@superblocksteam/vite-plugin-file-sync 1.99.99-next.3 → 2.0.0-SNAPSHOT.84af65cd215b6ca1

package/dist/ai-service/app-interface/shell.d.ts

@@ -1,15 +1,569 @@
 import { type GlobOptionsWithFileTypesUnset } from "glob";
+import type { NpmInstallBlockedAuditReport, TriageVerdict } from "@superblocksteam/shared";
+import type { DraftInterface } from "../../draft-interface.js";
+import type { IOperationQueue } from "../../util/operation-queue.js";
+import type { TemplateRenderer } from "../template-renderer.js";
 import { type FileArtifact } from "../types.js";
-import type { OperationQueue } from "../../util/operation-queue.js";
+import { type DraftChanges, type FileMetadata, type PathValidator } from "./filesystem/index.js";
+import type { VirtualFileSystem } from "./filesystem/index.js";
+import { type NpmRegistryClient } from "./npm-registry.js";
+/** Auth + transport for `POST /api/v1/security/package-lookup`. */
+export type PackageLookupDeps = {
+    getJwt: () => Promise<string>;
+    baseUrl: string;
+    fetch?: typeof fetch;
+    /**
+     * Optional quarantine hold-back: given a concrete version, return an older
+     * pin when the requested one is inside the release-age window. Absent →
+     * quarantine skipped (tests / deliberate opt-out). Fail-open on errors.
+     */
+    pickQuarantineHoldback?: (name: string, version: string) => Promise<string | undefined>;
+};
+type InstallSpecificPackagesOptions = {
+    /** Retained for caller compatibility; triage is advisory and never authorizes an install. */
+    cveTriageVerdicts?: TriageVerdict[];
+    cveUserOverride?: {
+        packages: string[];
+        reason: string;
+    };
+};
+/**
+ * Options for listing files with optional metadata.
+ */
+interface ListFilesOptions extends GlobOptionsWithFileTypesUnset {
+    /** Include file metadata (size, mtime, type). Default: false */
+    includeMetadata?: boolean;
+    /** Include directories in listing. Default: false (files only) */
+    includeDirs?: boolean;
+}
+type CopyConflictStrategy = "fail" | "skip" | "replace";
+export type CopyToolResult = {
+    copiedCount: number;
+    skippedCount: number;
+    rejectedCount: number;
+    copied?: string[];
+    skipped?: Array<{
+        path: string;
+        reason: "destination_exists" | "default_excluded";
+    }>;
+    rejected?: Array<{
+        path: string;
+        reason: string;
+    }>;
+};
+type CopyFileOptions = {
+    sourcePath: string;
+    destinationPath: string;
+    conflictStrategy?: CopyConflictStrategy;
+    verbose?: boolean;
+};
+type CopyDirectoryOptions = {
+    sourceDir: string;
+    destinationDir: string;
+    conflictStrategy?: CopyConflictStrategy;
+    verbose?: boolean;
+};
+/**
+ * AppShell provides the primary interface for the AI agent to interact
+ * with the application environment.
+ *
+ * It encapsulates:
+ * - File system operations (read, write, delete, list, rename)
+ * - Virtual file abstraction (APIs appear as single .ts files)
+ * - Draft management for undo/redo capability
+ * - Code quality tools (linting, type checking)
+ * - Package management
+ */
 export declare class AppShell {
     readonly appRootDirPath: string;
     private readonly fsOperationQueue;
-    constructor({ appRootDirPath, fsOperationQueue, }: {
+    private readonly linter;
+    private messageSender?;
+    private readonly draftManager?;
+    private readonly templateRenderer?;
+    private readonly virtualFs;
+    private readonly pathValidator;
+    private readonly enableDeletingLockfiles;
+    /**
+     * Resolves the per-org npm registry config at install time. The AiService
+     * always constructs one in production (SaaS, local dev, and ephemeral
+     * pods); the LD flag (`superblocks.npm-registry.enabled`) inside the
+     * client decides whether to short-circuit to "not-configured" without a
+     * server call. `undefined` here is the test-only path (or callers that
+     * deliberately opt out): every `.npmrc` helper becomes a no-op and the
+     * install runs against npm's default resolution.
+     */
+    private readonly npmRegistryClient?;
+    /**
+     * Optional sink for npm-install-blocked audit events (APPS-4191 / P6.3).
+     * The AiService injects a reporter bound to the org/app socket connection;
+     * `undefined` (tests, callers that opt out) makes the audit emit a no-op.
+     * The reporter is fire-and-forget — see `maybeReportBlockedInstall`.
+     */
+    private readonly reportNpmInstallBlocked?;
+    /**
+     * Optional deps for the install-time vulnerability index lookup.
+     * When absent the malware/CVE gate is skipped (test fixtures / deliberate
+     * opt-out). Production AiService always wires these.
+     */
+    private readonly packageLookup?;
+    /**
+     * Tracks files that must be read before they can be written.
+     * Used to enforce read-before-write pattern for AI safety.
+     */
+    private readonly requiredReads;
+    constructor({ appRootDirPath, fsOperationQueue, messageSender, draftInterface, templateRenderer, virtualFileSystem, pathValidator, enableDeletingLockfiles, npmRegistryClient, reportNpmInstallBlocked, packageLookup, }: {
         appRootDirPath: string;
-        fsOperationQueue: OperationQueue;
+        fsOperationQueue: IOperationQueue;
+        messageSender?: (message: any) => Promise<void>;
+        draftInterface?: DraftInterface;
+        templateRenderer?: TemplateRenderer;
+        virtualFileSystem: VirtualFileSystem;
+        /** Path validator for template-specific path restrictions */
+        pathValidator: PathValidator;
+        /** Feature flag to allow deleting package-manager lock files */
+        enableDeletingLockfiles?: boolean;
+        /**
+         * Optional npm registry client. The AiService always constructs one in
+         * production (the LD flag inside the client decides whether to short-
+         * circuit before making a server call); `undefined` here is the
+         * test-only opt-out — the install path runs against npm's default
+         * resolution.
+         */
+        npmRegistryClient?: NpmRegistryClient;
+        /**
+         * Optional sink for npm-install-blocked audit events (APPS-4191). The
+         * AiService injects a reporter bound to the org/app socket connection;
+         * `undefined` makes the audit emit a no-op (tests / opt-out callers).
+         */
+        reportNpmInstallBlocked?: (report: NpmInstallBlockedAuditReport) => void;
+        /**
+         * Optional vulnerability-index lookup transport. Absent → skip the
+         * install-time malware/CVE gate.
+         */
+        packageLookup?: PackageLookupDeps;
     });
-    readFiles(patterns: string[], globOptions?: GlobOptionsWithFileTypesUnset): Promise<FileArtifact[]>;
+    /**
+     * Toggle the API virtual-file projection. When disabled, reads to `apis/*`
+     * bypass the YAML→TS transformer and fall through to raw disk, which is what
+     * v2→v3 migration needs so Clark sees the original YAML sources.
+     */
+    setApiHandlerEnabled(enabled: boolean): void;
+    /**
+     * Enqueue a filesystem operation and annotate queue timing in llmobs.
+     * This helps separate queue contention from operation execution time.
+     */
+    private enqueueFsOperation;
+    readFiles(patterns: string[], globOptions?: GlobOptionsWithFileTypesUnset, enableAppBlacklist?: boolean): Promise<FileArtifact[]>;
     runTypecheck(abortSignal?: AbortSignal): Promise<Record<string, string[]> | null>;
+    runTypecheckRawOutput(abortSignal?: AbortSignal): Promise<string | null>;
+    /**
+     * Returns true when the app's root tsconfig declares project `references`.
+     *
+     * Reference apps (the fullstack/3.0 template) must be type-checked with
+     * `tsc -b`, which follows references; non-reference apps use the original
+     * `tsc --noEmit ...` command. Parsed with JSON5 because tsconfig.json allows
+     * comments and trailing commas. On any read/parse failure we fall back to
+     * `false` (the proven non-build-mode command): the only templates that use
+     * references ship a well-formed tsconfig, and legacy/2.0 apps have none.
+     */
+    private appUsesProjectReferences;
+    /**
+     * Generate "shadow" tsconfigs under `.superblocks/tscheck/` that mirror the
+     * app's project-reference graph but redirect all emit into that scratch dir,
+     * and return the app-root-relative path of the shadow root config to pass to
+     * `tsc -b`. Returns `null` on any failure so the caller can fail closed to a
+     * non-emitting `tsc --noEmit` (never a plain in-tree `tsc -b`, which would
+     * emit into the app tree and break build_debug's read-only contract).
+     *
+     * Why this exists: `tsc -b` cannot run with `--noEmit` against composite
+     * projects that emit declarations (TS6310), and build mode rejects a CLI
+     * `--outDir`/`--tsBuildInfoFile` override (TS5094). The only way to relocate
+     * emit is per-project config. Each shadow:
+     *   - `extends` the original config (inheriting include/exclude/paths/etc.,
+     *     whose relative paths still resolve against the original's directory),
+     *   - sets `rootDir` to the app root so composite projects don't treat the
+     *     scratch dir as the source root (TS6059),
+     *   - overrides `outDir` + `tsBuildInfoFile` into the scratch dir,
+     *   - rewrites `references` to point at the corresponding shadow configs (so
+     *     building a referenced project also emits into the scratch dir, never the
+     *     app tree).
+     *
+     * `.superblocks/` is already excluded from dbfs sync, the vite watcher, and
+     * Clark's context, so confining emit there preserves the read-only contract.
+     */
+    private prepareReferenceShadowConfigs;
+    runLinter(filePaths: string[], abortSignal?: AbortSignal): Promise<Record<string, string[]> | null>;
+    warmLinterCache(): void;
+    /**
+     * Emit one `superblocks.npm.install.*` observation (APPS-4189 / P6.2) and
+     * annotate the active llmobs span with the same dimensions. Shared by
+     * every `AppShell` install and uninstall method so metric and span streams join on
+     * (runner, registry_host, outcome) without drift. Every value flows
+     * through the P6.1 sanitization helpers inside `recordNpmInstall`, so a
+     * raw registry hostname or token cannot reach an exported attribute even
+     * if an upstream caller forgot to scrub.
+     */
+    private observeNpmInstall;
+    /**
+     * Report a blocked controlled install to the server-side audit trail
+     * (APPS-4191 / P6.3). Only `NpmInstallBlocked` is auditable — any other
+     * failure (or success) is left to metrics (P6.2). The structured error
+     * already carries the audit-relevant fields (reason, packages, registry
+     * host, error code); the injected reporter adds org/app identity and the
+     * server throttles + sanitizes + persists. Fire-and-forget: a reporting
+     * failure must never surface to (or break) the install caller.
+     */
+    private safeAudit;
+    private maybeReportBlockedInstall;
+    reportNpmTriageVerdict(verdict: TriageVerdict): void;
+    reportNpmUserOverride(args: {
+        packages: string[];
+        reason: string;
+    }): void;
+    /**
+     * Report silent CVE/quarantine substitutions to the same audit sink as
+     * blocked installs. Best-effort; never fails the install.
+     */
+    private maybeReportSubstitutions;
+    /** Mode 2: write gate substitutions into package.json. Audit is the caller's job after install succeeds (same as Mode 1). */
+    private applyDeclaredDependencyUpgrades;
+    remediateDeclaredDependencies(abortSignal?: AbortSignal): Promise<void>;
+    /**
+     * Env overlay for AppShell-spawned npm/pnpm installs in the live-edit
+     * pod. Routes npm's per-run debug log into `<app>/.superblocks/logs` via
+     * `NPM_CONFIG_LOGS_DIR` so a failed agent install leaves a collectable log
+     * in a predictable place — the same convention the CLI dev-server install
+     * uses (`buildInstallEnv` in the SDK). These execs otherwise inherit
+     * `process.env` implicitly, so we spread it before adding the override.
+     * pnpm has no equivalent logs-dir config and ignores the var (npm-only).
+     */
+    private installLogEnv;
+    /**
+     * Cloud edit pods force npm for agent-driven installs. npm rejects pnpm's
+     * `workspace:` protocol, so rewrite platform deps and strip any remaining
+     * workspace entries before spawning npm (APPS-3752 bootstrap does this on
+     * pod start; migration restructure and agent installs need the same guard).
+     */
+    private maybePreparePackageJsonForCloudNpm;
     runNpmInstall(abortSignal?: AbortSignal): Promise<void>;
+    /**
+     * APPS-4370. If the `prepareForPrivateRegistry` result tells us the
+     * server is unreachable AND the per-org disk marker says this org has
+     * at some prior point successfully resolved a configured registry,
+     * throw `NpmInstallBlocked(registry_unreachable)` BEFORE spawning npm.
+     *
+     * Without this short-circuit the install spawns anyway and hits one of
+     * two failure modes:
+     *   1. A previous install left a managed `.npmrc` with rotated credentials
+     *      → npm 401s mid-deploy and `classifyNpmExecError` tags it
+     *      `registry_auth_failed`, pointing the user at the wrong remediation.
+     *   2. No managed `.npmrc` exists → install silently resolves through
+     *      public npm, defeating the privacy posture during the outage.
+     *
+     * Bypassed when:
+     *   - The fetch result is anything other than `unreachable` (the
+     *     existing code paths handle `configured` / `stale` / `not-configured`).
+     *   - `everConfigured` is `undefined` (no store wired in — older call
+     *     sites, test fixtures) or `false` (greenfield org / first install).
+     *
+     * `packages` flows onto the structured error so the agent loop can
+     * surface "we tried to install <these> and the registry was unreachable".
+     */
+    private maybeShortCircuitForUnreachable;
+    /**
+     * POST `/api/v1/security/package-lookup` for a batch of `{name,version}`
+     * pairs. One request — the server cap is 5000. Throws on non-2xx / network
+     * / malformed body so the caller can apply malware fail-closed.
+     */
+    private lookupPackageVulnerabilities;
+    /**
+     * Mode 1: npm dry-run + lockfile.
+     * Mode 2: `topLevel` is always declared package.json floors (CVE remediations).
+     * Cloud malware tree = floors ∪ package-lock ∪ dry-run (after workspace:
+     * rewrite). Local stays floors-only — pnpm + lingering `workspace:*` mean
+     * full-tree coverage is not available there.
+     */
+    private resolveInstallTree;
+    private resolveTreeViaNpmDryRun;
+    private treeFromNpmDryRunJson;
+    private readPackagesFromPackageLock;
+    /**
+     * Vulnerability gate. Mode 1 remediates/blocks top-level CVEs; Mode 2
+     * silently rewrites declared deps (same major) and leaves the rest.
+     * No-op when `packageLookup` is unwired. Index failures → malware fail-closed.
+     */
+    private maybeRemediateVulnerabilities;
+    /**
+     * Derive the `hasAnyRegistryConfigured` tri-state from the
+     * `NpmRegistryFetchResult` that the immediately-preceding
+     * `prepareForPrivateRegistry` call returned.
+     *
+     *   - `true`      — `configured` or `stale`. At least one row is known
+     *                   to exist (fresh fetch or last-known-good cache).
+     *   - `false`     — `not-configured`. The kill switch is off OR the
+     *                   server returned an empty list. A deliberate "no rows"
+     *                   observation.
+     *   - `undefined` — `prepareForPrivateRegistry` returned `undefined` (no
+     *                   client wired in) OR the client resolved to `unreachable`
+     *                   (server down with no usable cache). Both mean "we don't
+     *                   know"; `buildBlockedMessage` falls back to the default
+     *                   variant rather than asserting a row count.
+     *
+     * Kept narrow + private so the signal stays a single derivation site rather
+     * than something every catch handler reimplements.
+     */
+    private static deriveHasAnyRegistryConfigured;
+    /**
+     * Convert an exec failure from `npm --json` into a structured error.
+     *
+     * - When the stdout JSON matches a known registry-blocked condition (E404,
+     *   ENOTFOUND, E401, ...) we throw `NpmInstallBlocked` so the tool layer
+     *   can surface it to the agent as a structured result.
+     * - Otherwise we fall back to the legacy `NpmInstallError(stderr)` so any
+     *   pre-existing handler (e.g. agent-planning's POST_PROCESSING_ERRORED
+     *   branch) behaves exactly as it did before.
+     *
+     * Only used on the npm code path; pnpm continues to throw `NpmInstallError`
+     * directly because pnpm's `--json` error contract differs and the
+     * registry-blocked scenarios only matter in cloud-edit (which forces npm).
+     *
+     * `registryFetchResult` carries the most recent
+     * `prepareForPrivateRegistry` result so the structured error can encode
+     * whether the org had any configured registry rows at the moment of
+     * failure (used by `buildBlockedMessage` to choose between default and
+     * row-aware advice variants). The active llmobs span is annotated with the
+     * same data points so a downstream `npm.install_blocked.*` facet can
+     * correlate reason, host, and row presence.
+     */
+    private classifyNpmExecError;
+    /**
+     * Wraps an install attempt so that a `registry_auth_failed` failure
+     * triggers one cache-invalidation + re-fetch + retry cycle before
+     * throwing. The helper owns the `.npmrc` materialisation so the retry
+     * picks up a freshly-fetched token without duplicating the prep call
+     * in every install method.
+     *
+     * Guard: only one retry per call — a second `registry_auth_failed`
+     * propagates unchanged.
+     */
+    private withAuthFailedRetry;
+    runPackageManagerInstall(abortSignal?: AbortSignal): Promise<string>;
+    installSpecificPackages(packages: Array<{
+        name: string;
+        version?: string;
+        dev?: boolean;
+    }>, abortSignal?: AbortSignal, options?: InstallSpecificPackagesOptions): Promise<string>;
+    uninstallPackages(packages: string[], options?: {
+        abortSignal?: AbortSignal;
+    }): Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    private static readonly MAX_GENERATION_RUNS;
+    saveGeneratedArtifact(artifact: FileArtifact, stepId: string, runTimestamp: string): Promise<void>;
+    pruneGenerations(keepLast?: number): Promise<void>;
+    sendMessage(message: {
+        type: string;
+        payload?: any;
+    }): Promise<void>;
+    /** Check if a given path exists in the app dir. */
+    pathExists(relativePath: string): Promise<boolean>;
+    /**
+     * Clears the scratch directory used for temporary API source files.
+     * This is typically called when a draft is rejected to clean up temporary artifacts.
+     */
+    clearScratchDirectory(): Promise<void>;
+    /**
+     * Reads a single file's content from the application.
+     *
+     * Handles virtual path translation for files managed by the VirtualFileSystem:
+     * - Virtual paths are read via the appropriate handler
+     * - Regular files are read directly from disk
+     *
+     * @param relativePath - The virtual path relative to app root
+     * @param options - Optional read options
+     * @param options.offset - Line number to start reading from (1-indexed)
+     * @param options.limit - Number of lines to read
+     * @returns The file content as a string
+     * @throws Error if file does not exist or cannot be read
+     */
+    readFile(relativePath: string, options?: {
+        offset?: number;
+        limit?: number;
+    }): Promise<string>;
+    /**
+     * Internal read implementation (no queue).
+     * Use this from other methods that are already enqueued to avoid deadlock.
+     */
+    private readFileInternal;
+    /**
+     * Writes content to a file as a draft.
+     *
+     * Handles virtual path translation for files managed by the VirtualFileSystem:
+     * - Virtual paths are written via the appropriate handler
+     * - Regular files are written via the draft interface
+     *
+     * @param relativePath - Virtual path relative to app root
+     * @param content - File content to write
+     * @param options - Optional write options
+     * @param options.bypassRequireRead - Skip the read-before-write check (use for new files)
+     * @throws Error if path is blacklisted, restricted, or draft manager not configured
+     * @throws Error if file requires reading first (unless bypassed)
+     */
+    writeFile(relativePath: string, content: string, options?: {
+        bypassRequireRead?: boolean;
+    }): Promise<void>;
+    /**
+     * Internal write implementation.
+     * Called directly by writeFile (no queue wrapper needed since draftInterface queues).
+     */
+    private writeFileInternal;
+    private resolveAppRelativePath;
+    private createEmptyCopyResult;
+    private recordCopied;
+    private recordSkipped;
+    private recordRejected;
+    private finalizeCopyResult;
+    private copyFileInternal;
+    private preflightCopyFile;
+    copyFile(options: CopyFileOptions): Promise<CopyToolResult>;
+    private collectDirectoryCopyEntries;
+    copyDirectory(options: CopyDirectoryOptions): Promise<CopyToolResult>;
+    /**
+     * Deletes a file or directory as a draft operation.
+     *
+     * Handles virtual path translation for files managed by the VirtualFileSystem:
+     * - Virtual paths delete via the appropriate handler
+     * - Regular files/directories are deleted via the draft interface
+     *
+     * @param relativePath - Virtual path relative to app root
+     * @throws Error if path is protected or draft manager not configured
+     */
+    deleteFile(relativePath: string): Promise<void>;
+    /**
+     * Internal delete implementation.
+     * Called directly by deleteFile (no queue wrapper needed since draftInterface queues).
+     */
+    private deleteFileInternal;
+    /**
+     * Lists files matching patterns, returning virtual paths.
+     *
+     * Physical files managed by the VirtualFileSystem are converted to
+     * their virtual representations (e.g., apis/MyAPI/api.yaml -> apis/MyAPI.ts).
+     *
+     * @param patterns - Glob patterns to match (defaults to application files)
+     * @param options - Glob options
+     * @returns Array of matching virtual file paths
+     */
+    listFiles(patterns?: string[], options?: GlobOptionsWithFileTypesUnset): Promise<string[]>;
+    /**
+     * Lists files matching patterns with metadata.
+     *
+     * @param patterns - Glob patterns to match (defaults to application files)
+     * @param options - Options including includeMetadata: true
+     * @returns Array of FileMetadata objects
+     */
+    listFiles(patterns?: string[], options?: ListFilesOptions & {
+        includeMetadata: true;
+    }): Promise<FileMetadata[]>;
+    /**
+     * Internal list implementation (no queue).
+     * Use this from other methods that are already enqueued to avoid deadlock.
+     *
+     * @param patterns - Glob patterns to match
+     * @param options - Glob options
+     * @returns Array of virtualized file paths (physical API paths converted to virtual)
+     */
+    private listFilesInternal;
+    /**
+     * Gets metadata for a list of file paths.
+     *
+     * @param paths - Array of virtual paths to get metadata for
+     * @returns Array of FileMetadata objects (excludes paths that don't exist)
+     */
+    private getFileMetadataList;
+    /**
+     * Gets metadata for a single file path.
+     *
+     * @param virtualPath - The virtual path to get metadata for
+     * @returns FileMetadata or undefined if file doesn't exist
+     */
+    private getFileMetadata;
+    /**
+     * Gets metadata for a virtual API file.
+     * Checks scratch file first (for pending changes), then falls back to YAML.
+     *
+     * @param virtualPath - The virtual API path (e.g., "apis/MyAPI.ts")
+     * @returns FileMetadata or undefined if not found
+     */
+    private getApiFileMetadata;
+    /**
+     * Renames or moves a file.
+     *
+     * Implemented as read + write + delete to work with the draft system.
+     *
+     * @param oldPath - Current virtual path
+     * @param newPath - New virtual path
+     * @throws Error if old file doesn't exist or new path is invalid
+     * @throws Error if old file requires reading first
+     */
+    renameFile(oldPath: string, newPath: string): Promise<void>;
+    /**
+     * Checks if there are any pending draft changes.
+     *
+     * @returns true if there are uncommitted draft changes
+     */
+    hasDraftChanges(): Promise<boolean>;
+    /**
+     * Gets a unified diff of pending draft changes.
+     *
+     * @param paths - Optional specific paths to diff. If empty, diffs all changes.
+     * @returns Unified diff string
+     */
+    getDraftDiff(paths?: string[]): Promise<string>;
+    /**
+     * Gets categorized draft changes.
+     *
+     * @returns Object containing arrays of edited, added, and deleted paths
+     */
+    getDraftChanges(): Promise<DraftChanges>;
+    /**
+     * Gets the underlying draft interface for direct access.
+     *
+     * This should only be used for advanced operations that require
+     * direct access to the draft interface. Prefer using the AppShell
+     * methods when possible.
+     *
+     * @internal
+     */
+    getDraftInterface(): DraftInterface | undefined;
+    /**
+     * Check if a file must be read before it can be written.
+     *
+     * @param relativePath - The path to check
+     * @returns true if the file must be read before writing
+     */
+    isReadRequired(relativePath: string): boolean;
+    /**
+     * Mark a file as requiring a read before write.
+     *
+     * Call this when a file has been modified externally (e.g., by lint/format)
+     * to ensure the AI reads the updated content before making further changes.
+     *
+     * @param relativePath - The path to mark as requiring read
+     */
+    requireRead(relativePath: string): void;
+    /**
+     * Mark a file as having been read, allowing subsequent writes.
+     * Called internally after successful read operations.
+     */
+    private markRead;
+    private getFileOperationBlacklistOptions;
+    /**
+     * Recursively deletes directory contents by creating draft deletes.
+     */
+    private deleteDirectoryRecursive;
 }
+export {};
 //# sourceMappingURL=shell.d.ts.map

package/dist/ai-service/app-interface/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../src/ai-service/app-interface/shell.ts"],"names":[],"mappings":"AAGA,OAAO,EAAQ,KAAK,6BAA6B,EAAE,MAAM,MAAM,CAAC;AAChE,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpE,qBAAa,QAAQ;IACnB,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiB;gBAEtC,EACV,cAAc,EACd,gBAAgB,GACjB,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,cAAc,CAAC;KAClC;IAKY,SAAS,CACpB,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,CAAC,EAAE,6BAA6B,GAC1C,OAAO,CAAC,YAAY,EAAE,CAAC;IAmBb,YAAY,CACvB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IA4C9B,aAAa,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAyBrE"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../src/ai-service/app-interface/shell.ts"],"names":[],"mappings":"AAcA,OAAO,EAAQ,KAAK,6BAA6B,EAAE,MAAM,MAAM,CAAC;AAYhE,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAKhE,OAAO,EAIL,KAAK,YAAY,EAElB,MAAM,aAAa,CAAC;AAQrB,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO/D,OAAO,EACL,KAAK,iBAAiB,EAIvB,MAAM,mBAAmB,CAAC;AAgC3B,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAClC,CAAC;AAEF,KAAK,8BAA8B,GAAG;IACpC,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC;IACpC,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AA+FF;;GAEG;AACH,UAAU,gBAAiB,SAAQ,6BAA6B;IAC9D,gEAAgE;IAChE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,KAAK,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAExD,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,oBAAoB,GAAG,kBAAkB,CAAC;KACnD,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;CACJ,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAUF;;;;;;;;;;GAUG;AACH,qBAAa,QAAQ;IACnB,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,aAAa,CAAC,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IAClD;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAoB;IAEvD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAE/B;IAEV;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAoB;IAEnD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAEvC,EACV,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACvB,aAAa,GACd,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,eAAe,CAAC;QAClC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,cAAc,CAAC,EAAE,cAAc,CAAC;QAChC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QACpC,iBAAiB,EAAE,iBAAiB,CAAC;QACrC,6DAA6D;QAC7D,aAAa,EAAE,aAAa,CAAC;QAC7B,gEAAgE;QAChE,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC;;;;;;WAMG;QACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;QACtC;;;;WAIG;QACH,uBAAuB,CAAC,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,IAAI,CAAC;QACzE;;;WAGG;QACH,aAAa,CAAC,EAAE,iBAAiB,CAAC;KACnC;IAkBD;;;;OAIG;IACI,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAInD;;;OAGG;YACW,kBAAkB;IA2BnB,SAAS,CACpB,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,CAAC,EAAE,6BAA6B,EAC3C,kBAAkB,UAAO,GACxB,OAAO,CAAC,YAAY,EAAE,CAAC;IAkCb,YAAY,CACvB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAoB9B,qBAAqB,CAChC,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmFzB;;;;;;;;;OASG;YACW,wBAAwB;IAetC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,6BAA6B;IA8O9B,SAAS,CACpB,SAAS,EAAE,MAAM,EAAE,EACnB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IA+BpC,eAAe;IAItB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA4BzB;;;;;;;;OAQG;IACH,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,yBAAyB;IAuC1B,sBAAsB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAUpD,qBAAqB,CAAC,IAAI,EAAE;QACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI;IAaR;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAmBhC,6HAA6H;YAC/G,+BAA+B;IAkBhC,6BAA6B,CACxC,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;;OAKG;YACW,kCAAkC;IAWnC,aAAa,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAgGpE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,+BAA+B;IAiBvC;;;;OAIG;YACW,4BAA4B;IA2D1C;;;;;;OAMG;YACW,kBAAkB;YAkFlB,uBAAuB;IAyDrC,OAAO,CAAC,qBAAqB;YAiEf,2BAA2B;IA6EzC;;;;OAIG;YACW,6BAA6B;IA6C3C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,MAAM,CAAC,8BAA8B;IAe7C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,oBAAoB;IAuE5B;;;;;;;;;OASG;YACW,mBAAmB;IA0CpB,wBAAwB,CAAC,WAAW,CAAC,EAAE,WAAW;IAqHlD,uBAAuB,CAClC,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,EAClE,WAAW,CAAC,EAAE,WAAW,EACzB,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC,MAAM,CAAC;IA6OL,iBAAiB,CAC5B,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,GACA,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAoI9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAM;IAGpC,qBAAqB,CAChC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAsBH,gBAAgB,CAC3B,QAAQ,SAA+B,GACtC,OAAO,CAAC,IAAI,CAAC;IAgCH,WAAW,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,GAAG,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjB,mDAAmD;IACtC,UAAU,CAAC,YAAY,EAAE,MAAM;IAW5C;;;OAGG;IACU,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBnD;;;;;;;;;;;;;OAaG;IAEU,QAAQ,CACnB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5C,OAAO,CAAC,MAAM,CAAC;IAiBlB;;;OAGG;YACW,gBAAgB;IA4D9B;;;;;;;;;;;;;OAaG;IAEU,SAAS,CACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC;IAyBhB;;;OAGG;YACW,iBAAiB;IA2D/B,OAAO,CAAC,sBAAsB;IAyB9B,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,kBAAkB;YAaZ,gBAAgB;YA4ChB,iBAAiB;IA8BlB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;YAyB1D,2BAA2B;IA2D5B,aAAa,CACxB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,cAAc,CAAC;IA6D1B;;;;;;;;;OASG;IAEU,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5D;;;OAGG;YACW,kBAAkB;IA2ChC;;;;;;;;;OASG;IACU,SAAS,CACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,OAAO,CAAC,EAAE,6BAA6B,GACtC,OAAO,CAAC,MAAM,EAAE,CAAC;IAEpB;;;;;;OAMG;IACU,SAAS,CACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,OAAO,CAAC,EAAE,gBAAgB,GAAG;QAAE,eAAe,EAAE,IAAI,CAAA;KAAE,GACrD,OAAO,CAAC,YAAY,EAAE,CAAC;IAiC1B;;;;;;;OAOG;YAEW,iBAAiB;IAmC/B;;;;;OAKG;YACW,mBAAmB;IAajC;;;;;OAKG;YACW,eAAe;IA+B7B;;;;;;OAMG;YACW,kBAAkB;IA0ChC;;;;;;;;;OASG;IAEU,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CxE;;;;OAIG;IACU,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAOhD;;;;;OAKG;IACU,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAO5D;;;;OAIG;IACU,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC;IAOrD;;;;;;;;OAQG;IACI,iBAAiB,IAAI,cAAc,GAAG,SAAS;IAQtD;;;;;OAKG;IACI,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;;;OAOG;IACI,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAI9C;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gCAAgC;IAUxC;;OAEG;YACW,wBAAwB;CAkBvC"}