 0) {\n      const line = this.buffer.slice(0, index);\n      this.buffer = this.buffer.slice(index + 1);\n      const frame = parseLine(line);\n      if (frame) this.onFrame(frame);\n      index = this.buffer.indexOf(\"\\n\");\n    }\n  }\n}\n\n/** Serialize + write one frame. Write errors are the socket's problem —\n *  callers handle teardown via the socket's own error/close events. */\nexport function writeFrame(\n  socket: Pick<Socket, \"write\">,\n  frame: WorkbenchRequest | WorkbenchFrame,\n): void {\n  try {\n    socket.write(`${JSON.stringify(frame)}\\n`);\n  } catch {\n    /* socket already destroyed — close handling owns cleanup */\n  }\n}\n\nexport const DEFAULT_WORKBENCH_PORT = 7411;\n\n/** Matches the timingSafeEqualStr helper used for every other shared-secret\n *  comparison in the codebase (preview-resolve.ts, workspace-attach-token.ts,\n *  snapshot-link.ts) — constant-time so the loopback auth check can't leak\n *  the token via response-time. */\nexport function timingSafeTokenEqual(a: string, b: string): boolean {\n  const ab = Buffer.from(a);\n  const bb = Buffer.from(b);\n  if (ab.length !== bb.length) return false;\n  return crypto.timingSafeEqual(ab, bb);\n}\n"],"mappings":";AAaA,OAAO,YAAY;AA8DnB,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU;AAChD;AAGO,SAAS,UAAU,MAA8C;AACtE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,IAAI;AACvC,WAAO,SAAS,MAAM,IAAI,SAAS;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,IAAM,cAAN,MAAkB;AAAA,EAGvB,YAA6B,SAAmD;AAAnD;AAAA,EAAoD;AAAA,EAApD;AAAA,EAFrB,SAAS;AAAA,EAIjB,KAAK,OAA8B;AACjC,SAAK,UAAU,MAAM,SAAS;AAC9B,QAAI,QAAQ,KAAK,OAAO,QAAQ,IAAI;AACpC,WAAO,SAAS,GAAG;AACjB,YAAM,OAAO,KAAK,OAAO,MAAM,GAAG,KAAK;AACvC,WAAK,SAAS,KAAK,OAAO,MAAM,QAAQ,CAAC;AACzC,YAAM,QAAQ,UAAU,IAAI;AAC5B,UAAI,MAAO,MAAK,QAAQ,KAAK;AAC7B,cAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,IAClC;AAAA,EACF;AACF;AAIO,SAAS,WACd,QACA,OACM;AACN,MAAI;AACF,WAAO,MAAM,GAAG,KAAK,UAAU,KAAK,CAAC;AAAA,CAAI;AAAA,EAC3C,QAAQ;AAAA,EAER;AACF;AAEO,IAAM,yBAAyB;AAM/B,SAAS,qBAAqB,GAAW,GAAoB;AAClE,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,MAAI,GAAG,WAAW,GAAG,OAAQ,QAAO;AACpC,SAAO,OAAO,gBAAgB,IAAI,EAAE;AACtC;","names":[]}

package/dist/chunk-YRC57EYG.js

@@ -0,0 +1,413 @@
+import {
+  workbenchPort,
+  workbenchToken
+} from "./chunk-4VUQ2NPF.js";
+import {
+  DEFAULT_WORKBENCH_PORT,
+  FrameReader,
+  writeFrame
+} from "./chunk-IE7EOKMD.js";
+
+// src/workbench/client.ts
+import { createReadStream, createWriteStream } from "fs";
+import { connect } from "net";
+
+// src/workbench/errors.ts
+var WorkbenchError = class extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.name = "WorkbenchError";
+    if (code) this.code = code;
+  }
+};
+
+// src/workbench/remote-process.ts
+import { EventEmitter } from "events";
+var RemoteProcessHandle = class extends EventEmitter {
+  constructor(sendSignal) {
+    super();
+    this.sendSignal = sendSignal;
+  }
+  sendSignal;
+  pid = void 0;
+  exitCode = null;
+  kill(_signal) {
+    this.sendSignal();
+    return true;
+  }
+};
+
+// src/workbench/client.ts
+function frameError(frame) {
+  return new WorkbenchError(frame.message, frame.code);
+}
+var WorkbenchClient = class {
+  port;
+  host;
+  token;
+  constructor(options = {}) {
+    this.port = options.port ?? workbenchPort() ?? DEFAULT_WORKBENCH_PORT;
+    this.host = options.host ?? "127.0.0.1";
+    this.token = options.token ?? workbenchToken();
+  }
+  /** Open a connection, send the request, route response frames. */
+  open(request, onFrame, onClose) {
+    const socket = connect(this.port, this.host);
+    let sawError;
+    const reader = new FrameReader((raw) => {
+      const frame = raw;
+      if (frame.t === "error") {
+        sawError = frameError(frame);
+      }
+      onFrame(frame, socket);
+    });
+    socket.on("connect", () => {
+      writeFrame(socket, { ...request, token: this.token });
+    });
+    socket.on("data", (chunk) => reader.push(chunk));
+    socket.on("error", (err) => {
+      sawError ??= err;
+    });
+    socket.on("close", () => onClose(sawError));
+    return socket;
+  }
+  ping() {
+    return new Promise((resolve, reject) => {
+      let version = null;
+      this.open(
+        { op: "ping" },
+        (frame) => {
+          if (frame.t === "pong") version = frame.version;
+        },
+        (error) => {
+          if (version === null) {
+            reject(error ?? new WorkbenchError("connection closed before pong"));
+          } else {
+            resolve(version);
+          }
+        }
+      );
+    });
+  }
+  /** Mirrors setup/commands.ts runSetupCommand (shell form, streamed output,
+   *  abort → graceful term-group kill, non-zero exit rejects). */
+  runSetupCommand(cmd, cwd, onOutput, signal) {
+    return new Promise((resolve, reject) => {
+      if (signal?.aborted) {
+        const error = new Error("Operation aborted");
+        error.name = "AbortError";
+        reject(error);
+        return;
+      }
+      let exitCode = null;
+      let exited = false;
+      let aborting = false;
+      const socket = this.open(
+        { op: "exec", command: cmd, cwd },
+        (frame) => {
+          if (frame.t === "out" && !aborting) {
+            onOutput(frame.s, Buffer.from(frame.d, "base64").toString("utf8"));
+          } else if (frame.t === "exit") {
+            exited = true;
+            exitCode = frame.code;
+          }
+        },
+        (error) => {
+          signal?.removeEventListener("abort", onAbort);
+          if (aborting) {
+            const abortError = new Error("Operation aborted");
+            abortError.name = "AbortError";
+            reject(abortError);
+          } else if (!exited) {
+            reject(error ?? new WorkbenchError("connection closed before exit"));
+          } else if (exitCode === 0) {
+            resolve();
+          } else {
+            reject(new Error(`Setup command exited with code ${exitCode}`));
+          }
+        }
+      );
+      const onAbort = () => {
+        if (exited || aborting) return;
+        aborting = true;
+        writeFrame(socket, { t: "signal", mode: "term-group" });
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  /** Mirrors setup/commands.ts runStartCommand: returns a live handle that
+   *  emits exit/error and whose kill() runs the graceful term-group stop. */
+  runStartCommand(cmd, cwd, onOutput) {
+    let socket;
+    const handle = new RemoteProcessHandle(() => {
+      if (socket) writeFrame(socket, { t: "signal", mode: "term-group" });
+    });
+    let exited = false;
+    socket = this.open(
+      { op: "exec", command: cmd, cwd },
+      (frame) => {
+        if (frame.t === "out") {
+          onOutput(frame.s, Buffer.from(frame.d, "base64").toString("utf8"));
+        } else if (frame.t === "exit") {
+          exited = true;
+          handle.exitCode = frame.code ?? (frame.signal ? null : 0);
+          handle.emit("exit", frame.code, frame.signal);
+        }
+      },
+      (error) => {
+        if (!exited) {
+          exited = true;
+          handle.exitCode = handle.exitCode ?? 1;
+          handle.emit(
+            "error",
+            error ?? new WorkbenchError("workbench connection lost", "workbench_gone")
+          );
+          handle.emit("exit", handle.exitCode, null);
+        }
+      }
+    );
+    return handle;
+  }
+  /** Mirrors promisified execFile (argv form, no shell): resolves stdout,
+   *  rejects with stderr-bearing error on non-zero exit. */
+  execFile(file, args, opts = {}) {
+    return new Promise((resolve, reject) => {
+      const stdout = [];
+      const stderr = [];
+      let exitCode = null;
+      let exitSignal = null;
+      let exited = false;
+      let timedOut = false;
+      const socket = this.open(
+        { op: "exec", argv: [file, ...args], cwd: opts.cwd ?? process.cwd() },
+        (frame) => {
+          if (frame.t === "out") {
+            (frame.s === "stdout" ? stdout : stderr).push(Buffer.from(frame.d, "base64"));
+          } else if (frame.t === "exit") {
+            exited = true;
+            exitCode = frame.code;
+            exitSignal = frame.signal;
+          }
+        },
+        (error) => {
+          if (timer) clearTimeout(timer);
+          const out = Buffer.concat(stdout).toString("utf8");
+          const errText = Buffer.concat(stderr).toString("utf8");
+          if (!exited) {
+            reject(error ?? new WorkbenchError("connection closed before exit"));
+          } else if (exitCode === 0) {
+            resolve({ stdout: out, stderr: errText });
+          } else {
+            const failure = new Error(
+              timedOut ? `Command timed out: ${file}` : `Command failed: ${file} ${args.join(" ")}
+${errText}`
+            );
+            failure.code = exitCode;
+            failure.signal = exitSignal;
+            failure.stdout = out;
+            failure.stderr = errText;
+            reject(failure);
+          }
+        }
+      );
+      const timer = opts.timeout ? setTimeout(() => {
+        timedOut = true;
+        writeFrame(socket, { t: "signal", mode: "term-group" });
+      }, opts.timeout) : null;
+      timer?.unref();
+    });
+  }
+  /**
+   * Synchronous PtySpawn adapter: returns a PtyProcess immediately; writes
+   * and resizes are queued until the connection opens. Exit surfaces through
+   * onExit exactly as node-pty's would (a lost connection = exit code 1 —
+   * the session's finalizeOnExit path treats it as a crashed CLI).
+   */
+  spawnPty(file, args, options) {
+    const dataListeners = [];
+    const exitListeners = [];
+    let connected = false;
+    let exited = false;
+    const preConnectQueue = [];
+    const socket = this.open(
+      {
+        op: "pty",
+        file,
+        args,
+        cwd: options.cwd,
+        env: options.env,
+        cols: options.cols,
+        rows: options.rows
+      },
+      (frame) => {
+        if (frame.t === "data") {
+          const text = Buffer.from(frame.d, "base64").toString("utf8");
+          for (const listener of dataListeners) listener(text);
+        } else if (frame.t === "exit") {
+          exited = true;
+          for (const listener of exitListeners) listener({ exitCode: frame.code ?? 1 });
+        }
+      },
+      () => {
+        if (!exited) {
+          exited = true;
+          for (const listener of exitListeners) listener({ exitCode: 1 });
+        }
+      }
+    );
+    socket.on("connect", () => {
+      connected = true;
+      for (const frame of preConnectQueue.splice(0)) writeFrame(socket, frame);
+    });
+    const send = (frame) => {
+      if (exited) return;
+      if (connected) writeFrame(socket, frame);
+      else preConnectQueue.push(frame);
+    };
+    return {
+      onData: (listener) => dataListeners.push(listener),
+      onExit: (listener) => exitListeners.push(listener),
+      write: (data) => send({ t: "input", d: Buffer.from(data, "utf8").toString("base64") }),
+      resize: (cols, rows) => send({ t: "resize", cols, rows }),
+      kill: (sig) => send({ t: "kill", ...sig ? { sig } : {} })
+    };
+  }
+  /** Build a snapshot of `cwd` in the workbench and stream the tar.gz to
+   *  `destPath` on the agent side (the upload path streams from disk). */
+  buildSnapshot(cwd, destPath) {
+    return new Promise((resolve, reject) => {
+      let meta = null;
+      let ended = false;
+      const out = createWriteStream(destPath);
+      let writeFailure = null;
+      out.on("error", (err) => {
+        writeFailure = err;
+      });
+      this.open(
+        { op: "snapshotBuild", cwd },
+        (frame) => {
+          if (frame.t === "meta") {
+            meta = {
+              sizeBytes: frame.sizeBytes,
+              fileCount: frame.fileCount,
+              deletionCount: frame.deletionCount,
+              capturedAt: frame.capturedAt
+            };
+          } else if (frame.t === "data") {
+            out.write(Buffer.from(frame.d, "base64"));
+          } else if (frame.t === "end") {
+            ended = true;
+          }
+        },
+        (error) => {
+          out.end(() => {
+            if (writeFailure) reject(writeFailure);
+            else if (error) reject(error);
+            else if (!ended || !meta) {
+              reject(new WorkbenchError("snapshot stream ended prematurely"));
+            } else resolve({ ...meta, tarPath: destPath });
+          });
+        }
+      );
+    });
+  }
+  /** Stream a local tar.gz up and extract it into `cwd` in the workbench. */
+  extractSnapshot(cwd, tarPath) {
+    return new Promise((resolve, reject) => {
+      let result = null;
+      const socket = this.open(
+        { op: "snapshotExtract", cwd },
+        (frame) => {
+          if (frame.t === "result") result = frame.value;
+        },
+        (error) => {
+          if (result) resolve(result);
+          else reject(error ?? new WorkbenchError("connection closed before result"));
+        }
+      );
+      socket.on("connect", () => {
+        const stream = createReadStream(tarPath, { highWaterMark: 64 * 1024 });
+        stream.on("data", (chunk) => {
+          writeFrame(socket, { t: "data", d: Buffer.from(chunk).toString("base64") });
+        });
+        stream.on("end", () => writeFrame(socket, { t: "end" }));
+        stream.on("error", (err) => {
+          socket.destroy(err);
+        });
+      });
+    });
+  }
+  readFile(path) {
+    return new Promise((resolve, reject) => {
+      const chunks = [];
+      let ended = false;
+      this.open(
+        { op: "readFile", path },
+        (frame) => {
+          if (frame.t === "data") chunks.push(Buffer.from(frame.d, "base64"));
+          else if (frame.t === "end") ended = true;
+        },
+        (error) => {
+          if (ended) resolve(Buffer.concat(chunks));
+          else reject(error ?? new WorkbenchError("connection closed before end"));
+        }
+      );
+    });
+  }
+  stat(path) {
+    return new Promise((resolve, reject) => {
+      let stat = null;
+      this.open(
+        { op: "stat", path },
+        (frame) => {
+          if (frame.t === "stat") {
+            stat = {
+              exists: frame.exists,
+              isFile: frame.isFile,
+              isDirectory: frame.isDirectory,
+              size: frame.size,
+              mtimeMs: frame.mtimeMs
+            };
+          }
+        },
+        (error) => {
+          if (stat) resolve(stat);
+          else reject(error ?? new WorkbenchError("connection closed before stat"));
+        }
+      );
+    });
+  }
+  readdir(path) {
+    return new Promise((resolve, reject) => {
+      let entries = null;
+      this.open(
+        { op: "readdir", path },
+        (frame) => {
+          if (frame.t === "entries") entries = frame.names;
+        },
+        (error) => {
+          if (entries) resolve(entries);
+          else reject(error ?? new WorkbenchError("connection closed before entries"));
+        }
+      );
+    });
+  }
+};
+var singleton = null;
+function getWorkbenchClient() {
+  singleton ??= new WorkbenchClient();
+  return singleton;
+}
+function resetWorkbenchClient() {
+  singleton = null;
+}
+
+export {
+  WorkbenchError,
+  RemoteProcessHandle,
+  WorkbenchClient,
+  getWorkbenchClient,
+  resetWorkbenchClient
+};
+//# sourceMappingURL=chunk-YRC57EYG.js.map

package/dist/chunk-YRC57EYG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/workbench/client.ts","../src/workbench/errors.ts","../src/workbench/remote-process.ts"],"sourcesContent":["/**\n * Client half of the workbench launcher protocol. Runs in the protected agent\n * container; every method opens one loopback connection, sends the request\n * frame, and adapts the stream back to the local signature it replaces\n * (runSetupCommand, runStartCommand, execFile, PtySpawn, snapshot build/\n * extract, workspace file reads). See server.ts / protocol.ts.\n */\n\nimport { createReadStream, createWriteStream } from \"node:fs\";\nimport { connect, type Socket } from \"node:net\";\nimport type { PtyProcess, PtySpawnOptions } from \"../harness/pty/pty-support.js\";\nimport type { SnapshotExtractResult } from \"../runner/work-preservation/snapshot-tar.js\";\nimport { WorkbenchError } from \"./errors.js\";\nimport { RemoteProcessHandle } from \"./remote-process.js\";\n\nexport { WorkbenchError } from \"./errors.js\";\nexport { RemoteProcessHandle } from \"./remote-process.js\";\nimport { workbenchPort, workbenchToken } from \"./mode.js\";\nimport {\n  DEFAULT_WORKBENCH_PORT,\n  FrameReader,\n  writeFrame,\n  type WorkbenchFrame,\n  type WorkbenchRequest,\n} from \"./protocol.js\";\n\nexport interface WorkbenchClientOptions {\n  port?: number;\n  token?: string;\n  host?: string;\n}\n\n/** Metadata for a snapshot built remotely and streamed to a local tar path. */\nexport interface RemoteSnapshotMeta {\n  tarPath: string;\n  sizeBytes: number;\n  fileCount: number;\n  deletionCount: number;\n  capturedAt: number;\n}\n\n/** Omit that distributes over a discriminated union (plain Omit collapses\n *  the union to its common properties). */\ntype DistributiveOmit<T, K extends PropertyKey> = T extends unknown ? Omit<T, K> : never;\n\nfunction frameError(frame: Extract<WorkbenchFrame, { t: \"error\" }>): WorkbenchError {\n  return new WorkbenchError(frame.message, frame.code);\n}\n\nexport class WorkbenchClient {\n  private readonly port: number;\n  private readonly host: string;\n  private readonly token: string;\n\n  constructor(options: WorkbenchClientOptions = {}) {\n    this.port = options.port ?? workbenchPort() ?? DEFAULT_WORKBENCH_PORT;\n    this.host = options.host ?? \"127.0.0.1\";\n    this.token = options.token ?? workbenchToken();\n  }\n\n  /** Open a connection, send the request, route response frames. */\n  private open(\n    request: DistributiveOmit<WorkbenchRequest, \"token\">,\n    onFrame: (frame: WorkbenchFrame, socket: Socket) => void,\n    onClose: (error?: Error) => void,\n  ): Socket {\n    const socket = connect(this.port, this.host);\n    let sawError: Error | undefined;\n    const reader = new FrameReader((raw) => {\n      const frame = raw as unknown as WorkbenchFrame;\n      if (frame.t === \"error\") {\n        sawError = frameError(frame as Extract<WorkbenchFrame, { t: \"error\" }>);\n      }\n      onFrame(frame, socket);\n    });\n    socket.on(\"connect\", () => {\n      writeFrame(socket, { ...request, token: this.token } as WorkbenchRequest);\n    });\n    socket.on(\"data\", (chunk) => reader.push(chunk));\n    socket.on(\"error\", (err) => {\n      sawError ??= err;\n    });\n    socket.on(\"close\", () => onClose(sawError));\n    return socket;\n  }\n\n  ping(): Promise<string> {\n    return new Promise((resolve, reject) => {\n      let version: string | null = null;\n      this.open(\n        { op: \"ping\" },\n        (frame) => {\n          if (frame.t === \"pong\") version = frame.version;\n        },\n        (error) => {\n          if (version === null) {\n            reject(error ?? new WorkbenchError(\"connection closed before pong\"));\n          } else {\n            resolve(version);\n          }\n        },\n      );\n    });\n  }\n\n  /** Mirrors setup/commands.ts runSetupCommand (shell form, streamed output,\n   *  abort → graceful term-group kill, non-zero exit rejects). */\n  runSetupCommand(\n    cmd: string,\n    cwd: string,\n    onOutput: (stream: \"stdout\" | \"stderr\", data: string) => void,\n    signal?: AbortSignal,\n  ): Promise<void> {\n    return new Promise((resolve, reject) => {\n      if (signal?.aborted) {\n        const error = new Error(\"Operation aborted\");\n        error.name = \"AbortError\";\n        reject(error);\n        return;\n      }\n      let exitCode: number | null = null;\n      let exited = false;\n      let aborting = false;\n      const socket = this.open(\n        { op: \"exec\", command: cmd, cwd },\n        (frame) => {\n          if (frame.t === \"out\" && !aborting) {\n            onOutput(frame.s, Buffer.from(frame.d, \"base64\").toString(\"utf8\"));\n          } else if (frame.t === \"exit\") {\n            exited = true;\n            exitCode = frame.code;\n          }\n        },\n        (error) => {\n          signal?.removeEventListener(\"abort\", onAbort);\n          if (aborting) {\n            const abortError = new Error(\"Operation aborted\");\n            abortError.name = \"AbortError\";\n            reject(abortError);\n          } else if (!exited) {\n            reject(error ?? new WorkbenchError(\"connection closed before exit\"));\n          } else if (exitCode === 0) {\n            resolve();\n          } else {\n            reject(new Error(`Setup command exited with code ${exitCode}`));\n          }\n        },\n      );\n      const onAbort = (): void => {\n        if (exited || aborting) return;\n        aborting = true;\n        writeFrame(socket, { t: \"signal\", mode: \"term-group\" });\n      };\n      signal?.addEventListener(\"abort\", onAbort, { once: true });\n    });\n  }\n\n  /** Mirrors setup/commands.ts runStartCommand: returns a live handle that\n   *  emits exit/error and whose kill() runs the graceful term-group stop. */\n  runStartCommand(\n    cmd: string,\n    cwd: string,\n    onOutput: (stream: \"stdout\" | \"stderr\", data: string) => void,\n  ): RemoteProcessHandle {\n    let socket: Socket | undefined;\n    const handle = new RemoteProcessHandle(() => {\n      if (socket) writeFrame(socket, { t: \"signal\", mode: \"term-group\" });\n    });\n    let exited = false;\n    socket = this.open(\n      { op: \"exec\", command: cmd, cwd },\n      (frame) => {\n        if (frame.t === \"out\") {\n          onOutput(frame.s, Buffer.from(frame.d, \"base64\").toString(\"utf8\"));\n        } else if (frame.t === \"exit\") {\n          exited = true;\n          handle.exitCode = frame.code ?? (frame.signal ? null : 0);\n          handle.emit(\"exit\", frame.code, frame.signal);\n        }\n      },\n      (error) => {\n        if (!exited) {\n          // Connection died without an exit frame (launcher restart, network\n          // teardown): surface as an error + synthetic exit so the supervisor\n          // observes the process ending rather than hanging on it forever.\n          exited = true;\n          handle.exitCode = handle.exitCode ?? 1;\n          handle.emit(\n            \"error\",\n            error ?? new WorkbenchError(\"workbench connection lost\", \"workbench_gone\"),\n          );\n          handle.emit(\"exit\", handle.exitCode, null);\n        }\n      },\n    );\n    return handle;\n  }\n\n  /** Mirrors promisified execFile (argv form, no shell): resolves stdout,\n   *  rejects with stderr-bearing error on non-zero exit. */\n  execFile(\n    file: string,\n    args: string[],\n    opts: { cwd?: string; timeout?: number; maxBuffer?: number } = {},\n  ): Promise<{ stdout: string; stderr: string }> {\n    return new Promise((resolve, reject) => {\n      const stdout: Buffer[] = [];\n      const stderr: Buffer[] = [];\n      let exitCode: number | null = null;\n      let exitSignal: string | null = null;\n      let exited = false;\n      let timedOut = false;\n      const socket = this.open(\n        { op: \"exec\", argv: [file, ...args], cwd: opts.cwd ?? process.cwd() },\n        (frame) => {\n          if (frame.t === \"out\") {\n            (frame.s === \"stdout\" ? stdout : stderr).push(Buffer.from(frame.d, \"base64\"));\n          } else if (frame.t === \"exit\") {\n            exited = true;\n            exitCode = frame.code;\n            exitSignal = frame.signal;\n          }\n        },\n        (error) => {\n          if (timer) clearTimeout(timer);\n          const out = Buffer.concat(stdout).toString(\"utf8\");\n          const errText = Buffer.concat(stderr).toString(\"utf8\");\n          if (!exited) {\n            reject(error ?? new WorkbenchError(\"connection closed before exit\"));\n          } else if (exitCode === 0) {\n            resolve({ stdout: out, stderr: errText });\n          } else {\n            const failure = new Error(\n              timedOut\n                ? `Command timed out: ${file}`\n                : `Command failed: ${file} ${args.join(\" \")}\\n${errText}`,\n            ) as Error & { code?: number | null; signal?: string | null; stdout: string; stderr: string };\n            failure.code = exitCode;\n            failure.signal = exitSignal;\n            failure.stdout = out;\n            failure.stderr = errText;\n            reject(failure);\n          }\n        },\n      );\n      const timer = opts.timeout\n        ? setTimeout(() => {\n            timedOut = true;\n            writeFrame(socket, { t: \"signal\", mode: \"term-group\" });\n          }, opts.timeout)\n        : null;\n      timer?.unref();\n    });\n  }\n\n  /**\n   * Synchronous PtySpawn adapter: returns a PtyProcess immediately; writes\n   * and resizes are queued until the connection opens. Exit surfaces through\n   * onExit exactly as node-pty's would (a lost connection = exit code 1 —\n   * the session's finalizeOnExit path treats it as a crashed CLI).\n   */\n  spawnPty(file: string, args: string[], options: PtySpawnOptions): PtyProcess {\n    const dataListeners: Array<(data: string) => void> = [];\n    const exitListeners: Array<(event: { exitCode: number }) => void> = [];\n    let connected = false;\n    let exited = false;\n    const preConnectQueue: WorkbenchFrame[] = [];\n\n    const socket = this.open(\n      {\n        op: \"pty\",\n        file,\n        args,\n        cwd: options.cwd,\n        env: options.env,\n        cols: options.cols,\n        rows: options.rows,\n      },\n      (frame) => {\n        if (frame.t === \"data\") {\n          const text = Buffer.from(frame.d, \"base64\").toString(\"utf8\");\n          for (const listener of dataListeners) listener(text);\n        } else if (frame.t === \"exit\") {\n          exited = true;\n          for (const listener of exitListeners) listener({ exitCode: frame.code ?? 1 });\n        }\n      },\n      () => {\n        if (!exited) {\n          exited = true;\n          for (const listener of exitListeners) listener({ exitCode: 1 });\n        }\n      },\n    );\n    socket.on(\"connect\", () => {\n      connected = true;\n      for (const frame of preConnectQueue.splice(0)) writeFrame(socket, frame);\n    });\n\n    const send = (frame: WorkbenchFrame): void => {\n      if (exited) return;\n      if (connected) writeFrame(socket, frame);\n      else preConnectQueue.push(frame);\n    };\n\n    return {\n      onData: (listener) => dataListeners.push(listener),\n      onExit: (listener) => exitListeners.push(listener),\n      write: (data) => send({ t: \"input\", d: Buffer.from(data, \"utf8\").toString(\"base64\") }),\n      resize: (cols, rows) => send({ t: \"resize\", cols, rows }),\n      kill: (sig) => send({ t: \"kill\", ...(sig ? { sig } : {}) }),\n    };\n  }\n\n  /** Build a snapshot of `cwd` in the workbench and stream the tar.gz to\n   *  `destPath` on the agent side (the upload path streams from disk). */\n  buildSnapshot(cwd: string, destPath: string): Promise<RemoteSnapshotMeta> {\n    return new Promise((resolve, reject) => {\n      let meta: Omit<RemoteSnapshotMeta, \"tarPath\"> | null = null;\n      let ended = false;\n      const out = createWriteStream(destPath);\n      let writeFailure: Error | null = null;\n      out.on(\"error\", (err) => {\n        writeFailure = err;\n      });\n      this.open(\n        { op: \"snapshotBuild\", cwd },\n        (frame) => {\n          if (frame.t === \"meta\") {\n            meta = {\n              sizeBytes: frame.sizeBytes,\n              fileCount: frame.fileCount,\n              deletionCount: frame.deletionCount,\n              capturedAt: frame.capturedAt,\n            };\n          } else if (frame.t === \"data\") {\n            out.write(Buffer.from(frame.d, \"base64\"));\n          } else if (frame.t === \"end\") {\n            ended = true;\n          }\n        },\n        (error) => {\n          out.end(() => {\n            if (writeFailure) reject(writeFailure);\n            else if (error) reject(error);\n            else if (!ended || !meta) {\n              reject(new WorkbenchError(\"snapshot stream ended prematurely\"));\n            } else resolve({ ...meta, tarPath: destPath });\n          });\n        },\n      );\n    });\n  }\n\n  /** Stream a local tar.gz up and extract it into `cwd` in the workbench. */\n  extractSnapshot(cwd: string, tarPath: string): Promise<SnapshotExtractResult> {\n    return new Promise((resolve, reject) => {\n      let result: SnapshotExtractResult | null = null;\n      const socket = this.open(\n        { op: \"snapshotExtract\", cwd },\n        (frame) => {\n          if (frame.t === \"result\") result = frame.value as SnapshotExtractResult;\n        },\n        (error) => {\n          if (result) resolve(result);\n          else reject(error ?? new WorkbenchError(\"connection closed before result\"));\n        },\n      );\n      socket.on(\"connect\", () => {\n        const stream = createReadStream(tarPath, { highWaterMark: 64 * 1024 });\n        stream.on(\"data\", (chunk) => {\n          writeFrame(socket, { t: \"data\", d: Buffer.from(chunk).toString(\"base64\") });\n        });\n        stream.on(\"end\", () => writeFrame(socket, { t: \"end\" }));\n        stream.on(\"error\", (err) => {\n          socket.destroy(err);\n        });\n      });\n    });\n  }\n\n  readFile(path: string): Promise<Buffer> {\n    return new Promise((resolve, reject) => {\n      const chunks: Buffer[] = [];\n      let ended = false;\n      this.open(\n        { op: \"readFile\", path },\n        (frame) => {\n          if (frame.t === \"data\") chunks.push(Buffer.from(frame.d, \"base64\"));\n          else if (frame.t === \"end\") ended = true;\n        },\n        (error) => {\n          if (ended) resolve(Buffer.concat(chunks));\n          else reject(error ?? new WorkbenchError(\"connection closed before end\"));\n        },\n      );\n    });\n  }\n\n  stat(path: string): Promise<{\n    exists: boolean;\n    isFile: boolean;\n    isDirectory: boolean;\n    size: number;\n    mtimeMs: number;\n  }> {\n    return new Promise((resolve, reject) => {\n      let stat: {\n        exists: boolean;\n        isFile: boolean;\n        isDirectory: boolean;\n        size: number;\n        mtimeMs: number;\n      } | null = null;\n      this.open(\n        { op: \"stat\", path },\n        (frame) => {\n          if (frame.t === \"stat\") {\n            stat = {\n              exists: frame.exists,\n              isFile: frame.isFile,\n              isDirectory: frame.isDirectory,\n              size: frame.size,\n              mtimeMs: frame.mtimeMs,\n            };\n          }\n        },\n        (error) => {\n          if (stat) resolve(stat);\n          else reject(error ?? new WorkbenchError(\"connection closed before stat\"));\n        },\n      );\n    });\n  }\n\n  readdir(path: string): Promise<string[]> {\n    return new Promise((resolve, reject) => {\n      let entries: string[] | null = null;\n      this.open(\n        { op: \"readdir\", path },\n        (frame) => {\n          if (frame.t === \"entries\") entries = frame.names;\n        },\n        (error) => {\n          if (entries) resolve(entries);\n          else reject(error ?? new WorkbenchError(\"connection closed before entries\"));\n        },\n      );\n    });\n  }\n}\n\nlet singleton: WorkbenchClient | null = null;\n\n/** Lazy env-configured client (split-mode pods). */\nexport function getWorkbenchClient(): WorkbenchClient {\n  singleton ??= new WorkbenchClient();\n  return singleton;\n}\n\n/** Test seam. */\nexport function resetWorkbenchClient(): void {\n  singleton = null;\n}\n","/** Error surfaced by the workbench client for launcher-side failures; `code`\n *  carries the remote error code (e.g. \"ENOENT\", \"unauthorized\") so callers'\n *  existing errno handling keeps working across the container boundary. */\nexport class WorkbenchError extends Error {\n  code?: string;\n  constructor(message: string, code?: string) {\n    super(message);\n    this.name = \"WorkbenchError\";\n    if (code) this.code = code;\n  }\n}\n","import { EventEmitter } from \"node:events\";\n\n/**\n * Structural stand-in for the ChildProcess surface the workspace-command\n * supervisor actually uses (pid/exitCode/kill + exit/error events) — see\n * ManagedChildProcess in setup/commands.ts. kill() requests the launcher's\n * graceful term-group sequence regardless of the signal argument.\n */\nexport class RemoteProcessHandle extends EventEmitter {\n  pid: number | undefined = undefined;\n  exitCode: number | null = null;\n\n  constructor(private readonly sendSignal: () => void) {\n    super();\n  }\n\n  kill(_signal?: NodeJS.Signals | number): boolean {\n    this.sendSignal();\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;;;AAQA,SAAS,kBAAkB,yBAAyB;AACpD,SAAS,eAA4B;;;ACN9B,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC;AAAA,EACA,YAAY,SAAiB,MAAe;AAC1C,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,QAAI,KAAM,MAAK,OAAO;AAAA,EACxB;AACF;;;ACVA,SAAS,oBAAoB;AAQtB,IAAM,sBAAN,cAAkC,aAAa;AAAA,EAIpD,YAA6B,YAAwB;AACnD,UAAM;AADqB;AAAA,EAE7B;AAAA,EAF6B;AAAA,EAH7B,MAA0B;AAAA,EAC1B,WAA0B;AAAA,EAM1B,KAAK,SAA4C;AAC/C,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AACF;;;AFyBA,SAAS,WAAW,OAAgE;AAClF,SAAO,IAAI,eAAe,MAAM,SAAS,MAAM,IAAI;AACrD;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACV;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,UAAkC,CAAC,GAAG;AAChD,SAAK,OAAO,QAAQ,QAAQ,cAAc,KAAK;AAC/C,SAAK,OAAO,QAAQ,QAAQ;AAC5B,SAAK,QAAQ,QAAQ,SAAS,eAAe;AAAA,EAC/C;AAAA;AAAA,EAGQ,KACN,SACA,SACA,SACQ;AACR,UAAM,SAAS,QAAQ,KAAK,MAAM,KAAK,IAAI;AAC3C,QAAI;AACJ,UAAM,SAAS,IAAI,YAAY,CAAC,QAAQ;AACtC,YAAM,QAAQ;AACd,UAAI,MAAM,MAAM,SAAS;AACvB,mBAAW,WAAW,KAAgD;AAAA,MACxE;AACA,cAAQ,OAAO,MAAM;AAAA,IACvB,CAAC;AACD,WAAO,GAAG,WAAW,MAAM;AACzB,iBAAW,QAAQ,EAAE,GAAG,SAAS,OAAO,KAAK,MAAM,CAAqB;AAAA,IAC1E,CAAC;AACD,WAAO,GAAG,QAAQ,CAAC,UAAU,OAAO,KAAK,KAAK,CAAC;AAC/C,WAAO,GAAG,SAAS,CAAC,QAAQ;AAC1B,mBAAa;AAAA,IACf,CAAC;AACD,WAAO,GAAG,SAAS,MAAM,QAAQ,QAAQ,CAAC;AAC1C,WAAO;AAAA,EACT;AAAA,EAEA,OAAwB;AACtB,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,UAAyB;AAC7B,WAAK;AAAA,QACH,EAAE,IAAI,OAAO;AAAA,QACb,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,OAAQ,WAAU,MAAM;AAAA,QAC1C;AAAA,QACA,CAAC,UAAU;AACT,cAAI,YAAY,MAAM;AACpB,mBAAO,SAAS,IAAI,eAAe,+BAA+B,CAAC;AAAA,UACrE,OAAO;AACL,oBAAQ,OAAO;AAAA,UACjB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,gBACE,KACA,KACA,UACA,QACe;AACf,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,QAAQ,SAAS;AACnB,cAAM,QAAQ,IAAI,MAAM,mBAAmB;AAC3C,cAAM,OAAO;AACb,eAAO,KAAK;AACZ;AAAA,MACF;AACA,UAAI,WAA0B;AAC9B,UAAI,SAAS;AACb,UAAI,WAAW;AACf,YAAM,SAAS,KAAK;AAAA,QAClB,EAAE,IAAI,QAAQ,SAAS,KAAK,IAAI;AAAA,QAChC,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,SAAS,CAAC,UAAU;AAClC,qBAAS,MAAM,GAAG,OAAO,KAAK,MAAM,GAAG,QAAQ,EAAE,SAAS,MAAM,CAAC;AAAA,UACnE,WAAW,MAAM,MAAM,QAAQ;AAC7B,qBAAS;AACT,uBAAW,MAAM;AAAA,UACnB;AAAA,QACF;AAAA,QACA,CAAC,UAAU;AACT,kBAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAI,UAAU;AACZ,kBAAM,aAAa,IAAI,MAAM,mBAAmB;AAChD,uBAAW,OAAO;AAClB,mBAAO,UAAU;AAAA,UACnB,WAAW,CAAC,QAAQ;AAClB,mBAAO,SAAS,IAAI,eAAe,+BAA+B,CAAC;AAAA,UACrE,WAAW,aAAa,GAAG;AACzB,oBAAQ;AAAA,UACV,OAAO;AACL,mBAAO,IAAI,MAAM,kCAAkC,QAAQ,EAAE,CAAC;AAAA,UAChE;AAAA,QACF;AAAA,MACF;AACA,YAAM,UAAU,MAAY;AAC1B,YAAI,UAAU,SAAU;AACxB,mBAAW;AACX,mBAAW,QAAQ,EAAE,GAAG,UAAU,MAAM,aAAa,CAAC;AAAA,MACxD;AACA,cAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,IAC3D,CAAC;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,gBACE,KACA,KACA,UACqB;AACrB,QAAI;AACJ,UAAM,SAAS,IAAI,oBAAoB,MAAM;AAC3C,UAAI,OAAQ,YAAW,QAAQ,EAAE,GAAG,UAAU,MAAM,aAAa,CAAC;AAAA,IACpE,CAAC;AACD,QAAI,SAAS;AACb,aAAS,KAAK;AAAA,MACZ,EAAE,IAAI,QAAQ,SAAS,KAAK,IAAI;AAAA,MAChC,CAAC,UAAU;AACT,YAAI,MAAM,MAAM,OAAO;AACrB,mBAAS,MAAM,GAAG,OAAO,KAAK,MAAM,GAAG,QAAQ,EAAE,SAAS,MAAM,CAAC;AAAA,QACnE,WAAW,MAAM,MAAM,QAAQ;AAC7B,mBAAS;AACT,iBAAO,WAAW,MAAM,SAAS,MAAM,SAAS,OAAO;AACvD,iBAAO,KAAK,QAAQ,MAAM,MAAM,MAAM,MAAM;AAAA,QAC9C;AAAA,MACF;AAAA,MACA,CAAC,UAAU;AACT,YAAI,CAAC,QAAQ;AAIX,mBAAS;AACT,iBAAO,WAAW,OAAO,YAAY;AACrC,iBAAO;AAAA,YACL;AAAA,YACA,SAAS,IAAI,eAAe,6BAA6B,gBAAgB;AAAA,UAC3E;AACA,iBAAO,KAAK,QAAQ,OAAO,UAAU,IAAI;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,SACE,MACA,MACA,OAA+D,CAAC,GACnB;AAC7C,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,SAAmB,CAAC;AAC1B,YAAM,SAAmB,CAAC;AAC1B,UAAI,WAA0B;AAC9B,UAAI,aAA4B;AAChC,UAAI,SAAS;AACb,UAAI,WAAW;AACf,YAAM,SAAS,KAAK;AAAA,QAClB,EAAE,IAAI,QAAQ,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,KAAK,KAAK,OAAO,QAAQ,IAAI,EAAE;AAAA,QACpE,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,OAAO;AACrB,aAAC,MAAM,MAAM,WAAW,SAAS,QAAQ,KAAK,OAAO,KAAK,MAAM,GAAG,QAAQ,CAAC;AAAA,UAC9E,WAAW,MAAM,MAAM,QAAQ;AAC7B,qBAAS;AACT,uBAAW,MAAM;AACjB,yBAAa,MAAM;AAAA,UACrB;AAAA,QACF;AAAA,QACA,CAAC,UAAU;AACT,cAAI,MAAO,cAAa,KAAK;AAC7B,gBAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACjD,gBAAM,UAAU,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACrD,cAAI,CAAC,QAAQ;AACX,mBAAO,SAAS,IAAI,eAAe,+BAA+B,CAAC;AAAA,UACrE,WAAW,aAAa,GAAG;AACzB,oBAAQ,EAAE,QAAQ,KAAK,QAAQ,QAAQ,CAAC;AAAA,UAC1C,OAAO;AACL,kBAAM,UAAU,IAAI;AAAA,cAClB,WACI,sBAAsB,IAAI,KAC1B,mBAAmB,IAAI,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,EAAK,OAAO;AAAA,YAC3D;AACA,oBAAQ,OAAO;AACf,oBAAQ,SAAS;AACjB,oBAAQ,SAAS;AACjB,oBAAQ,SAAS;AACjB,mBAAO,OAAO;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AACA,YAAM,QAAQ,KAAK,UACf,WAAW,MAAM;AACf,mBAAW;AACX,mBAAW,QAAQ,EAAE,GAAG,UAAU,MAAM,aAAa,CAAC;AAAA,MACxD,GAAG,KAAK,OAAO,IACf;AACJ,aAAO,MAAM;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,MAAc,MAAgB,SAAsC;AAC3E,UAAM,gBAA+C,CAAC;AACtD,UAAM,gBAA8D,CAAC;AACrE,QAAI,YAAY;AAChB,QAAI,SAAS;AACb,UAAM,kBAAoC,CAAC;AAE3C,UAAM,SAAS,KAAK;AAAA,MAClB;AAAA,QACE,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,QACA,KAAK,QAAQ;AAAA,QACb,KAAK,QAAQ;AAAA,QACb,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ;AAAA,MAChB;AAAA,MACA,CAAC,UAAU;AACT,YAAI,MAAM,MAAM,QAAQ;AACtB,gBAAM,OAAO,OAAO,KAAK,MAAM,GAAG,QAAQ,EAAE,SAAS,MAAM;AAC3D,qBAAW,YAAY,cAAe,UAAS,IAAI;AAAA,QACrD,WAAW,MAAM,MAAM,QAAQ;AAC7B,mBAAS;AACT,qBAAW,YAAY,cAAe,UAAS,EAAE,UAAU,MAAM,QAAQ,EAAE,CAAC;AAAA,QAC9E;AAAA,MACF;AAAA,MACA,MAAM;AACJ,YAAI,CAAC,QAAQ;AACX,mBAAS;AACT,qBAAW,YAAY,cAAe,UAAS,EAAE,UAAU,EAAE,CAAC;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,WAAO,GAAG,WAAW,MAAM;AACzB,kBAAY;AACZ,iBAAW,SAAS,gBAAgB,OAAO,CAAC,EAAG,YAAW,QAAQ,KAAK;AAAA,IACzE,CAAC;AAED,UAAM,OAAO,CAAC,UAAgC;AAC5C,UAAI,OAAQ;AACZ,UAAI,UAAW,YAAW,QAAQ,KAAK;AAAA,UAClC,iBAAgB,KAAK,KAAK;AAAA,IACjC;AAEA,WAAO;AAAA,MACL,QAAQ,CAAC,aAAa,cAAc,KAAK,QAAQ;AAAA,MACjD,QAAQ,CAAC,aAAa,cAAc,KAAK,QAAQ;AAAA,MACjD,OAAO,CAAC,SAAS,KAAK,EAAE,GAAG,SAAS,GAAG,OAAO,KAAK,MAAM,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;AAAA,MACrF,QAAQ,CAAC,MAAM,SAAS,KAAK,EAAE,GAAG,UAAU,MAAM,KAAK,CAAC;AAAA,MACxD,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG,QAAQ,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC,EAAG,CAAC;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,cAAc,KAAa,UAA+C;AACxE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,OAAmD;AACvD,UAAI,QAAQ;AACZ,YAAM,MAAM,kBAAkB,QAAQ;AACtC,UAAI,eAA6B;AACjC,UAAI,GAAG,SAAS,CAAC,QAAQ;AACvB,uBAAe;AAAA,MACjB,CAAC;AACD,WAAK;AAAA,QACH,EAAE,IAAI,iBAAiB,IAAI;AAAA,QAC3B,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,QAAQ;AACtB,mBAAO;AAAA,cACL,WAAW,MAAM;AAAA,cACjB,WAAW,MAAM;AAAA,cACjB,eAAe,MAAM;AAAA,cACrB,YAAY,MAAM;AAAA,YACpB;AAAA,UACF,WAAW,MAAM,MAAM,QAAQ;AAC7B,gBAAI,MAAM,OAAO,KAAK,MAAM,GAAG,QAAQ,CAAC;AAAA,UAC1C,WAAW,MAAM,MAAM,OAAO;AAC5B,oBAAQ;AAAA,UACV;AAAA,QACF;AAAA,QACA,CAAC,UAAU;AACT,cAAI,IAAI,MAAM;AACZ,gBAAI,aAAc,QAAO,YAAY;AAAA,qBAC5B,MAAO,QAAO,KAAK;AAAA,qBACnB,CAAC,SAAS,CAAC,MAAM;AACxB,qBAAO,IAAI,eAAe,mCAAmC,CAAC;AAAA,YAChE,MAAO,SAAQ,EAAE,GAAG,MAAM,SAAS,SAAS,CAAC;AAAA,UAC/C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,gBAAgB,KAAa,SAAiD;AAC5E,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,SAAuC;AAC3C,YAAM,SAAS,KAAK;AAAA,QAClB,EAAE,IAAI,mBAAmB,IAAI;AAAA,QAC7B,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,SAAU,UAAS,MAAM;AAAA,QAC3C;AAAA,QACA,CAAC,UAAU;AACT,cAAI,OAAQ,SAAQ,MAAM;AAAA,cACrB,QAAO,SAAS,IAAI,eAAe,iCAAiC,CAAC;AAAA,QAC5E;AAAA,MACF;AACA,aAAO,GAAG,WAAW,MAAM;AACzB,cAAM,SAAS,iBAAiB,SAAS,EAAE,eAAe,KAAK,KAAK,CAAC;AACrE,eAAO,GAAG,QAAQ,CAAC,UAAU;AAC3B,qBAAW,QAAQ,EAAE,GAAG,QAAQ,GAAG,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;AAAA,QAC5E,CAAC;AACD,eAAO,GAAG,OAAO,MAAM,WAAW,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACvD,eAAO,GAAG,SAAS,CAAC,QAAQ;AAC1B,iBAAO,QAAQ,GAAG;AAAA,QACpB,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,SAAS,MAA+B;AACtC,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,SAAmB,CAAC;AAC1B,UAAI,QAAQ;AACZ,WAAK;AAAA,QACH,EAAE,IAAI,YAAY,KAAK;AAAA,QACvB,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,OAAQ,QAAO,KAAK,OAAO,KAAK,MAAM,GAAG,QAAQ,CAAC;AAAA,mBACzD,MAAM,MAAM,MAAO,SAAQ;AAAA,QACtC;AAAA,QACA,CAAC,UAAU;AACT,cAAI,MAAO,SAAQ,OAAO,OAAO,MAAM,CAAC;AAAA,cACnC,QAAO,SAAS,IAAI,eAAe,8BAA8B,CAAC;AAAA,QACzE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,KAAK,MAMF;AACD,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,OAMO;AACX,WAAK;AAAA,QACH,EAAE,IAAI,QAAQ,KAAK;AAAA,QACnB,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,QAAQ;AACtB,mBAAO;AAAA,cACL,QAAQ,MAAM;AAAA,cACd,QAAQ,MAAM;AAAA,cACd,aAAa,MAAM;AAAA,cACnB,MAAM,MAAM;AAAA,cACZ,SAAS,MAAM;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AAAA,QACA,CAAC,UAAU;AACT,cAAI,KAAM,SAAQ,IAAI;AAAA,cACjB,QAAO,SAAS,IAAI,eAAe,+BAA+B,CAAC;AAAA,QAC1E;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,QAAQ,MAAiC;AACvC,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,UAA2B;AAC/B,WAAK;AAAA,QACH,EAAE,IAAI,WAAW,KAAK;AAAA,QACtB,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,UAAW,WAAU,MAAM;AAAA,QAC7C;AAAA,QACA,CAAC,UAAU;AACT,cAAI,QAAS,SAAQ,OAAO;AAAA,cACvB,QAAO,SAAS,IAAI,eAAe,kCAAkC,CAAC;AAAA,QAC7E;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,IAAI,YAAoC;AAGjC,SAAS,qBAAsC;AACpD,gBAAc,IAAI,gBAAgB;AAClC,SAAO;AACT;AAGO,SAAS,uBAA6B;AAC3C,cAAY;AACd;","names":[]}

package/dist/cli.js

@@ -12,7 +12,6 @@ import {
   TuiUnavailableError,
   applyBootstrapToEnv,
   awaitGitReady,
-  buildPromptBytes,
   buildSessionPreviewPorts,
   buildSynthesizedCredentials,
   claudeJsonPath,
@@ -21,21 +20,31 @@ import {
   defineTool,
   fetchBootstrap,
   findOnPath,
-  inheritedEnv,
   loadConveyorConfig,
   loadForwardPorts,
-  loadPtySpawn,
   parseUsageGauges,
   resolvePlaywrightMcpServer,
   resolveSessionStart,
-  runSetupCommand,
-  runStartCommand,
   runUsageProbe,
   sampleKeyUsage,
-  terminateProcessGroup,
   textResult
-} from "./chunk-PXQJ4NVO.js";
+} from "./chunk-DJPSNHVJ.js";
 import "./chunk-7TQO4ZF4.js";
+import {
+  getWorkbenchClient
+} from "./chunk-YRC57EYG.js";
+import {
+  workbenchEnabled
+} from "./chunk-4VUQ2NPF.js";
+import {
+  buildPromptBytes,
+  inheritedEnv,
+  loadPtySpawn,
+  runSetupCommand,
+  runStartCommand,
+  terminateProcessGroup
+} from "./chunk-2K6RRTQC.js";
+import "./chunk-IE7EOKMD.js";
 
 // src/cli.ts
 import { readFileSync } from "fs";
@@ -240,6 +249,19 @@ async function reportBootMilestone(opts) {
 }
 
 // src/setup/workspace-command-supervisor.ts
+function defaultCommandExecutors() {
+  if (workbenchEnabled()) {
+    const client = getWorkbenchClient();
+    return {
+      runSetupCommand: (command, cwd, onOutput, signal) => client.runSetupCommand(command, cwd, onOutput, signal),
+      runStartCommand: (cmd, cwd, onOutput) => client.runStartCommand(cmd, cwd, onOutput)
+    };
+  }
+  return {
+    runSetupCommand: (command, cwd, onOutput, signal) => runSetupCommand(command, cwd, onOutput, signal),
+    runStartCommand
+  };
+}
 var defaultWriteOutput = (stream, data) => {
   (stream === "stderr" ? process.stderr : process.stdout).write(data);
 };
@@ -291,8 +313,9 @@ var WorkspaceCommandSupervisor = class {
     }));
     this.startLazySidecarsFn = options.startLazySidecars ?? ((env, onLog, signal) => startLazySidecars(env, onLog, signal));
     this.waitForSidecarsFn = options.waitForSidecars ?? ((opts) => waitForSidecars({ onLog: opts.onLog, startLazy: opts.startLazy, signal: opts.signal }));
-    this.runSetupCommandFn = options.runSetupCommand ?? ((command, cwd, onOutput, signal) => runSetupCommand(command, cwd, onOutput, signal));
-    this.runStartCommandFn = options.runStartCommand ?? runStartCommand;
+    const executors = defaultCommandExecutors();
+    this.runSetupCommandFn = options.runSetupCommand ?? executors.runSetupCommand;
+    this.runStartCommandFn = options.runStartCommand ?? executors.runStartCommand;
     this.loadForwardPortsFn = options.loadForwardPorts ?? loadForwardPorts;
     this.writeOutput = options.writeOutput ?? defaultWriteOutput;
     this.terminateStartCommand = options.terminateStartCommand ?? terminateProcessGroup;
@@ -1989,6 +2012,27 @@ process.on("unhandledRejection", (reason) => {
   logAgentExit("unhandled_rejection", { exitCode: 1 });
   process.exit(1);
 });
+if (process.env.CONVEYOR_MODE === "workbench") {
+  const { startWorkbenchServer } = await import("./server-UGE67KIZ.js");
+  const { DEFAULT_WORKBENCH_PORT } = await import("./protocol-QJRHTTMQ.js");
+  const port = Number(process.env.CONVEYOR_WORKBENCH_PORT) || DEFAULT_WORKBENCH_PORT;
+  const token = process.env.CONVEYOR_WORKBENCH_TOKEN ?? process.env.POD_BOOTSTRAP_TOKEN ?? "";
+  if (!token) {
+    logger6.error("workbench mode requires POD_BOOTSTRAP_TOKEN (or CONVEYOR_WORKBENCH_TOKEN)");
+    process.exit(1);
+  }
+  const pkgDir = dirname3(fileURLToPath(import.meta.url));
+  const pkg = JSON.parse(readFileSync(join3(pkgDir, "..", "package.json"), "utf-8"));
+  const handle = await startWorkbenchServer({
+    port,
+    token,
+    version: pkg.version ?? "unknown"
+  });
+  logger6.info(`Workbench launcher listening on 127.0.0.1:${handle.port}`);
+  process.on("SIGTERM", () => process.exit(0));
+  await new Promise(() => {
+  });
+}
 var DEFAULT_CONVEYOR_API_URL = "https://api.conveyor.rallycryapp.com";
 var conveyorApiUrl = process.env.CONVEYOR_API_URL || DEFAULT_CONVEYOR_API_URL;
 var INSTANCE_NAME = process.env.CODESPACE_NAME || process.env.CLAUDESPACE_NAME;