@songsid/agend 2.2.0-beta.8 → 2.2.0

package/dist/kiro-log-gate.d.ts

@@ -0,0 +1,42 @@
+/**
+ * #1218 PR4: whether the Log may read a kiro instance's own history, and if not, why (the leader's ruling, 2026-10-13;
+ * sol's design check on #849). Two proofs are needed, and both must be positive — an unknown is a no:
+ *
+ * 1. **The root.** The launch's store root is the one the reader would open. Per engine: a credential profile's launch
+ *    sets `XDG_DATA_HOME` itself, which proves the classic (v1) store; the TUI (v2) store's `KIRO_HOME` is inherited from
+ *    the tmux server's environment and set by no launch, so it is never proven here. Launches are not changed to prove
+ *    it (a prefix would move an existing instance's store, account and conversation): that is a report-only
+ *    root-consistency change of its own (#849).
+ * 2. **The current session.** `--resume-id` proves where a launch started, not where the instance is now: a `/clear` or
+ *    `/chat load` typed in its terminal can move it unseen, and a sibling in the same directory writes rows that look the
+ *    same. No seam observes that yet (#1789), so this proof is never positive today.
+ *
+ * Until both hold, a kiro Log shows fleet events only, with the reason. There is no "may not be current" fallback,
+ * and no newest-row-for-this-directory or cross-engine guess. Fresh and legacy launches own no conversation id; V3 is
+ * not read at all.
+ */
+/** What an instance's last built kiro launch was: its engine, how it chose its conversation, its credential profile. */
+export interface KiroLogLaunch {
+    engine: "v1" | "v2" | "v3" | null;
+    mode: "legacy" | "resume" | "fresh";
+    credentialProfile: string | null;
+}
+/** Why a kiro Log shows fleet events only (each one worded on the tab). */
+export type KiroLogReason = "kiro_not_running" | "kiro_v3" | "kiro_engine_unknown" | "kiro_legacy" | "kiro_fresh" | "kiro_v2_root" | "kiro_no_profile" | "kiro_session_unobservable";
+/** The proofs beyond the launch itself. Neither exists yet: see #849 (root) and #1789 (current session). */
+export interface KiroLogProofs {
+    /** The TUI store's root, proven equal for this launch. */
+    v2Root?(): boolean;
+    /** The conversation the instance is in now is the one its launch resumed. */
+    currentSession?(): boolean;
+}
+/** Today's proofs: none. */
+export declare const KIRO_LOG_PROOFS_TODAY: KiroLogProofs;
+export type KiroLogGate = {
+    open: false;
+    reason: KiroLogReason;
+} | {
+    open: true;
+    engine: "v1" | "v2";
+};
+export declare function kiroLogGate(launch: KiroLogLaunch | null, proofs?: KiroLogProofs): KiroLogGate;

package/dist/kiro-log-gate.js

@@ -0,0 +1,39 @@
+/**
+ * #1218 PR4: whether the Log may read a kiro instance's own history, and if not, why (the leader's ruling, 2026-10-13;
+ * sol's design check on #849). Two proofs are needed, and both must be positive — an unknown is a no:
+ *
+ * 1. **The root.** The launch's store root is the one the reader would open. Per engine: a credential profile's launch
+ *    sets `XDG_DATA_HOME` itself, which proves the classic (v1) store; the TUI (v2) store's `KIRO_HOME` is inherited from
+ *    the tmux server's environment and set by no launch, so it is never proven here. Launches are not changed to prove
+ *    it (a prefix would move an existing instance's store, account and conversation): that is a report-only
+ *    root-consistency change of its own (#849).
+ * 2. **The current session.** `--resume-id` proves where a launch started, not where the instance is now: a `/clear` or
+ *    `/chat load` typed in its terminal can move it unseen, and a sibling in the same directory writes rows that look the
+ *    same. No seam observes that yet (#1789), so this proof is never positive today.
+ *
+ * Until both hold, a kiro Log shows fleet events only, with the reason. There is no "may not be current" fallback,
+ * and no newest-row-for-this-directory or cross-engine guess. Fresh and legacy launches own no conversation id; V3 is
+ * not read at all.
+ */
+/** Today's proofs: none. */
+export const KIRO_LOG_PROOFS_TODAY = {};
+export function kiroLogGate(launch, proofs = KIRO_LOG_PROOFS_TODAY) {
+    if (!launch)
+        return { open: false, reason: "kiro_not_running" };
+    if (launch.engine === "v3")
+        return { open: false, reason: "kiro_v3" };
+    if (!launch.engine)
+        return { open: false, reason: "kiro_engine_unknown" };
+    if (launch.mode === "legacy")
+        return { open: false, reason: "kiro_legacy" };
+    if (launch.mode !== "resume")
+        return { open: false, reason: "kiro_fresh" };
+    if (launch.engine === "v2" && proofs.v2Root?.() !== true)
+        return { open: false, reason: "kiro_v2_root" };
+    if (launch.engine === "v1" && !launch.credentialProfile)
+        return { open: false, reason: "kiro_no_profile" };
+    if (proofs.currentSession?.() !== true)
+        return { open: false, reason: "kiro_session_unobservable" };
+    return { open: true, engine: launch.engine };
+}
+//# sourceMappingURL=kiro-log-gate.js.map

package/dist/kiro-log-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-log-gate.js","sourceRoot":"","sources":["../src/kiro-log-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAsBH,4BAA4B;AAC5B,MAAM,CAAC,MAAM,qBAAqB,GAAkB,EAAE,CAAC;AAIvD,MAAM,UAAU,WAAW,CAAC,MAA4B,EAAE,SAAwB,qBAAqB;IACrG,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACzG,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC3G,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACpG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC"}

package/dist/launchd-handoff.d.ts

@@ -0,0 +1,43 @@
+/** Set on the detached copy: it does the work itself (never hands off again). */
+export declare const HANDED_OFF_ENV = "AGEND_LAUNCHD_HANDOFF";
+export declare const HANDOFF_LOG = "service-activation.log";
+/** A fleet agent's session (AGEND_INSTANCE_NAME, inherited by everything it runs), and not already the copy. */
+export declare function shouldHandOff(env: NodeJS.ProcessEnv): boolean;
+/** The part of a ChildProcess the hand-off uses: launch success and failure arrive as events (spawn / error). */
+export interface SpawnedChild {
+    once(event: "spawn", listener: () => void): unknown;
+    once(event: "error", listener: (err: Error) => void): unknown;
+    unref(): void;
+}
+export interface HandOffDeps {
+    open(path: string): number;
+    write(fd: number, text: string): void;
+    close(fd: number): void;
+    spawn(command: string, args: string[], options: {
+        detached: true;
+        stdio: ["ignore", number, number];
+        env: NodeJS.ProcessEnv;
+    }): SpawnedChild;
+    now(): Date;
+}
+/**
+ * Start the detached copy of `self` (this CLI, these arguments). It is handed off only once it has started (the `spawn`
+ * event); a launch that fails (`error`: ENOENT, EAGAIN …) comes back as a reason, and the caller then goes on itself.
+ * This command was already allowed through the gate, so the copy carries an origin of its own: the confirmation an
+ * agent gave (or the updater's origin) does not have to be given twice.
+ */
+export declare function handOff(o: {
+    agendHome: string;
+    self: {
+        command: string;
+        args: string[];
+    };
+    env: NodeJS.ProcessEnv;
+    action: string;
+}, deps: HandOffDeps): Promise<{
+    ok: true;
+    log: string;
+} | {
+    ok: false;
+    reason: string;
+}>;

package/dist/launchd-handoff.js

@@ -0,0 +1,56 @@
+/**
+ * #1871: on launchd, an activation takes two steps from the client: `launchctl bootout`, then `bootstrap`. The bootout
+ * stops the fleet, and the fleet's stop kills every agent's CLI. So a command run in an agent's pane dies between the
+ * two steps: the job stays unloaded (the fleet is down), its plan stays pending, and nobody is left to say so.
+ *
+ * Run from an agent session, such a command hands itself to a detached copy instead. The copy runs in its own session,
+ * as chat /update does, so it outlives the stop. Its output goes to a log in the AgEnD home.
+ */
+import { join } from "node:path";
+import { ORIGIN_ENV } from "./fleet-control-audit.js";
+/** Set on the detached copy: it does the work itself (never hands off again). */
+export const HANDED_OFF_ENV = "AGEND_LAUNCHD_HANDOFF";
+export const HANDOFF_LOG = "service-activation.log";
+/** A fleet agent's session (AGEND_INSTANCE_NAME, inherited by everything it runs), and not already the copy. */
+export function shouldHandOff(env) {
+    return !!(env.AGEND_INSTANCE_NAME ?? "").trim() && env[HANDED_OFF_ENV] !== "1";
+}
+/**
+ * Start the detached copy of `self` (this CLI, these arguments). It is handed off only once it has started (the `spawn`
+ * event); a launch that fails (`error`: ENOENT, EAGAIN …) comes back as a reason, and the caller then goes on itself.
+ * This command was already allowed through the gate, so the copy carries an origin of its own: the confirmation an
+ * agent gave (or the updater's origin) does not have to be given twice.
+ */
+export async function handOff(o, deps) {
+    const log = join(o.agendHome, HANDOFF_LOG);
+    let fd;
+    try {
+        fd = deps.open(log);
+    }
+    catch (err) {
+        return { ok: false, reason: `cannot open ${log}: ${err.message}` };
+    }
+    try {
+        deps.write(fd, `\n[${deps.now().toISOString()}] agend ${o.action}, handed off from ${o.env.AGEND_INSTANCE_NAME}'s session (#1871)\n`);
+        const env = { ...o.env, [HANDED_OFF_ENV]: "1", [ORIGIN_ENV]: `launchd hand-off of agend ${o.action} from ${o.env.AGEND_INSTANCE_NAME}` };
+        const child = deps.spawn(o.self.command, o.self.args, { detached: true, stdio: ["ignore", fd, fd], env });
+        const started = await new Promise(resolve => {
+            child.once("error", err => resolve(err));
+            child.once("spawn", () => resolve(null));
+        });
+        if (started)
+            return { ok: false, reason: `the detached copy did not start: ${started.message}` };
+        child.unref();
+        return { ok: true, log };
+    }
+    catch (err) {
+        return { ok: false, reason: `the detached copy did not start: ${err.message}` };
+    }
+    finally {
+        try {
+            deps.close(fd);
+        }
+        catch { /* the child holds its own copy */ }
+    }
+}
+//# sourceMappingURL=launchd-handoff.js.map

package/dist/launchd-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchd-handoff.js","sourceRoot":"","sources":["../src/launchd-handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAEpD,gHAAgH;AAChH,MAAM,UAAU,aAAa,CAAC,GAAsB;IAClD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,GAAG,CAAC;AACjF,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,CAA2G,EAC3G,IAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAAC,CAAC;IAC3H,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,MAAM,qBAAqB,CAAC,CAAC,GAAG,CAAC,mBAAmB,sBAAsB,CAAC,CAAC;QACtI,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,6BAA6B,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACzI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAe,OAAO,CAAC,EAAE;YACxD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACjG,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAqC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7F,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}