@stratusagent/cli 0.11.2 → 0.11.3

package/dist/runtime.js

@@ -0,0 +1,266 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { randomUUID } from 'node:crypto';
+import { AgentRunner, EventBus, SkillRegistry, ToolRegistry, missingSkillRequirements, describeToolAllowlistFinding, unmatchedToolAllowlist, } from '@stratusagent/core';
+import { createLocalCommandExecutor } from '@stratusagent/executor-local';
+import { loadPlugins } from '@stratusagent/plugins';
+import { createForgetTool, createRecallTool, createRememberTool, GATEWAY_ONLY_TOOL_NAMES, } from '@stratusagent/agents';
+import { createDemoTool, createFileCredentialResolver, createFileMemoryStore, createRuntimeProvider, defaultApiKeyEnvName, DEFAULT_STRATUS_AGENT, loadCredentials, loadOperatorSkills, memoryFilePath, migrateLegacyMemory, readNonEmptyString, readProcessEnv, resolveRuntimeConfig as resolveStateRuntimeConfig, withLegacyDefaultMemories, workspacesDirPath, } from '@stratusagent/state';
+import { createApprovalPolicy } from "./approvals.js";
+import { formatEvent } from "./events.js";
+import { writeLine, stringifyValue } from "./io.js";
+import { loadServePlugins } from "./trusted-config.js";
+/**
+ * Kept with its historical CLI signature: a parsed run command is a
+ * RuntimeSelection plus CLI-only fields the resolver ignores.
+ *
+ * Those fields are *permitted*, not required. Demanding a whole
+ * `ParsedRunCommand` made the type claim the resolver cared about
+ * `approvals`, `format`, and `events` — it reads none of them — so every
+ * caller with a selection in hand had to invent values to get past it.
+ */
+export const resolveRuntimeConfig = (command, env = {}) => resolveStateRuntimeConfig(command, env);
+/**
+ * A saved subscription sign-in silently demoted to per-token billing is the
+ * one config surprise that costs money — an API key in the environment
+ * outranks the stored credential, and the run otherwise looks identical.
+ * Detected from the resolved config: an apiKey where the stored credential
+ * is a subscription token means the environment won.
+ */
+export const warnOnCredentialOverride = async (runtime, streams, env = {}) => {
+    if (runtime.provider === 'demo') {
+        return;
+    }
+    const credentials = await loadCredentials(env);
+    const processEnv = readProcessEnv(env);
+    // The resolver records the variable that actually won — guessing it here
+    // would name the wrong one whenever a custom apiKeyEnv supplied the key,
+    // sending the reader to unset something that was never the cause.
+    const primaryOverride = runtime.apiKey !== undefined
+        ? { provider: runtime.provider, envVar: runtime.apiKeyEnvVar }
+        : undefined;
+    // Both subscription sign-ins demote the same way: a Claude setup token
+    // and the codex ChatGPT marker each lose to an environment API key, and
+    // the run otherwise looks identical while billing per token.
+    for (const target of ['anthropic', 'codex']) {
+        if (credentials[target]?.type !== 'oauth_token') {
+            continue;
+        }
+        const planName = target === 'anthropic'
+            ? 'Claude subscription sign-in'
+            : 'ChatGPT (codex login) sign-in';
+        const primary = primaryOverride?.provider === target ? primaryOverride.envVar : undefined;
+        // A fallback demoted the same way costs exactly as much, and only bites
+        // once the primary is already failing — the worst moment to discover it.
+        // The fallback path consults the provider's own conventional variable.
+        const conventionalVar = defaultApiKeyEnvName(target);
+        const fallbackVar = runtime.fallback?.provider === target
+            && runtime.fallback.apiKey !== undefined
+            && readNonEmptyString(processEnv[conventionalVar]) === runtime.fallback.apiKey
+            ? conventionalVar
+            : undefined;
+        const culprit = primary ?? fallbackVar;
+        if (!culprit) {
+            continue;
+        }
+        writeLine(streams.stderr, `Warning: ${culprit} in your environment outranks the ${planName} saved by \`stratus setup\`, `
+            + `so ${primary ? 'this run is' : 'a fallback retry would be'} billed per token instead of through your plan. `
+            + 'Unset it to use the subscription, or run `stratus doctor` to see everything that is being overridden.');
+    }
+};
+// The shared wiring behind every conversational command: memory (with
+// legacy migration), tools, events, provider (with fallback), and the
+// agent the runtime resolved. run uses it for one shot; chat keeps the
+// runner alive and resumes the same session turn after turn.
+export const createAgentRuntime = async (streams, options) => {
+    const runEnv = options.env ?? {};
+    await migrateLegacyMemory(runEnv);
+    const memory = withLegacyDefaultMemories(createFileMemoryStore(memoryFilePath(runEnv)));
+    const tools = new ToolRegistry();
+    tools.register(createDemoTool());
+    tools.register(createRememberTool(memory));
+    tools.register(createRecallTool(memory));
+    tools.register(createForgetTool(memory));
+    // The same skills the daemon would serve, from the same directory, for
+    // the same reason the plugins below match: a skill that routes in
+    // `stratus run` routes in `stratus serve`, and one that is broken is
+    // broken (and warned about) in both. The runner registers `skill.read`
+    // itself, gated on the soul enabling any skill.
+    const skills = new SkillRegistry();
+    await loadOperatorSkills(runEnv, skills, (line) => {
+        writeLine(streams.stderr, `Warning: ${line}`);
+    });
+    const bus = new EventBus({
+        onError: (error) => {
+            writeLine(streams.stderr, `Warning: event handler failed: ${error instanceof Error ? error.message : String(error)}`);
+        },
+    });
+    if (options.onEvent) {
+        const onEvent = options.onEvent;
+        bus.subscribe(async (event) => {
+            onEvent(event);
+        });
+    }
+    else if (options.events ?? true) {
+        bus.subscribe(async (event) => {
+            const line = formatEvent(event);
+            if (line) {
+                writeLine(streams.stdout, line);
+            }
+        });
+    }
+    // The same plugins the daemon would load, from the same trusted config,
+    // so a tool that works in `stratus run` works in `stratus serve` and a
+    // tool that is missing is missing in both. A local test that silently ran
+    // a different toolset than the daemon would be worse than no local test.
+    const pluginsConfig = await loadServePlugins(runEnv, options.configPath, (line) => {
+        writeLine(streams.stderr, `Warning: ${line}`);
+    });
+    const loadedPlugins = [];
+    if (Object.keys(pluginsConfig).length > 0) {
+        const result = await loadPlugins({
+            config: pluginsConfig,
+            host: {
+                resolve: (specifier) => import.meta.resolve(specifier),
+                import: (specifier) => import(__rewriteRelativeImportExtension(specifier)),
+            },
+            tools,
+            skills,
+            bus,
+            credentials: createFileCredentialResolver(runEnv),
+            workspaceRoot: workspacesDirPath(runEnv),
+        });
+        loadedPlugins.push(...result.loaded);
+        for (const failure of result.failures) {
+            writeLine(streams.stderr, `Warning: plugin ${failure.package} did not load: ${failure.reason}`);
+        }
+    }
+    // The Claude Code runtime executes kernel tools by calling back into the
+    // runner built just below — late-bound because the runner needs the
+    // provider first.
+    let hostedRunner;
+    const runtimeProvider = createRuntimeProvider(options.runtime, (error) => {
+        const fallback = options.runtime.provider === 'demo' ? undefined : options.runtime.fallback;
+        writeLine(streams.stderr, `Warning: the default model failed (${error instanceof Error ? error.message : String(error)}); falling back to ${fallback?.model ?? 'the fallback model'}.`);
+    }, async (session, call, context) => {
+        if (!hostedRunner) {
+            throw new Error('The Stratus runtime is not ready to execute tools yet.');
+        }
+        return hostedRunner.executeHostedToolCall(session, call, context);
+    }, options.maxTurns);
+    const runner = new AgentRunner({
+        provider: runtimeProvider,
+        tools,
+        executor: createLocalCommandExecutor(),
+        approvals: createApprovalPolicy(options.approvals ?? 'always', streams, options.env ?? {}, options.askApproval),
+        bus,
+        skills,
+        memory,
+        ...(options.maxTurns !== undefined ? { maxTurns: options.maxTurns } : {}),
+    });
+    hostedRunner = runner;
+    await runner.initialize();
+    // A soul is a full identity — without one, every provider serves the
+    // same built-in Stratus persona.
+    const agent = options.runtime.soul?.agent ?? DEFAULT_STRATUS_AGENT;
+    // The same advisory the daemon gives at roster load, from the same
+    // kernel check: a soul enabling a skill whose `requires:` its `tools:`
+    // does not cover must warn here too, or the local test stays silent
+    // about a configuration `stratus serve` flags.
+    for (const { skill, missing } of missingSkillRequirements(agent, skills)) {
+        writeLine(streams.stderr, `Warning: agent ${agent.id} enables skill ${skill.id}, which expects tools the agent is not allowed: ${missing.join(', ')}`);
+    }
+    // And the same for the tools themselves, after `initialize()` so the
+    // plugins have registered theirs: an allowlist entry naming a tool
+    // nothing provides grants nothing and says nothing, and a soul made only
+    // of those runs with no tools while its persona still talks about them.
+    const finding = unmatchedToolAllowlist(agent, tools.describe().map((tool) => tool.name), {
+        mayRegister: loadedPlugins.flatMap((plugin) => plugin.manifest.contributes.toolsDiscovered.map((declared) => declared.namespace)),
+        // A local run has no dispatcher, store, or channels, so it registers
+        // none of the daemon's tools. A soul written for `stratus serve` is
+        // not wrong for naming them here — it is in the wrong process.
+        elsewhere: GATEWAY_ONLY_TOOL_NAMES,
+    });
+    for (const line of finding ? describeToolAllowlistFinding(agent.id, finding) : []) {
+        writeLine(streams.stderr, `Warning: ${line}`);
+    }
+    // The kernel leaves this one to the host, because only the host knows
+    // which process it is not.
+    if (finding && finding.elsewhere.length > 0) {
+        writeLine(streams.stderr, `Warning: agent ${agent.id} lists ${finding.elsewhere.join(', ')}, which only the daemon provides`
+            + ' — the names are right, but stratus run cannot call them; stratus serve can');
+    }
+    const metadata = options.runtime.provider === 'demo'
+        ? { provider: 'demo', executor: 'local-command' }
+        : {
+            provider: options.runtime.provider,
+            model: options.runtime.model,
+            ...(options.runtime.provider === 'openai' ? { baseUrl: options.runtime.baseUrl } : {}),
+        };
+    // Handed back so a command can release what a plugin acquired — a browser
+    // above all. A one-shot `stratus run` that left a Chromium behind would
+    // be a leak per invocation.
+    const disposePlugins = async () => {
+        for (const plugin of loadedPlugins) {
+            try {
+                await plugin.instance.dispose?.();
+            }
+            catch (error) {
+                writeLine(streams.stderr, `Warning: plugin ${plugin.package} failed to shut down: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    };
+    return { runner, agent, metadata, disposePlugins };
+};
+export const runSingleLoop = async (prompt, streams, options) => {
+    const { runner, agent, metadata, disposePlugins } = await createAgentRuntime(streams, options);
+    try {
+        return await runner.run({
+            sessionId: randomUUID(),
+            agent,
+            userMessage: prompt,
+            metadata,
+        });
+    }
+    finally {
+        // Even when the run failed: a plugin that started a browser started it
+        // before the turn could fail.
+        await disposePlugins();
+    }
+};
+export const printSessionSummary = (session, streams) => {
+    writeLine(streams.stdout);
+    writeLine(streams.stdout, 'Messages');
+    for (const message of session.messages) {
+        if (message.role === 'assistant' && message.toolCalls && message.toolCalls.length > 0) {
+            const calls = message.toolCalls
+                .map((call) => `${call.toolName}(${JSON.stringify(call.input)})`)
+                .join(', ');
+            const prefix = message.content ? `${message.content} ` : '';
+            writeLine(streams.stdout, `[assistant] ${prefix}→ tool call ${calls}`);
+            continue;
+        }
+        if (message.role === 'assistant' && message.content.length === 0) {
+            // A turn nobody asked for that said nothing — see `RunInput.addressed`.
+            continue;
+        }
+        const nameSuffix = message.name ? `:${message.name}` : '';
+        const content = message.role === 'tool' ? stringifyValue(JSON.parse(message.content)) : message.content;
+        writeLine(streams.stdout, `[${message.role}${nameSuffix}] ${content}`);
+    }
+};
+export const formatRuntimeBanner = (runtime) => {
+    const soulSuffix = runtime.soul ? ` as ${runtime.soul.agent.name}` : '';
+    if (runtime.provider === 'demo') {
+        return `Starting Stratus Agent local loop with provider=demo${soulSuffix}`;
+    }
+    const fallbackSuffix = runtime.fallback ? ` fallback=${runtime.fallback.model}` : '';
+    return `Starting Stratus Agent local loop with provider=${runtime.provider} model=${runtime.model}${fallbackSuffix}${soulSuffix}`;
+};
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":";;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,WAAW,EACX,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,GAKvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAqB,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,IAAI,yBAAyB,EACjD,yBAAyB,EACzB,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAmF,EACnF,MAAsB,EAAE,EACA,EAAE,CAAC,yBAAyB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAC3C,OAAsB,EACtB,OAAmB,EACnB,MAAsB,EAAE,EACT,EAAE;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,yEAAyE;IACzE,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS;QAClD,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,OAAO,CAAU,EAAE,CAAC;QACrD,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,WAAW;YACrC,CAAC,CAAC,6BAA6B;YAC/B,CAAC,CAAC,+BAA+B,CAAC;QACpC,MAAM,OAAO,GAAG,eAAe,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM;eACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS;eACrC,kBAAkB,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC9E,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,OAAO,IAAI,WAAW,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,SAAS,CACP,OAAO,CAAC,MAAM,EACd,YAAY,OAAO,qCAAqC,QAAQ,+BAA+B;cAC7F,MAAM,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,2BAA2B,kDAAkD;cAC7G,uGAAuG,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AACvE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,OAAmB,EACnB,OAYC,EACD,EAAE;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IACjC,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,yBAAyB,CAAC,qBAAqB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;IACjC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzC,uEAAuE;IACvE,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;IACnC,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAChD,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC;QACvB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;KACF,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5B,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,IAAI,EAAE,CAAC;gBACT,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QAChF,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE;gBACJ,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtD,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,kCAAC,SAAS,EAAC;aACzC;YACD,KAAK;YACL,MAAM;YACN,GAAG;YACH,WAAW,EAAE,4BAA4B,CAAC,MAAM,CAAC;YACjD,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC;SACzC,CAAC,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,OAAO,CAAC,OAAO,kBAAkB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,oEAAoE;IACpE,kBAAkB;IAClB,IAAI,YAAqC,CAAC;IAC1C,MAAM,eAAe,GAAG,qBAAqB,CAC3C,OAAO,CAAC,OAAO,EACf,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5F,SAAS,CACP,OAAO,CAAC,MAAM,EACd,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,QAAQ,EAAE,KAAK,IAAI,oBAAoB,GAAG,CAC7J,CAAC;IACJ,CAAC,EACD,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC/B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,YAAY,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC,EACD,OAAO,CAAC,QAAQ,CACjB,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;QAC7B,QAAQ,EAAE,eAAe;QACzB,KAAK;QACL,QAAQ,EAAE,0BAA0B,EAAE;QACtC,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC;QAC/G,GAAG;QACH,MAAM;QACN,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IAEH,YAAY,GAAG,MAAM,CAAC;IACtB,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAE1B,qEAAqE;IACrE,iCAAiC;IACjC,MAAM,KAAK,GAAoB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;IAEpF,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,+CAA+C;IAC/C,KAAK,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACzE,SAAS,CACP,OAAO,CAAC,MAAM,EACd,kBAAkB,KAAK,CAAC,EAAE,kBAAkB,KAAK,CAAC,EAAE,mDAAmD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5H,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,mEAAmE;IACnE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,OAAO,GAAG,sBAAsB,CACpC,KAAK,EACL,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EACzC;QACE,WAAW,EAAE,aAAa,CAAC,OAAO,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9F;QACD,qEAAqE;QACrE,oEAAoE;QACpE,+DAA+D;QAC/D,SAAS,EAAE,uBAAuB;KACnC,CACF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAClF,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,sEAAsE;IACtE,2BAA2B;IAC3B,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,SAAS,CACP,OAAO,CAAC,MAAM,EACd,kBAAkB,KAAK,CAAC,EAAE,UAAU,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;cAC9F,6EAA6E,CAClF,CAAC;IACJ,CAAC;IAGD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;QAClD,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,QAAQ,EAAE,eAAe,EAAE;QAC1D,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;YAC5B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,CAAC;IAEN,0EAA0E;IAC1E,wEAAwE;IACxE,4BAA4B;IAC5B,MAAM,cAAc,GAAG,KAAK,IAAmB,EAAE;QAC/C,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CACP,OAAO,CAAC,MAAM,EACd,mBAAmB,MAAM,CAAC,OAAO,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAc,EACd,OAAmB,EACnB,OAOC,EACiB,EAAE;IACpB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC;YACtB,SAAS,EAAE,UAAU,EAAE;YACvB,KAAK;YACL,WAAW,EAAE,MAAM;YACnB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,uEAAuE;QACvE,8BAA8B;QAC9B,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAE,OAAmB,EAAQ,EAAE;IACjF,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEtC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtF,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS;iBAC5B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;iBAChE,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,MAAM,eAAe,KAAK,EAAE,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjE,wEAAwE;YACxE,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACrH,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG,UAAU,KAAK,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAsB,EAAU,EAAE;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAExE,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,uDAAuD,UAAU,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,OAAO,mDAAmD,OAAO,CAAC,QAAQ,UAAU,OAAO,CAAC,KAAK,GAAG,cAAc,GAAG,UAAU,EAAE,CAAC;AACpI,CAAC,CAAC"}

package/dist/slack.d.ts

@@ -0,0 +1,26 @@
+interface SlackIdentity {
+    botUserId?: string;
+    teamName?: string;
+    teamId?: string;
+}
+type SlackVerdict = {
+    status: 'ok';
+    identity: SlackIdentity;
+} | {
+    status: 'rejected';
+    detail: string;
+} | {
+    status: 'unreachable';
+    detail: string;
+};
+/** Verifies a bot token and reports the identity it belongs to. */
+export declare const verifySlackBotToken: (token: string, fetchImpl: typeof fetch | undefined) => Promise<SlackVerdict>;
+/**
+ * Verifies an app-level token by opening a Socket Mode URL. The URL is
+ * discarded — this only proves the token carries connections:write, which
+ * is the failure the daemon would otherwise hit at start time.
+ */
+export declare const verifySlackAppToken: (token: string, fetchImpl: typeof fetch | undefined) => Promise<SlackVerdict>;
+export declare const slackAppManifest: (agentName: string) => string;
+export {};
+//# sourceMappingURL=slack.d.ts.map

package/dist/slack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../src/slack.ts"],"names":[],"mappings":"AAMA,UAAU,aAAa;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,KAAK,YAAY,GACb;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAiC9C,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,GAAU,OAAO,MAAM,EAAE,WAAW,OAAO,KAAK,GAAG,SAAS,KAAG,OAAO,CAAC,YAAY,CAalH,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAU,OAAO,MAAM,EAAE,WAAW,OAAO,KAAK,GAAG,SAAS,KAAG,OAAO,CAAC,YAAY,CAGlH,CAAC;AAqCF,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,KAAG,MAsB1C,CAAC"}

package/dist/slack.js

@@ -0,0 +1,113 @@
+// Slack verification talks to the Web API over plain fetch rather than
+// through @stratusagent/channel-slack. Setup must stay usable before that
+// optional package is installed, and the CLI deliberately does not depend
+// on it (or on the ~9 MB of Slack SDKs underneath).
+const SLACK_API_ROOT = 'https://slack.com/api';
+const callSlack = async (method, token, fetchImpl) => {
+    if (typeof fetchImpl !== 'function') {
+        return { ok: false, verdict: { status: 'unreachable', detail: 'fetch is unavailable' } };
+    }
+    try {
+        const response = await fetchImpl(`${SLACK_API_ROOT}/${method}`, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${token}`,
+                'content-type': 'application/x-www-form-urlencoded',
+            },
+        });
+        if (!response.ok) {
+            return { ok: false, verdict: { status: 'unreachable', detail: `HTTP ${response.status}` } };
+        }
+        const body = await response.json();
+        if (body.ok === true) {
+            return { ok: true, body };
+        }
+        // Slack answers 200 with { ok: false, error } for bad credentials, so
+        // the error string — not the status — is what condemns a token.
+        return { ok: false, verdict: { status: 'rejected', detail: String(body.error ?? 'unknown error') } };
+    }
+    catch (error) {
+        return { ok: false, verdict: { status: 'unreachable', detail: error instanceof Error ? error.message : String(error) } };
+    }
+};
+/** Verifies a bot token and reports the identity it belongs to. */
+export const verifySlackBotToken = async (token, fetchImpl) => {
+    const result = await callSlack('auth.test', token, fetchImpl);
+    if (!result.ok) {
+        return result.verdict;
+    }
+    return {
+        status: 'ok',
+        identity: {
+            ...(typeof result.body.user_id === 'string' ? { botUserId: result.body.user_id } : {}),
+            ...(typeof result.body.team === 'string' ? { teamName: result.body.team } : {}),
+            ...(typeof result.body.team_id === 'string' ? { teamId: result.body.team_id } : {}),
+        },
+    };
+};
+/**
+ * Verifies an app-level token by opening a Socket Mode URL. The URL is
+ * discarded — this only proves the token carries connections:write, which
+ * is the failure the daemon would otherwise hit at start time.
+ */
+export const verifySlackAppToken = async (token, fetchImpl) => {
+    const result = await callSlack('apps.connections.open', token, fetchImpl);
+    return result.ok ? { status: 'ok', identity: {} } : result.verdict;
+};
+// Scopes and events the adapter needs. Kept in step with the manifest
+// shipped by @stratusagent/channel-slack (a test pins them together) so
+// setup can hand over a ready-to-paste manifest without depending on that
+// package being installed.
+const SLACK_BOT_SCOPES = [
+    'app_mentions:read',
+    // The history family is what lets an agent stay in a conversation it was
+    // brought into: without it Slack delivers only mentions, and a reply in
+    // the agent's own thread never reaches it. It is the workspace's switch
+    // for that — an app installed without these scopes answers mentions and
+    // nothing else, exactly as it always did.
+    'channels:history',
+    // The conversations read family backs outbound destination validation
+    // (conversations.info): whether a channel a schedule wants to report to
+    // exists, and whether this app is a member of it.
+    'channels:read',
+    'chat:write',
+    // What lets an agent be shown a screenshot: file bytes sit behind an
+    // authenticated URL that answers a token without this scope with a
+    // sign-in page. An app installed without it still hears about the
+    // attachment, by name, and is told it cannot open it.
+    'files:read',
+    'files:write',
+    'groups:history',
+    'groups:read',
+    'im:history',
+    'im:read',
+    'im:write',
+    'mpim:history',
+    'mpim:read',
+    'users:read',
+];
+const SLACK_BOT_EVENTS = ['app_mention', 'message.channels', 'message.groups', 'message.im', 'message.mpim'];
+export const slackAppManifest = (agentName) => JSON.stringify({
+    display_information: {
+        name: agentName,
+        description: 'A Stratus agent',
+        background_color: '#1a1d21',
+    },
+    features: {
+        bot_user: { display_name: agentName, always_online: true },
+    },
+    oauth_config: { scopes: { bot: SLACK_BOT_SCOPES } },
+    settings: {
+        event_subscriptions: { bot_events: SLACK_BOT_EVENTS },
+        // Required for remote approval: Allow / Always allow / Deny arrive as
+        // block_actions, and Slack delivers none of them to an app that has
+        // interactivity switched off. Enabled unconditionally rather than per
+        // mode — an app is created once, and discovering months later that the
+        // buttons do nothing means editing the manifest and reinstalling.
+        interactivity: { is_enabled: true },
+        org_deploy_enabled: false,
+        socket_mode_enabled: true,
+        token_rotation_enabled: false,
+    },
+}, null, 2);
+//# sourceMappingURL=slack.js.map

package/dist/slack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.js","sourceRoot":"","sources":["../src/slack.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,0EAA0E;AAC1E,0EAA0E;AAC1E,oDAAoD;AACpD,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAa/C,MAAM,SAAS,GAAG,KAAK,EACrB,MAAc,EACd,KAAa,EACb,SAAmC,EAC0D,EAAE;IAC/F,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,cAAc,IAAI,MAAM,EAAE,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,mCAAmC;aACpD;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,sEAAsE;QACtE,gEAAgE;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3H,CAAC;AACH,CAAC,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAAa,EAAE,SAAmC,EAAyB,EAAE;IACrH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE;YACR,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAAa,EAAE,SAAmC,EAAyB,EAAE;IACrH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,uBAAuB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACrE,CAAC,CAAC;AAEF,sEAAsE;AACtE,wEAAwE;AACxE,0EAA0E;AAC1E,2BAA2B;AAC3B,MAAM,gBAAgB,GAAG;IACvB,mBAAmB;IACnB,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,0CAA0C;IAC1C,kBAAkB;IAClB,sEAAsE;IACtE,wEAAwE;IACxE,kDAAkD;IAClD,eAAe;IACf,YAAY;IACZ,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,sDAAsD;IACtD,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,UAAU;IACV,cAAc;IACd,WAAW;IACX,YAAY;CACb,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAE7G,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;IAC5E,mBAAmB,EAAE;QACnB,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,iBAAiB;QAC9B,gBAAgB,EAAE,SAAS;KAC5B;IACD,QAAQ,EAAE;QACR,QAAQ,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE;KAC3D;IACD,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;IACnD,QAAQ,EAAE;QACR,mBAAmB,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE;QACrD,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,kEAAkE;QAClE,aAAa,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QACnC,kBAAkB,EAAE,KAAK;QACzB,mBAAmB,EAAE,IAAI;QACzB,sBAAsB,EAAE,KAAK;KAC9B;CACF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC"}

package/dist/source.d.ts

@@ -0,0 +1,24 @@
+import type { CliEnvironment } from './environment.ts';
+/**
+ * What a `skill add` source string means, in order: a directory on this
+ * machine, a GitHub `owner/repo` shorthand, or a URL git can clone. The
+ * shorthand is the form skills.sh and its CLI print, so a skill published
+ * there installs by the name its listing shows.
+ */
+export declare const resolveSource: (source: string, env: CliEnvironment, what: "skill" | "template") => Promise<{
+    kind: "local";
+    directory: string;
+} | {
+    kind: "git";
+    url: string;
+}>;
+/**
+ * A source URL safe to print: userinfo stripped. A token travels in exactly
+ * this position (`https://user:token@host/repo.git`), stdout is commonly
+ * retained in CI logs, and git's own stderr already redacts — only the
+ * unredacted URL is handed to git itself.
+ */
+export declare const redactedSourceUrl: (url: string) => string;
+/** Shallow-clone a source repository. Git owns every transport we would otherwise re-implement. */
+export declare const cloneSource: (url: string, destination: string) => Promise<void>;
+//# sourceMappingURL=source.d.ts.map

package/dist/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../src/source.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,EACd,KAAK,cAAc,EACnB,MAAM,OAAO,GAAG,UAAU,KACzB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAsB7E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,MAa/C,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,WAAW,GAAU,KAAK,MAAM,EAAE,aAAa,MAAM,KAAG,OAAO,CAAC,IAAI,CAuBhF,CAAC"}

package/dist/source.js

@@ -0,0 +1,80 @@
+import { spawn } from 'node:child_process';
+import { realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { readWorkingDirectory } from '@stratusagent/state';
+/**
+ * What a `skill add` source string means, in order: a directory on this
+ * machine, a GitHub `owner/repo` shorthand, or a URL git can clone. The
+ * shorthand is the form skills.sh and its CLI print, so a skill published
+ * there installs by the name its listing shows.
+ */
+export const resolveSource = async (source, env, what) => {
+    const localPath = path.resolve(readWorkingDirectory(env), source);
+    try {
+        if ((await stat(localPath)).isDirectory()) {
+            // The real directory, not the path as typed: a source that is
+            // itself a symlink would otherwise be copied as that link — an
+            // installed entry pointing back at the source tree, which the
+            // loader ignores as not-a-directory.
+            return { kind: 'local', directory: await realpath(localPath) };
+        }
+    }
+    catch {
+        // Not a local directory; read it as a remote source.
+    }
+    if (/^[\w.-]+\/[\w.-]+$/.test(source)) {
+        return { kind: 'git', url: `https://github.com/${source}` };
+    }
+    if (/^(https?|git|ssh|file):\/\//.test(source) || /^git@[\w.-]+:/.test(source)) {
+        return { kind: 'git', url: source };
+    }
+    throw new Error(`Cannot read ${JSON.stringify(source)} as a ${what} source. Pass a GitHub owner/repo, a git URL, or a local path.`);
+};
+/**
+ * A source URL safe to print: userinfo stripped. A token travels in exactly
+ * this position (`https://user:token@host/repo.git`), stdout is commonly
+ * retained in CI logs, and git's own stderr already redacts — only the
+ * unredacted URL is handed to git itself.
+ */
+export const redactedSourceUrl = (url) => {
+    try {
+        const parsed = new URL(url);
+        if (parsed.username || parsed.password) {
+            parsed.username = '***';
+            parsed.password = '';
+        }
+        return parsed.toString();
+    }
+    catch {
+        // scp-style (git@host:path) or anything else URL() refuses: keep the
+        // shape, hide whatever sits before the @.
+        return url.replace(/^[^@/]+@/, '***@');
+    }
+};
+/** Shallow-clone a source repository. Git owns every transport we would otherwise re-implement. */
+export const cloneSource = async (url, destination) => {
+    const display = redactedSourceUrl(url);
+    await new Promise((resolve, reject) => {
+        const child = spawn('git', ['clone', '--depth', '1', '--quiet', url, destination], {
+            stdio: ['ignore', 'ignore', 'pipe'],
+        });
+        let stderr = '';
+        child.stderr?.on('data', (chunk) => {
+            stderr += String(chunk);
+        });
+        child.on('error', (error) => {
+            reject(new Error(`Could not run git to fetch ${display}: ${error.message}`));
+        });
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                // git redacts credentials in its own messages; the URL we echo is
+                // ours to redact.
+                reject(new Error(`git clone failed for ${display}: ${stderr.trim() || `exit code ${code}`}`));
+            }
+        });
+    });
+};
+//# sourceMappingURL=source.js.map

package/dist/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../src/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAc,EACd,GAAmB,EACnB,IAA0B,EACoD,EAAE;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1C,8DAA8D;YAC9D,+DAA+D;YAC/D,8DAA8D;YAC9D,qCAAqC;YACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,sBAAsB,MAAM,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,gEAAgE,CACnH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAU,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;YACxB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,0CAA0C;QAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,WAAmB,EAAiB,EAAE;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE;YACjF,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,kBAAkB;gBAClB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,OAAO,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAChG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/supervisor.d.ts

@@ -0,0 +1,69 @@
+import type { CliStreams, CliEnvironment, SupervisorLink, RestartHandoff } from './environment.ts';
+import type { ParsedServeCommand } from './parse.ts';
+/**
+ * `stratus serve` — run the gateway (stratusd) in the foreground: load the
+ * roster, accept dispatches, print events, and drain cleanly on SIGTERM,
+ * SIGINT, or the injected shutdown signal.
+ */
+/**
+ * What a daemon exits with to ask for a fresh process. Only ever seen by the
+ * supervisor below, which is the only thing that starts a daemon with the
+ * environment marker that makes it exit this way instead of supervising.
+ */
+export declare const RESTART_EXIT_CODE = 75;
+/**
+ * What a daemon exits with when a restart could not drain — a turn that
+ * ignored its abort, a plugin or channel that did not let go. Distinct from
+ * the restart status on purpose: the supervisor answers this one by
+ * exiting with it too, so the process the service manager started ends
+ * and the manager restarts the whole unit — under systemd, cleaning the
+ * cgroup of whatever the plugin left running. A supervisor that started
+ * another daemon instead would keep that cgroup, and its leaks, alive.
+ */
+export declare const UNDRAINED_RESTART_EXIT_CODE = 76;
+/** Set in a daemon the supervisor started, so its own restart is an exit, not a second supervisor. */
+export declare const SUPERVISED_ENV = "STRATUS_SERVE_SUPERVISED";
+/**
+ * The control API port the last daemon bound, handed to its replacement by
+ * the supervisor. Honoured only where the replacement's own request — the
+ * flag, else the config it reads afresh — is still for any free port: a
+ * daemon that asked for port 0 comes back on the port it had, so a
+ * dashboard page reconnects to it, while a config since edited to a fixed
+ * port takes effect on that restart, as an `api` block change is meant to.
+ * A hint, never a pin: passing the port back as `--api-port` would outrank
+ * the config for every restart after.
+ */
+export declare const BOUND_API_PORT_ENV = "STRATUS_SERVE_BOUND_API_PORT";
+/**
+ * The IPC channel a supervisor opens when it spawns a daemon: what a
+ * supervised daemon says up it (the port it bound, so the supervisor
+ * carries *that* port to the next daemon rather than the first one's; the
+ * dashboard sessions it hands on) and what comes down it. Where there is
+ * no channel — the first daemon, or one a service manager started — there
+ * is no one to say it to, and nothing is said.
+ */
+export declare const defaultSupervisorLink: SupervisorLink;
+/**
+ * The parsed serve command as arguments again — what the fresh daemon is
+ * started with. From the command, not from `process.argv`: `stratus
+ * dashboard` runs the daemon through `runServe` with a command it built,
+ * and the process's own arguments would start a second dashboard.
+ */
+export declare const serveArgv: (command: ParsedServeCommand) => string[];
+/**
+ * The `bin` beside the module at `moduleUrl`, with that module's own
+ * extension: `dist/supervisor.js` respawns `dist/bin.js`, and a source checkout
+ * running `src/supervisor.ts` under type stripping respawns `src/bin.ts` — the
+ * flags that made that possible travel in `process.execArgv`. Assuming
+ * compiled output would hand a source checkout a file that does not exist,
+ * and a daemon that never comes back.
+ */
+export declare const restartEntrypoint: (moduleUrl: string) => string;
+/**
+ * Keep starting daemons for as long as they exit asking for another; the
+ * first exit that does not is this process's own — an undrained restart's
+ * status included, which ends the supervisor rather than starting a daemon
+ * beside what the last one could not release.
+ */
+export declare const superviseRestarts: (command: ParsedServeCommand, first: RestartHandoff, streams: CliStreams, env: CliEnvironment) => Promise<number>;
+//# sourceMappingURL=supervisor.d.ts.map

package/dist/supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EAGd,cAAc,EACd,cAAc,EAEf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,sGAAsG;AACtG,eAAO,MAAM,cAAc,6BAA6B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,iCAAiC,CAAC;AAuBjE;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAoBnC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAU7D,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,MAGrD,CAAC;AA+EF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,kBAAkB,EAC3B,OAAO,cAAc,EACrB,SAAS,UAAU,EACnB,KAAK,cAAc,KAClB,OAAO,CAAC,MAAM,CAoBhB,CAAC"}