@smthrs/std 1.0.0-rc.3 → 1.0.0-rc.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. package/README.md +35 -35
  2. package/dist/cjs/Bash.d.ts +76 -0
  3. package/dist/cjs/Bash.d.ts.map +1 -1
  4. package/dist/cjs/Bash.js +20 -9
  5. package/dist/cjs/Bash.js.map +2 -2
  6. package/dist/cjs/internal/GitWorktree.d.ts +11 -1
  7. package/dist/cjs/internal/GitWorktree.d.ts.map +1 -1
  8. package/dist/cjs/internal/GitWorktree.js +7 -1
  9. package/dist/cjs/internal/GitWorktree.js.map +2 -2
  10. package/dist/esm/Bash.d.ts +76 -0
  11. package/dist/esm/Bash.d.ts.map +1 -1
  12. package/dist/esm/Bash.js +46 -10
  13. package/dist/esm/Bash.js.map +1 -1
  14. package/dist/esm/internal/GitWorktree.d.ts +11 -1
  15. package/dist/esm/internal/GitWorktree.d.ts.map +1 -1
  16. package/dist/esm/internal/GitWorktree.js +8 -1
  17. package/dist/esm/internal/GitWorktree.js.map +1 -1
  18. package/docs/concepts/flows-and-handlers.md +2 -2
  19. package/docs/guides/run-a-shell-command.md +8 -0
  20. package/docs/troubleshooting.md +5 -0
  21. package/package.json +6 -6
  22. package/src/Bash.ts +67 -9
  23. package/src/internal/GitWorktree.ts +20 -2
package/README.md CHANGED
@@ -16,41 +16,41 @@ Not on npm yet; see [Installation](https://github.com/smithersai/smithers/blob/m
16
16
 
17
17
  The root entry point exports these namespaces; each is also importable from `@smthrs/std/<Module>`.
18
18
 
19
- | Module | Public exports | Description |
20
- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
21
- | `ApplyPatch` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation`, `paths` | Declares and applies a V4A patch. |
22
- | `Bash` | `name`, `description`, `DEFAULT_TIMEOUT_MS`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `outsideContainer`, `sealed`, `presentation` | Declares and runs bounded shell commands. |
23
- | `Checkpoints` | `baseId`, `scratchDirectory`, `configSection`, `Snapshot`, `Materialized`, `Checkpoints`, `make`, `unavailable`, `makeNoop`, `layerNoop`, `GitOptions`, `makeGit`, `layerGit`, `Relocation`, `relocate` | Pins a working tree as a git checkpoint and materializes it again. |
24
- | `Container` | `Request`, `Plan`, `Container`, `make`, `unavailable`, `makeNoop`, `layerNoop`, `makeCommand`, `layerCommand` | Routes a command into a named container. |
25
- | `Edit` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and applies exact text replacements. |
26
- | `ExaWebSearch` | `layer` | Provides WebSearch through the Exa API and kernel HTTP client. |
27
- | `Explore` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `make`, `flow` | Declares a dynamic exploration flow composed from other standard flows. |
28
- | `Fetch` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs raw HTTP GET requests. |
29
- | `Glob` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and runs filesystem glob searches. |
30
- | `Grep` | `name`, `description`, `Input`, `ContextLine`, `Symbol`, `Match`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and runs text searches over files. |
31
- | `HttpPost` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs HTTP POST requests. |
32
- | `LanguageServer` | `Position`, `LanguageServer`, `make`, `makeNoop`, `layerNoop` | Defines the language-server query service. |
33
- | `Ls` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and runs directory listings. |
34
- | `Lsp` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs ten language-server queries, from hover to diagnostics. |
35
- | `Manifest` | `flows`, `handlers`, `effectsFor`, `names`, `readOnly` | Exposes frozen flow, handler, and narrowing registries plus the read-only set. |
36
- | `NativeSearch` | `MAX_CAPTURE_BYTES`, `make`, `layer` | Implements Search through the ripgrep binary. |
37
- | `NodeLanguageServer` | `Config`, `MAX_QUEUED_FRAMES`, `MAX_PENDING_REQUESTS`, `make`, `makeLazy`, `layer`, `layerLazy` | Implements LanguageServer with Node child processes, routed by extension. |
38
- | `PortableSearch` | `make`, `layer` | Implements Search by walking the kernel filesystem in process. |
39
- | `Probe` | `key`, `Reason`, `InvalidProbe`, `Attribution`, `CONFIDENCE_FLOOR`, `MAX_OUTPUT_BYTES`, `posix`, `probeAttribution`, `classify`, `unjudged` | Attributes a non-zero exit to the command or to the tree, with Jev. |
40
- | `Read` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation`, `MAX_READ_FILE_BYTES`, `Preconditions`, `ReadSession`, `VersionedFileSystem` | Declares and runs bounded file reads. |
41
- | `Relocate` | `Relocation`, `relocate` | Rewrites a call's input so the call runs against a materialized checkpoint. |
42
- | `Search` | `GrepInput`, `GrepLine`, `ContextLine`, `Symbol`, `GrepMatch`, `GrepOutput`, `GlobInput`, `GlobOutput`, `Search`, `make`, `makeNoop`, `layerNoop` | Defines the search service both peers implement. |
43
- | `SearchConformance` | `GeneratedFile`, `Plan`, `Divergence`, `plan`, `materialize`, `compare`, `report` | Generates a tree and calls, then reports where two Search peers disagree. |
44
- | `SearchContract` | `validatePattern`, `validateGlob`, `canonicalGlob`, `matchesGlob`, `includedByGlobs`, `expression`, `unsatisfiableNotice`, `isContractRejection` | The shared matcher an external Search peer must build on. |
45
- | `ShellCommand` | `name`, `description`, `DEFAULT_TIMEOUT_MS`, `MAX_CAPTURE_BYTES`, `DEFAULT_MAX_OUTPUT_TOKENS`, `TIMEOUT_EXIT_CODE`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs a Codex-shaped shell command. |
46
- | `StdError` | `Code`, `StdError` | Defines typed standard-tool failures. |
47
- | `TestRun` | `name`, `description`, `scratchDirectory`, `DEFAULT_TIMEOUT_MS`, `MAX_CAPTURE_BYTES`, `Input`, `Outcome`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Runs the declared test suite and reads its report. |
48
- | `TreeFingerprint` | `key`, `defaultPrune`, `defaultIgnoreSuffixes`, `maxPaths`, `Measurement`, `script`, `parse`, `moved` | Measures a container's working directory so `bash` can report a write there. |
49
- | `TestRunner` | `captureBase`, `Runner`, `TestRunner`, `make`, `makeNoop`, `layer`, `layerNoop` | Declares how the project under test runs its suite. |
50
- | `UpdatePlan` | `name`, `description`, `StepStatus`, `Plan`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Acknowledges a Codex plan update. |
51
- | `WebFetch` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs normalized web-page fetches. |
52
- | `WebSearch` | `name`, `description`, `Input`, `Result`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `WebSearch`, `make`, `makeNoop`, `layerNoop`, `run` | Declares web search and its injectable provider service. |
53
- | `Write` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and runs file writes. |
19
+ | Module | Public exports | Description |
20
+ | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
21
+ | `ApplyPatch` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation`, `paths` | Declares and applies a V4A patch. |
22
+ | `Bash` | `name`, `description`, `DEFAULT_TIMEOUT_MS`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `invocation`, `inTerminal`, `outsideContainer`, `sealed`, `presentation` | Declares and runs bounded shell commands, here or in a registered terminal. |
23
+ | `Checkpoints` | `baseId`, `scratchDirectory`, `configSection`, `Snapshot`, `Materialized`, `Checkpoints`, `make`, `unavailable`, `makeNoop`, `layerNoop`, `GitOptions`, `makeGit`, `layerGit`, `Relocation`, `relocate` | Pins a working tree as a git checkpoint and materializes it again. |
24
+ | `Container` | `Request`, `Plan`, `Container`, `make`, `unavailable`, `makeNoop`, `layerNoop`, `makeCommand`, `layerCommand` | Routes a command into a named container. |
25
+ | `Edit` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and applies exact text replacements. |
26
+ | `ExaWebSearch` | `layer` | Provides WebSearch through the Exa API and kernel HTTP client. |
27
+ | `Explore` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `make`, `flow` | Declares a dynamic exploration flow composed from other standard flows. |
28
+ | `Fetch` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs raw HTTP GET requests. |
29
+ | `Glob` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and runs filesystem glob searches. |
30
+ | `Grep` | `name`, `description`, `Input`, `ContextLine`, `Symbol`, `Match`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and runs text searches over files. |
31
+ | `HttpPost` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs HTTP POST requests. |
32
+ | `LanguageServer` | `Position`, `LanguageServer`, `make`, `makeNoop`, `layerNoop` | Defines the language-server query service. |
33
+ | `Ls` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and runs directory listings. |
34
+ | `Lsp` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs ten language-server queries, from hover to diagnostics. |
35
+ | `Manifest` | `flows`, `handlers`, `effectsFor`, `names`, `readOnly` | Exposes frozen flow, handler, and narrowing registries plus the read-only set. |
36
+ | `NativeSearch` | `MAX_CAPTURE_BYTES`, `make`, `layer` | Implements Search through the ripgrep binary. |
37
+ | `NodeLanguageServer` | `Config`, `MAX_QUEUED_FRAMES`, `MAX_PENDING_REQUESTS`, `make`, `makeLazy`, `layer`, `layerLazy` | Implements LanguageServer with Node child processes, routed by extension. |
38
+ | `PortableSearch` | `make`, `layer` | Implements Search by walking the kernel filesystem in process. |
39
+ | `Probe` | `key`, `Reason`, `InvalidProbe`, `Attribution`, `CONFIDENCE_FLOOR`, `MAX_OUTPUT_BYTES`, `posix`, `probeAttribution`, `classify`, `unjudged` | Attributes a non-zero exit to the command or to the tree, with Jev. |
40
+ | `Read` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation`, `MAX_READ_FILE_BYTES`, `Preconditions`, `ReadSession`, `VersionedFileSystem` | Declares and runs bounded file reads. |
41
+ | `Relocate` | `Relocation`, `relocate` | Rewrites a call's input so the call runs against a materialized checkpoint. |
42
+ | `Search` | `GrepInput`, `GrepLine`, `ContextLine`, `Symbol`, `GrepMatch`, `GrepOutput`, `GlobInput`, `GlobOutput`, `Search`, `make`, `makeNoop`, `layerNoop` | Defines the search service both peers implement. |
43
+ | `SearchConformance` | `GeneratedFile`, `Plan`, `Divergence`, `plan`, `materialize`, `compare`, `report` | Generates a tree and calls, then reports where two Search peers disagree. |
44
+ | `SearchContract` | `validatePattern`, `validateGlob`, `canonicalGlob`, `matchesGlob`, `includedByGlobs`, `expression`, `unsatisfiableNotice`, `isContractRejection` | The shared matcher an external Search peer must build on. |
45
+ | `ShellCommand` | `name`, `description`, `DEFAULT_TIMEOUT_MS`, `MAX_CAPTURE_BYTES`, `DEFAULT_MAX_OUTPUT_TOKENS`, `TIMEOUT_EXIT_CODE`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs a Codex-shaped shell command. |
46
+ | `StdError` | `Code`, `StdError` | Defines typed standard-tool failures. |
47
+ | `TestRun` | `name`, `description`, `scratchDirectory`, `DEFAULT_TIMEOUT_MS`, `MAX_CAPTURE_BYTES`, `Input`, `Outcome`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Runs the declared test suite and reads its report. |
48
+ | `TreeFingerprint` | `key`, `defaultPrune`, `defaultIgnoreSuffixes`, `maxPaths`, `Measurement`, `script`, `parse`, `moved` | Measures a container's working directory so `bash` can report a write there. |
49
+ | `TestRunner` | `captureBase`, `Runner`, `TestRunner`, `make`, `makeNoop`, `layer`, `layerNoop` | Declares how the project under test runs its suite. |
50
+ | `UpdatePlan` | `name`, `description`, `StepStatus`, `Plan`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Acknowledges a Codex plan update. |
51
+ | `WebFetch` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run` | Declares and runs normalized web-page fetches. |
52
+ | `WebSearch` | `name`, `description`, `Input`, `Result`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `WebSearch`, `make`, `makeNoop`, `layerNoop`, `run` | Declares web search and its injectable provider service. |
53
+ | `Write` | `name`, `description`, `Input`, `Output`, `effects`, `effectsFor`, `capabilities`, `flow`, `run`, `activity`, `presentation` | Declares and runs file writes. |
54
54
 
55
55
  ```ts
56
56
  import { Read } from "@smthrs/std"
package/dist/cjs/Bash.d.ts CHANGED
@@ -281,6 +281,82 @@ export declare const run: (input: {
281
281
  } | undefined;
282
282
  readonly mutated?: boolean | undefined;
283
283
  }, StdError.StdError, ChildProcessSpawner.ChildProcessSpawner | import("effect/Path").Path>;
284
+ /**
285
+ * What one call runs, after planning and before any transport: the program,
286
+ * its arguments (absent for a shell command line), standard input, the
287
+ * caller's environment, and the logical invocation as a person reads it.
288
+ *
289
+ * @category models
290
+ * @since 1.0.0
291
+ */
292
+ export interface Invocation {
293
+ readonly file: string;
294
+ readonly args: ReadonlyArray<string> | undefined;
295
+ readonly stdin: string | undefined;
296
+ readonly env: Record<string, string> | undefined;
297
+ readonly quoted: string;
298
+ }
299
+ /**
300
+ * The invocation `input` names, or the typed refusal explaining why it names
301
+ * none. The same plan {@link run} spawns; a terminal provider runs it instead.
302
+ *
303
+ * @category constructors
304
+ * @since 1.0.0
305
+ */
306
+ export declare const invocation: (input: Input) => Invocation | StdError.StdError;
307
+ /**
308
+ * {@link run}'s contract through a registered terminal (T-TRM-05): the same
309
+ * plan, hermetic pre-check, bounded output and diagnostics refresh, with
310
+ * execution supplied by `execute` instead of a spawn on this host. A terminal
311
+ * has no container transport, so a containerised call is refused before it
312
+ * reaches `execute`.
313
+ *
314
+ * @category handlers
315
+ * @since 1.0.0
316
+ */
317
+ export declare const inTerminal: <R>(execute: (input: Input) => Effect.Effect<Output, StdError.StdError, R>) => (input: {
318
+ readonly mode: "hermetic";
319
+ readonly writes: readonly string[];
320
+ readonly reads: readonly string[];
321
+ readonly cwd?: string | undefined;
322
+ readonly env?: {
323
+ readonly [x: string]: string;
324
+ } | undefined;
325
+ readonly stdin?: string | undefined;
326
+ readonly command?: string | undefined;
327
+ readonly args?: readonly string[] | undefined;
328
+ readonly timeoutMs?: number | undefined;
329
+ readonly script?: string | undefined;
330
+ readonly interpreter?: string | undefined;
331
+ readonly container?: string | undefined;
332
+ } | {
333
+ readonly mode?: "unhermetic";
334
+ readonly cwd?: string | undefined;
335
+ readonly env?: {
336
+ readonly [x: string]: string;
337
+ } | undefined;
338
+ readonly stdin?: string | undefined;
339
+ readonly command?: string | undefined;
340
+ readonly args?: readonly string[] | undefined;
341
+ readonly timeoutMs?: number | undefined;
342
+ readonly script?: string | undefined;
343
+ readonly interpreter?: string | undefined;
344
+ readonly container?: string | undefined;
345
+ }) => Effect.Effect<{
346
+ readonly stderr: string;
347
+ readonly exitCode: number;
348
+ readonly stdout: string;
349
+ readonly stdoutTruncated: boolean;
350
+ readonly stderrTruncated: boolean;
351
+ readonly stdoutDroppedBytes: number;
352
+ readonly stderrDroppedBytes: number;
353
+ readonly invalidProbe?: {
354
+ readonly reason: "unknown-command" | "unknown-test" | "unknown-path" | "unknown-module" | "unknown-environment";
355
+ readonly evidence: string;
356
+ readonly message: string;
357
+ } | undefined;
358
+ readonly mutated?: boolean | undefined;
359
+ }, StdError.StdError, import("effect/Path").Path | R>;
284
360
  /**
285
361
  * The refusal a sealed host answers a call outside its container with.
286
362
  *
package/dist/cjs/Bash.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"Bash.d.ts","sourceRoot":"","sources":["../../src/Bash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,mBAAmB,MAAM,oCAAoC,CAAA;AAC9E,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAQvC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAGzC;;;;;GAKG;AACH,eAAO,MAAM,IAAI,SAAS,CAAA;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,yMACgL,CAAA;AAExM;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,SAAU,CAAA;AAmCzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;IAiChB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,IAAI,CAAA;AAErC;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;EA6BjB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,4CAKlB,CAAA;AAEF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO,KAAK,+CAajC,CAAA;AAEN;;;;;GAKG;AACH,eAAO,MAAM,YAAY,UAAkC,CAAA;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAsF,CAAA;AAUvG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY;;;;;;;;CAIf,CAAA;AA+KV;;;;;;;;GAQG;AACH,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2FA6Cd,CAAA;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,UAAU,MAAM,EAAE,WAAW,MAAM,GAAG,SAAS,KAAG,QAAQ,CAAC,QAMxF,CAAA;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,GAAI,UAAU,MAAM,MAErC,OAAO,KAAK,KACX,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACO,CAAA"}
1
+ {"version":3,"file":"Bash.d.ts","sourceRoot":"","sources":["../../src/Bash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,mBAAmB,MAAM,oCAAoC,CAAA;AAC9E,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAQvC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAGzC;;;;;GAKG;AACH,eAAO,MAAM,IAAI,SAAS,CAAA;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,yMACgL,CAAA;AAExM;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,SAAU,CAAA;AAmCzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;IAiChB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,IAAI,CAAA;AAErC;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;EA6BjB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,4CAKlB,CAAA;AAEF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO,KAAK,+CAajC,CAAA;AAEN;;;;;GAKG;AACH,eAAO,MAAM,YAAY,UAAkC,CAAA;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAsF,CAAA;AAUvG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY;;;;;;;;CAIf,CAAA;AA2LV;;;;;;;;GAQG;AACH,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2FAwCd,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO,KAAK,KAAG,UAAU,GAAG,QAAQ,CAAC,QAAuB,CAAA;AAEvF;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAC1B,SAAS,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qDAapE,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,UAAU,MAAM,EAAE,WAAW,MAAM,GAAG,SAAS,KAAG,QAAQ,CAAC,QAMxF,CAAA;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,GAAI,UAAU,MAAM,MAErC,OAAO,KAAK,KACX,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACO,CAAA"}
package/dist/cjs/Bash.js CHANGED
@@ -36,6 +36,8 @@ __export(Bash_exports, {
36
36
  effects: () => effects,
37
37
  effectsFor: () => effectsFor,
38
38
  flow: () => flow,
39
+ inTerminal: () => inTerminal,
40
+ invocation: () => invocation,
39
41
  name: () => name,
40
42
  outsideContainer: () => outsideContainer,
41
43
  presentation: () => presentation,
@@ -237,11 +239,16 @@ const plan = (input) => {
237
239
  quoted: [interpreter, ...args].join(" ")
238
240
  };
239
241
  };
242
+ const precheck = (input, path) => {
243
+ const intent = plan(input);
244
+ if (intent instanceof StdError.StdError || input.mode !== "hermetic") return intent;
245
+ return (0, import_EnvelopePrecheck.outsideEnvelope)(input, input.command ?? input.script, path) ?? intent;
246
+ };
240
247
  const routed = (plan2, input, transport) => {
241
248
  if (input.container === void 0) return Effect.succeed(plan2);
242
249
  if (Option.isNone(transport)) return Effect.fail(Container.unavailable(input.container));
243
250
  return Effect.map(
244
- transport.value.exec(request(plan2, input)),
251
+ transport.value.exec(request(plan2, input, input.container)),
245
252
  (routing) => ({
246
253
  file: routing.file,
247
254
  args: routing.args,
@@ -252,8 +259,8 @@ const routed = (plan2, input, transport) => {
252
259
  })
253
260
  );
254
261
  };
255
- const request = (plan2, input) => ({
256
- container: input.container ?? "",
262
+ const request = (plan2, input, container) => ({
263
+ container,
257
264
  file: "bash",
258
265
  args: plan2.args === void 0 ? ["-lc", plan2.file] : ["-lc", `exec "$@"`, "bash", plan2.file, ...plan2.args],
259
266
  ...input.cwd === void 0 ? {} : { cwd: input.cwd },
@@ -279,13 +286,8 @@ const fingerprint = (input, transport) => Effect.gen(function* () {
279
286
  return result.exitCode === 0 ? TreeFingerprint.parse(result.stdout) : void 0;
280
287
  }).pipe(Effect.orElseSucceed(() => void 0));
281
288
  const run = Effect.fn("Bash.run")(function* (input) {
282
- const path = yield* Path.Path;
283
- const intent = plan(input);
289
+ const intent = precheck(input, yield* Path.Path);
284
290
  if (intent instanceof StdError.StdError) return yield* Effect.fail(intent);
285
- if (input.mode === "hermetic") {
286
- const violation = (0, import_EnvelopePrecheck.outsideEnvelope)(input, input.command ?? input.script ?? "", path);
287
- if (violation !== void 0) return yield* Effect.fail(violation);
288
- }
289
291
  const contained = input.container !== void 0;
290
292
  const transport = yield* Effect.serviceOption(Container.Container);
291
293
  const spawned = yield* routed(intent, input, transport);
@@ -313,6 +315,15 @@ const run = Effect.fn("Bash.run")(function* (input) {
313
315
  ...mutated === void 0 ? {} : { mutated }
314
316
  };
315
317
  });
318
+ const invocation = (input) => plan(input);
319
+ const inTerminal = (execute) => Effect.fn("Bash.inTerminal")(function* (input) {
320
+ const intent = precheck(input, yield* Path.Path);
321
+ if (intent instanceof StdError.StdError) return yield* Effect.fail(intent);
322
+ if (input.container !== void 0) return yield* Effect.fail(Container.unavailable(input.container));
323
+ const output = yield* execute(input);
324
+ yield* Diagnostics.refresh;
325
+ return output;
326
+ });
316
327
  const outsideContainer = (sealedTo, requested) => new StdError.StdError({
317
328
  code: "outside_container",
318
329
  message: requested === void 0 ? `This host runs commands only inside container "${sealedTo}". Name it: { mode: "unhermetic", container: "${sealedTo}", command: "..." }.` : `This host runs commands only inside container "${sealedTo}", not "${requested}".`
package/dist/cjs/Bash.js.map CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "version": 3,
3
3
  "sources": ["../../src/Bash.ts"],
4
- "sourcesContent": ["/**\n * Bash flow declaration and portable handler.\n *\n * Two ways in, and the difference is where the payload is parsed. `command` is\n * a line for the platform shell, exactly as before. `script` is program text\n * delivered to an interpreter on standard input, as data: nothing quotes it,\n * escapes it, or terminates it with a heredoc marker, so the class of failure\n * that produced `docker exec c bash -lc '\u2026python - <<EOF\u2026'` cannot occur. Its\n * `args` reach the script as arguments rather than as interpolated text.\n *\n * `container` names a container the host knows how to reach, and the argv is\n * built by the injected {@link Container} transport rather than typed by the\n * caller. A host that binds no transport refuses such a call by saying so; the\n * requirement is optional here precisely so a host without containers is not\n * forced to declare one.\n *\n * @since 1.0.0\n */\n\nimport type * as ChildProcessSpawner from \"@smthrs/kernel/ChildProcessSpawner\"\nimport * as Path from \"@smthrs/kernel/Path\"\nimport * as Effect from \"effect/Effect\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport * as Container from \"./Container.ts\"\nimport { capability, envelope } from \"./internal/Declaration.ts\"\nimport * as Diagnostics from \"./internal/Diagnostics.ts\"\nimport { outsideEnvelope } from \"./internal/EnvelopePrecheck.ts\"\nimport * as Exec from \"./internal/Exec.ts\"\nimport { MAX_SHELL_OUTPUT_BYTES, truncateBytes } from \"./internal/Text.ts\"\nimport * as Probe from \"./Probe.ts\"\nimport * as StdError from \"./StdError.ts\"\nimport * as TreeFingerprint from \"./TreeFingerprint.ts\"\n\n/**\n * Registry name for the bash flow.\n *\n * @category identifiers\n * @since 1.0.0\n */\nexport const name = \"bash\"\n\n/**\n * Model-facing description of the bash flow.\n *\n * Capped at 200 characters and read every frame, which is why the\n * invalid-probe contract is not restated here: the cell contract teaches it\n * once, and a result that has one explains itself.\n *\n * @category descriptions\n * @since 1.0.0\n */\nexport const description =\n \"Run a shell command, or an interpreter over a script passed as data instead of quoted into a line. container routes it through the host's container transport. mode:hermetic pre-checks path tokens.\"\n\n/**\n * Default command timeout in milliseconds.\n *\n * Ten minutes lets full builds and test suites finish while ensuring a stalled\n * process eventually releases the flow.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const DEFAULT_TIMEOUT_MS = 600_000\n\nconst Command = Schema.optional(Schema.String.annotate({\n description: \"Shell command line to execute; give this or script, never both\"\n}))\nconst Script = Schema.optional(Schema.String.annotate({\n description: \"Program text delivered to the interpreter on stdin as data, so it needs no quoting or heredoc\"\n}))\nconst Interpreter = Schema.optional(Schema.String.annotate({\n description:\n \"Program that reads script on stdin; defaults to bash. python, python3, sh, zsh, node, ruby and perl are known\"\n}))\nconst Args = Schema.optional(\n Schema.Array(Schema.String).annotate({\n description: \"Arguments passed to the script as data, never interpolated into it\"\n })\n)\nconst Stdin = Schema.optional(Schema.String.annotate({\n description: \"Text written to the command's standard input; use script instead when the text is the program\"\n}))\nconst ContainerName = Schema.optional(Schema.String.annotate({\n description: \"Run inside this container through the host's container transport; requires mode:unhermetic\"\n}))\nconst Cwd = Schema.optional(Schema.String).annotate({\n description: \"Working directory for the command\",\n message: \"cwd must be a path string. For a checkpoint, pass { at: ctx.base } as the third ctx.call argument.\"\n})\nconst Env = Schema.optional(\n Schema.Record(Schema.String, Schema.String).annotate({ description: \"Environment variables for the command\" })\n)\nconst TimeoutMs = Schema.optional(Schema.Number).annotate({\n description: \"Wall-clock timeout in milliseconds; defaults to 600000 ms\",\n message: \"timeoutMs must be a number of milliseconds.\"\n})\n\n/**\n * Input schema for the bash flow.\n *\n * The mode named `hermetic` requires explicit read and write envelopes for a\n * lexical pre-check; it does not by itself confine the process. Unhermetic mode\n * deliberately omits those declarations so the distinction stays visible in\n * the input shape.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const Input = Schema.Union([\n Schema.Struct({\n mode: Schema.Literal(\"hermetic\").annotate({\n description: \"Lexically pre-check explicit path tokens against declared reads and writes; does not sandbox\"\n }),\n command: Command,\n script: Script,\n interpreter: Interpreter,\n args: Args,\n stdin: Stdin,\n container: ContainerName,\n reads: Schema.Array(Schema.NonEmptyString).annotate({ description: \"Paths or path globs the command may read\" }),\n writes: Schema.Array(Schema.NonEmptyString).annotate({ description: \"Paths or path globs the command may write\" }),\n cwd: Cwd,\n env: Env,\n timeoutMs: TimeoutMs\n }),\n Schema.Struct({\n // Omitted means unhermetic: it is the envelope `effects` already declares\n // for every call, so the default grants nothing a named mode would not.\n mode: Schema.Literal(\"unhermetic\").annotate({\n description: \"Run without a declared filesystem envelope as an irreversible effect; the default\"\n }).pipe(Schema.optionalKey, Schema.withDecodingDefaultKey(Effect.succeed(\"unhermetic\" as const))),\n command: Command,\n script: Script,\n interpreter: Interpreter,\n args: Args,\n stdin: Stdin,\n container: ContainerName,\n cwd: Cwd,\n env: Env,\n timeoutMs: TimeoutMs\n })\n])\n\n/**\n * Decoded input accepted by the bash handler.\n *\n * @category models\n * @since 1.0.0\n */\nexport type Input = typeof Input.Type\n\n/**\n * Output schema for the bash flow.\n *\n * `invalidProbe` is present when the shell itself refused to start the\n * command, which its exit code says outright: 127 for a program it could not\n * find, 126 for one it could not execute. Only that. Reading a runner's own\n * wording is a judgment rather than a fact, and `Probe.classify` makes it with\n * Jev for the `test` flow, whose caller is asking about a suite; a shell call\n * is any command at all and stays free of the gateway. See `Probe`.\n *\n * The `<stream>Truncated` flags are a wire convention, not a display detail.\n * A truncated capture is a fragment of what the process printed, and the\n * harness reads these flags to refuse a later write of those exact bytes \u2014\n * `@smthrs/harness/TruncatedOutput` is the consuming half. Renaming a flag, or\n * dropping it when the capture is cut, disarms that guard silently.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const Output = Schema.Struct({\n exitCode: Schema.Number.annotate({ description: \"Command exit code, including non-zero codes\" }),\n stdout: Schema.String.annotate({\n description: \"Captured stdout; only the tail, and not the whole output, when stdoutTruncated is true\"\n }),\n stderr: Schema.String.annotate({\n description: \"Captured stderr; only the tail, and not the whole output, when stderrTruncated is true\"\n }),\n stdoutTruncated: Schema.Boolean.annotate({\n description:\n \"Whether stdout exceeded the capture limit, leaving stdout a fragment that must not be written to a file\"\n }),\n stderrTruncated: Schema.Boolean.annotate({\n description:\n \"Whether stderr exceeded the capture limit, leaving stderr a fragment that must not be written to a file\"\n }),\n stdoutDroppedBytes: Schema.Number.annotate({ description: \"UTF-8 bytes omitted from the start of stdout\" }),\n stderrDroppedBytes: Schema.Number.annotate({ description: \"UTF-8 bytes omitted from the start of stderr\" }),\n invalidProbe: Schema.optional(\n Probe.InvalidProbe.annotate({\n description: \"Reserved for a confirmed launch failure; an exit code alone does not establish one\"\n })\n ),\n mutated: Schema.optional(\n Schema.Boolean.annotate({\n description:\n \"Present for a containerised command whose working directory was measured before and after it: true when the tree changed, false when it held still. Absent when the tree was not measured, which is never read as unchanged.\"\n })\n )\n})\n\n/**\n * Decoded output returned by the bash handler.\n *\n * @category models\n * @since 1.0.0\n */\nexport type Output = typeof Output.Type\n\n/**\n * Static conservative effect envelope for the bash flow.\n *\n * The declaration is the registry-time worst case because the mode is not\n * known until an invocation is decoded.\n *\n * @category effects\n * @since 1.0.0\n */\nexport const effects = envelope({\n tier: \"irreversible\",\n mode: \"expected\",\n reads: [],\n writes: []\n})\n\n/**\n * Narrows the effect envelope for a decoded invocation.\n *\n * @category effects\n * @since 1.0.0\n */\nexport const effectsFor = (input: Input) =>\n input.mode === \"hermetic\"\n ? envelope({\n tier: \"irreversible\",\n mode: \"hermetic\",\n reads: input.reads,\n writes: input.writes\n })\n : envelope({\n tier: \"irreversible\",\n mode: \"expected\",\n reads: [],\n writes: []\n })\n\n/**\n * Capabilities required by the bash flow.\n *\n * @category capabilities\n * @since 1.0.0\n */\nexport const capabilities = [capability(\"proc:spawn\", \"*\")]\n\n/**\n * Declaration-only bash flow.\n *\n * @category flows\n * @since 1.0.0\n */\nexport const flow = { name, description, input: Input, output: Output, capabilities, effects } as const\n\n/*\n * `bash` declares no activity on purpose. What a shell call does is in the\n * command, not in the declaration: the same flow runs a test suite, a type\n * check, and `cat`. A reader that recognises a direct runner says so from the\n * recorded command; everything else stays unknown, which is what an absent\n * activity means.\n */\n\n/**\n * How one recorded call to this flow reads: the verb for each settlement, the\n * input field that is its subject, and the measured output fields a one-line\n * summary may count.\n *\n * Display metadata only, governed by `@smthrs/registry`\n * `Descriptor.CallPresentation` and checked where `StandardFlows` binds it.\n *\n * @category presentation\n * @since 1.0.0-rc.0\n */\nexport const presentation = {\n verb: { pending: \"running\", success: \"ran\", failure: \"failed to run\" },\n subject: \"command\",\n result: \"command\"\n} as const\n\n/**\n * Select standard input explicitly. Shells need `--` before script arguments\n * so even an argument such as `-c` cannot replace the stdin program.\n * Other supported interpreters treat arguments after `-` as program data.\n */\nconst stdinArguments = (interpreter: string): ReadonlyArray<string> | undefined => {\n switch (interpreter) {\n case \"bash\":\n case \"zsh\":\n case \"sh\":\n case \"dash\":\n return [\"-s\", \"--\"]\n case \"python\":\n case \"python3\":\n case \"node\":\n case \"ruby\":\n case \"perl\":\n return [\"-\"]\n default:\n return undefined\n }\n}\n\n/** Whether a script is shell text the lexical pre-check can actually read. */\nconst shells = new Set([\"bash\", \"zsh\", \"sh\", \"dash\"])\n\n/** What one invocation runs, before any container transport rewrites it. */\ninterface Plan {\n readonly file: string\n readonly args: ReadonlyArray<string> | undefined\n readonly stdin: string | undefined\n readonly env: Record<string, string> | undefined\n readonly quoted: string\n}\n\nconst invalid = (message: string): StdError.StdError => new StdError.StdError({ code: \"invalid_input\", message })\n\n/** The invocation an input names, or the failure explaining why it names none. */\nconst plan = (input: Input): Plan | StdError.StdError => {\n const interpreter = input.interpreter ?? \"bash\"\n if (input.command !== undefined && input.script !== undefined) {\n return invalid(\"Give command or script, never both: a script is program text, a command is a shell line\")\n }\n if (input.command === undefined && input.script === undefined) {\n return invalid(\"Give either command (a shell line) or script (program text run by interpreter)\")\n }\n if (input.script !== undefined && input.stdin !== undefined) {\n return invalid(\"A script already arrives on standard input, so it cannot also carry stdin\")\n }\n if (input.command !== undefined && input.args !== undefined) {\n return invalid(\"args belong to a script; a command carries its own arguments in the line\")\n }\n if (input.command !== undefined && input.interpreter !== undefined) {\n return invalid(\"interpreter runs a script; a command runs in the platform shell\")\n }\n if (input.mode === \"hermetic\" && input.container !== undefined) {\n return invalid(\n \"A container has its own filesystem, so declared reads and writes cannot describe it. Use mode:unhermetic for a containerised command\"\n )\n }\n if (input.mode === \"hermetic\" && input.script !== undefined && !shells.has(interpreter)) {\n return invalid(\n `The hermetic pre-check reads shell text, and ${interpreter} is not a shell. Run this script with mode:unhermetic, or express it as shell`\n )\n }\n if (input.command !== undefined) {\n return { file: input.command, args: undefined, stdin: input.stdin, env: input.env, quoted: input.command }\n }\n const selector = stdinArguments(interpreter)\n if (selector === undefined) {\n return invalid(`Unsupported script interpreter: ${interpreter}`)\n }\n const args = [...selector, ...(input.args ?? [])]\n return {\n file: interpreter,\n args,\n stdin: input.script,\n env: input.env,\n quoted: [interpreter, ...args].join(\" \")\n }\n}\n\n/** The plan as the host will spawn it, once the container transport has had it. */\nconst routed = (\n plan: Plan,\n input: Input,\n transport: Option.Option<Container.Container>\n): Effect.Effect<Plan, StdError.StdError> => {\n if (input.container === undefined) return Effect.succeed(plan)\n if (Option.isNone(transport)) return Effect.fail(Container.unavailable(input.container))\n return Effect.map(\n transport.value.exec(request(plan, input)),\n (routing): Plan => ({\n file: routing.file,\n args: routing.args,\n stdin: plan.stdin,\n env: routing.env,\n // Diagnostics describe the logical invocation, not transport arguments.\n quoted: plan.quoted\n })\n )\n}\n\n/**\n * One containerised request, always through a login shell.\n *\n * A container's environment is what its profile makes it. The images this\n * harness runs against activate the project's interpreter \u2014 a conda env, a\n * virtualenv, a modified `PATH` \u2014 from `/etc/profile.d`, so a program spawned\n * directly by `docker exec` gets a different Python from the one that owns the\n * repository's dependencies. That is measured, not theoretical: r90 typed\n * `docker exec \u2026 bash -lc '\u2026'` by hand and got the activation for free, r91\n * routed `interpreter: \"python3\"` straight at the container and filled its\n * traces with `ModuleNotFoundError: No module named 'numpy'` and\n * `exec: \"/usr/local/bin/python\": no such file or directory`. Thirty of 45\n * instances then spent 138 cells scanning `/opt` for the real interpreter.\n *\n * So the login shell is the transport's, not the caller's. A command line is\n * one argument to `bash -lc`, as before. A program run under an interpreter\n * becomes `bash -lc 'exec \"$@\"' bash <interpreter> <args\u2026>`: the shell reads\n * the profile, then `exec` replaces it with the interpreter, so the script\n * still arrives on the inherited standard input and no argument is ever\n * re-parsed as shell text.\n */\nconst request = (plan: Plan, input: Input): Container.Request => ({\n container: input.container ?? \"\",\n file: \"bash\",\n args: plan.args === undefined\n ? [\"-lc\", plan.file]\n : [\"-lc\", `exec \"$@\"`, \"bash\", plan.file, ...plan.args],\n ...(input.cwd === undefined ? {} : { cwd: input.cwd }),\n ...(input.env === undefined ? {} : { env: input.env }),\n stdin: plan.stdin !== undefined\n})\n\n/** How long one fingerprint of the container's working directory may take. */\nconst FINGERPRINT_TIMEOUT_MS = 60_000\n\n/**\n * Measures the tree a containerised command is about to run in, or just ran in.\n *\n * The host's workspace walk cannot see a container's filesystem, so the\n * measurement is taken where the tree is: `TreeFingerprint.script` runs\n * through the same transport as the command, in the same working directory,\n * and answers with one checksum. Every way this can fail \u2014 no transport, a\n * container without `find` or `stat`, a timeout, a bounded listing \u2014 is read\n * as \"unmeasured\" and reported as an absent `mutated`, never as a tree that\n * held still. The time it costs is bounded by the command's own timeout so a\n * stalled container cannot spend more waiting to be measured than it may\n * spend running.\n */\nconst fingerprint = (\n input: Input,\n transport: Option.Option<Container.Container>\n): Effect.Effect<TreeFingerprint.Measurement | undefined, never, ChildProcessSpawner.ChildProcessSpawner> =>\n Effect.gen(function*() {\n if (input.container === undefined || Option.isNone(transport)) return undefined\n const routing = yield* transport.value.exec({\n container: input.container,\n file: \"sh\",\n args: [\"-c\", TreeFingerprint.script()],\n ...(input.cwd === undefined ? {} : { cwd: input.cwd }),\n stdin: false\n })\n const result = yield* Exec.exec(routing.file, {\n ...(routing.env === undefined ? {} : { env: routing.env }),\n timeoutMs: Math.min(input.timeoutMs ?? DEFAULT_TIMEOUT_MS, FINGERPRINT_TIMEOUT_MS),\n maxCaptureBytes: MAX_SHELL_OUTPUT_BYTES,\n args: routing.args\n })\n return result.exitCode === 0 ? TreeFingerprint.parse(result.stdout) : undefined\n }).pipe(Effect.orElseSucceed(() => undefined))\n\n/**\n * Executes a shell command through the permission-aware kernel service.\n *\n * Non-zero exit codes remain successful values. Only timeout, host, permission,\n * and declared-envelope pre-check failures use the typed error channel.\n *\n * @category handlers\n * @since 1.0.0\n */\nexport const run = Effect.fn(\"Bash.run\")(function*(\n input: Input\n): Effect.fn.Return<Output, StdError.StdError, ChildProcessSpawner.ChildProcessSpawner | Path.Path> {\n const path = yield* Path.Path\n const intent = plan(input)\n if (intent instanceof StdError.StdError) return yield* Effect.fail(intent)\n if (input.mode === \"hermetic\") {\n const violation = outsideEnvelope(input, input.command ?? input.script ?? \"\", path)\n if (violation !== undefined) return yield* Effect.fail(violation)\n }\n // The working directory belongs to the container. The transport supplies\n // any environment overrides its host process needs to forward into it.\n const contained = input.container !== undefined\n const transport = yield* Effect.serviceOption(Container.Container)\n const spawned = yield* routed(intent, input, transport)\n\n // The tree the command runs in, before it runs. Measured in the container\n // because nothing on this host can see it; see `TreeFingerprint`.\n const before = yield* fingerprint(input, transport)\n const result = yield* Exec.exec(spawned.file, {\n ...(input.cwd === undefined || contained ? {} : { cwd: input.cwd }),\n ...(spawned.env === undefined ? {} : { env: spawned.env }),\n timeoutMs: input.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n maxCaptureBytes: MAX_SHELL_OUTPUT_BYTES,\n ...(spawned.args === undefined ? {} : { args: spawned.args }),\n ...(spawned.stdin === undefined ? {} : { stdin: spawned.stdin })\n }).pipe(Effect.mapError((error) => Exec.toStdError(spawned.quoted, error)))\n const mutated = TreeFingerprint.moved(before, yield* fingerprint(input, transport))\n // A command on this host may have changed files a language server holds\n // open; a container's files are not the ones it was sent.\n if (!contained) yield* Diagnostics.refresh\n const stdout = truncateBytes(result.stdout, MAX_SHELL_OUTPUT_BYTES, { keep: \"tail\" })\n const stderr = truncateBytes(result.stderr, MAX_SHELL_OUTPUT_BYTES, { keep: \"tail\" })\n // Exit codes alone cannot establish whether the shell refused to launch a\n // command or a launched runner chose that status after executing tests.\n return {\n exitCode: result.exitCode,\n stdout: stdout.text,\n stderr: stderr.text,\n stdoutTruncated: result.stdoutDroppedBytes > 0 || stdout.truncated,\n stderrTruncated: result.stderrDroppedBytes > 0 || stderr.truncated,\n stdoutDroppedBytes: result.stdoutDroppedBytes + stdout.droppedBytes,\n stderrDroppedBytes: result.stderrDroppedBytes + stderr.droppedBytes,\n ...(mutated === undefined ? {} : { mutated })\n }\n})\n\n/**\n * The refusal a sealed host answers a call outside its container with.\n *\n * @category errors\n * @since 1.0.0-rc.1\n */\nexport const outsideContainer = (sealedTo: string, requested: string | undefined): StdError.StdError =>\n new StdError.StdError({\n code: \"outside_container\",\n message: requested === undefined\n ? `This host runs commands only inside container \"${sealedTo}\". Name it: { mode: \"unhermetic\", container: \"${sealedTo}\", command: \"...\" }.`\n : `This host runs commands only inside container \"${sealedTo}\", not \"${requested}\".`\n })\n\n/**\n * {@link run}, sealed to one container.\n *\n * A host that must not be reachable from the cell (a benchmark host holding\n * other tasks' tests and reference solutions, say) binds this instead of\n * {@link run}: a call naming `sealedTo` runs as usual, and every other call,\n * including one with no container that would run on the host, fails with\n * `outside_container` before anything is spawned.\n *\n * @category handlers\n * @since 1.0.0-rc.1\n */\nexport const sealed = (sealedTo: string) =>\n(\n input: Input\n): Effect.Effect<Output, StdError.StdError, ChildProcessSpawner.ChildProcessSpawner | Path.Path> =>\n input.container === sealedTo ? run(input) : Effect.fail(outsideContainer(sealedTo, input.container))\n"],
5
- "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoBA,WAAsB;AACtB,aAAwB;AACxB,aAAwB;AACxB,aAAwB;AACxB,gBAA2B;AAC3B,yBAAqC;AACrC,kBAA6B;AAC7B,8BAAgC;AAChC,WAAsB;AACtB,kBAAsD;AACtD,YAAuB;AACvB,eAA0B;AAC1B,sBAAiC;AAQ1B,MAAM,OAAO;AAYb,MAAM,cACX;AAWK,MAAM,qBAAqB;AAElC,MAAM,UAAU,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EACrD,aAAa;AACf,CAAC,CAAC;AACF,MAAM,SAAS,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EACpD,aAAa;AACf,CAAC,CAAC;AACF,MAAM,cAAc,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EACzD,aACE;AACJ,CAAC,CAAC;AACF,MAAM,OAAO,OAAO;AAAA,EAClB,OAAO,MAAM,OAAO,MAAM,EAAE,SAAS;AAAA,IACnC,aAAa;AAAA,EACf,CAAC;AACH;AACA,MAAM,QAAQ,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EACnD,aAAa;AACf,CAAC,CAAC;AACF,MAAM,gBAAgB,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EAC3D,aAAa;AACf,CAAC,CAAC;AACF,MAAM,MAAM,OAAO,SAAS,OAAO,MAAM,EAAE,SAAS;AAAA,EAClD,aAAa;AAAA,EACb,SAAS;AACX,CAAC;AACD,MAAM,MAAM,OAAO;AAAA,EACjB,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,EAAE,SAAS,EAAE,aAAa,wCAAwC,CAAC;AAC/G;AACA,MAAM,YAAY,OAAO,SAAS,OAAO,MAAM,EAAE,SAAS;AAAA,EACxD,aAAa;AAAA,EACb,SAAS;AACX,CAAC;AAaM,MAAM,QAAQ,OAAO,MAAM;AAAA,EAChC,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,UAAU,EAAE,SAAS;AAAA,MACxC,aAAa;AAAA,IACf,CAAC;AAAA,IACD,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,MAAM;AAAA,IACN,OAAO;AAAA,IACP,WAAW;AAAA,IACX,OAAO,OAAO,MAAM,OAAO,cAAc,EAAE,SAAS,EAAE,aAAa,2CAA2C,CAAC;AAAA,IAC/G,QAAQ,OAAO,MAAM,OAAO,cAAc,EAAE,SAAS,EAAE,aAAa,4CAA4C,CAAC;AAAA,IACjH,KAAK;AAAA,IACL,KAAK;AAAA,IACL,WAAW;AAAA,EACb,CAAC;AAAA,EACD,OAAO,OAAO;AAAA;AAAA;AAAA,IAGZ,MAAM,OAAO,QAAQ,YAAY,EAAE,SAAS;AAAA,MAC1C,aAAa;AAAA,IACf,CAAC,EAAE,KAAK,OAAO,aAAa,OAAO,uBAAuB,OAAO,QAAQ,YAAqB,CAAC,CAAC;AAAA,IAChG,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,MAAM;AAAA,IACN,OAAO;AAAA,IACP,WAAW;AAAA,IACX,KAAK;AAAA,IACL,KAAK;AAAA,IACL,WAAW;AAAA,EACb,CAAC;AACH,CAAC;AA6BM,MAAM,SAAS,OAAO,OAAO;AAAA,EAClC,UAAU,OAAO,OAAO,SAAS,EAAE,aAAa,8CAA8C,CAAC;AAAA,EAC/F,QAAQ,OAAO,OAAO,SAAS;AAAA,IAC7B,aAAa;AAAA,EACf,CAAC;AAAA,EACD,QAAQ,OAAO,OAAO,SAAS;AAAA,IAC7B,aAAa;AAAA,EACf,CAAC;AAAA,EACD,iBAAiB,OAAO,QAAQ,SAAS;AAAA,IACvC,aACE;AAAA,EACJ,CAAC;AAAA,EACD,iBAAiB,OAAO,QAAQ,SAAS;AAAA,IACvC,aACE;AAAA,EACJ,CAAC;AAAA,EACD,oBAAoB,OAAO,OAAO,SAAS,EAAE,aAAa,+CAA+C,CAAC;AAAA,EAC1G,oBAAoB,OAAO,OAAO,SAAS,EAAE,aAAa,+CAA+C,CAAC;AAAA,EAC1G,cAAc,OAAO;AAAA,IACnB,MAAM,aAAa,SAAS;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EACA,SAAS,OAAO;AAAA,IACd,OAAO,QAAQ,SAAS;AAAA,MACtB,aACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF,CAAC;AAmBM,MAAM,cAAU,6BAAS;AAAA,EAC9B,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO,CAAC;AAAA,EACR,QAAQ,CAAC;AACX,CAAC;AAQM,MAAM,aAAa,CAAC,UACzB,MAAM,SAAS,iBACX,6BAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO,MAAM;AAAA,EACb,QAAQ,MAAM;AAChB,CAAC,QACC,6BAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO,CAAC;AAAA,EACR,QAAQ,CAAC;AACX,CAAC;AAQE,MAAM,eAAe,KAAC,+BAAW,cAAc,GAAG,CAAC;AAQnD,MAAM,OAAO,EAAE,MAAM,aAAa,OAAO,OAAO,QAAQ,QAAQ,cAAc,QAAQ;AAqBtF,MAAM,eAAe;AAAA,EAC1B,MAAM,EAAE,SAAS,WAAW,SAAS,OAAO,SAAS,gBAAgB;AAAA,EACrE,SAAS;AAAA,EACT,QAAQ;AACV;AAOA,MAAM,iBAAiB,CAAC,gBAA2D;AACjF,UAAQ,aAAa;AAAA,IACnB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC,MAAM,IAAI;AAAA,IACpB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC,GAAG;AAAA,IACb;AACE,aAAO;AAAA,EACX;AACF;AAGA,MAAM,SAAS,oBAAI,IAAI,CAAC,QAAQ,OAAO,MAAM,MAAM,CAAC;AAWpD,MAAM,UAAU,CAAC,YAAuC,IAAI,SAAS,SAAS,EAAE,MAAM,iBAAiB,QAAQ,CAAC;AAGhH,MAAM,OAAO,CAAC,UAA2C;AACvD,QAAM,cAAc,MAAM,eAAe;AACzC,MAAI,MAAM,YAAY,UAAa,MAAM,WAAW,QAAW;AAC7D,WAAO,QAAQ,yFAAyF;AAAA,EAC1G;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,WAAW,QAAW;AAC7D,WAAO,QAAQ,gFAAgF;AAAA,EACjG;AACA,MAAI,MAAM,WAAW,UAAa,MAAM,UAAU,QAAW;AAC3D,WAAO,QAAQ,2EAA2E;AAAA,EAC5F;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,SAAS,QAAW;AAC3D,WAAO,QAAQ,0EAA0E;AAAA,EAC3F;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,gBAAgB,QAAW;AAClE,WAAO,QAAQ,iEAAiE;AAAA,EAClF;AACA,MAAI,MAAM,SAAS,cAAc,MAAM,cAAc,QAAW;AAC9D,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,cAAc,MAAM,WAAW,UAAa,CAAC,OAAO,IAAI,WAAW,GAAG;AACvF,WAAO;AAAA,MACL,gDAAgD,WAAW;AAAA,IAC7D;AAAA,EACF;AACA,MAAI,MAAM,YAAY,QAAW;AAC/B,WAAO,EAAE,MAAM,MAAM,SAAS,MAAM,QAAW,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC3G;AACA,QAAM,WAAW,eAAe,WAAW;AAC3C,MAAI,aAAa,QAAW;AAC1B,WAAO,QAAQ,mCAAmC,WAAW,EAAE;AAAA,EACjE;AACA,QAAM,OAAO,CAAC,GAAG,UAAU,GAAI,MAAM,QAAQ,CAAC,CAAE;AAChD,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,OAAO,MAAM;AAAA,IACb,KAAK,MAAM;AAAA,IACX,QAAQ,CAAC,aAAa,GAAG,IAAI,EAAE,KAAK,GAAG;AAAA,EACzC;AACF;AAGA,MAAM,SAAS,CACbA,OACA,OACA,cAC2C;AAC3C,MAAI,MAAM,cAAc,OAAW,QAAO,OAAO,QAAQA,KAAI;AAC7D,MAAI,OAAO,OAAO,SAAS,EAAG,QAAO,OAAO,KAAK,UAAU,YAAY,MAAM,SAAS,CAAC;AACvF,SAAO,OAAO;AAAA,IACZ,UAAU,MAAM,KAAK,QAAQA,OAAM,KAAK,CAAC;AAAA,IACzC,CAAC,aAAmB;AAAA,MAClB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,OAAOA,MAAK;AAAA,MACZ,KAAK,QAAQ;AAAA;AAAA,MAEb,QAAQA,MAAK;AAAA,IACf;AAAA,EACF;AACF;AAuBA,MAAM,UAAU,CAACA,OAAY,WAAqC;AAAA,EAChE,WAAW,MAAM,aAAa;AAAA,EAC9B,MAAM;AAAA,EACN,MAAMA,MAAK,SAAS,SAChB,CAAC,OAAOA,MAAK,IAAI,IACjB,CAAC,OAAO,aAAa,QAAQA,MAAK,MAAM,GAAGA,MAAK,IAAI;AAAA,EACxD,GAAI,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,EACpD,GAAI,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,EACpD,OAAOA,MAAK,UAAU;AACxB;AAGA,MAAM,yBAAyB;AAe/B,MAAM,cAAc,CAClB,OACA,cAEA,OAAO,IAAI,aAAY;AACrB,MAAI,MAAM,cAAc,UAAa,OAAO,OAAO,SAAS,EAAG,QAAO;AACtE,QAAM,UAAU,OAAO,UAAU,MAAM,KAAK;AAAA,IAC1C,WAAW,MAAM;AAAA,IACjB,MAAM;AAAA,IACN,MAAM,CAAC,MAAM,gBAAgB,OAAO,CAAC;AAAA,IACrC,GAAI,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,IACpD,OAAO;AAAA,EACT,CAAC;AACD,QAAM,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM;AAAA,IAC5C,GAAI,QAAQ,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;AAAA,IACxD,WAAW,KAAK,IAAI,MAAM,aAAa,oBAAoB,sBAAsB;AAAA,IACjF,iBAAiB;AAAA,IACjB,MAAM,QAAQ;AAAA,EAChB,CAAC;AACD,SAAO,OAAO,aAAa,IAAI,gBAAgB,MAAM,OAAO,MAAM,IAAI;AACxE,CAAC,EAAE,KAAK,OAAO,cAAc,MAAM,MAAS,CAAC;AAWxC,MAAM,MAAM,OAAO,GAAG,UAAU,EAAE,WACvC,OACkG;AAClG,QAAM,OAAO,OAAO,KAAK;AACzB,QAAM,SAAS,KAAK,KAAK;AACzB,MAAI,kBAAkB,SAAS,SAAU,QAAO,OAAO,OAAO,KAAK,MAAM;AACzE,MAAI,MAAM,SAAS,YAAY;AAC7B,UAAM,gBAAY,yCAAgB,OAAO,MAAM,WAAW,MAAM,UAAU,IAAI,IAAI;AAClF,QAAI,cAAc,OAAW,QAAO,OAAO,OAAO,KAAK,SAAS;AAAA,EAClE;AAGA,QAAM,YAAY,MAAM,cAAc;AACtC,QAAM,YAAY,OAAO,OAAO,cAAc,UAAU,SAAS;AACjE,QAAM,UAAU,OAAO,OAAO,QAAQ,OAAO,SAAS;AAItD,QAAM,SAAS,OAAO,YAAY,OAAO,SAAS;AAClD,QAAM,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM;AAAA,IAC5C,GAAI,MAAM,QAAQ,UAAa,YAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,IACjE,GAAI,QAAQ,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;AAAA,IACxD,WAAW,MAAM,aAAa;AAAA,IAC9B,iBAAiB;AAAA,IACjB,GAAI,QAAQ,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;AAAA,IAC3D,GAAI,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;AAAA,EAChE,CAAC,EAAE,KAAK,OAAO,SAAS,CAAC,UAAU,KAAK,WAAW,QAAQ,QAAQ,KAAK,CAAC,CAAC;AAC1E,QAAM,UAAU,gBAAgB,MAAM,QAAQ,OAAO,YAAY,OAAO,SAAS,CAAC;AAGlF,MAAI,CAAC,UAAW,QAAO,YAAY;AACnC,QAAM,aAAS,2BAAc,OAAO,QAAQ,oCAAwB,EAAE,MAAM,OAAO,CAAC;AACpF,QAAM,aAAS,2BAAc,OAAO,QAAQ,oCAAwB,EAAE,MAAM,OAAO,CAAC;AAGpF,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,iBAAiB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACzD,iBAAiB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACzD,oBAAoB,OAAO,qBAAqB,OAAO;AAAA,IACvD,oBAAoB,OAAO,qBAAqB,OAAO;AAAA,IACvD,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,EAC7C;AACF,CAAC;AAQM,MAAM,mBAAmB,CAAC,UAAkB,cACjD,IAAI,SAAS,SAAS;AAAA,EACpB,MAAM;AAAA,EACN,SAAS,cAAc,SACnB,kDAAkD,QAAQ,iDAAiD,QAAQ,yBACnH,kDAAkD,QAAQ,WAAW,SAAS;AACpF,CAAC;AAcI,MAAM,SAAS,CAAC,aACvB,CACE,UAEA,MAAM,cAAc,WAAW,IAAI,KAAK,IAAI,OAAO,KAAK,iBAAiB,UAAU,MAAM,SAAS,CAAC;",
4
+ "sourcesContent": ["/**\n * Bash flow declaration and portable handler.\n *\n * Two ways in, and the difference is where the payload is parsed. `command` is\n * a line for the platform shell, exactly as before. `script` is program text\n * delivered to an interpreter on standard input, as data: nothing quotes it,\n * escapes it, or terminates it with a heredoc marker, so the class of failure\n * that produced `docker exec c bash -lc '\u2026python - <<EOF\u2026'` cannot occur. Its\n * `args` reach the script as arguments rather than as interpolated text.\n *\n * `container` names a container the host knows how to reach, and the argv is\n * built by the injected {@link Container} transport rather than typed by the\n * caller. A host that binds no transport refuses such a call by saying so; the\n * requirement is optional here precisely so a host without containers is not\n * forced to declare one.\n *\n * @since 1.0.0\n */\n\nimport type * as ChildProcessSpawner from \"@smthrs/kernel/ChildProcessSpawner\"\nimport * as Path from \"@smthrs/kernel/Path\"\nimport * as Effect from \"effect/Effect\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport * as Container from \"./Container.ts\"\nimport { capability, envelope } from \"./internal/Declaration.ts\"\nimport * as Diagnostics from \"./internal/Diagnostics.ts\"\nimport { outsideEnvelope } from \"./internal/EnvelopePrecheck.ts\"\nimport * as Exec from \"./internal/Exec.ts\"\nimport { MAX_SHELL_OUTPUT_BYTES, truncateBytes } from \"./internal/Text.ts\"\nimport * as Probe from \"./Probe.ts\"\nimport * as StdError from \"./StdError.ts\"\nimport * as TreeFingerprint from \"./TreeFingerprint.ts\"\n\n/**\n * Registry name for the bash flow.\n *\n * @category identifiers\n * @since 1.0.0\n */\nexport const name = \"bash\"\n\n/**\n * Model-facing description of the bash flow.\n *\n * Capped at 200 characters and read every frame, which is why the\n * invalid-probe contract is not restated here: the cell contract teaches it\n * once, and a result that has one explains itself.\n *\n * @category descriptions\n * @since 1.0.0\n */\nexport const description =\n \"Run a shell command, or an interpreter over a script passed as data instead of quoted into a line. container routes it through the host's container transport. mode:hermetic pre-checks path tokens.\"\n\n/**\n * Default command timeout in milliseconds.\n *\n * Ten minutes lets full builds and test suites finish while ensuring a stalled\n * process eventually releases the flow.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const DEFAULT_TIMEOUT_MS = 600_000\n\nconst Command = Schema.optional(Schema.String.annotate({\n description: \"Shell command line to execute; give this or script, never both\"\n}))\nconst Script = Schema.optional(Schema.String.annotate({\n description: \"Program text delivered to the interpreter on stdin as data, so it needs no quoting or heredoc\"\n}))\nconst Interpreter = Schema.optional(Schema.String.annotate({\n description:\n \"Program that reads script on stdin; defaults to bash. python, python3, sh, zsh, node, ruby and perl are known\"\n}))\nconst Args = Schema.optional(\n Schema.Array(Schema.String).annotate({\n description: \"Arguments passed to the script as data, never interpolated into it\"\n })\n)\nconst Stdin = Schema.optional(Schema.String.annotate({\n description: \"Text written to the command's standard input; use script instead when the text is the program\"\n}))\nconst ContainerName = Schema.optional(Schema.String.annotate({\n description: \"Run inside this container through the host's container transport; requires mode:unhermetic\"\n}))\nconst Cwd = Schema.optional(Schema.String).annotate({\n description: \"Working directory for the command\",\n message: \"cwd must be a path string. For a checkpoint, pass { at: ctx.base } as the third ctx.call argument.\"\n})\nconst Env = Schema.optional(\n Schema.Record(Schema.String, Schema.String).annotate({ description: \"Environment variables for the command\" })\n)\nconst TimeoutMs = Schema.optional(Schema.Number).annotate({\n description: \"Wall-clock timeout in milliseconds; defaults to 600000 ms\",\n message: \"timeoutMs must be a number of milliseconds.\"\n})\n\n/**\n * Input schema for the bash flow.\n *\n * The mode named `hermetic` requires explicit read and write envelopes for a\n * lexical pre-check; it does not by itself confine the process. Unhermetic mode\n * deliberately omits those declarations so the distinction stays visible in\n * the input shape.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const Input = Schema.Union([\n Schema.Struct({\n mode: Schema.Literal(\"hermetic\").annotate({\n description: \"Lexically pre-check explicit path tokens against declared reads and writes; does not sandbox\"\n }),\n command: Command,\n script: Script,\n interpreter: Interpreter,\n args: Args,\n stdin: Stdin,\n container: ContainerName,\n reads: Schema.Array(Schema.NonEmptyString).annotate({ description: \"Paths or path globs the command may read\" }),\n writes: Schema.Array(Schema.NonEmptyString).annotate({ description: \"Paths or path globs the command may write\" }),\n cwd: Cwd,\n env: Env,\n timeoutMs: TimeoutMs\n }),\n Schema.Struct({\n // Omitted means unhermetic: it is the envelope `effects` already declares\n // for every call, so the default grants nothing a named mode would not.\n mode: Schema.Literal(\"unhermetic\").annotate({\n description: \"Run without a declared filesystem envelope as an irreversible effect; the default\"\n }).pipe(Schema.optionalKey, Schema.withDecodingDefaultKey(Effect.succeed(\"unhermetic\" as const))),\n command: Command,\n script: Script,\n interpreter: Interpreter,\n args: Args,\n stdin: Stdin,\n container: ContainerName,\n cwd: Cwd,\n env: Env,\n timeoutMs: TimeoutMs\n })\n])\n\n/**\n * Decoded input accepted by the bash handler.\n *\n * @category models\n * @since 1.0.0\n */\nexport type Input = typeof Input.Type\n\n/**\n * Output schema for the bash flow.\n *\n * `invalidProbe` is present when the shell itself refused to start the\n * command, which its exit code says outright: 127 for a program it could not\n * find, 126 for one it could not execute. Only that. Reading a runner's own\n * wording is a judgment rather than a fact, and `Probe.classify` makes it with\n * Jev for the `test` flow, whose caller is asking about a suite; a shell call\n * is any command at all and stays free of the gateway. See `Probe`.\n *\n * The `<stream>Truncated` flags are a wire convention, not a display detail.\n * A truncated capture is a fragment of what the process printed, and the\n * harness reads these flags to refuse a later write of those exact bytes \u2014\n * `@smthrs/harness/TruncatedOutput` is the consuming half. Renaming a flag, or\n * dropping it when the capture is cut, disarms that guard silently.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const Output = Schema.Struct({\n exitCode: Schema.Number.annotate({ description: \"Command exit code, including non-zero codes\" }),\n stdout: Schema.String.annotate({\n description: \"Captured stdout; only the tail, and not the whole output, when stdoutTruncated is true\"\n }),\n stderr: Schema.String.annotate({\n description: \"Captured stderr; only the tail, and not the whole output, when stderrTruncated is true\"\n }),\n stdoutTruncated: Schema.Boolean.annotate({\n description:\n \"Whether stdout exceeded the capture limit, leaving stdout a fragment that must not be written to a file\"\n }),\n stderrTruncated: Schema.Boolean.annotate({\n description:\n \"Whether stderr exceeded the capture limit, leaving stderr a fragment that must not be written to a file\"\n }),\n stdoutDroppedBytes: Schema.Number.annotate({ description: \"UTF-8 bytes omitted from the start of stdout\" }),\n stderrDroppedBytes: Schema.Number.annotate({ description: \"UTF-8 bytes omitted from the start of stderr\" }),\n invalidProbe: Schema.optional(\n Probe.InvalidProbe.annotate({\n description: \"Reserved for a confirmed launch failure; an exit code alone does not establish one\"\n })\n ),\n mutated: Schema.optional(\n Schema.Boolean.annotate({\n description:\n \"Present for a containerised command whose working directory was measured before and after it: true when the tree changed, false when it held still. Absent when the tree was not measured, which is never read as unchanged.\"\n })\n )\n})\n\n/**\n * Decoded output returned by the bash handler.\n *\n * @category models\n * @since 1.0.0\n */\nexport type Output = typeof Output.Type\n\n/**\n * Static conservative effect envelope for the bash flow.\n *\n * The declaration is the registry-time worst case because the mode is not\n * known until an invocation is decoded.\n *\n * @category effects\n * @since 1.0.0\n */\nexport const effects = envelope({\n tier: \"irreversible\",\n mode: \"expected\",\n reads: [],\n writes: []\n})\n\n/**\n * Narrows the effect envelope for a decoded invocation.\n *\n * @category effects\n * @since 1.0.0\n */\nexport const effectsFor = (input: Input) =>\n input.mode === \"hermetic\"\n ? envelope({\n tier: \"irreversible\",\n mode: \"hermetic\",\n reads: input.reads,\n writes: input.writes\n })\n : envelope({\n tier: \"irreversible\",\n mode: \"expected\",\n reads: [],\n writes: []\n })\n\n/**\n * Capabilities required by the bash flow.\n *\n * @category capabilities\n * @since 1.0.0\n */\nexport const capabilities = [capability(\"proc:spawn\", \"*\")]\n\n/**\n * Declaration-only bash flow.\n *\n * @category flows\n * @since 1.0.0\n */\nexport const flow = { name, description, input: Input, output: Output, capabilities, effects } as const\n\n/*\n * `bash` declares no activity on purpose. What a shell call does is in the\n * command, not in the declaration: the same flow runs a test suite, a type\n * check, and `cat`. A reader that recognises a direct runner says so from the\n * recorded command; everything else stays unknown, which is what an absent\n * activity means.\n */\n\n/**\n * How one recorded call to this flow reads: the verb for each settlement, the\n * input field that is its subject, and the measured output fields a one-line\n * summary may count.\n *\n * Display metadata only, governed by `@smthrs/registry`\n * `Descriptor.CallPresentation` and checked where `StandardFlows` binds it.\n *\n * @category presentation\n * @since 1.0.0-rc.0\n */\nexport const presentation = {\n verb: { pending: \"running\", success: \"ran\", failure: \"failed to run\" },\n subject: \"command\",\n result: \"command\"\n} as const\n\n/**\n * Select standard input explicitly. Shells need `--` before script arguments\n * so even an argument such as `-c` cannot replace the stdin program.\n * Other supported interpreters treat arguments after `-` as program data.\n */\nconst stdinArguments = (interpreter: string): ReadonlyArray<string> | undefined => {\n switch (interpreter) {\n case \"bash\":\n case \"zsh\":\n case \"sh\":\n case \"dash\":\n return [\"-s\", \"--\"]\n case \"python\":\n case \"python3\":\n case \"node\":\n case \"ruby\":\n case \"perl\":\n return [\"-\"]\n default:\n return undefined\n }\n}\n\n/** Whether a script is shell text the lexical pre-check can actually read. */\nconst shells = new Set([\"bash\", \"zsh\", \"sh\", \"dash\"])\n\n/** What one invocation runs, before any container transport rewrites it. */\ninterface Plan {\n readonly file: string\n readonly args: ReadonlyArray<string> | undefined\n readonly stdin: string | undefined\n readonly env: Record<string, string> | undefined\n readonly quoted: string\n}\n\nconst invalid = (message: string): StdError.StdError => new StdError.StdError({ code: \"invalid_input\", message })\n\n/** The invocation an input names, or the failure explaining why it names none. */\nconst plan = (input: Input): Plan | StdError.StdError => {\n const interpreter = input.interpreter ?? \"bash\"\n if (input.command !== undefined && input.script !== undefined) {\n return invalid(\"Give command or script, never both: a script is program text, a command is a shell line\")\n }\n if (input.command === undefined && input.script === undefined) {\n return invalid(\"Give either command (a shell line) or script (program text run by interpreter)\")\n }\n if (input.script !== undefined && input.stdin !== undefined) {\n return invalid(\"A script already arrives on standard input, so it cannot also carry stdin\")\n }\n if (input.command !== undefined && input.args !== undefined) {\n return invalid(\"args belong to a script; a command carries its own arguments in the line\")\n }\n if (input.command !== undefined && input.interpreter !== undefined) {\n return invalid(\"interpreter runs a script; a command runs in the platform shell\")\n }\n if (input.mode === \"hermetic\" && input.container !== undefined) {\n return invalid(\n \"A container has its own filesystem, so declared reads and writes cannot describe it. Use mode:unhermetic for a containerised command\"\n )\n }\n if (input.mode === \"hermetic\" && input.script !== undefined && !shells.has(interpreter)) {\n return invalid(\n `The hermetic pre-check reads shell text, and ${interpreter} is not a shell. Run this script with mode:unhermetic, or express it as shell`\n )\n }\n if (input.command !== undefined) {\n return { file: input.command, args: undefined, stdin: input.stdin, env: input.env, quoted: input.command }\n }\n const selector = stdinArguments(interpreter)\n if (selector === undefined) {\n return invalid(`Unsupported script interpreter: ${interpreter}`)\n }\n const args = [...selector, ...(input.args ?? [])]\n return {\n file: interpreter,\n args,\n stdin: input.script,\n env: input.env,\n quoted: [interpreter, ...args].join(\" \")\n }\n}\n\n/**\n * The plan, refused when its input names no one invocation or when a hermetic\n * call's paths fall outside its declared envelope. Spawned and terminal\n * execution share this one check.\n */\nconst precheck = (input: Input, path: Path.Path): Plan | StdError.StdError => {\n const intent = plan(input)\n if (intent instanceof StdError.StdError || input.mode !== \"hermetic\") return intent\n // A planned call carries exactly one of command or script.\n return outsideEnvelope(input, input.command ?? input.script!, path) ?? intent\n}\n\n/** The plan as the host will spawn it, once the container transport has had it. */\nconst routed = (\n plan: Plan,\n input: Input,\n transport: Option.Option<Container.Container>\n): Effect.Effect<Plan, StdError.StdError> => {\n if (input.container === undefined) return Effect.succeed(plan)\n if (Option.isNone(transport)) return Effect.fail(Container.unavailable(input.container))\n return Effect.map(\n transport.value.exec(request(plan, input, input.container)),\n (routing): Plan => ({\n file: routing.file,\n args: routing.args,\n stdin: plan.stdin,\n env: routing.env,\n // Diagnostics describe the logical invocation, not transport arguments.\n quoted: plan.quoted\n })\n )\n}\n\n/**\n * One containerised request, always through a login shell.\n *\n * A container's environment is what its profile makes it. The images this\n * harness runs against activate the project's interpreter \u2014 a conda env, a\n * virtualenv, a modified `PATH` \u2014 from `/etc/profile.d`, so a program spawned\n * directly by `docker exec` gets a different Python from the one that owns the\n * repository's dependencies. That is measured, not theoretical: r90 typed\n * `docker exec \u2026 bash -lc '\u2026'` by hand and got the activation for free, r91\n * routed `interpreter: \"python3\"` straight at the container and filled its\n * traces with `ModuleNotFoundError: No module named 'numpy'` and\n * `exec: \"/usr/local/bin/python\": no such file or directory`. Thirty of 45\n * instances then spent 138 cells scanning `/opt` for the real interpreter.\n *\n * So the login shell is the transport's, not the caller's. A command line is\n * one argument to `bash -lc`, as before. A program run under an interpreter\n * becomes `bash -lc 'exec \"$@\"' bash <interpreter> <args\u2026>`: the shell reads\n * the profile, then `exec` replaces it with the interpreter, so the script\n * still arrives on the inherited standard input and no argument is ever\n * re-parsed as shell text.\n */\nconst request = (plan: Plan, input: Input, container: string): Container.Request => ({\n container,\n file: \"bash\",\n args: plan.args === undefined\n ? [\"-lc\", plan.file]\n : [\"-lc\", `exec \"$@\"`, \"bash\", plan.file, ...plan.args],\n ...(input.cwd === undefined ? {} : { cwd: input.cwd }),\n ...(input.env === undefined ? {} : { env: input.env }),\n stdin: plan.stdin !== undefined\n})\n\n/** How long one fingerprint of the container's working directory may take. */\nconst FINGERPRINT_TIMEOUT_MS = 60_000\n\n/**\n * Measures the tree a containerised command is about to run in, or just ran in.\n *\n * The host's workspace walk cannot see a container's filesystem, so the\n * measurement is taken where the tree is: `TreeFingerprint.script` runs\n * through the same transport as the command, in the same working directory,\n * and answers with one checksum. Every way this can fail \u2014 no transport, a\n * container without `find` or `stat`, a timeout, a bounded listing \u2014 is read\n * as \"unmeasured\" and reported as an absent `mutated`, never as a tree that\n * held still. The time it costs is bounded by the command's own timeout so a\n * stalled container cannot spend more waiting to be measured than it may\n * spend running.\n */\nconst fingerprint = (\n input: Input,\n transport: Option.Option<Container.Container>\n): Effect.Effect<TreeFingerprint.Measurement | undefined, never, ChildProcessSpawner.ChildProcessSpawner> =>\n Effect.gen(function*() {\n if (input.container === undefined || Option.isNone(transport)) return undefined\n const routing = yield* transport.value.exec({\n container: input.container,\n file: \"sh\",\n args: [\"-c\", TreeFingerprint.script()],\n ...(input.cwd === undefined ? {} : { cwd: input.cwd }),\n stdin: false\n })\n const result = yield* Exec.exec(routing.file, {\n ...(routing.env === undefined ? {} : { env: routing.env }),\n timeoutMs: Math.min(input.timeoutMs ?? DEFAULT_TIMEOUT_MS, FINGERPRINT_TIMEOUT_MS),\n maxCaptureBytes: MAX_SHELL_OUTPUT_BYTES,\n args: routing.args\n })\n return result.exitCode === 0 ? TreeFingerprint.parse(result.stdout) : undefined\n }).pipe(Effect.orElseSucceed(() => undefined))\n\n/**\n * Executes a shell command through the permission-aware kernel service.\n *\n * Non-zero exit codes remain successful values. Only timeout, host, permission,\n * and declared-envelope pre-check failures use the typed error channel.\n *\n * @category handlers\n * @since 1.0.0\n */\nexport const run = Effect.fn(\"Bash.run\")(function*(\n input: Input\n): Effect.fn.Return<Output, StdError.StdError, ChildProcessSpawner.ChildProcessSpawner | Path.Path> {\n const intent = precheck(input, yield* Path.Path)\n if (intent instanceof StdError.StdError) return yield* Effect.fail(intent)\n // The working directory belongs to the container. The transport supplies\n // any environment overrides its host process needs to forward into it.\n const contained = input.container !== undefined\n const transport = yield* Effect.serviceOption(Container.Container)\n const spawned = yield* routed(intent, input, transport)\n\n // The tree the command runs in, before it runs. Measured in the container\n // because nothing on this host can see it; see `TreeFingerprint`.\n const before = yield* fingerprint(input, transport)\n const result = yield* Exec.exec(spawned.file, {\n ...(input.cwd === undefined || contained ? {} : { cwd: input.cwd }),\n ...(spawned.env === undefined ? {} : { env: spawned.env }),\n timeoutMs: input.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n maxCaptureBytes: MAX_SHELL_OUTPUT_BYTES,\n ...(spawned.args === undefined ? {} : { args: spawned.args }),\n ...(spawned.stdin === undefined ? {} : { stdin: spawned.stdin })\n }).pipe(Effect.mapError((error) => Exec.toStdError(spawned.quoted, error)))\n const mutated = TreeFingerprint.moved(before, yield* fingerprint(input, transport))\n // A command on this host may have changed files a language server holds\n // open; a container's files are not the ones it was sent.\n if (!contained) yield* Diagnostics.refresh\n const stdout = truncateBytes(result.stdout, MAX_SHELL_OUTPUT_BYTES, { keep: \"tail\" })\n const stderr = truncateBytes(result.stderr, MAX_SHELL_OUTPUT_BYTES, { keep: \"tail\" })\n // Exit codes alone cannot establish whether the shell refused to launch a\n // command or a launched runner chose that status after executing tests.\n return {\n exitCode: result.exitCode,\n stdout: stdout.text,\n stderr: stderr.text,\n stdoutTruncated: result.stdoutDroppedBytes > 0 || stdout.truncated,\n stderrTruncated: result.stderrDroppedBytes > 0 || stderr.truncated,\n stdoutDroppedBytes: result.stdoutDroppedBytes + stdout.droppedBytes,\n stderrDroppedBytes: result.stderrDroppedBytes + stderr.droppedBytes,\n ...(mutated === undefined ? {} : { mutated })\n }\n})\n\n/**\n * What one call runs, after planning and before any transport: the program,\n * its arguments (absent for a shell command line), standard input, the\n * caller's environment, and the logical invocation as a person reads it.\n *\n * @category models\n * @since 1.0.0\n */\nexport interface Invocation {\n readonly file: string\n readonly args: ReadonlyArray<string> | undefined\n readonly stdin: string | undefined\n readonly env: Record<string, string> | undefined\n readonly quoted: string\n}\n\n/**\n * The invocation `input` names, or the typed refusal explaining why it names\n * none. The same plan {@link run} spawns; a terminal provider runs it instead.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const invocation = (input: Input): Invocation | StdError.StdError => plan(input)\n\n/**\n * {@link run}'s contract through a registered terminal (T-TRM-05): the same\n * plan, hermetic pre-check, bounded output and diagnostics refresh, with\n * execution supplied by `execute` instead of a spawn on this host. A terminal\n * has no container transport, so a containerised call is refused before it\n * reaches `execute`.\n *\n * @category handlers\n * @since 1.0.0\n */\nexport const inTerminal = <R>(\n execute: (input: Input) => Effect.Effect<Output, StdError.StdError, R>\n) =>\n Effect.fn(\"Bash.inTerminal\")(function*(\n input: Input\n ): Effect.fn.Return<Output, StdError.StdError, R | Path.Path> {\n const intent = precheck(input, yield* Path.Path)\n if (intent instanceof StdError.StdError) return yield* Effect.fail(intent)\n if (input.container !== undefined) return yield* Effect.fail(Container.unavailable(input.container))\n const output = yield* execute(input)\n // The terminal ran on this workspace: files a language server holds may\n // have changed, exactly as after a spawn here.\n yield* Diagnostics.refresh\n return output\n })\n\n/**\n * The refusal a sealed host answers a call outside its container with.\n *\n * @category errors\n * @since 1.0.0-rc.1\n */\nexport const outsideContainer = (sealedTo: string, requested: string | undefined): StdError.StdError =>\n new StdError.StdError({\n code: \"outside_container\",\n message: requested === undefined\n ? `This host runs commands only inside container \"${sealedTo}\". Name it: { mode: \"unhermetic\", container: \"${sealedTo}\", command: \"...\" }.`\n : `This host runs commands only inside container \"${sealedTo}\", not \"${requested}\".`\n })\n\n/**\n * {@link run}, sealed to one container.\n *\n * A host that must not be reachable from the cell (a benchmark host holding\n * other tasks' tests and reference solutions, say) binds this instead of\n * {@link run}: a call naming `sealedTo` runs as usual, and every other call,\n * including one with no container that would run on the host, fails with\n * `outside_container` before anything is spawned.\n *\n * @category handlers\n * @since 1.0.0-rc.1\n */\nexport const sealed = (sealedTo: string) =>\n(\n input: Input\n): Effect.Effect<Output, StdError.StdError, ChildProcessSpawner.ChildProcessSpawner | Path.Path> =>\n input.container === sealedTo ? run(input) : Effect.fail(outsideContainer(sealedTo, input.container))\n"],
5
+ "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoBA,WAAsB;AACtB,aAAwB;AACxB,aAAwB;AACxB,aAAwB;AACxB,gBAA2B;AAC3B,yBAAqC;AACrC,kBAA6B;AAC7B,8BAAgC;AAChC,WAAsB;AACtB,kBAAsD;AACtD,YAAuB;AACvB,eAA0B;AAC1B,sBAAiC;AAQ1B,MAAM,OAAO;AAYb,MAAM,cACX;AAWK,MAAM,qBAAqB;AAElC,MAAM,UAAU,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EACrD,aAAa;AACf,CAAC,CAAC;AACF,MAAM,SAAS,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EACpD,aAAa;AACf,CAAC,CAAC;AACF,MAAM,cAAc,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EACzD,aACE;AACJ,CAAC,CAAC;AACF,MAAM,OAAO,OAAO;AAAA,EAClB,OAAO,MAAM,OAAO,MAAM,EAAE,SAAS;AAAA,IACnC,aAAa;AAAA,EACf,CAAC;AACH;AACA,MAAM,QAAQ,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EACnD,aAAa;AACf,CAAC,CAAC;AACF,MAAM,gBAAgB,OAAO,SAAS,OAAO,OAAO,SAAS;AAAA,EAC3D,aAAa;AACf,CAAC,CAAC;AACF,MAAM,MAAM,OAAO,SAAS,OAAO,MAAM,EAAE,SAAS;AAAA,EAClD,aAAa;AAAA,EACb,SAAS;AACX,CAAC;AACD,MAAM,MAAM,OAAO;AAAA,EACjB,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,EAAE,SAAS,EAAE,aAAa,wCAAwC,CAAC;AAC/G;AACA,MAAM,YAAY,OAAO,SAAS,OAAO,MAAM,EAAE,SAAS;AAAA,EACxD,aAAa;AAAA,EACb,SAAS;AACX,CAAC;AAaM,MAAM,QAAQ,OAAO,MAAM;AAAA,EAChC,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,UAAU,EAAE,SAAS;AAAA,MACxC,aAAa;AAAA,IACf,CAAC;AAAA,IACD,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,MAAM;AAAA,IACN,OAAO;AAAA,IACP,WAAW;AAAA,IACX,OAAO,OAAO,MAAM,OAAO,cAAc,EAAE,SAAS,EAAE,aAAa,2CAA2C,CAAC;AAAA,IAC/G,QAAQ,OAAO,MAAM,OAAO,cAAc,EAAE,SAAS,EAAE,aAAa,4CAA4C,CAAC;AAAA,IACjH,KAAK;AAAA,IACL,KAAK;AAAA,IACL,WAAW;AAAA,EACb,CAAC;AAAA,EACD,OAAO,OAAO;AAAA;AAAA;AAAA,IAGZ,MAAM,OAAO,QAAQ,YAAY,EAAE,SAAS;AAAA,MAC1C,aAAa;AAAA,IACf,CAAC,EAAE,KAAK,OAAO,aAAa,OAAO,uBAAuB,OAAO,QAAQ,YAAqB,CAAC,CAAC;AAAA,IAChG,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,MAAM;AAAA,IACN,OAAO;AAAA,IACP,WAAW;AAAA,IACX,KAAK;AAAA,IACL,KAAK;AAAA,IACL,WAAW;AAAA,EACb,CAAC;AACH,CAAC;AA6BM,MAAM,SAAS,OAAO,OAAO;AAAA,EAClC,UAAU,OAAO,OAAO,SAAS,EAAE,aAAa,8CAA8C,CAAC;AAAA,EAC/F,QAAQ,OAAO,OAAO,SAAS;AAAA,IAC7B,aAAa;AAAA,EACf,CAAC;AAAA,EACD,QAAQ,OAAO,OAAO,SAAS;AAAA,IAC7B,aAAa;AAAA,EACf,CAAC;AAAA,EACD,iBAAiB,OAAO,QAAQ,SAAS;AAAA,IACvC,aACE;AAAA,EACJ,CAAC;AAAA,EACD,iBAAiB,OAAO,QAAQ,SAAS;AAAA,IACvC,aACE;AAAA,EACJ,CAAC;AAAA,EACD,oBAAoB,OAAO,OAAO,SAAS,EAAE,aAAa,+CAA+C,CAAC;AAAA,EAC1G,oBAAoB,OAAO,OAAO,SAAS,EAAE,aAAa,+CAA+C,CAAC;AAAA,EAC1G,cAAc,OAAO;AAAA,IACnB,MAAM,aAAa,SAAS;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EACA,SAAS,OAAO;AAAA,IACd,OAAO,QAAQ,SAAS;AAAA,MACtB,aACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF,CAAC;AAmBM,MAAM,cAAU,6BAAS;AAAA,EAC9B,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO,CAAC;AAAA,EACR,QAAQ,CAAC;AACX,CAAC;AAQM,MAAM,aAAa,CAAC,UACzB,MAAM,SAAS,iBACX,6BAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO,MAAM;AAAA,EACb,QAAQ,MAAM;AAChB,CAAC,QACC,6BAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO,CAAC;AAAA,EACR,QAAQ,CAAC;AACX,CAAC;AAQE,MAAM,eAAe,KAAC,+BAAW,cAAc,GAAG,CAAC;AAQnD,MAAM,OAAO,EAAE,MAAM,aAAa,OAAO,OAAO,QAAQ,QAAQ,cAAc,QAAQ;AAqBtF,MAAM,eAAe;AAAA,EAC1B,MAAM,EAAE,SAAS,WAAW,SAAS,OAAO,SAAS,gBAAgB;AAAA,EACrE,SAAS;AAAA,EACT,QAAQ;AACV;AAOA,MAAM,iBAAiB,CAAC,gBAA2D;AACjF,UAAQ,aAAa;AAAA,IACnB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC,MAAM,IAAI;AAAA,IACpB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC,GAAG;AAAA,IACb;AACE,aAAO;AAAA,EACX;AACF;AAGA,MAAM,SAAS,oBAAI,IAAI,CAAC,QAAQ,OAAO,MAAM,MAAM,CAAC;AAWpD,MAAM,UAAU,CAAC,YAAuC,IAAI,SAAS,SAAS,EAAE,MAAM,iBAAiB,QAAQ,CAAC;AAGhH,MAAM,OAAO,CAAC,UAA2C;AACvD,QAAM,cAAc,MAAM,eAAe;AACzC,MAAI,MAAM,YAAY,UAAa,MAAM,WAAW,QAAW;AAC7D,WAAO,QAAQ,yFAAyF;AAAA,EAC1G;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,WAAW,QAAW;AAC7D,WAAO,QAAQ,gFAAgF;AAAA,EACjG;AACA,MAAI,MAAM,WAAW,UAAa,MAAM,UAAU,QAAW;AAC3D,WAAO,QAAQ,2EAA2E;AAAA,EAC5F;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,SAAS,QAAW;AAC3D,WAAO,QAAQ,0EAA0E;AAAA,EAC3F;AACA,MAAI,MAAM,YAAY,UAAa,MAAM,gBAAgB,QAAW;AAClE,WAAO,QAAQ,iEAAiE;AAAA,EAClF;AACA,MAAI,MAAM,SAAS,cAAc,MAAM,cAAc,QAAW;AAC9D,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,cAAc,MAAM,WAAW,UAAa,CAAC,OAAO,IAAI,WAAW,GAAG;AACvF,WAAO;AAAA,MACL,gDAAgD,WAAW;AAAA,IAC7D;AAAA,EACF;AACA,MAAI,MAAM,YAAY,QAAW;AAC/B,WAAO,EAAE,MAAM,MAAM,SAAS,MAAM,QAAW,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC3G;AACA,QAAM,WAAW,eAAe,WAAW;AAC3C,MAAI,aAAa,QAAW;AAC1B,WAAO,QAAQ,mCAAmC,WAAW,EAAE;AAAA,EACjE;AACA,QAAM,OAAO,CAAC,GAAG,UAAU,GAAI,MAAM,QAAQ,CAAC,CAAE;AAChD,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,OAAO,MAAM;AAAA,IACb,KAAK,MAAM;AAAA,IACX,QAAQ,CAAC,aAAa,GAAG,IAAI,EAAE,KAAK,GAAG;AAAA,EACzC;AACF;AAOA,MAAM,WAAW,CAAC,OAAc,SAA8C;AAC5E,QAAM,SAAS,KAAK,KAAK;AACzB,MAAI,kBAAkB,SAAS,YAAY,MAAM,SAAS,WAAY,QAAO;AAE7E,aAAO,yCAAgB,OAAO,MAAM,WAAW,MAAM,QAAS,IAAI,KAAK;AACzE;AAGA,MAAM,SAAS,CACbA,OACA,OACA,cAC2C;AAC3C,MAAI,MAAM,cAAc,OAAW,QAAO,OAAO,QAAQA,KAAI;AAC7D,MAAI,OAAO,OAAO,SAAS,EAAG,QAAO,OAAO,KAAK,UAAU,YAAY,MAAM,SAAS,CAAC;AACvF,SAAO,OAAO;AAAA,IACZ,UAAU,MAAM,KAAK,QAAQA,OAAM,OAAO,MAAM,SAAS,CAAC;AAAA,IAC1D,CAAC,aAAmB;AAAA,MAClB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,OAAOA,MAAK;AAAA,MACZ,KAAK,QAAQ;AAAA;AAAA,MAEb,QAAQA,MAAK;AAAA,IACf;AAAA,EACF;AACF;AAuBA,MAAM,UAAU,CAACA,OAAY,OAAc,eAA0C;AAAA,EACnF;AAAA,EACA,MAAM;AAAA,EACN,MAAMA,MAAK,SAAS,SAChB,CAAC,OAAOA,MAAK,IAAI,IACjB,CAAC,OAAO,aAAa,QAAQA,MAAK,MAAM,GAAGA,MAAK,IAAI;AAAA,EACxD,GAAI,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,EACpD,GAAI,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,EACpD,OAAOA,MAAK,UAAU;AACxB;AAGA,MAAM,yBAAyB;AAe/B,MAAM,cAAc,CAClB,OACA,cAEA,OAAO,IAAI,aAAY;AACrB,MAAI,MAAM,cAAc,UAAa,OAAO,OAAO,SAAS,EAAG,QAAO;AACtE,QAAM,UAAU,OAAO,UAAU,MAAM,KAAK;AAAA,IAC1C,WAAW,MAAM;AAAA,IACjB,MAAM;AAAA,IACN,MAAM,CAAC,MAAM,gBAAgB,OAAO,CAAC;AAAA,IACrC,GAAI,MAAM,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,IACpD,OAAO;AAAA,EACT,CAAC;AACD,QAAM,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM;AAAA,IAC5C,GAAI,QAAQ,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;AAAA,IACxD,WAAW,KAAK,IAAI,MAAM,aAAa,oBAAoB,sBAAsB;AAAA,IACjF,iBAAiB;AAAA,IACjB,MAAM,QAAQ;AAAA,EAChB,CAAC;AACD,SAAO,OAAO,aAAa,IAAI,gBAAgB,MAAM,OAAO,MAAM,IAAI;AACxE,CAAC,EAAE,KAAK,OAAO,cAAc,MAAM,MAAS,CAAC;AAWxC,MAAM,MAAM,OAAO,GAAG,UAAU,EAAE,WACvC,OACkG;AAClG,QAAM,SAAS,SAAS,OAAO,OAAO,KAAK,IAAI;AAC/C,MAAI,kBAAkB,SAAS,SAAU,QAAO,OAAO,OAAO,KAAK,MAAM;AAGzE,QAAM,YAAY,MAAM,cAAc;AACtC,QAAM,YAAY,OAAO,OAAO,cAAc,UAAU,SAAS;AACjE,QAAM,UAAU,OAAO,OAAO,QAAQ,OAAO,SAAS;AAItD,QAAM,SAAS,OAAO,YAAY,OAAO,SAAS;AAClD,QAAM,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM;AAAA,IAC5C,GAAI,MAAM,QAAQ,UAAa,YAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;AAAA,IACjE,GAAI,QAAQ,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;AAAA,IACxD,WAAW,MAAM,aAAa;AAAA,IAC9B,iBAAiB;AAAA,IACjB,GAAI,QAAQ,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;AAAA,IAC3D,GAAI,QAAQ,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;AAAA,EAChE,CAAC,EAAE,KAAK,OAAO,SAAS,CAAC,UAAU,KAAK,WAAW,QAAQ,QAAQ,KAAK,CAAC,CAAC;AAC1E,QAAM,UAAU,gBAAgB,MAAM,QAAQ,OAAO,YAAY,OAAO,SAAS,CAAC;AAGlF,MAAI,CAAC,UAAW,QAAO,YAAY;AACnC,QAAM,aAAS,2BAAc,OAAO,QAAQ,oCAAwB,EAAE,MAAM,OAAO,CAAC;AACpF,QAAM,aAAS,2BAAc,OAAO,QAAQ,oCAAwB,EAAE,MAAM,OAAO,CAAC;AAGpF,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,iBAAiB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACzD,iBAAiB,OAAO,qBAAqB,KAAK,OAAO;AAAA,IACzD,oBAAoB,OAAO,qBAAqB,OAAO;AAAA,IACvD,oBAAoB,OAAO,qBAAqB,OAAO;AAAA,IACvD,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,EAC7C;AACF,CAAC;AAyBM,MAAM,aAAa,CAAC,UAAiD,KAAK,KAAK;AAY/E,MAAM,aAAa,CACxB,YAEA,OAAO,GAAG,iBAAiB,EAAE,WAC3B,OAC4D;AAC5D,QAAM,SAAS,SAAS,OAAO,OAAO,KAAK,IAAI;AAC/C,MAAI,kBAAkB,SAAS,SAAU,QAAO,OAAO,OAAO,KAAK,MAAM;AACzE,MAAI,MAAM,cAAc,OAAW,QAAO,OAAO,OAAO,KAAK,UAAU,YAAY,MAAM,SAAS,CAAC;AACnG,QAAM,SAAS,OAAO,QAAQ,KAAK;AAGnC,SAAO,YAAY;AACnB,SAAO;AACT,CAAC;AAQI,MAAM,mBAAmB,CAAC,UAAkB,cACjD,IAAI,SAAS,SAAS;AAAA,EACpB,MAAM;AAAA,EACN,SAAS,cAAc,SACnB,kDAAkD,QAAQ,iDAAiD,QAAQ,yBACnH,kDAAkD,QAAQ,WAAW,SAAS;AACpF,CAAC;AAcI,MAAM,SAAS,CAAC,aACvB,CACE,UAEA,MAAM,cAAc,WAAW,IAAI,KAAK,IAAI,OAAO,KAAK,iBAAiB,UAAU,MAAM,SAAS,CAAC;",
6
6
  "names": ["plan"]
7
7
  }
package/dist/cjs/internal/GitWorktree.d.ts CHANGED
@@ -75,7 +75,17 @@ export interface Shadow {
75
75
  readonly repository: Repository;
76
76
  /** Runs host git with the shadow as `GIT_DIR`, and `workTree` as its work tree when given. */
77
77
  readonly git: (args: ReadonlyArray<string>, workTree?: string) => Effect.Effect<Exec.ExecResult, StdError.StdError, ChildProcessSpawner>;
78
- /** Copies the workspace index into the shadow, so the shadow never writes the agent's own. */
78
+ /**
79
+ * Copies the workspace index into the shadow, with its modification time, so
80
+ * the shadow never writes the agent's own.
81
+ *
82
+ * The time is part of what git reads. It trusts an entry's recorded stat
83
+ * unless the entry is at least as new as the index file, in whole seconds;
84
+ * a copy stamped at the moment of copying made every entry look older, and a
85
+ * same-size edit from the second the index was written was recorded as the
86
+ * committed bytes (#3431). The time is taken before the bytes are read, so
87
+ * an index rewritten meanwhile leaves the copy looking older, never newer.
88
+ */
79
89
  readonly adoptIndex: Effect.Effect<void, StdError.StdError, ChildProcessSpawner>;
80
90
  }
81
91
  /**
package/dist/cjs/internal/GitWorktree.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"GitWorktree.d.ts","sourceRoot":"","sources":["../../../src/internal/GitWorktree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AA+CjC;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CACzC;AAuDD;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,8FAA8F;IAC9F,QAAQ,CAAC,GAAG,EAAE,CACZ,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,QAAQ,CAAC,EAAE,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IAC3E,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;CACjF;AA2RD;;;;;GAKG;AACH,eAAO,MAAM,WAAW;yBA7VI,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,aAAa,CAAC,MAAM,CAAC;gBA1ChE,MAAM,QAAQ,aAAa,CAAC,MAAM,CAAC;iBA6ClC,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;0BA3CjE,MAAM,QAAQ,aAAa,CAAC,MAAM,CAAC;;;;2BAiWlC,CAAC,EAAE,CAAC,EAAE,CAAC,QAC7B,MAAM,UACJ,MAAM,UACN,MAAM,OACT,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,mBAAmB,CAAC;iBA3N/C,CAAC,EAAE,CAAC,EAAE,CAAC,QACnB,MAAM,GAAG,UAAU,OACpB,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,mBAAmB,CAAC;CAuP8B,CAAA"}
1
+ {"version":3,"file":"GitWorktree.d.ts","sourceRoot":"","sources":["../../../src/internal/GitWorktree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AA+CjC;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CACzC;AAuDD;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,8FAA8F;IAC9F,QAAQ,CAAC,GAAG,EAAE,CACZ,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,QAAQ,CAAC,EAAE,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IAC3E;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;CACjF;AAmSD;;;;;GAKG;AACH,eAAO,MAAM,WAAW;yBA/WI,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,aAAa,CAAC,MAAM,CAAC;gBA1ChE,MAAM,QAAQ,aAAa,CAAC,MAAM,CAAC;iBA6ClC,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;0BA3CjE,MAAM,QAAQ,aAAa,CAAC,MAAM,CAAC;;;;2BAmXlC,CAAC,EAAE,CAAC,EAAE,CAAC,QAC7B,MAAM,UACJ,MAAM,UACN,MAAM,OACT,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,mBAAmB,CAAC;iBA3N/C,CAAC,EAAE,CAAC,EAAE,CAAC,QACnB,MAAM,GAAG,UAAU,OACpB,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,mBAAmB,CAAC;CAuP8B,CAAA"}
package/dist/cjs/internal/GitWorktree.js CHANGED
@@ -81,6 +81,12 @@ const temporaryRoot = () => {
81
81
  const remove = (path) => run("rm", ["-rf", "--", path]).pipe(
82
82
  import_effect.Effect.flatMap((removed) => removed.exitCode === 0 ? import_effect.Effect.void : import_effect.Effect.fail(failed(removed.stderr.trim())))
83
83
  );
84
+ const adoptIndexScript = [
85
+ "set -C",
86
+ 'if [ -e "$1" ]',
87
+ 'then : > "$2.at" && touch -r "$1" -- "$2.at" && cat -- "$1" > "$2" && touch -r "$2.at" -- "$2" && rm -f -- "$2.at"',
88
+ "fi"
89
+ ].join("; ");
84
90
  const shadowOf = (repository, path) => ({
85
91
  path,
86
92
  repository,
@@ -97,7 +103,7 @@ const shadowOf = (repository, path) => ({
97
103
  ),
98
104
  adoptIndex: run("sh", [
99
105
  "-c",
100
- 'set -C; if [ -e "$1" ]; then cat -- "$1" > "$2"; fi',
106
+ adoptIndexScript,
101
107
  "sh",
102
108
  repository.index,
103
109
  `${path}/index`