@stratusagent/cli 0.11.2 → 0.11.4

package/dist/source.js

@@ -0,0 +1,80 @@
+import { spawn } from 'node:child_process';
+import { realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { readWorkingDirectory } from '@stratusagent/state';
+/**
+ * What a `skill add` source string means, in order: a directory on this
+ * machine, a GitHub `owner/repo` shorthand, or a URL git can clone. The
+ * shorthand is the form skills.sh and its CLI print, so a skill published
+ * there installs by the name its listing shows.
+ */
+export const resolveSource = async (source, env, what) => {
+    const localPath = path.resolve(readWorkingDirectory(env), source);
+    try {
+        if ((await stat(localPath)).isDirectory()) {
+            // The real directory, not the path as typed: a source that is
+            // itself a symlink would otherwise be copied as that link — an
+            // installed entry pointing back at the source tree, which the
+            // loader ignores as not-a-directory.
+            return { kind: 'local', directory: await realpath(localPath) };
+        }
+    }
+    catch {
+        // Not a local directory; read it as a remote source.
+    }
+    if (/^[\w.-]+\/[\w.-]+$/.test(source)) {
+        return { kind: 'git', url: `https://github.com/${source}` };
+    }
+    if (/^(https?|git|ssh|file):\/\//.test(source) || /^git@[\w.-]+:/.test(source)) {
+        return { kind: 'git', url: source };
+    }
+    throw new Error(`Cannot read ${JSON.stringify(source)} as a ${what} source. Pass a GitHub owner/repo, a git URL, or a local path.`);
+};
+/**
+ * A source URL safe to print: userinfo stripped. A token travels in exactly
+ * this position (`https://user:token@host/repo.git`), stdout is commonly
+ * retained in CI logs, and git's own stderr already redacts — only the
+ * unredacted URL is handed to git itself.
+ */
+export const redactedSourceUrl = (url) => {
+    try {
+        const parsed = new URL(url);
+        if (parsed.username || parsed.password) {
+            parsed.username = '***';
+            parsed.password = '';
+        }
+        return parsed.toString();
+    }
+    catch {
+        // scp-style (git@host:path) or anything else URL() refuses: keep the
+        // shape, hide whatever sits before the @.
+        return url.replace(/^[^@/]+@/, '***@');
+    }
+};
+/** Shallow-clone a source repository. Git owns every transport we would otherwise re-implement. */
+export const cloneSource = async (url, destination) => {
+    const display = redactedSourceUrl(url);
+    await new Promise((resolve, reject) => {
+        const child = spawn('git', ['clone', '--depth', '1', '--quiet', url, destination], {
+            stdio: ['ignore', 'ignore', 'pipe'],
+        });
+        let stderr = '';
+        child.stderr?.on('data', (chunk) => {
+            stderr += String(chunk);
+        });
+        child.on('error', (error) => {
+            reject(new Error(`Could not run git to fetch ${display}: ${error.message}`));
+        });
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                // git redacts credentials in its own messages; the URL we echo is
+                // ours to redact.
+                reject(new Error(`git clone failed for ${display}: ${stderr.trim() || `exit code ${code}`}`));
+            }
+        });
+    });
+};
+//# sourceMappingURL=source.js.map

package/dist/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../src/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAc,EACd,GAAmB,EACnB,IAA0B,EACoD,EAAE;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1C,8DAA8D;YAC9D,+DAA+D;YAC/D,8DAA8D;YAC9D,qCAAqC;YACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,sBAAsB,MAAM,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,gEAAgE,CACnH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAU,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;YACxB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,0CAA0C;QAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,WAAmB,EAAiB,EAAE;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE;YACjF,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,kBAAkB;gBAClB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,OAAO,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAChG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/supervisor.d.ts

@@ -0,0 +1,69 @@
+import type { CliStreams, CliEnvironment, SupervisorLink, RestartHandoff } from './environment.ts';
+import type { ParsedServeCommand } from './parse.ts';
+/**
+ * `stratus serve` — run the gateway (stratusd) in the foreground: load the
+ * roster, accept dispatches, print events, and drain cleanly on SIGTERM,
+ * SIGINT, or the injected shutdown signal.
+ */
+/**
+ * What a daemon exits with to ask for a fresh process. Only ever seen by the
+ * supervisor below, which is the only thing that starts a daemon with the
+ * environment marker that makes it exit this way instead of supervising.
+ */
+export declare const RESTART_EXIT_CODE = 75;
+/**
+ * What a daemon exits with when a restart could not drain — a turn that
+ * ignored its abort, a plugin or channel that did not let go. Distinct from
+ * the restart status on purpose: the supervisor answers this one by
+ * exiting with it too, so the process the service manager started ends
+ * and the manager restarts the whole unit — under systemd, cleaning the
+ * cgroup of whatever the plugin left running. A supervisor that started
+ * another daemon instead would keep that cgroup, and its leaks, alive.
+ */
+export declare const UNDRAINED_RESTART_EXIT_CODE = 76;
+/** Set in a daemon the supervisor started, so its own restart is an exit, not a second supervisor. */
+export declare const SUPERVISED_ENV = "STRATUS_SERVE_SUPERVISED";
+/**
+ * The control API port the last daemon bound, handed to its replacement by
+ * the supervisor. Honoured only where the replacement's own request — the
+ * flag, else the config it reads afresh — is still for any free port: a
+ * daemon that asked for port 0 comes back on the port it had, so a
+ * dashboard page reconnects to it, while a config since edited to a fixed
+ * port takes effect on that restart, as an `api` block change is meant to.
+ * A hint, never a pin: passing the port back as `--api-port` would outrank
+ * the config for every restart after.
+ */
+export declare const BOUND_API_PORT_ENV = "STRATUS_SERVE_BOUND_API_PORT";
+/**
+ * The IPC channel a supervisor opens when it spawns a daemon: what a
+ * supervised daemon says up it (the port it bound, so the supervisor
+ * carries *that* port to the next daemon rather than the first one's; the
+ * dashboard sessions it hands on) and what comes down it. Where there is
+ * no channel — the first daemon, or one a service manager started — there
+ * is no one to say it to, and nothing is said.
+ */
+export declare const defaultSupervisorLink: SupervisorLink;
+/**
+ * The parsed serve command as arguments again — what the fresh daemon is
+ * started with. From the command, not from `process.argv`: `stratus
+ * dashboard` runs the daemon through `runServe` with a command it built,
+ * and the process's own arguments would start a second dashboard.
+ */
+export declare const serveArgv: (command: ParsedServeCommand) => string[];
+/**
+ * The `bin` beside the module at `moduleUrl`, with that module's own
+ * extension: `dist/supervisor.js` respawns `dist/bin.js`, and a source checkout
+ * running `src/supervisor.ts` under type stripping respawns `src/bin.ts` — the
+ * flags that made that possible travel in `process.execArgv`. Assuming
+ * compiled output would hand a source checkout a file that does not exist,
+ * and a daemon that never comes back.
+ */
+export declare const restartEntrypoint: (moduleUrl: string) => string;
+/**
+ * Keep starting daemons for as long as they exit asking for another; the
+ * first exit that does not is this process's own — an undrained restart's
+ * status included, which ends the supervisor rather than starting a daemon
+ * beside what the last one could not release.
+ */
+export declare const superviseRestarts: (command: ParsedServeCommand, first: RestartHandoff, streams: CliStreams, env: CliEnvironment) => Promise<number>;
+//# sourceMappingURL=supervisor.d.ts.map

package/dist/supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EAGd,cAAc,EACd,cAAc,EAEf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,sGAAsG;AACtG,eAAO,MAAM,cAAc,6BAA6B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,iCAAiC,CAAC;AAuBjE;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAoBnC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAU7D,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,MAGrD,CAAC;AA+EF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,kBAAkB,EAC3B,OAAO,cAAc,EACrB,SAAS,UAAU,EACnB,KAAK,cAAc,KAClB,OAAO,CAAC,MAAM,CAoBhB,CAAC"}

package/dist/supervisor.js

@@ -0,0 +1,218 @@
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { writeLine } from "./io.js";
+/**
+ * `stratus serve` — run the gateway (stratusd) in the foreground: load the
+ * roster, accept dispatches, print events, and drain cleanly on SIGTERM,
+ * SIGINT, or the injected shutdown signal.
+ */
+/**
+ * What a daemon exits with to ask for a fresh process. Only ever seen by the
+ * supervisor below, which is the only thing that starts a daemon with the
+ * environment marker that makes it exit this way instead of supervising.
+ */
+export const RESTART_EXIT_CODE = 75;
+/**
+ * What a daemon exits with when a restart could not drain — a turn that
+ * ignored its abort, a plugin or channel that did not let go. Distinct from
+ * the restart status on purpose: the supervisor answers this one by
+ * exiting with it too, so the process the service manager started ends
+ * and the manager restarts the whole unit — under systemd, cleaning the
+ * cgroup of whatever the plugin left running. A supervisor that started
+ * another daemon instead would keep that cgroup, and its leaks, alive.
+ */
+export const UNDRAINED_RESTART_EXIT_CODE = 76;
+/** Set in a daemon the supervisor started, so its own restart is an exit, not a second supervisor. */
+export const SUPERVISED_ENV = 'STRATUS_SERVE_SUPERVISED';
+/**
+ * The control API port the last daemon bound, handed to its replacement by
+ * the supervisor. Honoured only where the replacement's own request — the
+ * flag, else the config it reads afresh — is still for any free port: a
+ * daemon that asked for port 0 comes back on the port it had, so a
+ * dashboard page reconnects to it, while a config since edited to a fixed
+ * port takes effect on that restart, as an `api` block change is meant to.
+ * A hint, never a pin: passing the port back as `--api-port` would outrank
+ * the config for every restart after.
+ */
+export const BOUND_API_PORT_ENV = 'STRATUS_SERVE_BOUND_API_PORT';
+const isDashboardSession = (value) => typeof value === 'object' && value !== null
+    && typeof value.id === 'string'
+    && typeof value.expiresAt === 'number'
+    && typeof value.vouchedBy === 'string';
+/** Shape-checked, because the other end of an IPC channel is still another process. */
+const isSupervisorMessage = (value) => {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const message = value;
+    if (message.type === 'stratusd.bound-api-port') {
+        return typeof message.port === 'number' && Number.isInteger(message.port) && message.port > 0;
+    }
+    if (message.type === 'stratusd.sessions') {
+        return Array.isArray(message.sessions) && message.sessions.every(isDashboardSession);
+    }
+    return false;
+};
+/**
+ * The IPC channel a supervisor opens when it spawns a daemon: what a
+ * supervised daemon says up it (the port it bound, so the supervisor
+ * carries *that* port to the next daemon rather than the first one's; the
+ * dashboard sessions it hands on) and what comes down it. Where there is
+ * no channel — the first daemon, or one a service manager started — there
+ * is no one to say it to, and nothing is said.
+ */
+export const defaultSupervisorLink = {
+    send(message) {
+        if (typeof process.send === 'function' && process.channel) {
+            process.send(message);
+        }
+    },
+    receive(handler) {
+        const channel = process.channel;
+        if (!channel) {
+            return;
+        }
+        process.on('message', (message) => {
+            if (isSupervisorMessage(message)) {
+                handler(message);
+            }
+        });
+        // A 'message' listener refs the channel, which would keep this process
+        // alive after its drain; the daemon's own work is what holds it open.
+        channel.unref?.();
+    },
+};
+/**
+ * The parsed serve command as arguments again — what the fresh daemon is
+ * started with. From the command, not from `process.argv`: `stratus
+ * dashboard` runs the daemon through `runServe` with a command it built,
+ * and the process's own arguments would start a second dashboard.
+ */
+export const serveArgv = (command) => [
+    'serve',
+    ...(command.configPath !== undefined ? ['--config', command.configPath] : []),
+    ...(command.idleTimeoutMs !== undefined ? ['--idle-timeout', String(command.idleTimeoutMs / 1000)] : []),
+    ...(command.approvals !== undefined ? ['--approvals', command.approvals] : []),
+    ...(command.events ? [] : ['--no-events']),
+    ...(command.logToFile === false ? ['--no-log-file'] : []),
+    ...(command.api === false ? ['--no-api'] : command.api === true ? ['--api'] : []),
+    ...(command.apiPort !== undefined ? ['--api-port', String(command.apiPort)] : []),
+    ...(command.apiHost !== undefined ? ['--api-host', command.apiHost] : []),
+];
+/**
+ * The `bin` beside the module at `moduleUrl`, with that module's own
+ * extension: `dist/supervisor.js` respawns `dist/bin.js`, and a source checkout
+ * running `src/supervisor.ts` under type stripping respawns `src/bin.ts` — the
+ * flags that made that possible travel in `process.execArgv`. Assuming
+ * compiled output would hand a source checkout a file that does not exist,
+ * and a daemon that never comes back.
+ */
+export const restartEntrypoint = (moduleUrl) => {
+    const modulePath = fileURLToPath(moduleUrl);
+    return path.join(path.dirname(modulePath), `bin${path.extname(modulePath)}`);
+};
+/**
+ * Run this CLI's own entrypoint as a child with the daemon's streams and
+ * exit code, forwarding the signals a supervisor would otherwise swallow.
+ *
+ * A child, and the parent waits, rather than a detached process and an
+ * exit: under systemd and launchd the process the manager started is the
+ * service, and its exit ends the job — cgroup and all, on Linux — so the
+ * daemon that received the restart has to stay the manager's process and
+ * become the supervisor of the next one. That is what makes the same path
+ * hold in the foreground and under `--no-login`, where nothing else would
+ * bring a clean exit back.
+ */
+const defaultServeRespawn = (env) => (argv, handoff) => new Promise((resolve, reject) => {
+    const entrypoint = restartEntrypoint(import.meta.url);
+    // The daemon's own streams, plus an IPC channel for what it and its
+    // supervisor have to tell each other. See SupervisorLink.
+    const child = spawn(process.execPath, [...process.execArgv, entrypoint, ...argv], {
+        stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
+        env: {
+            ...process.env,
+            [SUPERVISED_ENV]: '1',
+            ...(handoff.boundApiPort !== undefined ? { [BOUND_API_PORT_ENV]: String(handoff.boundApiPort) } : {}),
+        },
+    });
+    if (handoff.sessions.length > 0 && child.connected) {
+        // Queued in the channel until the daemon listens, which it does
+        // before its API is up; the API holds them until it can adopt them.
+        // A send that fails (the daemon died before reading) is not this
+        // supervisor's failure: the exit below reports what happened, and a
+        // daemon that never took them simply comes up signed out.
+        const sessions = { type: 'stratusd.sessions', sessions: handoff.sessions };
+        child.send(sessions, () => undefined);
+    }
+    const forward = (signal) => () => {
+        child.kill(signal);
+    };
+    const onTerm = forward('SIGTERM');
+    const onInt = forward('SIGINT');
+    const onAbort = () => {
+        child.kill('SIGTERM');
+    };
+    process.on('SIGTERM', onTerm);
+    process.on('SIGINT', onInt);
+    env.shutdownSignal?.addEventListener('abort', onAbort, { once: true });
+    const done = () => {
+        process.off('SIGTERM', onTerm);
+        process.off('SIGINT', onInt);
+        env.shutdownSignal?.removeEventListener('abort', onAbort);
+    };
+    let reportedPort;
+    let handedBack;
+    child.on('message', (message) => {
+        if (!isSupervisorMessage(message)) {
+            return;
+        }
+        if (message.type === 'stratusd.bound-api-port') {
+            reportedPort = message.port;
+        }
+        else {
+            handedBack = message.sessions;
+        }
+    });
+    child.once('error', (error) => {
+        done();
+        reject(error);
+    });
+    child.once('exit', (code, signal) => {
+        done();
+        // Killed by a signal is a stop, not a request to come back.
+        resolve({
+            code: code ?? (signal ? 1 : 0),
+            ...(reportedPort !== undefined ? { boundApiPort: reportedPort } : {}),
+            ...(handedBack !== undefined ? { sessions: handedBack } : {}),
+        });
+    });
+});
+/**
+ * Keep starting daemons for as long as they exit asking for another; the
+ * first exit that does not is this process's own — an undrained restart's
+ * status included, which ends the supervisor rather than starting a daemon
+ * beside what the last one could not release.
+ */
+export const superviseRestarts = async (command, first, streams, env) => {
+    const respawn = env.serveRespawn ?? defaultServeRespawn(env);
+    // The hand-off follows the daemons: the port each one said it bound is
+    // what the next one is told (so a config edited to a fixed port and
+    // back hands on the last address, not the first), and the sessions are
+    // whatever the last one handed back — a daemon that handed nothing
+    // hands nothing on.
+    let handoff = first;
+    let result;
+    do {
+        writeLine(streams.stdout, 'Restarting stratusd.');
+        result = await respawn(serveArgv(command), handoff);
+        handoff = {
+            ...(result.boundApiPort !== undefined || handoff.boundApiPort !== undefined
+                ? { boundApiPort: result.boundApiPort ?? handoff.boundApiPort }
+                : {}),
+            sessions: result.sessions ?? [],
+        };
+    } while (result.code === RESTART_EXIT_CODE);
+    return result.code;
+};
+//# sourceMappingURL=supervisor.js.map

package/dist/supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C,sGAAsG;AACtG,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAEjE,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAA6B,EAAE,CACvE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;OACxC,OAAQ,KAA0B,CAAC,EAAE,KAAK,QAAQ;OAClD,OAAQ,KAAiC,CAAC,SAAS,KAAK,QAAQ;OAChE,OAAQ,KAAiC,CAAC,SAAS,KAAK,QAAQ,CAAC;AAEtE,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAA8B,EAAE;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAA+D,CAAC;IAChF,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAC/C,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,IAAI,CAAC,OAAO;QACV,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,OAAO;QACb,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAgB,EAAE,EAAE;YACzC,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,CAAC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAA2B,EAAY,EAAE,CAAC;IAClE,OAAO;IACP,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC1C,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CAC1E,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAU,EAAE;IAC7D,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAC/E,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAG,CAAC,GAAmB,EAAE,EAAE,CAAC,CAAC,IAAc,EAAE,OAAuB,EAA0B,EAAE,CACvH,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,oEAAoE;IACpE,0DAA0D;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,EAAE;QAChF,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC;QAC/C,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,CAAC,cAAc,CAAC,EAAE,GAAG;YACrB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtG;KACF,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACnD,gEAAgE;QAChE,oEAAoE;QACpE,iEAAiE;QACjE,oEAAoE;QACpE,0DAA0D;QAC1D,MAAM,QAAQ,GAAsB,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,EAAE,CAAC,GAAS,EAAE;QACrD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5B,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,GAAG,CAAC,cAAc,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,IAAI,YAAgC,CAAC;IACrC,IAAI,UAA0C,CAAC;IAC/C,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAgB,EAAE,EAAE;QACvC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC/C,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5B,IAAI,EAAE,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAClC,IAAI,EAAE,CAAC;QACP,4DAA4D;QAC5D,OAAO,CAAC;YACN,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,OAA2B,EAC3B,KAAqB,EACrB,OAAmB,EACnB,GAAmB,EACF,EAAE;IACnB,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC7D,uEAAuE;IACvE,oEAAoE;IACpE,uEAAuE;IACvE,mEAAmE;IACnE,oBAAoB;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAqB,CAAC;IAC1B,GAAG,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QAClD,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,GAAG;YACR,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;gBACzE,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE;gBAC/D,CAAC,CAAC,EAAE,CAAC;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;SAChC,CAAC;IACJ,CAAC,QAAQ,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC,CAAC"}

package/dist/trusted-config.d.ts

@@ -0,0 +1,84 @@
+import { type ApiConfig, type ApprovalsConfig, type PrincipalsConfig, type PluginsConfig } from '@stratusagent/state';
+import type { CliEnvironment } from './environment.ts';
+/**
+ * A credential that exists only in this shell cannot reach the daemon: a
+ * service manager starts with its own environment and never sources a
+ * profile, so the unit would come up unauthenticated while setup had just
+ * reported everything ready. Returns the variable to name, if so.
+ */
+/**
+ * The daemon's `approvals` block, from the config file the daemon itself
+ * would load. Discovery goes through the shared resolver rather than
+ * reading ~/.stratus/config.json directly: `--config` and STRATUS_CONFIG
+ * both move it, and a second copy of that precedence would resolve the
+ * approver set from a file the gateway is not running on.
+ *
+ * **Only from a trusted location.** An auto-discovered project-local
+ * `stratus.config.json` outranks the global one and can be checked into any
+ * repository — which is why stored credentials are already never combined
+ * with an endpoint it selects. This block is the same kind of boundary and
+ * a sharper one: it names the people who may authorize an agent's gated
+ * tool calls, and it would do so through Slack tokens the user configured
+ * globally. A cloned repo must not be able to appoint its own approver, so
+ * an untrusted config's approvals are ignored — loudly, since silently
+ * dropping the block someone is looking at is its own kind of wrong.
+ *
+ * An unreadable config degrades to headless with a warning, matching how
+ * every other consumer treats one: refusing to start would take the whole
+ * fleet down over a policy block that may not even be present.
+ */
+export declare const loadServeApprovals: (env: CliEnvironment, configPath: string | undefined, warn: (line: string) => void) => Promise<ApprovalsConfig>;
+/**
+ * One line naming who can actually answer, so a remote daemon does not look
+ * configured when it is not. Two ways it can be hollow, and they fail
+ * differently, so they read differently:
+ *
+ * - No channel running at all (no Slack tokens, or the optional package is
+ *   not installed) — nothing renders the request, so the turn waits out the
+ *   whole timeout before being denied. That is the bad one, and the only
+ *   place it is visible is here, at startup.
+ * - A channel is running but an agent has no approvers — the adapter denies
+ *   that agent's requests on arrival, which is at least prompt.
+ *
+ * `agentIds` is therefore the agents that can actually be *asked*, not
+ * every agent with tokens on disk.
+ */
+/**
+ * The `principals` block, read under the same trust rule as `approvals` and
+ * for a sharper reason: it names the people whose messages an agent takes
+ * as its operator's, which is the trust root everything downstream lowers
+ * from. A cloned repo appointing itself the principal would arrive as
+ * `user` in every Slack thread the daemon serves.
+ */
+export declare const loadServePrincipals: (env: CliEnvironment, configPath: string | undefined, warn: (line: string) => void) => Promise<PrincipalsConfig>;
+/**
+ * The daemon's `api` block, from the config file the daemon itself would
+ * load — and only from a trusted location.
+ *
+ * An auto-discovered project-local `stratus.config.json` outranks the global
+ * one and can be checked into any repository. Which interface a daemon binds
+ * is exactly the kind of decision a cloned repo must not get to make, so an
+ * untrusted config's block is ignored loudly rather than obeyed.
+ */
+export declare const loadServeApi: (env: CliEnvironment, configPath: string | undefined, warn: (line: string) => void) => Promise<ApiConfig>;
+/**
+ * The daemon's `plugins` block — the same trust boundary as the three above,
+ * and the one it was written for. A plugin runs in-process with the daemon,
+ * so a list of them is a list of code; a `stratus.config.json` that ships
+ * in a cloned repository must not be able to write it.
+ */
+export declare const loadServePlugins: (env: CliEnvironment, configPath: string | undefined, warn: (line: string) => void) => Promise<PluginsConfig>;
+/**
+ * The daemon's `executor` or `memoryStore` selection — a name a plugin
+ * registered — under the trust rule `plugins` has, and for the same
+ * reason one step on: the plugins block decides which code runs, and
+ * these decide which of that code an agent's commands run in and where its
+ * memories are written. A cloned repository swapping a sandbox executor
+ * for the host's is the downgrade this refuses.
+ *
+ * Absent, or ignored, means the built-in — the caller substitutes it. A
+ * project config that says nothing leaves the global file's choice in
+ * force, as every trusted block does.
+ */
+export declare const loadServeRuntimeSelection: (key: "executor" | "memoryStore", env: CliEnvironment, configPath: string | undefined, warn: (line: string) => void) => Promise<string | undefined>;
+//# sourceMappingURL=trusted-config.d.ts.map

package/dist/trusted-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-config.d.ts","sourceRoot":"","sources":["../src/trusted-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kBAAkB,GAC7B,KAAK,cAAc,EACnB,YAAY,MAAM,GAAG,SAAS,EAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAC3B,OAAO,CAAC,eAAe,CAczB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC9B,KAAK,cAAc,EACnB,YAAY,MAAM,GAAG,SAAS,EAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAC3B,OAAO,CAAC,gBAAgB,CA0B1B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GACvB,KAAK,cAAc,EACnB,YAAY,MAAM,GAAG,SAAS,EAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAC3B,OAAO,CAAC,SAAS,CAcnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,KAAK,cAAc,EACnB,YAAY,MAAM,GAAG,SAAS,EAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAC3B,OAAO,CAAC,aAAa,CAcvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,GACpC,KAAK,UAAU,GAAG,aAAa,EAC/B,KAAK,cAAc,EACnB,YAAY,MAAM,GAAG,SAAS,EAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAoB5B,CAAC"}

package/dist/trusted-config.js

@@ -0,0 +1,159 @@
+import { readGlobalConfigBlock, readTrustedConfigBlock, } from '@stratusagent/state';
+/**
+ * A credential that exists only in this shell cannot reach the daemon: a
+ * service manager starts with its own environment and never sources a
+ * profile, so the unit would come up unauthenticated while setup had just
+ * reported everything ready. Returns the variable to name, if so.
+ */
+/**
+ * The daemon's `approvals` block, from the config file the daemon itself
+ * would load. Discovery goes through the shared resolver rather than
+ * reading ~/.stratus/config.json directly: `--config` and STRATUS_CONFIG
+ * both move it, and a second copy of that precedence would resolve the
+ * approver set from a file the gateway is not running on.
+ *
+ * **Only from a trusted location.** An auto-discovered project-local
+ * `stratus.config.json` outranks the global one and can be checked into any
+ * repository — which is why stored credentials are already never combined
+ * with an endpoint it selects. This block is the same kind of boundary and
+ * a sharper one: it names the people who may authorize an agent's gated
+ * tool calls, and it would do so through Slack tokens the user configured
+ * globally. A cloned repo must not be able to appoint its own approver, so
+ * an untrusted config's approvals are ignored — loudly, since silently
+ * dropping the block someone is looking at is its own kind of wrong.
+ *
+ * An unreadable config degrades to headless with a warning, matching how
+ * every other consumer treats one: refusing to start would take the whole
+ * fleet down over a policy block that may not even be present.
+ */
+export const loadServeApprovals = async (env, configPath, warn) => {
+    const block = await readTrustedConfigBlock('approvals', env, configPath);
+    if (block.status === 'untrusted') {
+        warn(`ignoring the approvals config in ${block.path}: a project-local config cannot decide who may approve `
+            + 'this daemon\'s tool calls. Move it to ~/.stratus/config.json, or pass it with --config.');
+        return {};
+    }
+    if (block.status === 'unreadable') {
+        warn(`ignoring the approvals config (${block.error instanceof Error ? block.error.message : String(block.error)}); refusing gated calls`);
+        return {};
+    }
+    return block.status === 'present' ? block.value : {};
+};
+/**
+ * One line naming who can actually answer, so a remote daemon does not look
+ * configured when it is not. Two ways it can be hollow, and they fail
+ * differently, so they read differently:
+ *
+ * - No channel running at all (no Slack tokens, or the optional package is
+ *   not installed) — nothing renders the request, so the turn waits out the
+ *   whole timeout before being denied. That is the bad one, and the only
+ *   place it is visible is here, at startup.
+ * - A channel is running but an agent has no approvers — the adapter denies
+ *   that agent's requests on arrival, which is at least prompt.
+ *
+ * `agentIds` is therefore the agents that can actually be *asked*, not
+ * every agent with tokens on disk.
+ */
+/**
+ * The `principals` block, read under the same trust rule as `approvals` and
+ * for a sharper reason: it names the people whose messages an agent takes
+ * as its operator's, which is the trust root everything downstream lowers
+ * from. A cloned repo appointing itself the principal would arrive as
+ * `user` in every Slack thread the daemon serves.
+ */
+export const loadServePrincipals = async (env, configPath, warn) => {
+    let block = await readTrustedConfigBlock('principals', env, configPath);
+    if (block.status === 'untrusted') {
+        // An auto-discovered project config shadows the global one in
+        // discovery, and a daemon started inside a cloned repository would
+        // otherwise run with no principals policy at all — a cloned repo that
+        // cannot define the policy must not be able to suppress it either. The
+        // global file is the trusted answer; it is read instead.
+        warn(`ignoring the principals config in ${block.path}: a project-local config cannot decide whose messages `
+            + 'this daemon\'s agents treat as their operator\'s. Using ~/.stratus/config.json instead.');
+        block = await readGlobalConfigBlock('principals', env);
+    }
+    if (block.status === 'unreadable') {
+        // Closed, not open: the one thing in this block that can fail to
+        // parse is `admit`, whose misspelling would otherwise mean `anyone` —
+        // the setting exists so that a typo does not open the door, and a
+        // warning that opens it anyway is the door with a note on it.
+        warn(`the principals config could not be read (${block.error instanceof Error ? block.error.message : String(block.error)}); `
+            + 'refusing every Slack sender until it is fixed');
+        return { admit: 'principals' };
+    }
+    return block.status === 'present' ? block.value : {};
+};
+/**
+ * The daemon's `api` block, from the config file the daemon itself would
+ * load — and only from a trusted location.
+ *
+ * An auto-discovered project-local `stratus.config.json` outranks the global
+ * one and can be checked into any repository. Which interface a daemon binds
+ * is exactly the kind of decision a cloned repo must not get to make, so an
+ * untrusted config's block is ignored loudly rather than obeyed.
+ */
+export const loadServeApi = async (env, configPath, warn) => {
+    const block = await readTrustedConfigBlock('api', env, configPath);
+    if (block.status === 'untrusted') {
+        warn(`ignoring the api config in ${block.path}: a project-local config cannot decide which interface this `
+            + 'daemon binds. Move it to ~/.stratus/config.json, or pass it with --config.');
+        return {};
+    }
+    if (block.status === 'unreadable') {
+        warn(`ignoring the api config (${block.error instanceof Error ? block.error.message : String(block.error)}); using the defaults`);
+        return {};
+    }
+    return block.status === 'present' ? block.value : {};
+};
+/**
+ * The daemon's `plugins` block — the same trust boundary as the three above,
+ * and the one it was written for. A plugin runs in-process with the daemon,
+ * so a list of them is a list of code; a `stratus.config.json` that ships
+ * in a cloned repository must not be able to write it.
+ */
+export const loadServePlugins = async (env, configPath, warn) => {
+    const block = await readTrustedConfigBlock('plugins', env, configPath);
+    if (block.status === 'untrusted') {
+        warn(`ignoring the plugins config in ${block.path}: a project-local config cannot decide which code runs inside `
+            + 'this daemon. Move it to ~/.stratus/config.json, or pass it with --config.');
+        return {};
+    }
+    if (block.status === 'unreadable') {
+        warn(`ignoring the plugins config (${block.error instanceof Error ? block.error.message : String(block.error)}); loading no plugins`);
+        return {};
+    }
+    return block.status === 'present' ? block.value : {};
+};
+/**
+ * The daemon's `executor` or `memoryStore` selection — a name a plugin
+ * registered — under the trust rule `plugins` has, and for the same
+ * reason one step on: the plugins block decides which code runs, and
+ * these decide which of that code an agent's commands run in and where its
+ * memories are written. A cloned repository swapping a sandbox executor
+ * for the host's is the downgrade this refuses.
+ *
+ * Absent, or ignored, means the built-in — the caller substitutes it. A
+ * project config that says nothing leaves the global file's choice in
+ * force, as every trusted block does.
+ */
+export const loadServeRuntimeSelection = async (key, env, configPath, warn) => {
+    let block = await readTrustedConfigBlock(key, env, configPath);
+    if (block.status === 'untrusted') {
+        // The global file's choice, not the built-in: a clone that cannot
+        // select an executor must not be able to deselect one either — a
+        // repository shipping `"executor": "local"` would otherwise swap the
+        // operator's sandbox for the host, which is the exact downgrade this
+        // block refuses. The same fall-through `principals` uses.
+        warn(`ignoring ${key} in ${block.path}: a project-local config cannot decide `
+            + (key === 'executor' ? 'where this daemon\'s agents run their commands' : 'where this daemon\'s agents keep their memories')
+            + '. Using ~/.stratus/config.json instead.');
+        block = await readGlobalConfigBlock(key, env);
+    }
+    if (block.status === 'unreadable') {
+        warn(`ignoring ${key} (${block.error instanceof Error ? block.error.message : String(block.error)}); using the built-in`);
+        return undefined;
+    }
+    return block.status === 'present' ? block.value : undefined;
+};
+//# sourceMappingURL=trusted-config.js.map

package/dist/trusted-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-config.js","sourceRoot":"","sources":["../src/trusted-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAKvB,MAAM,qBAAqB,CAAC;AAG7B;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,GAAmB,EACnB,UAA8B,EAC9B,IAA4B,EACF,EAAE;IAC5B,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,IAAI,CACF,oCAAoC,KAAK,CAAC,IAAI,yDAAyD;cACrG,yFAAyF,CAC5F,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,kCAAkC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC1I,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,GAAmB,EACnB,UAA8B,EAC9B,IAA4B,EACD,EAAE;IAC7B,IAAI,KAAK,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,8DAA8D;QAC9D,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,CACF,qCAAqC,KAAK,CAAC,IAAI,wDAAwD;cACrG,yFAAyF,CAC5F,CAAC;QACF,KAAK,GAAG,MAAM,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,iEAAiE;QACjE,sEAAsE;QACtE,kEAAkE;QAClE,8DAA8D;QAC9D,IAAI,CACF,4CAA4C,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK;cACvH,+CAA+C,CAClD,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAmB,EACnB,UAA8B,EAC9B,IAA4B,EACR,EAAE;IACtB,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,IAAI,CACF,8BAA8B,KAAK,CAAC,IAAI,8DAA8D;cACpG,4EAA4E,CAC/E,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,4BAA4B,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAClI,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,GAAmB,EACnB,UAA8B,EAC9B,IAA4B,EACJ,EAAE;IAC1B,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,IAAI,CACF,kCAAkC,KAAK,CAAC,IAAI,gEAAgE;cAC1G,2EAA2E,CAC9E,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,gCAAgC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACtI,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,GAA+B,EAC/B,GAAmB,EACnB,UAA8B,EAC9B,IAA4B,EACC,EAAE;IAC/B,IAAI,KAAK,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,kEAAkE;QAClE,iEAAiE;QACjE,qEAAqE;QACrE,qEAAqE;QACrE,0DAA0D;QAC1D,IAAI,CACF,YAAY,GAAG,OAAO,KAAK,CAAC,IAAI,yCAAyC;cACvE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,iDAAiD,CAAC;cAC3H,yCAAyC,CAC5C,CAAC;QACF,KAAK,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,YAAY,GAAG,KAAK,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC1H,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC,CAAC"}