@roj-ai/sdk 0.1.3 → 0.1.5

package/dist/plugins/session-state/plugin.js

@@ -0,0 +1,159 @@
+/**
+ * Session State Plugin
+ *
+ * Provides a typed, persistent state object per session that can be updated by:
+ * - Agent (via tool)
+ * - Client/SPA (via RPC method)
+ * - Backend/system (via RPC method with system caller context)
+ *
+ * State changes are broadcast as notifications and can trigger agent dequeue.
+ * A preset-defined validate function controls write permissions per caller.
+ */
+import z from 'zod/v4';
+import { definePlugin } from '../../core/plugins/plugin-builder.js';
+import { createEventsFactory } from '../../core/events/types.js';
+import { getEntryAgentId } from '../../core/sessions/state.js';
+import { Err, Ok } from '../../lib/utils/result.js';
+import { ValidationErrors } from '../../core/errors.js';
+export const sessionStateEvents = createEventsFactory({
+    events: {
+        session_state_updated: z.object({
+            state: z.record(z.string(), z.unknown()),
+            callerSource: z.enum(['agent', 'client', 'system']),
+        }),
+        session_state_external_consumed: z.object({}),
+    },
+});
+export const sessionStatePlugin = definePlugin('sessionState')
+    .pluginConfig()
+    .isSessionEnabled(({ pluginConfig }) => pluginConfig !== undefined)
+    .events([sessionStateEvents])
+    .state({
+    key: 'sessionState',
+    initial: () => ({ state: {}, pendingExternalUpdate: false }),
+    reduce: (current, event, _sessionState, pluginConfig) => {
+        switch (event.type) {
+            case 'session_state_updated':
+                return {
+                    state: event.state,
+                    pendingExternalUpdate: event.callerSource !== 'agent',
+                };
+            case 'session_state_external_consumed':
+                return { ...current, pendingExternalUpdate: false };
+            default:
+                // Initialize with config defaults if state is empty and config is available
+                if (pluginConfig && Object.keys(current.state).length === 0) {
+                    return { ...current, state: pluginConfig.initial };
+                }
+                return current;
+        }
+    },
+})
+    .notification('sessionStateChanged', {
+    schema: z.object({
+        sessionId: z.string(),
+        state: z.record(z.string(), z.unknown()),
+    }),
+})
+    .method('get', {
+    input: z.object({ sessionId: z.string() }),
+    output: z.object({ state: z.record(z.string(), z.unknown()) }),
+    handler: async (ctx) => {
+        const currentState = ctx.pluginState.state;
+        const config = ctx.pluginConfig;
+        const state = Object.keys(currentState).length === 0 && config ? config.initial : currentState;
+        return Ok({ state });
+    },
+})
+    .method('update', {
+    input: z.object({
+        sessionId: z.string(),
+        updates: z.record(z.string(), z.unknown()),
+    }),
+    output: z.object({ state: z.record(z.string(), z.unknown()) }),
+    handler: async (ctx, input) => {
+        const config = ctx.pluginConfig;
+        if (!config)
+            return Err(ValidationErrors.invalid('Session state plugin not configured'));
+        const currentState = Object.keys(ctx.pluginState.state).length === 0
+            ? config.initial
+            : ctx.pluginState.state;
+        const proposed = { ...currentState, ...input.updates };
+        // Validate against schema
+        const parsed = config.schema.safeParse(proposed);
+        if (!parsed.success) {
+            return Err(ValidationErrors.invalid(`Schema validation failed: ${parsed.error.message}`));
+        }
+        // Run custom validate function
+        if (config.validate) {
+            const result = config.validate(currentState, proposed, ctx.caller);
+            if (result !== true) {
+                return Err(ValidationErrors.invalid(result));
+            }
+        }
+        // Emit event
+        await ctx.emitEvent(sessionStateEvents.create('session_state_updated', {
+            state: proposed,
+            callerSource: ctx.caller.source,
+        }));
+        // Notify connected clients
+        ctx.notify('sessionStateChanged', {
+            sessionId: String(ctx.sessionId),
+            state: proposed,
+        });
+        // Schedule agent if external update
+        if (ctx.caller.source !== 'agent') {
+            const entryAgentId = getEntryAgentId(ctx.sessionState);
+            if (entryAgentId) {
+                ctx.scheduleAgent(entryAgentId);
+            }
+        }
+        return Ok({ state: proposed });
+    },
+})
+    .tool('update_session_state', {
+    description: 'Update the session state. Use this to signal status changes (e.g., file ready for download, phase transitions).',
+    input: z.object({
+        updates: z.record(z.string(), z.unknown()).describe('Key-value pairs to merge into the current session state'),
+    }),
+    execute: async (input, _toolCtx, ctx) => {
+        const result = await ctx.self.update({
+            sessionId: String(ctx.sessionId),
+            updates: input.updates,
+        });
+        if (typeof result === 'object' && result !== null && 'ok' in result && !result.ok) {
+            const err = result;
+            return { ok: false, error: { message: err.error.message, recoverable: true } };
+        }
+        return { ok: true, value: [{ type: 'text', text: 'Session state updated.' }] };
+    },
+})
+    .dequeue({
+    hasPendingMessages: (ctx) => ctx.pluginState.pendingExternalUpdate,
+    getPendingMessages: (ctx) => {
+        if (!ctx.pluginState.pendingExternalUpdate)
+            return null;
+        const stateStr = JSON.stringify(ctx.pluginState.state, null, 2);
+        return {
+            messages: [{
+                    role: 'user',
+                    content: `<system>Session state was updated externally. Current state:\n${stateStr}</system>`,
+                }],
+            token: true,
+        };
+    },
+    markConsumed: async (ctx) => {
+        await ctx.emitEvent(sessionStateEvents.create('session_state_external_consumed', {}));
+    },
+})
+    .systemPrompt((ctx) => {
+    const config = ctx.pluginConfig;
+    if (!config)
+        return null;
+    const state = Object.keys(ctx.pluginState.state).length === 0
+        ? config.initial
+        : ctx.pluginState.state;
+    return `## Session State\n\nCurrent session state:\n\`\`\`json\n${JSON.stringify(state, null, 2)}\n\`\`\`\n\nUse the \`update_session_state\` tool to update state values.`;
+})
+    .build();
+//# sourceMappingURL=plugin.js.map

package/dist/plugins/session-state/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/plugins/session-state/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,CAAC,MAAM,QAAQ,CAAA;AAEtB,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;IACrD,MAAM,EAAE;QACP,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;YAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACnD,CAAC;QACF,+BAA+B,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;KAC7C;CACD,CAAC,CAAA;AAaF,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC;KAC5D,YAAY,EAA4B;KACxC,gBAAgB,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,KAAK,SAAS,CAAC;KAClE,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;KAC5B,KAAK,CAAC;IACN,GAAG,EAAE,cAAc;IACnB,OAAO,EAAE,GAA4B,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;IACrF,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE;QACvD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,uBAAuB;gBAC3B,OAAO;oBACN,KAAK,EAAE,KAAK,CAAC,KAAgC;oBAC7C,qBAAqB,EAAE,KAAK,CAAC,YAAY,KAAK,OAAO;iBACrD,CAAA;YACF,KAAK,iCAAiC;gBACrC,OAAO,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAA;YACpD;gBACC,4EAA4E;gBAC5E,IAAI,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7D,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAG,YAAyC,CAAC,OAAO,EAAE,CAAA;gBACjF,CAAC;gBACD,OAAO,OAAO,CAAA;QAChB,CAAC;IACF,CAAC;CACD,CAAC;KACD,YAAY,CAAC,qBAAqB,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;KACxC,CAAC;CACF,CAAC;KACD,MAAM,CAAC,KAAK,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAA;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAA;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAA;QAC9F,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACrB,CAAC;CACD,CAAC;KACD,MAAM,CAAC,QAAQ,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;KAC1C,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAA;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,CAAA;QAExF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAA;QAExB,MAAM,QAAQ,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAA;QAEtD,0BAA0B;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAC1F,CAAC;QAED,+BAA+B;QAC/B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAClE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;YAC7C,CAAC;QACF,CAAC;QAED,aAAa;QACb,MAAM,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,uBAAuB,EAAE;YACtE,KAAK,EAAE,QAAQ;YACf,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;SAC/B,CAAC,CAAC,CAAA;QAEH,2BAA2B;QAC3B,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE;YACjC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;YAChC,KAAK,EAAE,QAAQ;SACf,CAAC,CAAA;QAEF,oCAAoC;QACpC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACtD,IAAI,YAAY,EAAE,CAAC;gBAClB,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAA;YAChC,CAAC;QACF,CAAC;QAED,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC/B,CAAC;CACD,CAAC;KACD,IAAI,CAAC,sBAAsB,EAAE;IAC7B,WAAW,EAAE,iHAAiH;IAC9H,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;KAC9G,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YACpC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC,CAAA;QAEF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,IAAI,MAAM,IAAI,CAAE,MAA0B,CAAC,EAAE,EAAE,CAAC;YACxG,MAAM,GAAG,GAAG,MAAmD,CAAA;YAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAA;QAC/E,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAA;IACxF,CAAC;CACD,CAAC;KACD,OAAO,CAAC;IACR,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,qBAAqB;IAClE,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,qBAAqB;YAAE,OAAO,IAAI,CAAA;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC/D,OAAO;YACN,QAAQ,EAAE,CAAC;oBACV,IAAI,EAAE,MAAe;oBACrB,OAAO,EAAE,iEAAiE,QAAQ,WAAW;iBAC7F,CAAC;YACF,KAAK,EAAE,IAAI;SACX,CAAA;IACF,CAAC;IACD,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC,CAAA;IACtF,CAAC;CACD,CAAC;KACD,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAA;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAC5D,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAA;IACxB,OAAO,2DAA2D,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,2EAA2E,CAAA;AAC5K,CAAC,CAAC;KACD,KAAK,EAAE,CAAA"}

package/dist/plugins/session-stats/index.js

@@ -0,0 +1,3 @@
+export { sessionStatsPlugin } from './plugin.js';
+export { selectSessionStats } from './plugin.js';
+//# sourceMappingURL=index.js.map

package/dist/plugins/session-stats/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/session-stats/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA"}

package/dist/plugins/session-stats/plugin.js

@@ -0,0 +1,81 @@
+import { agentEvents } from '../../core/agents/state.js';
+import { llmEvents } from '../../core/llm/state.js';
+import { definePlugin } from '../../core/plugins/plugin-builder.js';
+import { selectPluginState } from '../../core/sessions/reducer.js';
+import { toolEvents } from '../../core/tools/state.js';
+const createInitialStats = () => ({
+    totalTokens: 0,
+    promptTokens: 0,
+    completionTokens: 0,
+    totalCost: 0,
+    llmCalls: 0,
+    llmErrors: 0,
+    toolCalls: 0,
+    toolErrors: 0,
+    agentCount: 0,
+    firstEventAt: null,
+    lastEventAt: null,
+    byProvider: {},
+});
+const PLUGIN_STATE_KEY = 'sessionStats';
+/**
+ * Select session stats from session state (for external consumers).
+ */
+export function selectSessionStats(sessionState) {
+    return selectPluginState(sessionState, PLUGIN_STATE_KEY) ?? createInitialStats();
+}
+// ============================================================================
+// Plugin
+// ============================================================================
+export const sessionStatsPlugin = definePlugin('session-stats')
+    .events([agentEvents, llmEvents, toolEvents])
+    .state({
+    key: PLUGIN_STATE_KEY,
+    initial: createInitialStats,
+    reduce: (stats, event) => {
+        const now = event.timestamp;
+        const withTimestamp = (partial) => ({
+            ...stats,
+            ...partial,
+            firstEventAt: stats.firstEventAt ?? now,
+            lastEventAt: now,
+        });
+        switch (event.type) {
+            case 'agent_spawned':
+                return withTimestamp({ agentCount: stats.agentCount + 1 });
+            case 'inference_completed': {
+                const provider = event.metrics.provider;
+                const byProvider = provider
+                    ? {
+                        ...stats.byProvider,
+                        [provider]: {
+                            llmCalls: (stats.byProvider[provider]?.llmCalls ?? 0) + 1,
+                            totalTokens: (stats.byProvider[provider]?.totalTokens ?? 0) + event.metrics.totalTokens,
+                            promptTokens: (stats.byProvider[provider]?.promptTokens ?? 0) + event.metrics.promptTokens,
+                            completionTokens: (stats.byProvider[provider]?.completionTokens ?? 0) + event.metrics.completionTokens,
+                            totalCost: (stats.byProvider[provider]?.totalCost ?? 0) + (event.metrics.cost ?? 0),
+                        },
+                    }
+                    : stats.byProvider;
+                return withTimestamp({
+                    llmCalls: stats.llmCalls + 1,
+                    totalTokens: stats.totalTokens + event.metrics.totalTokens,
+                    promptTokens: stats.promptTokens + event.metrics.promptTokens,
+                    completionTokens: stats.completionTokens + event.metrics.completionTokens,
+                    totalCost: stats.totalCost + (event.metrics.cost ?? 0),
+                    byProvider,
+                });
+            }
+            case 'inference_failed':
+                return withTimestamp({ llmErrors: stats.llmErrors + 1 });
+            case 'tool_started':
+                return withTimestamp({ toolCalls: stats.toolCalls + 1 });
+            case 'tool_failed':
+                return withTimestamp({ toolErrors: stats.toolErrors + 1 });
+            default:
+                return stats;
+        }
+    },
+})
+    .build();
+//# sourceMappingURL=plugin.js.map

package/dist/plugins/session-stats/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/plugins/session-stats/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AA8BlD,MAAM,kBAAkB,GAAG,GAAsB,EAAE,CAAC,CAAC;IACpD,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;IACf,gBAAgB,EAAE,CAAC;IACnB,SAAS,EAAE,CAAC;IACZ,QAAQ,EAAE,CAAC;IACX,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,CAAC;IACb,YAAY,EAAE,IAAI;IAClB,WAAW,EAAE,IAAI;IACjB,UAAU,EAAE,EAAE;CACd,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,cAAc,CAAA;AAEvC;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAA0B;IAC5D,OAAO,iBAAiB,CAAoB,YAAY,EAAE,gBAAgB,CAAC,IAAI,kBAAkB,EAAE,CAAA;AACpG,CAAC;AAED,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,eAAe,CAAC;KAC7D,MAAM,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;KAC5C,KAAK,CAAC;IACN,GAAG,EAAE,gBAAgB;IACrB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAA;QAC3B,MAAM,aAAa,GAAG,CAAC,OAAmC,EAAqB,EAAE,CAAC,CAAC;YAClF,GAAG,KAAK;YACR,GAAG,OAAO;YACV,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,GAAG;YACvC,WAAW,EAAE,GAAG;SAChB,CAAC,CAAA;QAEF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,eAAe;gBACnB,OAAO,aAAa,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC,CAAA;YAE3D,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAA;gBACvC,MAAM,UAAU,GAAG,QAAQ;oBAC1B,CAAC,CAAC;wBACD,GAAG,KAAK,CAAC,UAAU;wBACnB,CAAC,QAAQ,CAAC,EAAE;4BACX,QAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;4BACzD,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW;4BACvF,YAAY,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY;4BAC1F,gBAAgB,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,gBAAgB,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB;4BACtG,SAAS,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;yBACnF;qBACD;oBACD,CAAC,CAAC,KAAK,CAAC,UAAU,CAAA;gBACnB,OAAO,aAAa,CAAC;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC;oBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW;oBAC1D,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY;oBAC7D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB;oBACzE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;oBACtD,UAAU;iBACV,CAAC,CAAA;YACH,CAAC;YAED,KAAK,kBAAkB;gBACtB,OAAO,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,CAAA;YAEzD,KAAK,cAAc;gBAClB,OAAO,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,CAAA;YAEzD,KAAK,aAAa;gBACjB,OAAO,aAAa,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC,CAAA;YAE3D;gBACC,OAAO,KAAK,CAAA;QACd,CAAC;IACF,CAAC;CACD,CAAC;KACD,KAAK,EAAE,CAAA"}

package/dist/plugins/shell/executor.js

@@ -0,0 +1,339 @@
+import { resolve } from 'node:path';
+import { Err, Ok } from '../../lib/utils/result.js';
+// ============================================================================
+// Constants
+// ============================================================================
+const VIRTUAL_SESSION = '/home/user/session';
+const VIRTUAL_WORKSPACE = '/home/user/workspace';
+/** Maximum output size per stream in bytes (1 MB) */
+const MAX_OUTPUT_BYTES = 1_048_576;
+/** Grace period before SIGKILL after SIGTERM (ms) */
+const GRACEFUL_KILL_DELAY_MS = 5000;
+// ============================================================================
+// Shell escaping
+// ============================================================================
+function shellEscape(arg) {
+    if (arg.length === 0)
+        return "''";
+    if (/^[a-zA-Z0-9_./:=@%^,+-]+$/.test(arg))
+        return arg;
+    return "'" + arg.replace(/'/g, "'\\''") + "'";
+}
+// ============================================================================
+// Symlink escape detection
+// ============================================================================
+/**
+ * Check if a resolved path escapes allowed directories via symlinks.
+ * Returns true if escape detected (real path outside all allowed roots).
+ */
+async function checkSymlinkEscape(fs, resolvedPath, ...allowedRoots) {
+    try {
+        const realPath = await fs.realpath(resolvedPath);
+        for (const root of allowedRoots) {
+            if (!root)
+                continue;
+            const realRoot = await fs.realpath(root);
+            if (realPath === realRoot || realPath.startsWith(realRoot + '/')) {
+                return false; // Within bounds
+            }
+        }
+        return true; // Escaped
+    }
+    catch {
+        return false; // Path doesn't exist yet — no symlink to exploit
+    }
+}
+// ============================================================================
+// Path resolution
+// ============================================================================
+async function resolveAgentPath(fs, agentPath, sessionDir, workspaceDir, sandboxed) {
+    if (sandboxed) {
+        if (agentPath.startsWith(VIRTUAL_SESSION + '/') || agentPath === VIRTUAL_SESSION) {
+            const rel = agentPath.slice(VIRTUAL_SESSION.length);
+            const absolutePath = resolve(sessionDir, rel.slice(1) || '.');
+            const normalizedRoot = resolve(sessionDir);
+            if (absolutePath !== normalizedRoot && !absolutePath.startsWith(normalizedRoot + '/')) {
+                return Err({ message: `Path '${agentPath}' resolves outside allowed directories`, recoverable: false });
+            }
+            if (await checkSymlinkEscape(fs, absolutePath, sessionDir)) {
+                return Err({ message: `Path '${agentPath}' resolves outside session directory via symlink`, recoverable: false });
+            }
+            return Ok(absolutePath);
+        }
+        if (agentPath.startsWith(VIRTUAL_WORKSPACE + '/') || agentPath === VIRTUAL_WORKSPACE) {
+            if (!workspaceDir) {
+                return Err({ message: 'No workspace directory is configured for this session.', recoverable: false });
+            }
+            const rel = agentPath.slice(VIRTUAL_WORKSPACE.length);
+            const absolutePath = resolve(workspaceDir, rel.slice(1) || '.');
+            const normalizedRoot = resolve(workspaceDir);
+            if (absolutePath !== normalizedRoot && !absolutePath.startsWith(normalizedRoot + '/')) {
+                return Err({ message: `Path '${agentPath}' resolves outside allowed directories`, recoverable: false });
+            }
+            if (await checkSymlinkEscape(fs, absolutePath, workspaceDir)) {
+                return Err({ message: `Path '${agentPath}' resolves outside workspace directory via symlink`, recoverable: false });
+            }
+            return Ok(absolutePath);
+        }
+        const validPrefixes = workspaceDir
+            ? `${VIRTUAL_SESSION}/ or ${VIRTUAL_WORKSPACE}/`
+            : `${VIRTUAL_SESSION}/`;
+        return Err({ message: `Path must start with ${validPrefixes}. Got: '${agentPath}'`, recoverable: false });
+    }
+    // Non-sandboxed: validate within allowed dirs
+    const absolutePath = resolve(agentPath);
+    const normalizedSession = resolve(sessionDir);
+    const normalizedWorkspace = workspaceDir ? resolve(workspaceDir) : null;
+    const isInSession = absolutePath === normalizedSession || absolutePath.startsWith(normalizedSession + '/');
+    const isInWorkspace = normalizedWorkspace
+        && (absolutePath === normalizedWorkspace || absolutePath.startsWith(normalizedWorkspace + '/'));
+    if (!isInSession && !isInWorkspace) {
+        return Err({ message: `Path '${agentPath}' is outside allowed directories`, recoverable: false });
+    }
+    if (await checkSymlinkEscape(fs, absolutePath, sessionDir, workspaceDir)) {
+        return Err({ message: `Path '${agentPath}' resolves outside allowed directories via symlink`, recoverable: false });
+    }
+    return Ok(absolutePath);
+}
+// ============================================================================
+// Environment
+// ============================================================================
+/** Safe environment variables that can be passed to child processes */
+const SAFE_ENV_VARS = ['PATH', 'HOME', 'USER', 'SHELL', 'TERM', 'LANG', 'LC_ALL', 'TZ'];
+function getSafeEnv() {
+    return Object.fromEntries(SAFE_ENV_VARS
+        .filter(key => process.env[key])
+        .map(key => [key, process.env[key]]));
+}
+export function buildBwrapArgs(opts) {
+    const { command, cwd, sandbox, extraBinds } = opts;
+    const sessionDir = opts.sessionDir ? resolve(opts.sessionDir) : undefined;
+    const workspaceDir = opts.workspaceDir ? resolve(opts.workspaceDir) : undefined;
+    const args = [
+        '--ro-bind',
+        '/',
+        '/',
+        '--dev',
+        '/dev',
+        '--proc',
+        '/proc',
+        '--tmpfs',
+        '/tmp',
+    ];
+    // Hide sensitive directories with tmpfs overlays
+    // (overrides --ro-bind / / for these paths, preventing access to user home dirs and root)
+    args.push('--tmpfs', '/home');
+    args.push('--tmpfs', '/root');
+    if (sessionDir) {
+        // Map real session dir to /home/user/session (read-write)
+        args.push('--bind', sessionDir, VIRTUAL_SESSION);
+    }
+    if (workspaceDir) {
+        // Map real workspace dir to /home/user/workspace (read-write)
+        args.push('--bind', workspaceDir, VIRTUAL_WORKSPACE);
+    }
+    // Extra bind mounts (e.g. git project dir for worktree support, .gitconfig)
+    for (const bind of extraBinds ?? []) {
+        args.push(bind.mode === 'ro' ? '--ro-bind' : '--bind', bind.path, bind.destPath ?? bind.path);
+    }
+    // Additional writable paths (legacy support)
+    for (const p of sandbox.writablePaths ?? []) {
+        args.push('--bind', p, p);
+    }
+    // If no sessionDir/workspaceDir mapping, fall back to making cwd writable
+    if (!sessionDir && !workspaceDir) {
+        args.push('--bind', cwd, cwd);
+    }
+    args.push('--unshare-all');
+    if (sandbox.network) {
+        args.push('--share-net');
+    }
+    args.push('--die-with-parent');
+    // Set working directory inside the namespace
+    args.push('--chdir', cwd);
+    args.push('/bin/sh', '-c', command);
+    return args;
+}
+export class ShellExecutor {
+    config;
+    fs;
+    process;
+    constructor(config, deps) {
+        this.config = config;
+        this.fs = deps.fs;
+        this.process = deps.process;
+    }
+    async execute(input, environment) {
+        const args = typeof input.args === 'string' ? [input.args] : input.args;
+        const fullCommand = args
+            ? `${shellEscape(input.command)} ${args.map(shellEscape).join(' ')}`
+            : input.command;
+        const timeout = input.timeout ?? this.config.timeout ?? 30000;
+        const startTime = Date.now();
+        // Resolve directories from environment
+        const sessionDir = environment.sessionDir;
+        const workspaceDir = environment.workspaceDir;
+        // Determine sandbox mode from config
+        const sandboxEnabled = this.config.sandboxed && this.config.sandbox?.enabled !== false;
+        // Resolve cwd based on sandbox mode:
+        // - bwrap enabled: use virtual path (bwrap handles mapping)
+        // - sandboxed but no bwrap: agent sends virtual paths, resolve to real paths
+        // - not sandboxed: agent sends real paths, use as-is
+        let cwd;
+        if (sandboxEnabled) {
+            cwd = input.cwd ?? VIRTUAL_SESSION;
+        }
+        else if (this.config.sandboxed && input.cwd) {
+            // Sandboxed env but bwrap disabled — resolve virtual paths to real paths
+            const cwdResult = await resolveAgentPath(this.fs, input.cwd, sessionDir, workspaceDir, this.config.sandboxed);
+            if (!cwdResult.ok)
+                return cwdResult;
+            cwd = cwdResult.value;
+        }
+        else {
+            cwd = input.cwd ?? workspaceDir ?? this.config.cwd;
+        }
+        // Validate directories exist before sandbox bind mount
+        if (sandboxEnabled) {
+            if (sessionDir && !(await this.fs.exists(sessionDir))) {
+                return Err({
+                    message: `Session directory does not exist: ${sessionDir}`,
+                    recoverable: false,
+                });
+            }
+            if (workspaceDir && !(await this.fs.exists(workspaceDir))) {
+                return Err({
+                    message: `Workspace directory does not exist: ${workspaceDir}`,
+                    recoverable: false,
+                });
+            }
+        }
+        return new Promise((resolve) => {
+            let stdout = '';
+            let stderr = '';
+            let timedOut = false;
+            let child;
+            if (sandboxEnabled) {
+                // Apply resource limits inside the sandbox
+                const timeoutSeconds = Math.ceil(timeout / 1000);
+                const sandboxCommand = `ulimit -v 524288 -f 204800 -u 64 -t ${timeoutSeconds} 2>/dev/null; ${fullCommand}`;
+                const bwrapArgs = buildBwrapArgs({
+                    command: sandboxCommand,
+                    cwd,
+                    sandbox: this.config.sandbox ?? { enabled: true },
+                    sessionDir,
+                    workspaceDir,
+                    extraBinds: this.config.extraBinds,
+                });
+                child = this.process.spawn('bwrap', bwrapArgs, {
+                    cwd: sessionDir ?? this.config.cwd,
+                    env: { ...getSafeEnv(), ...this.config.env },
+                    detached: true,
+                });
+            }
+            else {
+                const shell = this.config.shell ?? (process.platform === 'win32' ? 'cmd.exe' : '/bin/sh');
+                const shellFlag = process.platform === 'win32' ? '/c' : '-c';
+                child = this.process.spawn(shell, [shellFlag, fullCommand], {
+                    cwd,
+                    env: { ...getSafeEnv(), ...this.config.env },
+                    detached: true,
+                });
+            }
+            // Handle stdin
+            if (input.stdin) {
+                child.stdin?.write(input.stdin);
+                child.stdin?.end();
+            }
+            else {
+                child.stdin?.end();
+            }
+            // Collect stdout with size cap
+            let stdoutBytes = 0;
+            let stdoutTruncated = false;
+            child.stdout?.on('data', (data) => {
+                if (stdoutTruncated)
+                    return;
+                const remaining = MAX_OUTPUT_BYTES - stdoutBytes;
+                if (data.length > remaining) {
+                    stdout += data.toString('utf-8', 0, remaining);
+                    stdoutBytes = MAX_OUTPUT_BYTES;
+                    stdoutTruncated = true;
+                    stdout += '\n[stdout truncated at 1 MB]';
+                }
+                else {
+                    stdout += data.toString();
+                    stdoutBytes += data.length;
+                }
+            });
+            // Collect stderr with size cap
+            let stderrBytes = 0;
+            let stderrTruncated = false;
+            child.stderr?.on('data', (data) => {
+                if (stderrTruncated)
+                    return;
+                const remaining = MAX_OUTPUT_BYTES - stderrBytes;
+                if (data.length > remaining) {
+                    stderr += data.toString('utf-8', 0, remaining);
+                    stderrBytes = MAX_OUTPUT_BYTES;
+                    stderrTruncated = true;
+                    stderr += '\n[stderr truncated at 1 MB]';
+                }
+                else {
+                    stderr += data.toString();
+                    stderrBytes += data.length;
+                }
+            });
+            // Timeout handler — SIGTERM first, then SIGKILL after grace period
+            let killTimeoutId;
+            const timeoutId = setTimeout(() => {
+                timedOut = true;
+                try {
+                    process.kill(-child.pid, 'SIGTERM');
+                }
+                catch {
+                    child.kill('SIGTERM');
+                }
+                killTimeoutId = setTimeout(() => {
+                    try {
+                        process.kill(-child.pid, 'SIGKILL');
+                    }
+                    catch {
+                        try {
+                            child.kill('SIGKILL');
+                        }
+                        catch { /* already dead */ }
+                    }
+                }, GRACEFUL_KILL_DELAY_MS);
+            }, timeout);
+            // Process exit
+            child.on('close', (code, signal) => {
+                clearTimeout(timeoutId);
+                if (killTimeoutId)
+                    clearTimeout(killTimeoutId);
+                const durationMs = Date.now() - startTime;
+                resolve(Ok({
+                    stdout: stdout.trim(),
+                    stderr: stderr.trim(),
+                    exitCode: code ?? -1,
+                    signal: signal ?? undefined,
+                    timedOut,
+                    durationMs,
+                }));
+            });
+            // Process error
+            child.on('error', (error) => {
+                clearTimeout(timeoutId);
+                if (killTimeoutId)
+                    clearTimeout(killTimeoutId);
+                const durationMs = Date.now() - startTime;
+                resolve(Err({
+                    message: `Failed to execute command: ${error.message}`,
+                    recoverable: false,
+                    details: { durationMs },
+                }));
+            });
+        });
+    }
+}
+//# sourceMappingURL=executor.js.map

package/dist/plugins/shell/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/plugins/shell/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGnC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,uBAAuB,CAAA;AAI5D,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,eAAe,GAAG,oBAAoB,CAAA;AAC5C,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAEhD,qDAAqD;AACrD,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAElC,qDAAqD;AACrD,MAAM,sBAAsB,GAAG,IAAI,CAAA;AAEnC,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,SAAS,WAAW,CAAC,GAAW;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IACrD,OAAO,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAA;AAC9C,CAAC;AAED,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAAc,EAAE,YAAoB,EAAE,GAAG,YAA2C;IACrH,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QAChD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;gBAClE,OAAO,KAAK,CAAA,CAAC,gBAAgB;YAC9B,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAA,CAAC,UAAU;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA,CAAC,iDAAiD;IAC/D,CAAC;AACF,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAC9B,EAAc,EACd,SAAiB,EACjB,UAAkB,EAClB,YAAgC,EAChC,SAAkB;IAElB,IAAI,SAAS,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,UAAU,CAAC,eAAe,GAAG,GAAG,CAAC,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClF,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;YACnD,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;YAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;YAC1C,IAAI,YAAY,KAAK,cAAc,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC;gBACvF,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,SAAS,wCAAwC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACxG,CAAC;YACD,IAAI,MAAM,kBAAkB,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC5D,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,SAAS,kDAAkD,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YAClH,CAAC;YACD,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YACtF,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnB,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,wDAAwD,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACtG,CAAC;YACD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACrD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;YAC/D,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;YAC5C,IAAI,YAAY,KAAK,cAAc,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC;gBACvF,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,SAAS,wCAAwC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACxG,CAAC;YACD,IAAI,MAAM,kBAAkB,CAAC,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC9D,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,SAAS,oDAAoD,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACpH,CAAC;YACD,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;QACxB,CAAC;QACD,MAAM,aAAa,GAAG,YAAY;YACjC,CAAC,CAAC,GAAG,eAAe,QAAQ,iBAAiB,GAAG;YAChD,CAAC,CAAC,GAAG,eAAe,GAAG,CAAA;QACxB,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,wBAAwB,aAAa,WAAW,SAAS,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,8CAA8C;IAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACvC,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC7C,MAAM,mBAAmB,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,MAAM,WAAW,GAAG,YAAY,KAAK,iBAAiB,IAAI,YAAY,CAAC,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAA;IAC1G,MAAM,aAAa,GAAG,mBAAmB;WACrC,CAAC,YAAY,KAAK,mBAAmB,IAAI,YAAY,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,CAAC,CAAA;IAChG,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,SAAS,kCAAkC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;IAClG,CAAC;IACD,IAAI,MAAM,kBAAkB,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1E,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,SAAS,oDAAoD,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;IACpH,CAAC;IACD,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;AACxB,CAAC;AA2CD,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,uEAAuE;AACvE,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;AAEvF,SAAS,UAAU;IAClB,OAAO,MAAM,CAAC,WAAW,CACxB,aAAa;SACX,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAC/B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAC,CACtC,CAAA;AACF,CAAC;AAkBD,MAAM,UAAU,cAAc,CAAC,IAAkB;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAE/E,MAAM,IAAI,GAAa;QACtB,WAAW;QACX,GAAG;QACH,GAAG;QACH,OAAO;QACP,MAAM;QACN,QAAQ;QACR,OAAO;QACP,SAAS;QACT,MAAM;KACN,CAAA;IAED,iDAAiD;IACjD,0FAA0F;IAC1F,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAE7B,IAAI,UAAU,EAAE,CAAC;QAChB,0DAA0D;QAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,CAAA;IACjD,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QAClB,8DAA8D;QAC9D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAA;IACrD,CAAC;IAED,4EAA4E;IAC5E,KAAK,MAAM,IAAI,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9F,CAAC;IAED,6CAA6C;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1B,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAE1B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAE9B,6CAA6C;IAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAEzB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAEnC,OAAO,IAAI,CAAA;AACZ,CAAC;AA4BD,MAAM,OAAO,aAAa;IAIL;IAHH,EAAE,CAAY;IACd,OAAO,CAAe;IAEvC,YAAoB,MAAmB,EAAE,IAAuB;QAA5C,WAAM,GAAN,MAAM,CAAa;QACtC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAA;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,OAAO,CACZ,KAAsB,EACtB,WAA+B;QAE/B,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAA;QACvE,MAAM,WAAW,GAAG,IAAI;YACvB,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACpE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;QAEhB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAA;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAE5B,uCAAuC;QACvC,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAA;QACzC,MAAM,YAAY,GAAG,WAAW,CAAC,YAAY,CAAA;QAE7C,qCAAqC;QACrC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,KAAK,CAAA;QAEtF,qCAAqC;QACrC,4DAA4D;QAC5D,6EAA6E;QAC7E,qDAAqD;QACrD,IAAI,GAAW,CAAA;QACf,IAAI,cAAc,EAAE,CAAC;YACpB,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,eAAe,CAAA;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YAC/C,yEAAyE;YACzE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC7G,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAA;YACnC,GAAG,GAAG,SAAS,CAAC,KAAK,CAAA;QACtB,CAAC;aAAM,CAAC;YACP,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAA;QACnD,CAAC;QAED,uDAAuD;QACvD,IAAI,cAAc,EAAE,CAAC;YACpB,IAAI,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,GAAG,CAAC;oBACV,OAAO,EAAE,qCAAqC,UAAU,EAAE;oBAC1D,WAAW,EAAE,KAAK;iBAClB,CAAC,CAAA;YACH,CAAC;YACD,IAAI,YAAY,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,GAAG,CAAC;oBACV,OAAO,EAAE,uCAAuC,YAAY,EAAE;oBAC9D,WAAW,EAAE,KAAK;iBAClB,CAAC,CAAA;YACH,CAAC;QACF,CAAC;QAED,OAAO,IAAI,OAAO,CAAiC,CAAC,OAAO,EAAE,EAAE;YAC9D,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,IAAI,QAAQ,GAAG,KAAK,CAAA;YAEpB,IAAI,KAAmB,CAAA;YACvB,IAAI,cAAc,EAAE,CAAC;gBACpB,2CAA2C;gBAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;gBAChD,MAAM,cAAc,GAAG,uCAAuC,cAAc,iBAAiB,WAAW,EAAE,CAAA;gBAC1G,MAAM,SAAS,GAAG,cAAc,CAAC;oBAChC,OAAO,EAAE,cAAc;oBACvB,GAAG;oBACH,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;oBACjD,UAAU;oBACV,YAAY;oBACZ,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;iBAClC,CAAC,CAAA;gBACF,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE;oBAC9C,GAAG,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG;oBAClC,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;oBAC5C,QAAQ,EAAE,IAAI;iBACd,CAAC,CAAA;YACH,CAAC;iBAAM,CAAC;gBACP,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBACzF,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;gBAE5D,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE;oBAC3D,GAAG;oBACH,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;oBAC5C,QAAQ,EAAE,IAAI;iBACd,CAAC,CAAA;YACH,CAAC;YAED,eAAe;YACf,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBAC/B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAA;YACnB,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAA;YACnB,CAAC;YAED,+BAA+B;YAC/B,IAAI,WAAW,GAAG,CAAC,CAAA;YACnB,IAAI,eAAe,GAAG,KAAK,CAAA;YAC3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,IAAI,eAAe;oBAAE,OAAM;gBAC3B,MAAM,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAA;gBAChD,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;oBAC9C,WAAW,GAAG,gBAAgB,CAAA;oBAC9B,eAAe,GAAG,IAAI,CAAA;oBACtB,MAAM,IAAI,8BAA8B,CAAA;gBACzC,CAAC;qBAAM,CAAC;oBACP,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;oBACzB,WAAW,IAAI,IAAI,CAAC,MAAM,CAAA;gBAC3B,CAAC;YACF,CAAC,CAAC,CAAA;YAEF,+BAA+B;YAC/B,IAAI,WAAW,GAAG,CAAC,CAAA;YACnB,IAAI,eAAe,GAAG,KAAK,CAAA;YAC3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,IAAI,eAAe;oBAAE,OAAM;gBAC3B,MAAM,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAA;gBAChD,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;oBAC9C,WAAW,GAAG,gBAAgB,CAAA;oBAC9B,eAAe,GAAG,IAAI,CAAA;oBACtB,MAAM,IAAI,8BAA8B,CAAA;gBACzC,CAAC;qBAAM,CAAC;oBACP,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;oBACzB,WAAW,IAAI,IAAI,CAAC,MAAM,CAAA;gBAC3B,CAAC;YACF,CAAC,CAAC,CAAA;YAEF,mEAAmE;YACnE,IAAI,aAAwD,CAAA;YAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBACjC,QAAQ,GAAG,IAAI,CAAA;gBACf,IAAI,CAAC;oBACJ,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAI,EAAE,SAAS,CAAC,CAAA;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACR,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBACtB,CAAC;gBACD,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC/B,IAAI,CAAC;wBACJ,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAI,EAAE,SAAS,CAAC,CAAA;oBACrC,CAAC;oBAAC,MAAM,CAAC;wBACR,IAAI,CAAC;4BACJ,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;wBACtB,CAAC;wBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;oBAC/B,CAAC;gBACF,CAAC,EAAE,sBAAsB,CAAC,CAAA;YAC3B,CAAC,EAAE,OAAO,CAAC,CAAA;YAEX,eAAe;YACf,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAClC,YAAY,CAAC,SAAS,CAAC,CAAA;gBACvB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAA;gBAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;gBAEzC,OAAO,CAAC,EAAE,CAAC;oBACV,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;oBACrB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;oBACrB,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;oBACpB,MAAM,EAAE,MAAM,IAAI,SAAS;oBAC3B,QAAQ;oBACR,UAAU;iBACV,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,gBAAgB;YAChB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,YAAY,CAAC,SAAS,CAAC,CAAA;gBACvB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAA;gBAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;gBAEzC,OAAO,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,8BAA8B,KAAK,CAAC,OAAO,EAAE;oBACtD,WAAW,EAAE,KAAK;oBAClB,OAAO,EAAE,EAAE,UAAU,EAAE;iBACvB,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;IACH,CAAC;CACD"}

package/dist/plugins/shell/index.js

@@ -0,0 +1,6 @@
+/**
+ * Shell plugin - command execution with sandbox support
+ */
+export { createRestrictedShellConfig, createSafeShellConfig, shellPlugin, } from './plugin.js';
+export { buildBwrapArgs, ShellExecutor, } from './executor.js';
+//# sourceMappingURL=index.js.map

package/dist/plugins/shell/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/shell/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACN,2BAA2B,EAC3B,qBAAqB,EAGrB,WAAW,GAEX,MAAM,aAAa,CAAA;AAEpB,OAAO,EACN,cAAc,EAMd,aAAa,GAEb,MAAM,eAAe,CAAA"}