@resolflow/cli 0.0.0-stage → 0.1.0-beta.1

package/dist/agents/auth.js

@@ -0,0 +1,109 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loginAllowed = exports.POLICY_OFF = exports.GEMINI_LOGIN_MESSAGE = exports.VENDOR_TERMS = exports.TOOL_ARG = exports.LOGIN_TERMS_VERSION = exports.isLoginTool = exports.LOGIN_TOOLS = void 0;
+exports.notAvailableMessage = notAvailableMessage;
+exports.loginTermsText = loginTermsText;
+exports.authModeOf = authModeOf;
+exports.readPolicy = readPolicy;
+exports.codexHomeOf = codexHomeOf;
+const path = __importStar(require("path"));
+exports.LOGIN_TOOLS = ['claude-code', 'codex'];
+const isLoginTool = (id) => id === 'claude-code' || id === 'codex';
+exports.isLoginTool = isLoginTool;
+/** The version of the summary the person accepted; a new version asks again. */
+exports.LOGIN_TERMS_VERSION = '2026-10-24';
+/*
+ * Codex jobs from Resolflow are opt-in on the device (CODEX_OPT_IN_ENV in tools.ts, RF-ce19e014: its read-only
+ * sandbox does not stop reads outside the job folder). A Codex login needs the person's real CODEX_HOME, so it is
+ * offered only behind the same opt-in (exactly "1").
+ */
+/** The CLI tool name the person types (`resolflow config agent-key claude`). */
+exports.TOOL_ARG = { 'claude-code': 'claude', codex: 'codex' };
+exports.VENDOR_TERMS = {
+    'claude-code': {
+        name: 'Anthropic',
+        urls: ['https://code.claude.com/docs/en/legal-and-compliance', 'https://www.anthropic.com/legal/consumer-terms'],
+    },
+    codex: { name: 'OpenAI', urls: ['https://learn.chatgpt.com/docs/auth', 'https://openai.com/policies/terms-of-use'] },
+};
+exports.GEMINI_LOGIN_MESSAGE = "CLI login for Gemini / Antigravity is not available: Google's terms do not allow third-party use of a Gemini CLI login.";
+function notAvailableMessage(def, id) {
+    return `CLI login for ${def.label} is not available: it is turned off by the Resolflow administrator. Keep using an API key (\`resolflow config agent-key ${exports.TOOL_ARG[id]}\`).`;
+}
+/** The summary shown before the person types `yes` (English, like the rest of the CLI). */
+function loginTermsText(def, id) {
+    const v = exports.VENDOR_TERMS[id];
+    return [
+        `Use your existing ${def.label} login for Resolflow jobs on this machine (terms summary v${exports.LOGIN_TERMS_VERSION}):`,
+        `  - ${def.label} runs as installed (the unmodified ${v.name} binary) and reads its own login. Resolflow never reads,`,
+        '    copies, logs or uploads your login files or tokens; Resolflow only learns that this tool uses "login".',
+        '  - Jobs use YOUR plan and its usage limits (not Resolflow credits, not an API key).',
+        '  - Only work you start yourself: background (system-triggered) runs never use your login.',
+        `  - ${v.name}'s terms apply to you and are not changed by this choice; ${v.name} can limit or block such use.`,
+        `    Read them: ${v.urls.join(' · ')}`,
+        '  - Your own tool settings load in this mode; Resolflow switches off what it can (hooks, plugins, MCP servers,',
+        '    tools), see the CLI README. The Resolflow administrator can switch this off for everyone at any time.',
+        `  Undo: resolflow config agent-auth ${exports.TOOL_ARG[id]} api_key`,
+    ];
+}
+/**
+ * The mode this machine uses for a tool: `login` only when the person chose it here AND accepted the current terms
+ * summary; everything else (no choice, an older summary, a typo in the file) is `api_key`.
+ */
+function authModeOf(cfg, id) {
+    if (!(0, exports.isLoginTool)(id))
+        return 'api_key';
+    return cfg.agentAuth?.[id] === 'login' && cfg.agentAuthTerms?.[id]?.version === exports.LOGIN_TERMS_VERSION ? 'login' : 'api_key';
+}
+/** A policy received from the server: only `true` allows; anything else (missing, junk) is off. */
+function readPolicy(raw) {
+    const c = raw && typeof raw === 'object' ? raw.cliLogin : undefined;
+    const r = c && typeof c === 'object' ? c : {};
+    return { 'claude-code': r['claude-code'] === true, codex: r.codex === true };
+}
+exports.POLICY_OFF = Object.freeze({ 'claude-code': false, codex: false });
+const loginAllowed = (ref, id) => ref?.current?.[id] === true;
+exports.loginAllowed = loginAllowed;
+/**
+ * Codex in login mode: the person's own CODEX_HOME (where `codex login` keeps auth.json) — only the path is passed
+ * to the Codex binary; this CLI never opens anything in it.
+ */
+function codexHomeOf(env) {
+    if (env.CODEX_HOME && path.isAbsolute(env.CODEX_HOME))
+        return env.CODEX_HOME;
+    const home = env.HOME || env.USERPROFILE;
+    return home && path.isAbsolute(home) ? path.join(home, '.codex') : null;
+}

package/dist/agents/daily-budget.js

@@ -0,0 +1,170 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DailyBudget = exports.SPEND_FILE = exports.MIN_JOB_BUDGET_USD = exports.DEFAULT_DAILY_BUDGET_USD = void 0;
+exports.localDay = localDay;
+exports.dailyLimitOf = dailyLimitOf;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+/**
+ * Daily spending ceiling for local coding agent jobs (RF-27cf99e3, L9).
+ *
+ * Every Claude Code job reports `total_cost_usd`; the sum for the current LOCAL day is kept in
+ * `<config dir>/agent-spend.json` (0600). Once the sum reaches the ceiling, new jobs are refused with
+ * `budget_exceeded`; below it, a job's own `--max-budget-usd` is lowered to what is left (never below 0.01).
+ * Codex reports no cost, so it is not counted. 0 = no daily ceiling.
+ */
+exports.DEFAULT_DAILY_BUDGET_USD = 10;
+exports.MIN_JOB_BUDGET_USD = 0.01;
+exports.SPEND_FILE = 'agent-spend.json';
+/** YYYY-MM-DD of `d` in this machine's local time zone. */
+function localDay(d) {
+    const p = (n) => String(n).padStart(2, '0');
+    return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
+}
+const DAY_RE = /^\d{4}-\d{2}-\d{2}$/;
+const round2 = (n) => Math.round(n * 100) / 100;
+// The stored total keeps sub-cent costs (many cheap jobs add up); only what is shown or reserved is rounded.
+const round6 = (n) => Math.round(n * 1e6) / 1e6;
+/** Round down to whole cents (what is left must never be rounded up). */
+const floor2 = (n) => Math.floor(n * 100 + 1e-9) / 100;
+/** A daily ceiling from config: a finite number >= 0, else the default. */
+function dailyLimitOf(v) {
+    return typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : exports.DEFAULT_DAILY_BUDGET_USD;
+}
+class DailyBudget {
+    dir;
+    opts;
+    file;
+    now;
+    /** USD held by jobs still running (so concurrent jobs cannot together overshoot the ceiling). */
+    held = 0;
+    warnedFor = null;
+    constructor(dir, opts) {
+        this.dir = dir;
+        this.opts = opts;
+        this.file = path.join(dir, exports.SPEND_FILE);
+        this.now = opts.now ?? (() => new Date());
+    }
+    /** Spent today (0 when the file is missing, from another day, or unreadable — the last one with a warning). */
+    spentToday() {
+        const today = localDay(this.now());
+        let raw;
+        try {
+            raw = fs.readFileSync(this.file, 'utf8');
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                this.warnOnce(`could not read ${exports.SPEND_FILE} (${err.code ?? 'error'})`);
+            return 0;
+        }
+        try {
+            const v = JSON.parse(raw);
+            if (!v || typeof v !== 'object' || typeof v.day !== 'string' || !DAY_RE.test(v.day) || typeof v.spentUsd !== 'number' || !Number.isFinite(v.spentUsd) || v.spentUsd < 0) {
+                throw new Error('bad shape');
+            }
+            return v.day === today ? v.spentUsd : 0;
+        }
+        catch {
+            this.warnOnce(`${exports.SPEND_FILE} is damaged`);
+            return 0;
+        }
+    }
+    snapshot() {
+        const limitUsd = dailyLimitOf(this.opts.limit());
+        const spentUsd = this.spentToday();
+        return { day: localDay(this.now()), spentUsd, limitUsd, remainingUsd: limitUsd === 0 ? null : Math.max(0, round2(limitUsd - spentUsd)) };
+    }
+    /** Add a reported cost to today's total (a day change resets it). */
+    add(usd) {
+        if (!(typeof usd === 'number' && Number.isFinite(usd) && usd > 0))
+            return;
+        const day = localDay(this.now());
+        const spentUsd = round6(this.spentToday() + usd);
+        (0, config_1.writePrivateFile)(this.file, JSON.stringify({ day, spentUsd }) + '\n');
+    }
+    /**
+     * Hold budget for a job that asked for `jobBudgetUsd`. Refused (null) when what is left today — minus what
+     * running jobs hold — is below the 0.01 USD minimum; otherwise the job's budget is lowered to what is left.
+     */
+    reserve(jobBudgetUsd) {
+        const s = this.snapshot();
+        let budget = jobBudgetUsd;
+        if (s.remainingUsd !== null) {
+            const left = floor2(s.remainingUsd - this.held);
+            if (left < exports.MIN_JOB_BUDGET_USD)
+                return null;
+            budget = Math.max(exports.MIN_JOB_BUDGET_USD, Math.min(jobBudgetUsd, left));
+        }
+        let open = true;
+        const hold = budget;
+        this.held += hold;
+        return {
+            jobBudgetUsd: budget,
+            charge: (usd) => {
+                if (!open || !(typeof usd === 'number' && Number.isFinite(usd) && usd > 0))
+                    return;
+                try {
+                    this.add(usd);
+                }
+                catch (err) {
+                    this.opts.warn?.(`Could not save today's agent spend (${err.message}).`);
+                }
+            },
+            release: () => {
+                if (!open)
+                    return;
+                open = false;
+                this.held = Math.max(0, this.held - hold);
+            },
+        };
+    }
+    /** Human line for `resolflow status` / `resolflow agents`. */
+    describe() {
+        const s = this.snapshot();
+        return s.limitUsd === 0
+            ? `Agent spend today: ${s.spentUsd.toFixed(2)} USD (no daily limit)`
+            : `Agent spend today: ${s.spentUsd.toFixed(2)} / ${s.limitUsd.toFixed(2)} USD`;
+    }
+    warnOnce(what) {
+        const key = `${localDay(this.now())}:${what}`;
+        if (this.warnedFor === key)
+            return;
+        this.warnedFor = key;
+        this.opts.warn?.(`${what}: counting today's agent spend from 0.`);
+    }
+}
+exports.DailyBudget = DailyBudget;

package/dist/agents/errors.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HARD_AGENT_KINDS = exports.LOGIN_INVALID_MESSAGE = exports.AGENT_ERROR_MESSAGES = void 0;
+exports.claudeErrorKind = claudeErrorKind;
+exports.classifyAgentErrorText = classifyAgentErrorText;
+exports.AGENT_ERROR_MESSAGES = {
+    invalid_key: 'The coding agent has no valid API key on this device. Run: resolflow config agent-key <tool>',
+    rate_limited: 'The coding agent was rate limited by its provider; try again shortly.',
+    quota: 'The provider account of the coding agent has no credit or quota left.',
+    model_not_found: 'The coding agent does not know this model.',
+    budget_exceeded: 'The coding agent reached the budget or turn cap of this job.',
+    timeout: 'The coding agent took longer than the time cap of this job.',
+    unsupported: 'This coding agent cannot run this job on this device (update it, or the resolflow CLI).',
+    cli_login_disabled: 'Using a CLI login is turned off by the Resolflow administrator. On that machine switch the tool to an API key: `resolflow config agent-auth <tool> api_key` and `resolflow config agent-key <tool>`.',
+    device_error: 'The coding agent failed on this device.',
+};
+/** invalid_key while the tool runs on the person's CLI login (RF-90e75d6d): it is the login, not a key. */
+exports.LOGIN_INVALID_MESSAGE = 'The coding agent is not signed in on this device, or its login was rejected. Sign in with the tool itself, or switch to an API key: resolflow config agent-auth <tool> api_key';
+/** Claude Code `error` categories (assistant message `error`, `system/api_retry` `error`). */
+function claudeErrorKind(category) {
+    switch (category) {
+        case 'authentication_failed':
+        case 'oauth_org_not_allowed':
+            return 'invalid_key';
+        case 'billing_error':
+        case 'account_on_hold':
+            return 'quota';
+        case 'rate_limit':
+        case 'overloaded':
+            return 'rate_limited';
+        case 'model_not_found':
+            return 'model_not_found';
+        case 'max_output_tokens':
+            return 'budget_exceeded';
+        case 'invalid_request':
+        case 'server_error':
+        case 'cloud_credential_error':
+        case 'unknown':
+            return 'device_error';
+        default:
+            return null;
+    }
+}
+/** Kinds that end a run at once even while the tool would retry (a person must act). */
+exports.HARD_AGENT_KINDS = new Set(['invalid_key', 'quota', 'model_not_found']);
+/** The kind of a free-text error (Codex `turn.failed` / `error`, stderr of a failed start). */
+function classifyAgentErrorText(text) {
+    const t = String(text ?? '').slice(0, 4000);
+    if (/\b401\b|unauthori[sz]ed|invalid[_ ]?(x-)?api[_ -]?key|incorrect api key|api key (is )?(missing|not (set|found|valid))|authentication(_error| failed| required)|not logged in|please (run )?\/?login|no api key/i.test(t))
+        return 'invalid_key';
+    if (/insufficient_quota|quota|billing|credit balance|payment required|\b402\b|account (is )?on hold/i.test(t))
+        return 'quota';
+    if (/\b429\b|rate[_ -]?limit|too many requests|overloaded|\b529\b/i.test(t))
+        return 'rate_limited';
+    if (/model[^.\n]{0,80}(not found|does not exist|not exist|is not supported|unknown|not available)|no such model|unknown model|model_not_found/i.test(t))
+        return 'model_not_found';
+    if (/unknown option|unexpected argument|unrecognized (option|argument)|error: unknown|invalid value for/i.test(t))
+        return 'unsupported';
+    return 'device_error';
+}

package/dist/agents/run-process.js

@@ -0,0 +1,183 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runProcess = runProcess;
+exports.withEmptyTempDir = withEmptyTempDir;
+exports.writeJobFile = writeJobFile;
+exports.agentEnv = agentEnv;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const STDERR_TAIL = 4096;
+const MAX_LINE = 4 * 1024 * 1024;
+function runProcess(spec) {
+    return new Promise((resolve) => {
+        const grace = spec.graceMs ?? 5_000;
+        let stderrTail = '';
+        let buf = '';
+        let aborted = false;
+        let timedOut = false;
+        let settled = false;
+        const timers = [];
+        const child = (0, child_process_1.spawn)(spec.bin, spec.args, {
+            cwd: spec.cwd,
+            env: spec.env,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            shell: false,
+            detached: process.platform !== 'win32',
+            windowsHide: true,
+        });
+        const killGroup = (sig) => {
+            if (child.exitCode !== null || child.signalCode !== null || !child.pid)
+                return;
+            try {
+                if (process.platform !== 'win32')
+                    process.kill(-child.pid, sig);
+                else
+                    child.kill(sig);
+            }
+            catch {
+                try {
+                    child.kill(sig);
+                }
+                catch {
+                    /* gone */
+                }
+            }
+        };
+        const stop = () => {
+            killGroup('SIGINT');
+            const t1 = setTimeout(() => killGroup('SIGTERM'), grace);
+            const t2 = setTimeout(() => killGroup('SIGKILL'), grace * 2);
+            timers.push(t1, t2);
+        };
+        const onAbort = () => {
+            if (settled || aborted || timedOut)
+                return;
+            aborted = true;
+            stop();
+        };
+        if (spec.signal.aborted)
+            queueMicrotask(onAbort);
+        else
+            spec.signal.addEventListener('abort', onAbort, { once: true });
+        const wall = setTimeout(() => {
+            if (settled || aborted)
+                return;
+            timedOut = true;
+            stop();
+        }, Math.max(1, spec.timeoutMs));
+        timers.push(wall);
+        const flushLines = (final) => {
+            let nl;
+            while ((nl = buf.indexOf('\n')) >= 0) {
+                const line = buf.slice(0, nl).replace(/\r$/, '');
+                buf = buf.slice(nl + 1);
+                if (line.trim())
+                    safeLine(line);
+            }
+            if (final && buf.trim())
+                safeLine(buf);
+            if (final)
+                buf = '';
+            if (buf.length > MAX_LINE)
+                buf = ''; // a runaway line without newline: dropped, never buffered forever
+        };
+        const safeLine = (line) => {
+            try {
+                spec.onLine(line);
+            }
+            catch {
+                /* a parser error never kills the job runner */
+            }
+        };
+        child.stdout?.setEncoding('utf8');
+        child.stdout?.on('data', (d) => {
+            buf += d;
+            flushLines(false);
+        });
+        child.stderr?.setEncoding('utf8');
+        child.stderr?.on('data', (d) => {
+            stderrTail = (stderrTail + d).slice(-STDERR_TAIL);
+        });
+        child.stdin?.on('error', () => undefined); // the agent may exit before reading everything
+        if (spec.stdin !== undefined)
+            child.stdin?.write(spec.stdin);
+        child.stdin?.end();
+        const finish = (o) => {
+            if (settled)
+                return;
+            settled = true;
+            for (const t of timers)
+                clearTimeout(t);
+            spec.signal.removeEventListener('abort', onAbort);
+            flushLines(true);
+            resolve({ ...o, stderrTail, aborted, timedOut });
+        };
+        child.on('error', (err) => finish({ code: null, signal: null, spawnError: err.code ?? 'spawn_failed' }));
+        child.on('close', (code, signal) => finish({ code, signal }));
+    });
+}
+/** An empty private temp dir for one job, removed afterwards (Mode A: the agent never sees a repo or project config). */
+async function withEmptyTempDir(fn) {
+    const dir = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), 'resolflow-job-'));
+    if (process.platform !== 'win32')
+        fs.chmodSync(dir, 0o700);
+    try {
+        return await fn(dir);
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** Write a private file (0600) inside the job dir. */
+function writeJobFile(dir, name, content) {
+    const file = path.join(dir, name);
+    fs.writeFileSync(file, content, { mode: 0o600 });
+    return file;
+}
+/**
+ * The environment of an agent process: a short allow-list from this process (PATH, HOME, locale, temp, proxy
+ * settings) plus what the adapter adds (the API key). Nothing else leaks in — no other secrets of the shell.
+ */
+const PASS_ENV = ['PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM', 'TMPDIR', 'TMP', 'TEMP', 'SYSTEMROOT', 'APPDATA', 'LOCALAPPDATA', 'USERPROFILE', 'HTTPS_PROXY', 'HTTP_PROXY', 'NO_PROXY', 'https_proxy', 'http_proxy', 'no_proxy', 'NODE_EXTRA_CA_CERTS', 'SSL_CERT_FILE'];
+function agentEnv(extra, from = process.env) {
+    const env = {};
+    for (const k of PASS_ENV)
+        if (from[k] !== undefined)
+            env[k] = from[k];
+    return { ...env, NO_COLOR: '1', ...extra };
+}