@slopus/happy-agent-supervisor 0.0.9 → 0.0.10-darwin-arm64

package/README.md

@@ -24,22 +24,28 @@ matching executable lives.
 
 ## Where it runs
 
-| Platform | Architecture | Rust target                  | Enforcement                                           |
-| -------- | ------------ | ---------------------------- | ----------------------------------------------------- |
-| macOS    | arm64        | `aarch64-apple-darwin`       | Seatbelt profile installed in-process                 |
-| macOS    | x64          | `x86_64-apple-darwin`        | Seatbelt profile installed in-process                 |
-| Linux    | arm64        | `aarch64-unknown-linux-musl` | namespaces, mount policy, seccomp, capability removal |
-| Linux    | x64          | `x86_64-unknown-linux-musl`  | namespaces, mount policy, seccomp, capability removal |
+| Platform   | Architecture | Rust target                  | Enforcement                                             |
+| ---------- | ------------ | ---------------------------- | ------------------------------------------------------- |
+| macOS      | arm64        | `aarch64-apple-darwin`       | Seatbelt profile installed in-process                   |
+| macOS      | x64          | `x86_64-apple-darwin`        | Seatbelt profile installed in-process                   |
+| Linux      | arm64        | `aarch64-unknown-linux-musl` | namespaces, mount policy, seccomp, capability removal   |
+| Linux      | x64          | `x86_64-unknown-linux-musl`  | namespaces, mount policy, seccomp, capability removal   |
+| Windows 11 | x64          | `x86_64-pc-windows-gnu`      | Codex restricted tokens, Happy accounts, ACLs, firewall |
 
 The Linux binaries are static musl builds, so they run on any distribution and
 can be mounted read-only into a container that has no toolchain of its own.
-A local Windows 11 x64 adapter is under validation. It builds a pinned Codex native sandbox
+The Windows 11 x64 adapter builds a pinned Codex native sandbox
 with separate Happy OS identities; see `native/windows/source.json` and the license notices there.
 Run `pnpm build:native:windows` with the specified Rust toolchain installed. Set
 `HAPPY_CODEX_SOURCE_DIR` to reuse a checkout of the exact pinned commit. Building does not
 provision the sandbox. First execution requires one-time native setup; host allowlist proxy
 and independent listener policies currently fail closed until their Windows implementation
-is complete. This local validation build is not a published Windows release.
+is complete. The matching Windows supervisor and helpers are published starting with `0.0.9`.
+
+Windows retains Codex's native restricted-token model. A folder granting write access to
+`Everyone` can satisfy that token's write check even outside the selected writable roots.
+This release does not include Codex TUI's additional world-writable-folder audit; use normal
+per-user project directories. Broader filesystem hardening is deferred.
 
 ## Install
 
@@ -205,6 +211,49 @@ would be enforcing the list. A host list with egress disabled is already enforce
 by the isolated network namespace. No TLS is terminated anywhere, so the boundary
 is which host may be reached rather than what is sent to it.
 
+## Strict workspace services
+
+The optional `service` policy selects a separate mandatory boundary. It currently requires
+Linux with working user/mount/PID/network namespaces and a delegated cgroup v2 parent with
+`memory` and `pids` enabled. The daemon must already run inside that delegation (normally in
+a sibling leaf cgroup). Startup never changes service privileges, host cgroup delegation,
+AppArmor, or global sysctls. macOS and Windows service launches fail closed; their ordinary
+shell behavior is unchanged.
+
+The trusted controller supplies an empty private root, explicit read-only input mounts,
+private scratch paths, an execution identity, resource limits, and a private bridge socket.
+`controllerPid` must identify the direct launching process. Before creating runtime resources,
+the supervisor records its PID and kernel start time in `process.json` beside the bridge.
+Recovery must check that identity as well as cgroup emptiness; an absent cgroup alone does not
+prove that a supervisor still setting up its sandbox has exited.
+Pass service policies through a controller-owned, mode-0600 `--policy-file` beneath the
+daemon's protected private storage, not through command-line JSON: process listings must
+not reveal the bridge credential. The controller owns that file's lifecycle too.
+The service sees a fixed system runtime, selected files below `/workspace`, a private home,
+and private temporary storage. It receives a clean environment. Pathname Unix sockets are
+blocked even if a socket is subsequently inserted into an input directory. Overlapping
+scratch paths need an existing mount point inside the read-only input; no host directory is
+created for that purpose.
+
+Service IPC is namespaced too. The service syscall boundary prevents creating replacement
+namespaces, remounting resource controls, or using io_uring to bypass socket restrictions.
+Unix socketpairs are unavailable as well, since reconnectable datagram pairs would bypass
+pathname-socket denial. Commands that require Unix-socket IPC need a different runtime design;
+service startup never relaxes this boundary automatically. Pipes and inherited stdin/stdout work.
+
+The controller authenticates to the bridge using the execution's 64-byte hex token. The
+bridge returns one byte (`1` for a connected endpoint, `0` for an unreachable endpoint),
+then relays with bounded buffers to the single declared loopback port. This is private native
+transport, not the HTTP API: the daemon additionally enforces API authorization and HTTP-only
+forwarding. Never expose the socket, token, or native policy to page JavaScript or tool results.
+Outbound service grants match exact hostname/port pairs and never permit private IPs.
+
+The workload enters its cgroup before executing. Its descendants remain subject to the same
+memory/process limits, including detached children. The supervisor follows its owner's death;
+namespace-init death kills the workload tree. Normal completion checks that the cgroup is empty
+before removing it. After abrupt supervisor death, the controller must independently confirm
+the retained cgroup is empty and all runtime handles are closed before deleting workspace files.
+
 ## Process hardening
 
 The supervisor runs as the same user as the workload and holds the workload's

package/SHA256SUMS

@@ -0,0 +1 @@
+c1b7f06565595967bb44611e5e47d1f79245a974002f33bba7843a12ae3f50b0  vendor/aarch64-apple-darwin/bin/happy-agent-supervisor

package/package.json

@@ -1,46 +1,33 @@
 {
   "name": "@slopus/happy-agent-supervisor",
-  "version": "0.0.9",
-  "description": "Trusted native sandbox boundary for Happy agent workloads.",
-  "keywords": [
-    "sandbox",
-    "seatbelt",
-    "seccomp",
-    "supervisor"
-  ],
+  "version": "0.0.10-darwin-arm64",
+  "description": "Trusted native sandbox boundary for Happy agent workloads. Native binary for darwin-arm64.",
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/slopus/happy-agent.git",
     "directory": "packages/happy-agent-supervisor"
   },
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
+  ],
+  "bin": {
+    "happy-agent-supervisor": "vendor/aarch64-apple-darwin/bin/happy-agent-supervisor"
+  },
   "files": [
-    "dist",
+    "vendor",
+    "SHA256SUMS",
     "LICENSE",
     "README.md"
   ],
-  "type": "module",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "default": "./dist/index.js"
-    }
-  },
   "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "@sinclair/typebox": "^0.34.49"
-  },
-  "engines": {
-    "node": ">=22.19.0"
-  },
-  "optionalDependencies": {
-    "@slopus/happy-agent-supervisor-win32-x64": "npm:@slopus/happy-agent-supervisor@0.0.9-win32-x64",
-    "@slopus/happy-agent-supervisor-darwin-arm64": "npm:@slopus/happy-agent-supervisor@0.0.9-darwin-arm64",
-    "@slopus/happy-agent-supervisor-darwin-x64": "npm:@slopus/happy-agent-supervisor@0.0.9-darwin-x64",
-    "@slopus/happy-agent-supervisor-linux-arm64": "npm:@slopus/happy-agent-supervisor@0.0.9-linux-arm64",
-    "@slopus/happy-agent-supervisor-linux-x64": "npm:@slopus/happy-agent-supervisor@0.0.9-linux-x64"
+    "access": "public",
+    "tag": "platform"
   }
 }

package/dist/SupervisorPolicy.d.ts

@@ -1,55 +0,0 @@
-import { type Static } from "@sinclair/typebox";
-export declare const supervisorPermissionModeSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"read_only">, import("@sinclair/typebox").TLiteral<"workspace_write">, import("@sinclair/typebox").TLiteral<"auto">, import("@sinclair/typebox").TLiteral<"full_access">]>;
-export type SupervisorPermissionMode = Static<typeof supervisorPermissionModeSchema>;
-export declare const supervisorProxyFrontEndSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"http">, import("@sinclair/typebox").TLiteral<"socks5">]>;
-export type SupervisorProxyFrontEnd = Static<typeof supervisorProxyFrontEndSchema>;
-/**
- * The front-ends to expose inside the sandbox.
- *
- * The supervisor provides the proxy itself. It forks an egress process before the sandbox exists
- * and joins the two with a socketpair, so nothing inside the sandbox reaches the proxy — or
- * anything else — by address, and the caller supplies neither a descriptor nor a token. Which hosts
- * that egress process may reach comes from `network.allowedHosts`.
- */
-export declare const supervisorOutgoingProxySchema: import("@sinclair/typebox").TObject<{
-    frontEnds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"http">, import("@sinclair/typebox").TLiteral<"socks5">]>>;
-}>;
-export type SupervisorOutgoingProxy = Static<typeof supervisorOutgoingProxySchema>;
-export declare const supervisorNetworkPolicySchema: import("@sinclair/typebox").TObject<{
-    egress: import("@sinclair/typebox").TBoolean;
-    allowedHosts: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
-    localBinding: import("@sinclair/typebox").TBoolean;
-    outgoingProxy: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
-        frontEnds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"http">, import("@sinclair/typebox").TLiteral<"socks5">]>>;
-    }>>;
-}>;
-export type SupervisorNetworkPolicy = Static<typeof supervisorNetworkPolicySchema>;
-/**
- * The native supervisor's input. Its names intentionally match ComputePermissions one-for-one.
- *
- * The working directory is the workspace root for `workspace_write` and `auto`; keeping it out of
- * the document prevents two sources of truth for the process cwd. A non-empty `allowedHosts`
- * requires `network.outgoingProxy`, because the host list is enforced in the egress process the
- * proxy creates, and without a proxy there would be nothing enforcing it. Each entry names one host
- * or one `*.suffix`; a bare `*` is refused, and open egress is expressed by configuring no proxy.
- */
-export declare const supervisorPolicySchema: import("@sinclair/typebox").TObject<{
-    mode: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"read_only">, import("@sinclair/typebox").TLiteral<"workspace_write">, import("@sinclair/typebox").TLiteral<"auto">, import("@sinclair/typebox").TLiteral<"full_access">]>;
-    allowedReadPaths: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
-    deniedReadPaths: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
-    allowedWritePaths: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
-    deniedWritePaths: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
-    /** Windows placeholder type for protected project files that may be absent. */
-    deniedWriteFilePaths: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
-    network: import("@sinclair/typebox").TObject<{
-        egress: import("@sinclair/typebox").TBoolean;
-        allowedHosts: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
-        localBinding: import("@sinclair/typebox").TBoolean;
-        outgoingProxy: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
-            frontEnds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"http">, import("@sinclair/typebox").TLiteral<"socks5">]>>;
-        }>>;
-    }>;
-}>;
-export type SupervisorPolicy = Static<typeof supervisorPolicySchema>;
-export declare function parseSupervisorPolicy(value: unknown): SupervisorPolicy;
-//# sourceMappingURL=SupervisorPolicy.d.ts.map

package/dist/SupervisorPolicy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SupervisorPolicy.d.ts","sourceRoot":"","sources":["../sources/SupervisorPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,mBAAmB,CAAC;AAGtD,eAAO,MAAM,8BAA8B,qPAKzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAErF,eAAO,MAAM,6BAA6B,oIAGxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B;;EAKzC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEnF,eAAO,MAAM,6BAA6B;;;;;;;EAQzC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEnF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB;;;;;;IAO3B,+EAA+E;;;;;;;;;;EAKtF,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAErE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAQtE"}

package/dist/SupervisorPolicy.js

@@ -1,58 +0,0 @@
-import { Type } from "@sinclair/typebox";
-import { Value } from "@sinclair/typebox/value";
-export const supervisorPermissionModeSchema = Type.Union([
-    Type.Literal("read_only"),
-    Type.Literal("workspace_write"),
-    Type.Literal("auto"),
-    Type.Literal("full_access"),
-]);
-export const supervisorProxyFrontEndSchema = Type.Union([
-    Type.Literal("http"),
-    Type.Literal("socks5"),
-]);
-/**
- * The front-ends to expose inside the sandbox.
- *
- * The supervisor provides the proxy itself. It forks an egress process before the sandbox exists
- * and joins the two with a socketpair, so nothing inside the sandbox reaches the proxy — or
- * anything else — by address, and the caller supplies neither a descriptor nor a token. Which hosts
- * that egress process may reach comes from `network.allowedHosts`.
- */
-export const supervisorOutgoingProxySchema = Type.Object({
-    frontEnds: Type.Array(supervisorProxyFrontEndSchema, { minItems: 1 }),
-}, { additionalProperties: false });
-export const supervisorNetworkPolicySchema = Type.Object({
-    egress: Type.Boolean(),
-    allowedHosts: Type.Optional(Type.Array(Type.String())),
-    localBinding: Type.Boolean(),
-    outgoingProxy: Type.Optional(supervisorOutgoingProxySchema),
-}, { additionalProperties: false });
-/**
- * The native supervisor's input. Its names intentionally match ComputePermissions one-for-one.
- *
- * The working directory is the workspace root for `workspace_write` and `auto`; keeping it out of
- * the document prevents two sources of truth for the process cwd. A non-empty `allowedHosts`
- * requires `network.outgoingProxy`, because the host list is enforced in the egress process the
- * proxy creates, and without a proxy there would be nothing enforcing it. Each entry names one host
- * or one `*.suffix`; a bare `*` is refused, and open egress is expressed by configuring no proxy.
- */
-export const supervisorPolicySchema = Type.Object({
-    mode: supervisorPermissionModeSchema,
-    allowedReadPaths: Type.Optional(Type.Array(Type.String())),
-    deniedReadPaths: Type.Optional(Type.Array(Type.String())),
-    allowedWritePaths: Type.Optional(Type.Array(Type.String())),
-    deniedWritePaths: Type.Optional(Type.Array(Type.String())),
-    /** Windows placeholder type for protected project files that may be absent. */
-    deniedWriteFilePaths: Type.Optional(Type.Array(Type.String())),
-    network: supervisorNetworkPolicySchema,
-}, { additionalProperties: false });
-export function parseSupervisorPolicy(value) {
-    if (!Value.Check(supervisorPolicySchema, value)) {
-        const details = [...Value.Errors(supervisorPolicySchema, value)]
-            .map((error) => `${error.path || "/"} ${error.message}`)
-            .join("; ");
-        throw new Error(`Invalid supervisor policy: ${details}`);
-    }
-    return Value.Parse(supervisorPolicySchema, value);
-}
-//# sourceMappingURL=SupervisorPolicy.js.map

package/dist/SupervisorPolicy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SupervisorPolicy.js","sourceRoot":"","sources":["../sources/SupervisorPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAEhD,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC,KAAK,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IACzB,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IACpB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;CAC9B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC,KAAK,CAAC;IACpD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IACpB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;CACzB,CAAC,CAAC;AAIH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC,MAAM,CACpD;IACI,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;CACxE,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAClC,CAAC;AAIF,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC,MAAM,CACpD;IACI,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;IACtB,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE;IAC5B,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC;CAC9D,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAClC,CAAC;AAIF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAC7C;IACI,IAAI,EAAE,8BAA8B;IACpC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,+EAA+E;IAC/E,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,6BAA6B;CACzC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAClC,CAAC;AAIF,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;aAC3D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;aACvD,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC"}

package/dist/impl/resolveBinaryForTarget.d.ts

@@ -1,3 +0,0 @@
-import { type PlatformKey } from "../platform.js";
-export declare function resolveBinaryForTarget(key: PlatformKey, binaryPath?: string): string;
-//# sourceMappingURL=resolveBinaryForTarget.d.ts.map

package/dist/impl/resolveBinaryForTarget.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolveBinaryForTarget.d.ts","sourceRoot":"","sources":["../../sources/impl/resolveBinaryForTarget.ts"],"names":[],"mappings":"AAKA,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAIpE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAwCpF"}

package/dist/impl/resolveBinaryForTarget.js

@@ -1,39 +0,0 @@
-import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { PLATFORM_TARGETS } from "../platform.js";
-const require = createRequire(import.meta.url);
-export function resolveBinaryForTarget(key, binaryPath) {
-    if (binaryPath !== undefined) {
-        const explicit = path.resolve(binaryPath);
-        if (!existsSync(explicit)) {
-            throw new Error(`Happy agent supervisor binary does not exist: ${explicit}`);
-        }
-        return explicit;
-    }
-    const platform = PLATFORM_TARGETS[key];
-    const executable = platform.os === "win32" ? "happy-agent-supervisor.exe" : "happy-agent-supervisor";
-    try {
-        const manifest = require.resolve(`${platform.alias}/package.json`);
-        const installed = path.join(path.dirname(manifest), "vendor", platform.target, "bin", executable);
-        if (existsSync(installed))
-            return installed;
-    }
-    catch {
-        // Fall through to repository-local native build locations.
-    }
-    const packageRoot = fileURLToPath(new URL("../../", import.meta.url));
-    const localCandidates = [
-        path.join(packageRoot, "native", "target", platform.target, "release", executable),
-        path.join(packageRoot, "native", "target", platform.target, "debug", executable),
-        path.join(packageRoot, "native", "target", "release", executable),
-        path.join(packageRoot, "native", "target", "debug", executable),
-    ];
-    const local = localCandidates.find((candidate) => existsSync(candidate));
-    if (local !== undefined)
-        return local;
-    throw new Error(`The optional binary package ${platform.alias} is missing. Reinstall ` +
-        "@slopus/happy-agent-supervisor or build the matching native target.");
-}
-//# sourceMappingURL=resolveBinaryForTarget.js.map

package/dist/impl/resolveBinaryForTarget.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolveBinaryForTarget.js","sourceRoot":"","sources":["../../sources/impl/resolveBinaryForTarget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,gBAAgB,CAAC;AAEpE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,UAAU,sBAAsB,CAAC,GAAgB,EAAE,UAAmB;IACxE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GACZ,QAAQ,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wBAAwB,CAAC;IACtF,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,eAAe,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACvB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EACtB,QAAQ,EACR,QAAQ,CAAC,MAAM,EACf,KAAK,EACL,UAAU,CACb,CAAC;QACF,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,2DAA2D;IAC/D,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;QAChF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC;KAClE,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,IAAI,KAAK,CACX,+BAA+B,QAAQ,CAAC,KAAK,yBAAyB;QAClE,qEAAqE,CAC5E,CAAC;AACN,CAAC"}

package/dist/index.d.ts

@@ -1,5 +0,0 @@
-export { parseSupervisorPolicy, supervisorNetworkPolicySchema, supervisorPermissionModeSchema, supervisorPolicySchema, type SupervisorNetworkPolicy, type SupervisorPermissionMode, type SupervisorPolicy, } from "./SupervisorPolicy.js";
-export { linuxSupervisorArchitectureSchema, type LinuxSupervisorArchitecture } from "./platform.js";
-export { resolveLinuxSupervisorBinary } from "./resolveLinuxSupervisorBinary.js";
-export { resolveSupervisorBinary } from "./resolveSupervisorBinary.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../sources/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iCAAiC,EAAE,KAAK,2BAA2B,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/index.js

@@ -1,5 +0,0 @@
-export { parseSupervisorPolicy, supervisorNetworkPolicySchema, supervisorPermissionModeSchema, supervisorPolicySchema, } from "./SupervisorPolicy.js";
-export { linuxSupervisorArchitectureSchema } from "./platform.js";
-export { resolveLinuxSupervisorBinary } from "./resolveLinuxSupervisorBinary.js";
-export { resolveSupervisorBinary } from "./resolveSupervisorBinary.js";
-//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../sources/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,sBAAsB,GAIzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iCAAiC,EAAoC,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/platform.d.ts

@@ -1,43 +0,0 @@
-import { type Static } from "@sinclair/typebox";
-export declare const PLATFORM_TARGETS: {
-    readonly "win32-x64": {
-        readonly alias: "@slopus/happy-agent-supervisor-win32-x64";
-        readonly arch: "x64";
-        readonly os: "win32";
-        readonly tag: "win32-x64";
-        readonly target: "x86_64-pc-windows-gnu";
-    };
-    readonly "darwin-arm64": {
-        readonly alias: "@slopus/happy-agent-supervisor-darwin-arm64";
-        readonly arch: "arm64";
-        readonly os: "darwin";
-        readonly tag: "darwin-arm64";
-        readonly target: "aarch64-apple-darwin";
-    };
-    readonly "darwin-x64": {
-        readonly alias: "@slopus/happy-agent-supervisor-darwin-x64";
-        readonly arch: "x64";
-        readonly os: "darwin";
-        readonly tag: "darwin-x64";
-        readonly target: "x86_64-apple-darwin";
-    };
-    readonly "linux-arm64": {
-        readonly alias: "@slopus/happy-agent-supervisor-linux-arm64";
-        readonly arch: "arm64";
-        readonly os: "linux";
-        readonly tag: "linux-arm64";
-        readonly target: "aarch64-unknown-linux-musl";
-    };
-    readonly "linux-x64": {
-        readonly alias: "@slopus/happy-agent-supervisor-linux-x64";
-        readonly arch: "x64";
-        readonly os: "linux";
-        readonly tag: "linux-x64";
-        readonly target: "x86_64-unknown-linux-musl";
-    };
-};
-export type PlatformKey = keyof typeof PLATFORM_TARGETS;
-export declare const linuxSupervisorArchitectureSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"amd64">, import("@sinclair/typebox").TLiteral<"x64">, import("@sinclair/typebox").TLiteral<"x86_64">, import("@sinclair/typebox").TLiteral<"arm64">, import("@sinclair/typebox").TLiteral<"aarch64">]>;
-/** Architecture spellings used by OCI, Node.js, and Rust target triples. */
-export type LinuxSupervisorArchitecture = Static<typeof linuxSupervisorArchitectureSchema>;
-//# sourceMappingURL=platform.d.ts.map

package/dist/platform.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../sources/platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,mBAAmB,CAAC;AAEtD,eAAO,MAAM,gBAAgB;aACzB,WAAW;iBACP,KAAK,EAAE,0CAA0C;iBACjD,IAAI,EAAE,KAAK;iBACX,EAAE,EAAE,OAAO;iBACX,GAAG,EAAE,WAAW;iBAChB,MAAM,EAAE,uBAAuB;;aAEnC,cAAc;iBACV,KAAK,EAAE,6CAA6C;iBACpD,IAAI,EAAE,OAAO;iBACb,EAAE,EAAE,QAAQ;iBACZ,GAAG,EAAE,cAAc;iBACnB,MAAM,EAAE,sBAAsB;;aAElC,YAAY;iBACR,KAAK,EAAE,2CAA2C;iBAClD,IAAI,EAAE,KAAK;iBACX,EAAE,EAAE,QAAQ;iBACZ,GAAG,EAAE,YAAY;iBACjB,MAAM,EAAE,qBAAqB;;aAEjC,aAAa;iBACT,KAAK,EAAE,4CAA4C;iBACnD,IAAI,EAAE,OAAO;iBACb,EAAE,EAAE,OAAO;iBACX,GAAG,EAAE,aAAa;iBAClB,MAAM,EAAE,4BAA4B;;aAExC,WAAW;iBACP,KAAK,EAAE,0CAA0C;iBACjD,IAAI,EAAE,KAAK;iBACX,EAAE,EAAE,OAAO;iBACX,GAAG,EAAE,WAAW;iBAChB,MAAM,EAAE,2BAA2B;;CAEjC,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAExD,eAAO,MAAM,iCAAiC,kRAM5C,CAAC;AAEH,4EAA4E;AAC5E,MAAM,MAAM,2BAA2B,GAAG,MAAM,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/platform.js

@@ -1,46 +0,0 @@
-import { Type } from "@sinclair/typebox";
-export const PLATFORM_TARGETS = {
-    "win32-x64": {
-        alias: "@slopus/happy-agent-supervisor-win32-x64",
-        arch: "x64",
-        os: "win32",
-        tag: "win32-x64",
-        target: "x86_64-pc-windows-gnu",
-    },
-    "darwin-arm64": {
-        alias: "@slopus/happy-agent-supervisor-darwin-arm64",
-        arch: "arm64",
-        os: "darwin",
-        tag: "darwin-arm64",
-        target: "aarch64-apple-darwin",
-    },
-    "darwin-x64": {
-        alias: "@slopus/happy-agent-supervisor-darwin-x64",
-        arch: "x64",
-        os: "darwin",
-        tag: "darwin-x64",
-        target: "x86_64-apple-darwin",
-    },
-    "linux-arm64": {
-        alias: "@slopus/happy-agent-supervisor-linux-arm64",
-        arch: "arm64",
-        os: "linux",
-        tag: "linux-arm64",
-        target: "aarch64-unknown-linux-musl",
-    },
-    "linux-x64": {
-        alias: "@slopus/happy-agent-supervisor-linux-x64",
-        arch: "x64",
-        os: "linux",
-        tag: "linux-x64",
-        target: "x86_64-unknown-linux-musl",
-    },
-};
-export const linuxSupervisorArchitectureSchema = Type.Union([
-    Type.Literal("amd64"),
-    Type.Literal("x64"),
-    Type.Literal("x86_64"),
-    Type.Literal("arm64"),
-    Type.Literal("aarch64"),
-]);
-//# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../sources/platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B,WAAW,EAAE;QACT,KAAK,EAAE,0CAA0C;QACjD,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,uBAAuB;KAClC;IACD,cAAc,EAAE;QACZ,KAAK,EAAE,6CAA6C;QACpD,IAAI,EAAE,OAAO;QACb,EAAE,EAAE,QAAQ;QACZ,GAAG,EAAE,cAAc;QACnB,MAAM,EAAE,sBAAsB;KACjC;IACD,YAAY,EAAE;QACV,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,QAAQ;QACZ,GAAG,EAAE,YAAY;QACjB,MAAM,EAAE,qBAAqB;KAChC;IACD,aAAa,EAAE;QACX,KAAK,EAAE,4CAA4C;QACnD,IAAI,EAAE,OAAO;QACb,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,aAAa;QAClB,MAAM,EAAE,4BAA4B;KACvC;IACD,WAAW,EAAE;QACT,KAAK,EAAE,0CAA0C;QACjD,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,2BAA2B;KACtC;CACK,CAAC;AAIX,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC,KAAK,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IACnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IACrB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;CAC1B,CAAC,CAAC"}

package/dist/resolveLinuxSupervisorBinary.d.ts

@@ -1,3 +0,0 @@
-import { type LinuxSupervisorArchitecture } from "./platform.js";
-export declare function resolveLinuxSupervisorBinary(architecture: LinuxSupervisorArchitecture, binaryPath?: string): string;
-//# sourceMappingURL=resolveLinuxSupervisorBinary.d.ts.map

package/dist/resolveLinuxSupervisorBinary.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolveLinuxSupervisorBinary.d.ts","sourceRoot":"","sources":["../sources/resolveLinuxSupervisorBinary.ts"],"names":[],"mappings":"AAEA,OAAO,EAEH,KAAK,2BAA2B,EAEnC,MAAM,eAAe,CAAC;AAGvB,wBAAgB,4BAA4B,CACxC,YAAY,EAAE,2BAA2B,EACzC,UAAU,CAAC,EAAE,MAAM,GACpB,MAAM,CAOR"}

package/dist/resolveLinuxSupervisorBinary.js

@@ -1,11 +0,0 @@
-import { Value } from "@sinclair/typebox/value";
-import { linuxSupervisorArchitectureSchema, } from "./platform.js";
-import { resolveBinaryForTarget } from "./impl/resolveBinaryForTarget.js";
-export function resolveLinuxSupervisorBinary(architecture, binaryPath) {
-    if (!Value.Check(linuxSupervisorArchitectureSchema, architecture)) {
-        throw new Error(`Unsupported Linux supervisor architecture: ${String(architecture)}.`);
-    }
-    const key = architecture === "arm64" || architecture === "aarch64" ? "linux-arm64" : "linux-x64";
-    return resolveBinaryForTarget(key, binaryPath);
-}
-//# sourceMappingURL=resolveLinuxSupervisorBinary.js.map

package/dist/resolveLinuxSupervisorBinary.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolveLinuxSupervisorBinary.js","sourceRoot":"","sources":["../sources/resolveLinuxSupervisorBinary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAEhD,OAAO,EACH,iCAAiC,GAGpC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,MAAM,UAAU,4BAA4B,CACxC,YAAyC,EACzC,UAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iCAAiC,EAAE,YAAY,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,GACL,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IACzF,OAAO,sBAAsB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC"}

package/dist/resolveSupervisorBinary.d.ts

@@ -1,2 +0,0 @@
-export declare function resolveSupervisorBinary(binaryPath?: string): string;
-//# sourceMappingURL=resolveSupervisorBinary.d.ts.map

package/dist/resolveSupervisorBinary.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolveSupervisorBinary.d.ts","sourceRoot":"","sources":["../sources/resolveSupervisorBinary.ts"],"names":[],"mappings":"AAGA,wBAAgB,uBAAuB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAcnE"}

package/dist/resolveSupervisorBinary.js

@@ -1,14 +0,0 @@
-import {} from "./platform.js";
-import { resolveBinaryForTarget } from "./impl/resolveBinaryForTarget.js";
-export function resolveSupervisorBinary(binaryPath) {
-    const key = `${process.platform}-${process.arch}`;
-    if (key !== "darwin-arm64" &&
-        key !== "darwin-x64" &&
-        key !== "linux-arm64" &&
-        key !== "linux-x64" &&
-        key !== "win32-x64") {
-        throw new Error(`The Happy agent supervisor does not support ${process.platform} ${process.arch}.`);
-    }
-    return resolveBinaryForTarget(key, binaryPath);
-}
-//# sourceMappingURL=resolveSupervisorBinary.js.map

package/dist/resolveSupervisorBinary.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolveSupervisorBinary.js","sourceRoot":"","sources":["../sources/resolveSupervisorBinary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,MAAM,UAAU,uBAAuB,CAAC,UAAmB;IACvD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAiB,CAAC;IACjE,IACI,GAAG,KAAK,cAAc;QACtB,GAAG,KAAK,YAAY;QACpB,GAAG,KAAK,aAAa;QACrB,GAAG,KAAK,WAAW;QACnB,GAAG,KAAK,WAAW,EACrB,CAAC;QACC,MAAM,IAAI,KAAK,CACX,+CAA+C,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,GAAG,CACrF,CAAC;IACN,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC"}