@rosthq/cli 0.7.31 → 0.7.33

package/dist/forge-workspace.d.ts

@@ -0,0 +1,39 @@
+export declare const MODEL_SPAWN_ENV_ALLOWLIST: readonly ["PATH", "HOME", "LANG", "LC_ALL", "TMPDIR", "SHELL", "NODE_OPTIONS"];
+export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export type ForgeCredential = {
+    token: string;
+    expiresAt: string;
+};
+export type ForgeWorkspace = {
+    baseRepo: string;
+    worktreeDir: string;
+    branch: string;
+    readOnly: boolean;
+    baseSha: string;
+};
+export type ForgeWorkspaceProfile = "build" | "review";
+export type PrepareForgeWorkspaceOptions = {
+    baseDir: string;
+    tenantId: string;
+    buildRequestId: string;
+    changeset: {
+        id: string;
+        ordinal: number;
+        total: number;
+    };
+    profile: ForgeWorkspaceProfile;
+    headSha?: string;
+    repo: {
+        owner: string;
+        name: string;
+        default_branch: string;
+    };
+    credential: ForgeCredential;
+    remoteUrl?: string;
+};
+export declare function prepareForgeWorkspace(options: PrepareForgeWorkspaceOptions): Promise<ForgeWorkspace>;
+export declare function pushChangeset(ws: ForgeWorkspace, credential: ForgeCredential): Promise<{
+    commitSha: string;
+} | null>;
+export declare function removeWorkspace(ws: ForgeWorkspace): Promise<void>;
+//# sourceMappingURL=forge-workspace.d.ts.map

package/dist/forge-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AAmDA,eAAO,MAAM,yBAAyB,gFAQ5B,CAAC;AAEX,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAW7E;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAuPF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiC1G;AA8CD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA2BvC;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}

package/dist/index.js

@@ -42464,6 +42464,16 @@ var softwareDeveloperTeamRoleSchema = external_exports.enum([
   "qa_release",
   "fold_memory"
 ]);
+var softwareDeveloperTeamLaneSchema = external_exports.enum(["runner", "cloud"]);
+var softwareDeveloperTeamLaneOverridesSchema = external_exports.object({
+  forge_lead: softwareDeveloperTeamLaneSchema.optional(),
+  planner: softwareDeveloperTeamLaneSchema.optional(),
+  builder: softwareDeveloperTeamLaneSchema.optional(),
+  plan_conformance_reviewer: softwareDeveloperTeamLaneSchema.optional(),
+  security_reviewer: softwareDeveloperTeamLaneSchema.optional(),
+  qa_release: softwareDeveloperTeamLaneSchema.optional(),
+  fold_memory: softwareDeveloperTeamLaneSchema.optional()
+}).strict();
 var softwareEnvironmentSchema = external_exports.enum(["development", "preview", "production"]);
 var softwareGrantStatusSchema = external_exports.enum(["active", "revoked"]);
 var softwareConfigValueKindSchema = external_exports.enum(["plain", "secret_ref"]);
@@ -43045,7 +43055,14 @@ var softwareDeveloperTeamInstallInputSchema = external_exports.object({
   // auto-activate unless the owner explicitly acknowledges that posture. Never
   // silently inherit a more-permissive-than-designed ceiling (invariant #10). A
   // tenant within the envelope (locked_down/balanced) never needs this.
-  acknowledge_autonomy_ceiling: external_exports.boolean().default(false)
+  acknowledge_autonomy_ceiling: external_exports.boolean().default(false),
+  // DER-1317 (T0.2a): optionally pin an individual role to a specific execution
+  // lane. Omitted roles staff their declared default lane (phase-owning agents =
+  // `runner`; the human `forge_lead` seat is never staffed with an agent, so its
+  // override is inert). `.nullable()` for the same confirm-replay round-trip
+  // reason as `software_project_id` above (JSONB re-parse of a human-confirmed
+  // command tolerates a JSON `null` for an omitted object).
+  lane_overrides: softwareDeveloperTeamLaneOverridesSchema.nullable().optional()
 }).strict();
 var softwareDeveloperTeamSeatSummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
@@ -45132,7 +45149,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-05.1",
+    version: "2026-07-05.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -45869,7 +45886,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_a_forge_authority_profile\` | \`software_factory.authority_profile.create\` | Define a Forge authority profile (a named seat capability preset). Owner-only; defaults to the read_only preset. | Tenant-admin | Call with \`{"name":"Builder","preset":"contributor"}\`. |
 | \`rost_grant_forge_seat_authority\` | \`software_factory.authority.grant\` | Grant a seat a Forge authority profile on a project (seat \u2192 project \u2192 profile). Owner-only and human-gated; emits a durable authority-change event. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","seat_id":"<seat-id>","authority_profile_id":"<profile-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_revoke_forge_seat_authority\` | \`software_factory.authority.revoke\` | Revoke a Forge authority grant (teardown). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_install_forge_developer_team\` | \`software_factory.developer_team.install\` | Install AND activate the governed Forge Developer Team: Forge Lead (human) plus Planner, Builder, plan reviewer, security reviewer, QA/release, and Fold/Memory seats with draft Charters, first-party Forge Skills, and authority presets. Approving ALSO auto-staffs the 6 agent seats as live occupancies at a pull-request-only, observe-first posture (open pull requests, never merge/deploy without a human), steward-chained to the human lead, each with a signed manifest + passed sandbox dry-run; it sets a conservative default token budget (only if none) and, for a supplied project, a default pr_only GitHub automation policy (only if none \u2014 never widening a stricter one). Entitlement-gated and human-gated. | Tenant-admin | Call with \`{"steward_seat_id":"<human-steward-seat-id>"}\` \u2014 \`software_project_id\` is optional (when supplied it scopes authority grants to that project; the team installs tenant-wide either way). If the company autonomy ceiling is more permissive than the observe-first envelope, add \`{"acknowledge_autonomy_ceiling":true}\` to activate. Non-interactive callers receive a confirmation handoff. |
+| \`rost_install_forge_developer_team\` | \`software_factory.developer_team.install\` | Install AND activate the governed Forge Developer Team: Forge Lead (human) plus Planner, Builder, plan reviewer, security reviewer, QA/release, and Fold/Memory seats with draft Charters, first-party Forge Skills, and authority presets. Approving ALSO auto-staffs the 6 agent seats as live occupancies at a pull-request-only, observe-first posture (open pull requests, never merge/deploy without a human), steward-chained to the human lead, each with a signed manifest + passed sandbox dry-run; the 6 agent seats staff the runner lane and go live in a PARKED state \u2014 they become claimable once a runner pairs and cannot claim work before then; it sets a conservative default token budget (only if none) and, for a supplied project, a default pr_only GitHub automation policy (only if none \u2014 never widening a stricter one). Entitlement-gated and human-gated. | Tenant-admin | Call with \`{"steward_seat_id":"<human-steward-seat-id>"}\` \u2014 \`software_project_id\` is optional (when supplied it scopes authority grants to that project; the team installs tenant-wide either way). If the company autonomy ceiling is more permissive than the observe-first envelope, add \`{"acknowledge_autonomy_ceiling":true}\` to activate. Add \`{"lane_overrides":{"qa_release":"cloud"}}\` to pin a role to the cloud lane instead of the default runner lane. Non-interactive callers receive a confirmation handoff. |
 | \`rost_list_forge_config\` | \`software_factory.config.list\` | List active Forge configuration entries. Plain values may be returned only when they passed the non-secret guard; secret refs appear as metadata and never include the ref value. | Tenant | Call with \`{}\` or \`{"software_project_id":"<project-id>","environment":"preview"}\`. |
 | \`rost_set_forge_config\` | \`software_factory.config.set\` | Human-gated config create/rotation for plain values or secret refs. Secret refs store only a vault pointer and raw secret-shaped plain values are rejected. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","environment":"preview","key_name":"PUBLIC_BASE_URL","value_kind":"plain","plain_value":"https://preview.example.com"}\`. |
 | \`rost_list_forge_secret_requests\` | \`software_factory.secret_request.list\` | List missing-secret requests and their approval Task ids/statuses. It returns request metadata only \u2014 no secret values and no vault refs. | Tenant | Call with \`{}\` or \`{"status":"pending"}\`. |
@@ -49083,7 +49100,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.config.list", "namespace": "software_factory", "action": "config.list", "title": "List Forge config", "description": "List active Forge config metadata for project environments. Plain config values may be returned; secret refs are represented only as has_secret_ref.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "environment", "flag": "environment", "type": "enum", "required": false, "enumValues": ["development", "preview", "production"] }], "hasComplexInput": false, "help": "List active Forge config entries. Plain config may be shown; secret refs are represented only as metadata." },
   { "id": "software_factory.config.set", "namespace": "software_factory", "action": "config.set", "title": "Set Forge config", "description": "Create or rotate a Forge project config entry. Secret config stores only a vault ref pointer; raw values are never accepted for secret_ref entries.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "value_kind", "flag": "value-kind", "type": "enum", "required": true, "enumValues": ["plain", "secret_ref"] }, { "name": "plain_value", "flag": "plain-value", "type": "string", "required": false }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": false }], "hasComplexInput": false, "help": "Set or rotate a Forge project config key. Secret entries store only vault refs and are human-gated." },
   { "id": "software_factory.conformance.record_findings", "namespace": "software_factory", "action": "conformance.record_findings", "title": "Record Forge conformance findings", "description": "The plan-conformance reviewer records one or more findings against a build request; open findings route the request back to implementation. Recording is evidence, not a decision \u2014 accepting a gap is a separate human gate. Requires the Forge add-on.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "phase_run_id", "flag": "phase-run-id", "type": "string", "required": false }], "hasComplexInput": true, "help": "Record structured Forge plan-conformance findings as reviewer evidence. Open findings route the request back to implementation; accepting a gap remains a separate human gate." },
-  { "id": "software_factory.developer_team.install", "namespace": "software_factory", "action": "developer_team.install", "title": "Install Forge Developer Team", "description": "Install AND activate the governed Forge Developer Team: 7 seats (1 human lead + 6 agents), first-party skills, authority presets, and a conservative token budget. Approving this ACTIVATES the 6 agents as live occupancies at a pr_only, observe-first posture: they open pull requests but never merge or deploy without a human. Entitlement-gated and human-confirmed.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": true }, { "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "assign_skills", "flag": "assign-skills", "type": "boolean", "required": false }, { "name": "acknowledge_autonomy_ceiling", "flag": "acknowledge-autonomy-ceiling", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Install the governed Forge Developer Team template with seats, draft Charters, skills, project authority grants, and audit records. Tenant-admin and human-gated; creates no live agent occupancy." },
+  { "id": "software_factory.developer_team.install", "namespace": "software_factory", "action": "developer_team.install", "title": "Install Forge Developer Team", "description": "Install AND activate the governed Forge Developer Team: 7 seats (1 human lead + 6 agents), first-party skills, authority presets, and a conservative token budget. Approving this ACTIVATES the 6 agents as live occupancies at a pr_only, observe-first posture: they open pull requests but never merge or deploy without a human. Entitlement-gated and human-confirmed.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": true }, { "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "assign_skills", "flag": "assign-skills", "type": "boolean", "required": false }, { "name": "acknowledge_autonomy_ceiling", "flag": "acknowledge-autonomy-ceiling", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Install the governed Forge Developer Team template with seats, draft Charters, skills, project authority grants, and audit records. Tenant-admin and human-gated; creates no live agent occupancy." },
   { "id": "software_factory.gate.decide", "namespace": "software_factory", "action": "gate.decide", "title": "Decide a Forge gate", "description": "A human approves or rejects a Forge gate. The resolver is recorded (never an agent \u2014 invariant #7); sensitive gates (security sign-off, merge/deploy, authority change, production deploy) also write a linked human decision. Requires confirmation.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "gate_id", "flag": "gate-id", "type": "string", "required": true }, { "name": "decision", "flag": "decision", "type": "enum", "required": true, "enumValues": ["approve", "reject"] }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human approves or rejects a Forge gate; an agent caller routes to /approvals and can never self-approve. Sensitive gates record a human decision." },
   { "id": "software_factory.github.installation_token.create", "namespace": "software_factory", "action": "github.installation_token.create", "title": "Create a Forge GitHub installation token", "description": "Mint a short-lived GitHub App installation token for one bound repository after server-side policy evaluation. The token is returned once and never persisted.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "repository_id", "flag": "repository-id", "type": "integer", "required": true }, { "name": "requested_actions", "flag": "requested-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requested_automation_mode", "flag": "requested-automation-mode", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Mint a short-lived GitHub App installation token for one bound repository after policy evaluation; token material is returned once and never stored." },
   { "id": "software_factory.github.installation.bind", "namespace": "software_factory", "action": "github.installation.bind", "title": "Bind Forge GitHub repositories to projects", "description": "Bind already-connected GitHub repositories to Forge projects. Owner-only and human-gated; operates on repositories already verified and connected in this tenant, so no GitHub re-authorization is required. Available any time, add or re-map bindings.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }], "hasComplexInput": true, "help": "Bind already-connected GitHub repositories to Forge projects from the Forge GitHub settings flow. Owner-only and human-gated; no GitHub re-authorization required." },
@@ -51653,13 +51670,43 @@ function parseSemver2(value) {
 }
 
 // src/runner-serve.ts
-import { execFile as execFileCallback3, spawn } from "node:child_process";
+import { execFile as execFileCallback4, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { chmod, mkdir as mkdir2, readFile as readFile3, rename, rm as rm3, statfs, writeFile as writeFile2 } from "node:fs/promises";
 import { cpus, homedir as homedir2, hostname as hostname3, platform, totalmem, tmpdir } from "node:os";
 import path4 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
+import { promisify as promisify4 } from "node:util";
+
+// src/forge-workspace.ts
+import { execFile as execFileCallback3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
+var execFile3 = promisify3(execFileCallback3);
+var MODEL_SPAWN_ENV_ALLOWLIST = [
+  "PATH",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "TMPDIR",
+  "SHELL",
+  "NODE_OPTIONS"
+];
+function buildModelSpawnEnv(base) {
+  const out = {};
+  for (const key of MODEL_SPAWN_ENV_ALLOWLIST) {
+    const value = base[key];
+    if (typeof value === "string") {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+var CLONE_TIMEOUT_MS = 10 * 6e4;
+var FETCH_TIMEOUT_MS = 5 * 6e4;
+var PUSH_TIMEOUT_MS = 5 * 6e4;
+var GIT_MAX_BUFFER = 64 * 1024 * 1024;
+var FORGE_GIT_AUTHOR_NAME = `${BRAND.name} ${RSF_ADDON_BRAND.shortName}`;
+var FORGE_GIT_AUTHOR_EMAIL = `${RSF_ADDON_BRAND.cliGroup}@${BRAND_DISTRIBUTION.cliBinName}.invalid`;
 
 // src/runner-sandbox.ts
 import { existsSync as existsSync2, realpathSync } from "node:fs";
@@ -51896,7 +51943,7 @@ async function sweepStaleRunnerTempFiles(dir, options = {}) {
 }
 
 // src/runner-serve.ts
-var execFile3 = promisify3(execFileCallback3);
+var execFile4 = promisify4(execFileCallback4);
 var RUNNER_WORK_ORDER_TOOLS = [
   "mcp__rost__rost_get_context",
   "mcp__rost__rost_report_status",
@@ -52259,7 +52306,7 @@ async function detectCapabilities(cliVersion, env, homeDir) {
 }
 async function probe(command) {
   try {
-    const { stdout, stderr } = await execFile3(command, ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile4(command, ["--version"], { timeout: 1500 });
     return { installed: true, version: (stdout || stderr).trim() || null, auth_state: "ready" };
   } catch {
     return { installed: false, version: null, auth_state: "unknown" };
@@ -52267,7 +52314,7 @@ async function probe(command) {
 }
 async function probeGit() {
   try {
-    const { stdout, stderr } = await execFile3("git", ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile4("git", ["--version"], { timeout: 1500 });
     const raw = (stdout || stderr).trim();
     return { installed: true, version: /(\d+\.\d+(?:\.\d+)?)/.exec(raw)?.[1] ?? (raw || null) };
   } catch {
@@ -52276,7 +52323,7 @@ async function probeGit() {
 }
 async function probeGh() {
   try {
-    const { stdout, stderr } = await execFile3("gh", ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile4("gh", ["--version"], { timeout: 1500 });
     const raw = (stdout || stderr).trim().split("\n")[0]?.trim() ?? "";
     const authenticated = await probeGhAuth();
     return { installed: true, version: /(\d+\.\d+\.\d+)/.exec(raw)?.[1] ?? (raw || null), authenticated };
@@ -52286,7 +52333,7 @@ async function probeGh() {
 }
 async function probeGhAuth() {
   try {
-    await execFile3("gh", ["auth", "status"], { timeout: 1500 });
+    await execFile4("gh", ["auth", "status"], { timeout: 1500 });
     return true;
   } catch {
     return false;
@@ -52498,6 +52545,7 @@ async function spawnRunnerTurn(appUrl2, workOrder, runtime, kind, sandbox, state
     };
     const child = spawn(command, args, {
       cwd: tmpdir(),
+      env: buildModelSpawnEnv(process.env),
       stdio: ["ignore", "pipe", "pipe"]
     });
     let out = "";
@@ -52625,13 +52673,13 @@ function usage() {
 }
 
 // src/runner-service.ts
-import { execFile as execFileCallback4 } from "node:child_process";
+import { execFile as execFileCallback5 } from "node:child_process";
 import { realpathSync as realpathSync2 } from "node:fs";
 import { access as access2, mkdir as mkdir3, readFile as readFile4, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import path5 from "node:path";
-import { promisify as promisify4 } from "node:util";
-var execFile4 = promisify4(execFileCallback4);
+import { promisify as promisify5 } from "node:util";
+var execFile5 = promisify5(execFileCallback5);
 var SERVICE_VERBS = ["install-service", "start", "stop", "restart", "status", "logs", "uninstall"];
 function isServiceVerb(value) {
   return value !== void 0 && SERVICE_VERBS.includes(value);
@@ -53190,7 +53238,7 @@ function escapePlist(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 var defaultExec = async (file2, args, options) => {
-  const result = await execFile4(file2, args, options?.env ? { env: options.env } : {});
+  const result = await execFile5(file2, args, options?.env ? { env: options.env } : {});
   return { stdout: String(result.stdout), stderr: String(result.stderr) };
 };
 function assertNever2(value) {