@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/windows-cli-api.js

@@ -1,185 +0,0 @@
-import { evaluateWebRequest } from "./web-auth.js";
-import { gatewayRequestContext } from "./web-request-context.js";
-import { readBoundedWebBody } from "./web-body.js";
-import { windowsBridgeFor, windowsCliEnabled } from "./windows-cli.js";
-import { windowsAgentsFor } from "./windows-agents.js";
-import { nativeAgentId } from "./native-instance-registry.js";
-import { isSettingsReplay, settingsRequestLocalAdmin } from "./settings-request-capability.js";
-import { withNativePaneVerification } from "./runtime-pane-native.js";
-function json(res, code, value) {
-    if (res.destroyed || res.writableEnded)
-        return;
-    res.writeHead(code, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" });
-    res.end(JSON.stringify(value));
-}
-/** The ordinary dashboard gate AND an explicit admin-only, non-public boundary. Rechecked after every await. */
-export function nativeCliAuthorization(req, url, ctx) {
-    if (gatewayRequestContext(req))
-        return false;
-    // Confirmed creation replays intentionally carry no browser cookies or bearer headers. Only the server-owned,
-    // still-current administrator capability may continue this exact operation; it grants no other native route.
-    if (isSettingsReplay(req)) {
-        try {
-            return req.method === "POST" && url.pathname === "/ui/instances" && settingsRequestLocalAdmin(req);
-        }
-        catch {
-            return false;
-        }
-    }
-    const v = evaluateWebRequest(req, url, ctx.webToken, ctx.webSessions, { touch: false });
-    return v.kind === "allow" && (v.via === "header-token" || v.session.tier === "admin");
-}
-/**
- * Who may be shown WHICH account a sign-in is (a masked e-mail and a plan): an admin SESSION on the dashboard reached directly (surface "local": this machine, a LAN, a tailnet or your own proxy), and no one else. These routes also
- * serve the CLI's own header token (an agent's) and other flows that predate the account display, so the callers are not turned away: the
- * answer is the same without the account (`withoutAccountIdentity`). No public link or gateway, no read or guest session, no header token,
- * no replayed confirmation.
- */
-export function accountIdentityVisible(req, url, ctx) {
-    if (gatewayRequestContext(req) || isSettingsReplay(req))
-        return false;
-    const v = evaluateWebRequest(req, url, ctx.webToken, ctx.webSessions, { touch: false });
-    return v.kind === "allow" && v.via === "session" && v.session.tier === "admin" && v.session.surface === "local";
-}
-/** The same inventory without any account: names and `loggedIn`/`authenticated` stay, every `identity` goes. A copy; the stored value is untouched. */
-export function probeWithoutAccountIdentity(probe) {
-    const copy = structuredClone(probe);
-    for (const row of copy.clis ?? [])
-        delete row.identity;
-    for (const row of copy.credentialProfiles?.profiles ?? [])
-        delete row.identity;
-    return copy;
-}
-export function machineWithoutAccountIdentity(machine) {
-    return machine.inventory ? { ...machine, inventory: probeWithoutAccountIdentity(machine.inventory) } : machine;
-}
-export function handleWindowsCliRequest(req, res, url, ctx, bridge) {
-    const path = url.pathname;
-    const agentPage = /^\/ui\/windows-agents\/[a-f0-9-]{36}$/i.test(path);
-    if (!agentPage && path !== "/ui/windows-cli" && !path.startsWith("/ui/windows-cli/"))
-        return false;
-    if (!windowsCliEnabled()) {
-        json(res, 404, { error: "Windows CLI preview is not enabled" });
-        return true;
-    }
-    const authorized = () => nativeCliAuthorization(req, url, ctx);
-    if (!authorized()) {
-        json(res, 403, { error: "Windows CLI tasks require an administrator on the local dashboard" });
-        return true;
-    }
-    const service = bridge ?? windowsBridgeFor(ctx);
-    const method = req.method ?? "GET";
-    if (path === "/ui/windows-cli/agents" || path.startsWith("/ui/windows-cli/agents/")) {
-        void (async () => {
-            const store = windowsAgentsFor(ctx);
-            const runtime = ctx.nativeInstanceRuntime?.();
-            const canonical = (id) => {
-                const row = Object.entries(ctx.fleetConfig?.instances ?? {}).find(([, config]) => nativeAgentId(config) === id.toLowerCase());
-                if (!row)
-                    throw new Error("Windows instance is not registered in the Fleet");
-                return row[0];
-            };
-            const agent = /^\/ui\/windows-cli\/agents\/([a-f0-9-]{36})(?:\/(messages|recover))?$/i.exec(path);
-            if (method === "GET" && path === "/ui/windows-cli/agents") {
-                const registered = new Set(Object.values(ctx.fleetConfig?.instances ?? {}).map(config => nativeAgentId(config)));
-                json(res, 200, { agents: store.list().filter(profile => !runtime || !ctx.fleetConfig || registered.has(profile.id)) });
-                return;
-            }
-            if (method === "GET" && agent && !agent[2]) {
-                json(res, 200, { agent: runtime ? runtime.get(canonical(agent[1])) : store.get(agent[1]) });
-                return;
-            }
-            if (method !== "POST") {
-                json(res, 404, { error: "Unknown Windows agent operation" });
-                return;
-            }
-            const raw = await readBoundedWebBody(req, 40_000);
-            if (!authorized()) {
-                json(res, 403, { error: "Authorization expired" });
-                return;
-            }
-            const input = JSON.parse(raw.toString("utf8"));
-            if (path === "/ui/windows-cli/agents") {
-                const result = runtime ? await runtime.create(input, authorized) : null;
-                const created = result ? result.agent : await store.create(input, authorized);
-                if (!authorized()) {
-                    json(res, 403, { error: "Authorization expired" });
-                    return;
-                }
-                json(res, 201, { ...(result ?? {}), agent: created });
-            }
-            else if (agent?.[2] === "messages" && runtime && ctx.deliverToInstance) {
-                if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).some(key => !["requestId", "prompt"].includes(key)) || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(input.requestId) || typeof input.prompt !== "string" || !input.prompt.trim() || input.prompt.length > 8000)
-                    throw new Error("Invalid Windows agent message");
-                const name = canonical(agent[1]), existing = runtime.get(name)?.turns.find(turn => turn.id === input.requestId);
-                if (existing && existing.prompt !== input.prompt)
-                    throw new Error("requestId belongs to a different message");
-                if (!existing) {
-                    const messageId = `native:${input.requestId}:user`, ts = new Date().toISOString();
-                    const sent = await ctx.deliverToInstance(name, { type: "fleet_inbound", content: input.prompt, requestId: input.requestId, meta: { source: "web", user: "You", message_id: messageId, ts } }, { stillCurrent: authorized });
-                    if (!authorized()) {
-                        json(res, 403, { error: "Authorization expired" });
-                        return;
-                    }
-                    if (sent === false)
-                        throw new Error("The instance did not accept this message");
-                    ctx.emitSseEvent?.("message", { instance: name, role: "user", sender: "You", text: input.prompt, ts, messageId });
-                }
-                json(res, 202, { accepted: true, agent: runtime.get(name) });
-            }
-            else if (agent?.[2] === "messages")
-                json(res, 202, { task: store.send(agent[1], input, authorized) });
-            else if (agent?.[2] === "recover")
-                json(res, 200, { agent: runtime ? runtime.recoverAsync ? await runtime.recoverAsync(canonical(agent[1]), input.confirmedStopped) : runtime.recover(canonical(agent[1]), input.confirmedStopped) : store.recover(agent[1], input.confirmedStopped) });
-            else
-                json(res, 404, { error: "Unknown Windows agent operation" });
-        })().catch(error => {
-            const allowed = authorized();
-            json(res, allowed ? 400 : 403, { error: allowed ? error instanceof Error ? error.message : "Windows agent operation failed" : "Authorization expired" });
-        });
-        return true;
-    }
-    if ((method === "GET" || method === "HEAD") && (agentPage || path === "/ui/windows-cli")) {
-        return false; // The ordinary app shell owns this panel, after the preview/admin checks above.
-    }
-    if (method === "GET" && path === "/ui/windows-cli/tasks") {
-        json(res, 200, { tasks: service.list() });
-        return true;
-    }
-    const task = /^\/ui\/windows-cli\/tasks\/([a-z0-9-]{16,80})$/i.exec(path);
-    if (method === "GET" && task) {
-        const result = service.get(task[1]);
-        json(res, result ? 200 : 404, result ?? { error: "Task not found" });
-        return true;
-    }
-    const cancel = /^\/ui\/windows-cli\/tasks\/([a-z0-9-]{16,80})\/cancel$/i.exec(path);
-    if (method !== "POST" || (!cancel && path !== "/ui/windows-cli/tasks" && path !== "/ui/windows-cli/probe")) {
-        json(res, 404, { error: "Unknown Windows CLI operation" });
-        return true;
-    }
-    void (async () => {
-        const raw = await readBoundedWebBody(req, 80_000);
-        if (!authorized()) {
-            json(res, 403, { error: "Authorization expired" });
-            return;
-        }
-        const input = raw.length ? JSON.parse(raw.toString("utf8")) : {};
-        if (path === "/ui/windows-cli/probe") {
-            if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).some(key => key !== "force") || (input.force !== undefined && typeof input.force !== "boolean"))
-                throw new Error("Probe accepts only an optional boolean force field");
-            const result = await service.probe(input, authorized);
-            if (!authorized()) {
-                json(res, 403, { error: "Authorization expired" });
-                return;
-            }
-            const labelled = withNativePaneVerification(result);
-            json(res, 200, accountIdentityVisible(req, url, ctx) ? labelled : probeWithoutAccountIdentity(labelled));
-        }
-        else if (cancel)
-            json(res, 202, service.cancel(cancel[1]));
-        else
-            json(res, 202, service.start(input, authorized));
-    })().catch(error => json(res, 400, { error: error instanceof Error ? error.message : "Windows CLI operation failed" }));
-    return true;
-}
-//# sourceMappingURL=windows-cli-api.js.map

package/dist/windows-cli-api.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"windows-cli-api.js","sourceRoot":"","sources":["../src/windows-cli-api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAuB,MAAM,eAAe,CAAC;AAExE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAA+C,MAAM,kBAAkB,CAAC;AAEpH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAWtE,SAAS,IAAI,CAAC,GAAmB,EAAE,IAAY,EAAE,KAAc;IAC7D,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO;IAC/C,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACxG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC;AACD,gHAAgH;AAChH,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,GAAQ,EAAE,GAAyB;IAC9F,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,8GAA8G;IAC9G,6GAA6G;IAC7G,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YAAC,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAC3G,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACzB,CAAC;IACD,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAgC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrH,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AACxF,CAAC;AACD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,GAAQ,EAAE,GAAyB;IAC9F,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAgC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrH,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC;AAClH,CAAC;AACD,uJAAuJ;AACvJ,MAAM,UAAU,2BAA2B,CAAC,KAAsB;IAChE,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE;QAAE,OAAQ,GAA8B,CAAC,QAAQ,CAAC;IACnF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,QAAQ,IAAI,EAAE;QAAE,OAAQ,GAA8B,CAAC,QAAQ,CAAC;IAC3G,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,OAAuB;IACnE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACjH,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ,EAAE,GAAyB,EAAE,MAAyB;IAC/I,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,MAAM,SAAS,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IACnG,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC3G,MAAM,UAAU,GAAG,GAAY,EAAE,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mEAAmE,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACnI,MAAM,OAAO,GAAG,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,IAAI,IAAI,KAAK,wBAAwB,IAAI,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,OAAO,GAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAAC;YAC5C,MAAM,SAAS,GAAC,CAAC,EAAS,EAAQ,EAAE;gBAClC,MAAM,GAAG,GAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,MAAM,CAAC,EAAC,EAAE,CAAA,aAAa,CAAC,MAA6C,CAAC,KAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9J,IAAG,CAAC,GAAG;oBAAC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBAAA,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3F,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClG,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBAC1D,MAAM,UAAU,GAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,IAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA,EAAE,CAAA,aAAa,CAAC,MAA6C,CAAC,CAAC,CAAC,CAAC;gBAClJ,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,MAAM,EAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,CAAA,EAAE,CAAA,CAAC,OAAO,IAAE,CAAC,GAAG,CAAC,WAAW,IAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAC,CAAC,CAAC;gBAAA,OAAO;YACrH,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACpJ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAChG,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAClF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAC,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC9E,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAClF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,CAAC;iBACI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,OAAO,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;gBACvE,IAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAG,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA,EAAE,CAAA,CAAC,CAAC,WAAW,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAG,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAC,IAAI;oBAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACvW,MAAM,IAAI,GAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAC,QAAQ,GAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,CAAC,EAAE,KAAG,KAAK,CAAC,SAAS,CAAC,CAAC;gBACvG,IAAG,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAG,KAAK,CAAC,MAAM;oBAAC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC1G,IAAG,CAAC,QAAQ,EAAC,CAAC;oBACZ,MAAM,SAAS,GAAC,UAAU,KAAK,CAAC,SAAS,OAAO,EAAC,EAAE,GAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBAC7E,MAAM,IAAI,GAAC,MAAM,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,eAAe,EAAC,OAAO,EAAC,KAAK,CAAC,MAAM,EAAC,SAAS,EAAC,KAAK,CAAC,SAAS,EAAC,IAAI,EAAC,EAAC,MAAM,EAAC,KAAK,EAAC,IAAI,EAAC,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,EAAE,EAAC,EAAC,EAAC,EAAC,YAAY,EAAC,UAAU,EAAC,CAAC,CAAC;oBACpM,IAAG,CAAC,UAAU,EAAE,EAAC,CAAC;wBAAA,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,KAAK,EAAC,uBAAuB,EAAC,CAAC,CAAC;wBAAA,OAAO;oBAAA,CAAC;oBACxE,IAAG,IAAI,KAAG,KAAK;wBAAC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC5E,GAAG,CAAC,YAAY,EAAE,CAAC,SAAS,EAAC,EAAC,QAAQ,EAAC,IAAI,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,IAAI,EAAC,KAAK,CAAC,MAAM,EAAC,EAAE,EAAC,SAAS,EAAC,CAAC,CAAC;gBACxG,CAAC;gBACD,IAAI,CAAC,GAAG,EAAC,GAAG,EAAC,EAAC,QAAQ,EAAC,IAAI,EAAC,KAAK,EAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;YACxD,CAAC;iBACI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU;gBAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;iBACjG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;;gBACjR,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACjB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC3J,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,KAAK,iBAAiB,CAAC,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC,CAAC,gFAAgF;IAChG,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACrH,MAAM,IAAI,GAAG,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACzJ,MAAM,MAAM,GAAG,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,uBAAuB,CAAC,EAAE,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAClF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YAC7P,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YACtD,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAClF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3G,CAAC;aAAM,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;YACxD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;IACxH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/windows-cli-providers.d.ts

@@ -1,106 +0,0 @@
-export declare const NATIVE_PROVIDER_IDS: readonly ["codex", "claude-code", "antigravity", "grok", "kiro-cli", "opencode", "muse"];
-export type NativeProviderId = typeof NATIVE_PROVIDER_IDS[number];
-export type NativeSandbox = "read-only" | "workspace-write";
-/** Internal execution capability. Never accepted as part of a public task input or persisted with a turn. */
-export interface NativeMcpConnection {
-    endpoint: string;
-    token: string;
-    tools: string[];
-}
-export declare const NATIVE_MCP_SERVER = "agend_native";
-export declare function nativeProviderMcpSupported(cli: unknown): boolean;
-export declare function validateNativeMcpConnection(value: unknown): NativeMcpConnection;
-export interface NativeProviderDescriptor {
-    id: NativeProviderId;
-    name: string;
-    company: string;
-    /** Executable basenames only. IDE launchers such as kiro.cmd are deliberately excluded. */
-    binaryNames: readonly string[];
-    supports: {
-        execution: boolean;
-        resume: boolean;
-        model: boolean;
-        mcp?: boolean;
-    };
-    readOnlySupport: boolean;
-    permission: "os-sandbox" | "read-tools" | "native-policy";
-    permissionNote: string;
-    promptTransport: "stdin-text" | "stdin-json" | "file";
-    /** null means unknown, not signed out. These commands must never initiate a login. */
-    authProbe: readonly string[] | null;
-    /** A listing command only; never an inference/model request. */
-    modelProbe: readonly string[] | null;
-    reason?: string;
-}
-export declare function isNativeProviderId(value: unknown): value is NativeProviderId;
-export declare function nativeProvider(id: NativeProviderId): NativeProviderDescriptor;
-/**
- * M-2239 P1-2: each CLI's own "do not update" switch, put in front of every argv AgEnD runs (probe and task), as the
- * Linux backends do (codex.ts, grok.ts). The env switches are in nativeCliEnvironment. Antigravity has no documented
- * switch: it is started only by an administrator's explicit detection or a task, never on a timer or a read.
- */
-export declare function nativeUpdateGuard(id: NativeProviderId): string[];
-/** Empty means native CLI default. Models remain literal argv, never shell source. */
-export declare function validateNativeModel(value: unknown): string | undefined;
-export declare function validNativeSessionId(cli: NativeProviderId, value: unknown): value is string;
-export interface NativeProviderTask {
-    cli: NativeProviderId;
-    cwd: string;
-    prompt: string;
-    sandbox: NativeSandbox;
-    model?: string;
-}
-export interface NativeInvocationOptions {
-    resumeSessionId?: string;
-    /** For file transports, a private file containing exactly task.prompt, owned/cleaned up by the worker. */
-    promptFile?: string;
-    mcp?: NativeMcpLaunch;
-}
-export interface NativeMcpLaunch {
-    nodePath: string;
-    helperPath: string;
-    connectionPath: string;
-    configPath: string;
-    tools: string[];
-    serverName?: string;
-}
-export declare function nativeMcpServerConfig(launch: NativeMcpLaunch): {
-    mcpServers: Record<string, {
-        command: string;
-        args: string[];
-    }>;
-};
-export interface NativeInvocation {
-    args: string[];
-    stdin: string;
-    env?: Record<string, string>;
-}
-/** Launch-local file policy, supported by the audited native Claude release. No account settings are rewritten.
- * acceptEdits alone can still honor broader ambient allow rules. This hard file-tool check takes precedence over
- * those grants. User/project/local settings are excluded so inherited additionalDirectories cannot widen the file
- * boundary. Managed organization policy remains provider-owned. This is not an OS sandbox for shell commands or MCP
- * tools. Both the exec and persistent adapter must use this exact policy.
- */
-export declare function nativeClaudeFilePolicyArgs(): string[];
-/** Only an argv plan. The caller supplies cwd to spawn({ shell: false, stdio: ['pipe', ...] }). */
-export declare function buildNativeInvocation(task: NativeProviderTask, options?: NativeInvocationOptions): NativeInvocation;
-export interface NativeProviderEvent {
-    text?: string;
-    sessionId?: string;
-    completed?: boolean;
-    failed?: boolean;
-    error?: string;
-}
-/** A recognized provider event, never arbitrary stdout, supplies completion proof. */
-export declare function parseNativeProviderEvent(cli: NativeProviderId, line: string): NativeProviderEvent | null;
-/** No auth probe may infer signed-out from an unsupported command, timeout or malformed output. */
-export declare function parseNativeAuthResult(cli: NativeProviderId, ok: boolean, output: string): boolean | null;
-export interface NativeModelOption {
-    id: string;
-    name?: string;
-    description?: string;
-}
-/** Seven providers share a 64 KiB worker reply. Keep catalog data below 6 KiB each. */
-export declare function boundNativeModelOptions(options: readonly NativeModelOption[]): NativeModelOption[];
-/** Conservative model listing parser; malformed/unrecognized listings leave custom model entry available. */
-export declare function parseNativeModels(cli: NativeProviderId, output: string): NativeModelOption[];