@team-semicolon/semicolony-cli 4.18.110 → 4.18.111

package/dist/bundle.js

@@ -1524,7 +1524,7 @@ ${o}
 `),we.fsyncSync(r)}finally{we.closeSync(r)}return()=>{try{let n=we.lstatSync(t.updateLock);if(!n.isFile()||n.isSymbolicLink())throw new Error("Worker-agent update lock became unsafe");we.unlinkSync(t.updateLock)}catch(n){if(n.code!=="ENOENT")throw n}}}function O7n(t){let e={};for(let r of t)e[`profile:${r.actor_id}:context`]=r.context.sha256,e[`profile:${r.actor_id}:skills`]=Azt(r),e[`profile:${r.actor_id}:tools`]=ba(sTe(r)),e[`profile:${r.actor_id}:mcp`]=ba(rTe(r.actor_id));return e}function UE(t,e,r=384){we.mkdirSync(Rt.dirname(t),{recursive:!0});let n=`${t}.${process.pid}.tmp`;we.writeFileSync(n,e,{mode:r}),we.chmodSync(n,r),we.renameSync(n,t)}function mzt(t,e){let r=oTe(t,e);for(let c of[r.root,r.soul,r.skills,r.tools,r.config])tc(t,c);let n=we.lstatSync(r.soul),i=we.lstatSync(r.tools),s=we.lstatSync(r.config);if(!n.isFile()||n.isSymbolicLink()||(n.mode&511)!==384)throw new Error(`Worker-agent ${e.actor_id} staged context mode is invalid`);if(!i.isFile()||i.isSymbolicLink()||(i.mode&511)!==384)throw new Error(`Worker-agent ${e.actor_id} staged tools mode is invalid`);if(!s.isFile()||s.isSymbolicLink()||(s.mode&511)!==384)throw new Error(`Worker-agent ${e.actor_id} staged config mode is invalid`);let o=q7(we.readFileSync(r.soul,"utf8"),e.actor_id);if(o===null||ba(`${o}
 `)!==e.context.sha256)throw new Error(`Worker-agent ${e.actor_id} staged context digest mismatch`);let a=e.skills.map(c=>{let l=Rt.join(r.skills,c.name,"SKILL.md");tc(t,l);let u=we.lstatSync(l);if(!u.isFile()||u.isSymbolicLink()||(u.mode&511)!==420)throw new Error(`Worker-agent ${e.actor_id} staged skill mode is invalid`);let d=we.readFileSync(l);return RI(d,`Worker-agent ${e.actor_id} staged skill`),{name:c.name,sha256:ba(d)}});if(ba(Gs(a))!==Azt(e))throw new Error(`Worker-agent ${e.actor_id} staged skill digest mismatch`);if(ba(we.readFileSync(r.tools))!==ba(sTe(e)))throw new Error(`Worker-agent ${e.actor_id} staged tools digest mismatch`);if(ba(F7(we.readFileSync(r.config,"utf8"),e.actor_id)??"")!==ba(rTe(e.actor_id)))throw new Error(`Worker-agent ${e.actor_id} staged MCP projection mismatch`);RI(we.readFileSync(r.soul),"Worker-agent staged context"),RI(we.readFileSync(r.tools),"Worker-agent staged tools"),RI(we.readFileSync(r.config),"Worker-agent staged config")}function P7n(t,e,r){let n=Rt.join(t.stagingRoot,r.releaseId),i=Rt.dirname(Rt.dirname(t.stagingRoot));tc(i,n),we.mkdirSync(t.stagingRoot,{recursive:!0,mode:448});try{we.mkdirSync(n,{mode:448})}catch(s){throw s.code==="EEXIST"?new Error(`Worker-agent staging path already exists: ${n}`):s}try{for(let s of r.profiles){QL(e.hermes_home,s);let o=iR(e.hermes_home,s),a=oTe(n,s);UE(a.soul,pzt(we.readFileSync(o.soul,"utf8"),s.actor_id,s.context.content)),we.mkdirSync(a.skills,{recursive:!0,mode:448});for(let c of s.skills){let l=Rt.join(a.skills,c.name,"SKILL.md");we.mkdirSync(Rt.dirname(l),{recursive:!0,mode:448}),we.writeFileSync(l,c.content,{mode:420})}UE(a.tools,sTe(s)),UE(a.config,azt(we.readFileSync(o.config,"utf8"),s.actor_id)),mzt(n,s)}return n}catch(s){throw we.rmSync(n,{recursive:!0,force:!0}),s}}function yzt(t){let e=[],r=n=>{for(let i of we.readdirSync(n).sort()){let s=Rt.join(n,i),o=Rt.relative(t,s),a=we.lstatSync(s);if(a.isSymbolicLink())throw new Error("Worker-agent backup must not contain symlinks");if(a.isDirectory())r(s);else if(a.isFile())e.push({path:o,sha256:ba(we.readFileSync(s)),mode:a.mode&511});else throw new Error("Worker-agent backup contains an unsupported file type")}};return r(t),e}function N7n(t,e,r,n){let i=Rt.join(t.backups,`${r.releaseId}-${n.toISOString().replace(/[:.]/g,"-")}`);tc(t.root,i),we.mkdirSync(t.backups,{recursive:!0,mode:448});try{we.mkdirSync(i,{mode:448})}catch(s){throw s.code==="EEXIST"?new Error(`Worker-agent backup receipt already exists: ${i}`):s}try{let s={schema_version:1,installation_id:lg,release_id:r.releaseId,release_version:r.version,manifest_sha256:r.manifestSha256,created_at:n.toISOString(),actors:[],had_release_state:we.existsSync(t.releaseState),files:[]};for(let a of r.profiles){let c=iR(e.hermes_home,a);QL(e.hermes_home,a);let l=Rt.join(i,a.actor_id);we.mkdirSync(l),we.copyFileSync(c.soul,Rt.join(l,"SOUL.md"));let u=we.existsSync(c.skills),d=we.existsSync(c.tools);u&&we.cpSync(c.skills,Rt.join(l,"skills"),{recursive:!0}),d&&we.copyFileSync(c.tools,Rt.join(l,"tools.json")),we.copyFileSync(c.config,Rt.join(l,"config.yaml")),s.actors.push({actor_id:a.actor_id,runtime_profile:a.runtime_profile,had_skills:u,had_tools:d})}s.had_release_state&&we.copyFileSync(t.releaseState,Rt.join(i,"release-state.json")),s.files=yzt(i);let o={...s,receipt_sha256:ba(Gs(s))};return dy(Rt.join(i,"receipt.json"),o),i}catch(s){throw we.rmSync(i,{recursive:!0,force:!0}),s}}function bzt(t){let e=Rt.join(t,"receipt.json");tc(t,e);let r=we.lstatSync(e);if(!r.isFile()||r.isSymbolicLink()||(r.mode&511)!==384)throw new Error("Worker-agent backup receipt file is unsafe");let n=JSON.parse(we.readFileSync(e,"utf8"));if(!nTe(n))throw new Error("Worker-agent backup receipt must be an object");if(iTe(n,["schema_version","installation_id","release_id","release_version","manifest_sha256","created_at","actors","had_release_state","files","receipt_sha256"],"Worker-agent backup receipt"),n.schema_version!==1||n.installation_id!==lg||typeof n.release_id!="string"||typeof n.release_version!="string"||typeof n.manifest_sha256!="string"||!/^[a-f0-9]{64}$/i.test(n.manifest_sha256)||typeof n.created_at!="string"||!Number.isFinite(Date.parse(n.created_at))||typeof n.had_release_state!="boolean"||!Array.isArray(n.actors)||!Array.isArray(n.files)||typeof n.receipt_sha256!="string")throw new Error("Worker-agent backup receipt fields are invalid");let i=n.actors;if(i.length!==dd.length)throw new Error("Worker-agent backup actor set is invalid");for(let[l,u]of dd.entries()){let d=i[l];if(!nTe(d))throw new Error("Worker-agent backup actor entry is invalid");if(iTe(d,["actor_id","runtime_profile","had_skills","had_tools"],"Worker-agent backup actor"),d.actor_id!==u.actor_id||d.runtime_profile!==u.runtime_profile||typeof d.had_skills!="boolean"||typeof d.had_tools!="boolean")throw new Error("Worker-agent backup actor binding is invalid")}let s=n.files;for(let l of s){if(!nTe(l))throw new Error("Worker-agent backup file entry is invalid");if(iTe(l,["path","sha256","mode"],"Worker-agent backup file"),typeof l.path!="string"||Rt.isAbsolute(l.path)||Rt.normalize(l.path)!==l.path||l.path.startsWith("..")||typeof l.sha256!="string"||!/^[a-f0-9]{64}$/i.test(l.sha256)||typeof l.mode!="number")throw new Error("Worker-agent backup file entry is invalid")}let{receipt_sha256:o,...a}=n;if(o!==ba(Gs(a)))throw new Error("Worker-agent backup receipt digest mismatch");let c=yzt(t).filter(l=>l.path!=="receipt.json");if(Gs(c)!==Gs(s))throw new Error("Worker-agent backup file digest mismatch");return n}function Ezt(t,e,r,n){let i=bzt(t);for(let s of r){let o=iR(e.hermes_home,s);QL(e.hermes_home,s);let a=Rt.join(t,s.actor_id),c=i.actors.find(d=>d.actor_id===s.actor_id);if(!c||c.runtime_profile!==s.runtime_profile)throw new Error("Worker-agent backup actor binding does not match restore target");let l=i.files.find(d=>d.path===`${s.actor_id}/SOUL.md`);if(!l)throw new Error("Worker-agent backup is missing the profile context");UE(o.soul,we.readFileSync(Rt.join(a,"SOUL.md"),"utf8"),l.mode),we.rmSync(o.skills,{recursive:!0,force:!0}),c.had_skills&&we.cpSync(Rt.join(a,"skills"),o.skills,{recursive:!0}),we.rmSync(o.tools,{force:!0}),c.had_tools&&we.copyFileSync(Rt.join(a,"tools.json"),o.tools);let u=i.files.find(d=>d.path===`${s.actor_id}/config.yaml`);if(!u)throw new Error("Worker-agent backup is missing the profile config");UE(o.config,we.readFileSync(Rt.join(a,"config.yaml"),"utf8"),u.mode)}tc(Rt.dirname(n),n),we.rmSync(n,{force:!0}),i.had_release_state&&we.copyFileSync(Rt.join(t,"release-state.json"),n)}function L7n(t,e,r,n){for(let i of r){let s=iR(t,i),o=oTe(e,i);QL(t,i),mzt(e,i);let a=we.lstatSync(s.soul).mode&511;UE(s.soul,we.readFileSync(o.soul,"utf8"),a),n?.(`profile:${i.actor_id}:context`);let c=`${s.skills}.${process.pid}.new`;we.rmSync(c,{recursive:!0,force:!0}),we.cpSync(o.skills,c,{recursive:!0}),we.rmSync(s.skills,{recursive:!0,force:!0}),we.mkdirSync(Rt.dirname(s.skills),{recursive:!0}),we.renameSync(c,s.skills),n?.(`profile:${i.actor_id}:skills`),UE(s.tools,we.readFileSync(o.tools,"utf8")),n?.(`profile:${i.actor_id}:tools`);let l=we.lstatSync(s.config).mode&511;UE(s.config,we.readFileSync(o.config,"utf8"),l),n?.(`profile:${i.actor_id}:mcp`)}}async function wzt(t={}){let e=t.env??process.env,r=Rt.resolve(t.homeDir??e.HOME??hzt.homedir()),n=FE(r),i=tR(n.installationState);if(!i)throw new Error("Worker-agent installation state is missing");let s=t.client??lp({env:e,surface:t.surface}),o=lzt(await s.fetchActiveRelease()),a=dzt(i.hermes_home,o.profiles),c=O7n(o.profiles),l=Object.keys(c).map(h=>({id:h,current_digest:a[h]??null,desired_digest:c[h],action:a[h]===c[h]?"unchanged":a[h]===null?"create":"update"})),u=rR(n.releaseState)?.applied_release_version??null;if(t.check)return{mode:"check",status:l.every(h=>h.action==="unchanged")?"pass":"available",release_id:o.releaseId,manifest_sha256:o.manifestSha256,installed:u,target:o.version,targets:l};let d=(t.now??(()=>new Date))(),f=gzt(n,d);try{let h=lzt(await s.fetchActiveRelease());if(h.releaseId!==o.releaseId||h.version!==o.version||h.manifestSha256!==o.manifestSha256)throw new Error("Worker-agent active release changed between plan and apply");let A=dzt(i.hermes_home,h.profiles),g=Object.keys(c).map(b=>({id:b,current_digest:A[b]??null,desired_digest:c[b],action:A[b]===c[b]?"unchanged":A[b]===null?"create":"update"})),m=P7n(n,i,h),y;try{y=N7n(n,i,h,d)}catch(b){throw we.rmSync(m,{recursive:!0,force:!0}),b}try{L7n(i.hermes_home,m,h.profiles,t.afterTargetApply);let b={schema_version:2,profile_id:"semo-ops-worker-agent",installation_id:"hermes-principals@hermes",applied_release_id:h.releaseId,applied_release_version:h.version,manifest_sha256:h.manifestSha256,managed_target_digests:c,backup_receipt:y,applied_at:d.toISOString(),last_doctor_status:"pass",last_doctor_at:d.toISOString(),required_doctor_checks:[...h.requiredChecks]},E=await(t.doctor??(async()=>{let{runWorkerAgentDoctor:I}=await Promise.resolve().then(()=>(aTe(),Czt));return I({homeDir:r,requiredChecks:h.requiredChecks,expectedReleaseState:b})}))();if(E.status!=="pass")throw new Error("Worker-agent doctor did not pass after apply");dy(n.releaseState,b);let _=await s.reportUpdate({release_id:h.releaseId,manifest_sha256:h.manifestSha256,doctor_status:"pass",doctor_summary:{checks:E.checks.map(({id:I,status:Q})=>({id:I,status:Q}))},applied_at:d.toISOString()});if(!_.reported||!_.applied)throw new Error("Worker-agent release report was not applied");return we.rmSync(m,{recursive:!0,force:!0}),{mode:"update",status:"pass",release_id:h.releaseId,manifest_sha256:h.manifestSha256,installed:h.version,target:h.version,targets:g.map(I=>({...I,current_digest:I.desired_digest,action:"unchanged"}))}}catch(b){let w=!1;try{Ezt(y,i,h.profiles,n.releaseState),w=!0,we.rmSync(m,{recursive:!0,force:!0})}catch{throw dy(n.rollbackFailure,{schema_version:1,release_id:h.releaseId,installation_id:lg,staging_path:m,backup_receipt:y,rollback_status:"fail",failed_at:d.toISOString()}),new Error(`Worker-agent restore failed; preserved staging=${m} backup=${y}`)}dy(n.rollbackFailure,{schema_version:1,release_id:h.releaseId,installation_id:lg,rollback_status:"restored",failed_at:d.toISOString()});try{await s.reportUpdate({release_id:h.releaseId,manifest_sha256:h.manifestSha256,doctor_status:"fail",doctor_summary:{phase:"apply",rollback:w?"restored":"fail"}})}catch{}throw b}}finally{f()}}function _zt(t){return[`SEMO Ops Worker-agent ${t.mode}: ${t.status}`,`  release=${t.release_id} manifest_sha256=${t.manifest_sha256}`,`  installed=${t.installed??"none"} target=${t.target}`,...t.targets.map(e=>`  ${e.action} ${e.id}`)].join(`
 `)}var fzt,we,hzt,Rt,U7,ba,Azt,sTe,TI,j7=H(()=>{"use strict";fzt=require("node:crypto"),we=v(require("node:fs")),hzt=v(require("node:os")),Rt=v(require("node:path"));bB();Mh();D7();SL();czt();U7=(t,e)=>`<!-- SEMO_OPS_WORKER_AGENT_RELEASE:${t}:${e} -->`,ba=t=>(0,fzt.createHash)("sha256").update(t).digest("hex"),Azt=t=>ba(Gs(t.skills.map(({name:e,sha256:r})=>({name:e,sha256:r})))),sTe=t=>`${JSON.stringify({tools:t.tools},null,2)}
-`;TI={extractManaged:q7,replaceManaged:pzt,restoreBackup:Ezt,validateWorkerAgentBackupReceipt:bzt,acquireUpdateLock:gzt,extractWorkerAgentMcp:F7}});function DL(t){return new Error(t?`Worker-agent KB request failed with HTTP ${t}`:"Worker-agent KB request failed")}function vzt(t,e){let r=sR.join(t,`${e}.token`),n=$7.lstatSync(r);if(!n.isFile()||n.isSymbolicLink()||n.mode&63)throw new Error(`${e} credential file must be a private regular file`);let i=$7.readFileSync(r,"utf8").trim();if(!new RegExp(`^wck_${e}_[A-Za-z0-9_-]{32,}$`).test(i))throw new Error(`${e} credential has an invalid format`);return i}function kzt(t){if(!sR.isAbsolute(t)||sR.normalize(t)!==t)throw new Error("credentials directory must be a normalized absolute path");let e=vzt(t,"semi"),r=vzt(t,"colony");if((0,RL.createHash)("sha256").update(e).digest("hex")===(0,RL.createHash)("sha256").update(r).digest("hex"))throw new Error("actor credentials must be distinct");return{semi:e,colony:r}}function zl(t){let e=new URL(t),r=e.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(e.hostname);if(e.username||e.password||e.search||e.hash||e.protocol!=="https:"&&!r)throw new Error("Gateway URL must be HTTPS or loopback HTTP without credentials/query/fragment");return e.toString().replace(/\/$/,"")}async function xzt(t){let e=Date.now(),r=(0,RL.randomUUID)(),n=new AbortController,i=setTimeout(()=>n.abort(),t.timeoutMs??5e3);try{let s=await(t.fetchImpl??fetch)(`${zl(t.baseUrl)}${t.operation==="kb_get"?"/kb/get":"/kb/search"}`,{method:"POST",headers:{authorization:`Bearer ${t.tokens[t.actor]}`,"content-type":"application/json","x-correlation-id":r},body:JSON.stringify(t.args),signal:n.signal});if(Number(s.headers.get("content-length")??0)>Izt)throw DL();let a=await s.text();if(!s.ok)throw DL(s.status);if(Buffer.byteLength(a)>Izt||F7n.test(a))throw DL();let c;try{c=JSON.parse(a)}catch{throw DL()}return{correlation_id:r,actor:t.actor,operation:t.operation,status:"success",latency_ms:Date.now()-e,result:c}}catch(s){throw s instanceof Error&&/^Worker-agent KB request failed/.test(s.message)?s:DL()}finally{clearTimeout(i)}}var RL,$7,sR,F7n,Izt,oR=H(()=>{"use strict";RL=require("node:crypto"),$7=v(require("node:fs")),sR=v(require("node:path")),F7n=/\bwck_[A-Za-z0-9_-]{20,}\b|\bAuthorization\b|postgres(?:ql)?:\/\//i,Izt=1024*1024});function fy(t,e){return new Error(e?`Worker-agent ${t} request failed with HTTP ${e}`:`Worker-agent ${t} request failed`)}async function Szt(t,e,r,n,i){let s=new AbortController,o=setTimeout(()=>s.abort(),r.timeoutMs??5e3);try{let a=await(r.fetchImpl??fetch)(`${zl(r.baseUrl)}${e}`,{method:"POST",headers:{authorization:`Bearer ${r.tokens[r.actor]}`,"content-type":"application/json","x-correlation-id":i},body:JSON.stringify(n),signal:s.signal});if(Number(a.headers.get("content-length")??0)>Bzt)throw fy(t);let c=await a.text();if(!a.ok)throw fy(t,a.status);if(Buffer.byteLength(c)>Bzt||U7n.test(c))throw fy(t);let l;try{l=JSON.parse(c)}catch{throw fy(t)}if(!l||typeof l!="object"||Array.isArray(l))throw fy(t);return l}finally{clearTimeout(o)}}async function Qzt(t){let e=Date.now(),r=(0,cTe.randomUUID)();try{let n=await Szt("action_list","/action/list",t,t.payload,r);if(!Array.isArray(n.items))throw fy("action_list");return{correlation_id:r,actor:t.actor,operation:"action_list",status:"success",latency_ms:Date.now()-e,items:n.items}}catch(n){throw n instanceof Error&&/^Worker-agent action_list request failed/.test(n.message)?n:fy("action_list")}}async function Dzt(t){let e=Date.now(),r=(0,cTe.randomUUID)();try{let i=(await Szt("action_create","/action/create",t,t.payload,r)).action_item_id;if(typeof i!="string"||i.length<36)throw fy("action_create");return{correlation_id:r,actor:t.actor,operation:"action_create",status:"success",latency_ms:Date.now()-e,action_item_id:i}}catch(n){throw n instanceof Error&&/^Worker-agent action_create request failed/.test(n.message)?n:fy("action_create")}}var cTe,Bzt,U7n,Rzt=H(()=>{"use strict";cTe=require("node:crypto");oR();Bzt=256*1024,U7n=/\bwck_[A-Za-z0-9_-]{20,}\b|\bAuthorization\b|postgres(?:ql)?:\/\/|\bDATABASE_URL\b|\bSEMO_OPS_WORKER_KB_TOKEN\b/i});function aR(t){if(!qE.isAbsolute(t)||qE.normalize(t)!==t)throw new Error("feedback spool root must be a normalized absolute path");return t}function uTe(t){let e=aR(t);ct.existsSync(e)||ct.mkdirSync(e,{recursive:!0,mode:448});let r=ct.lstatSync(e);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("feedback spool root is unsafe");return ct.chmodSync(e,448),e}function H7(t,e){return qE.join(aR(t),`${e}.jsonl`)}function Mzt(t){return qE.join(aR(t),".replay.lock")}function dTe(t){let e=ct.lstatSync(t);if(!e.isFile()||e.isSymbolicLink())throw new Error("feedback spool file is unsafe");if(e.mode&63)throw new Error("feedback spool file is not private")}function j7n(t){ct.existsSync(t)&&dTe(t);let e=ct.constants.O_WRONLY|ct.constants.O_CREAT|ct.constants.O_APPEND|(ct.constants.O_NOFOLLOW??0),r=ct.openSync(t,e,384);if(!ct.fstatSync(r).isFile())throw ct.closeSync(r),new Error("feedback spool file is unsafe");return ct.fchmodSync(r,384),r}function $7n(t,e){let r=uTe(t),n=H7(r,e.actor),i=JSON.stringify(e);if(MI.test(i))throw new Error("feedback spool record is unsafe");let s=j7n(n);try{ct.writeSync(s,`${i}
+`;TI={extractManaged:q7,replaceManaged:pzt,restoreBackup:Ezt,validateWorkerAgentBackupReceipt:bzt,acquireUpdateLock:gzt,extractWorkerAgentMcp:F7}});function DL(t){return new Error(t?`Worker-agent KB request failed with HTTP ${t}`:"Worker-agent KB request failed")}function vzt(t,e){let r=sR.join(t,`${e}.token`),n=$7.lstatSync(r);if(!n.isFile()||n.isSymbolicLink()||n.mode&63)throw new Error(`${e} credential file must be a private regular file`);let i=$7.readFileSync(r,"utf8").trim();if(!new RegExp(`^wck_${e}_[A-Za-z0-9_-]{32,}$`).test(i))throw new Error(`${e} credential has an invalid format`);return i}function kzt(t){if(!sR.isAbsolute(t)||sR.normalize(t)!==t)throw new Error("credentials directory must be a normalized absolute path");let e=vzt(t,"semi"),r=vzt(t,"colony");if((0,RL.createHash)("sha256").update(e).digest("hex")===(0,RL.createHash)("sha256").update(r).digest("hex"))throw new Error("actor credentials must be distinct");return{semi:e,colony:r}}function zl(t){let e=new URL(t),r=e.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(e.hostname);if(e.username||e.password||e.search||e.hash||e.protocol!=="https:"&&!r)throw new Error("Gateway URL must be HTTPS or loopback HTTP without credentials/query/fragment");return e.toString().replace(/\/$/,"")}async function xzt(t){let e=Date.now(),r=(0,RL.randomUUID)(),n=new AbortController,i=setTimeout(()=>n.abort(),t.timeoutMs??5e3);try{let s=await(t.fetchImpl??fetch)(`${zl(t.baseUrl)}${t.operation==="kb_get"?"/kb/get":"/kb/search"}`,{method:"POST",headers:{authorization:`Bearer ${t.tokens[t.actor]}`,"content-type":"application/json","x-correlation-id":r},body:JSON.stringify(t.args),signal:n.signal});if(Number(s.headers.get("content-length")??0)>Izt)throw DL();let a=await s.text();if(!s.ok)throw DL(s.status);if(Buffer.byteLength(a)>Izt||F7n.test(a))throw DL();let c;try{c=JSON.parse(a)}catch{throw DL()}return{correlation_id:r,actor:t.actor,operation:t.operation,status:"success",latency_ms:Date.now()-e,result:c}}catch(s){throw s instanceof Error&&/^Worker-agent KB request failed/.test(s.message)?s:DL()}finally{clearTimeout(i)}}var RL,$7,sR,F7n,Izt,oR=H(()=>{"use strict";RL=require("node:crypto"),$7=v(require("node:fs")),sR=v(require("node:path")),F7n=/\bwck_[A-Za-z0-9_-]{20,}\b|\bAuthorization\b|postgres(?:ql)?:\/\//i,Izt=1024*1024});function fy(t,e){return new Error(e?`Worker-agent ${t} request failed with HTTP ${e}`:`Worker-agent ${t} request failed`)}async function Szt(t,e,r,n,i){let s=new AbortController,o=setTimeout(()=>s.abort(),r.timeoutMs??5e3);try{let a=await(r.fetchImpl??fetch)(`${zl(r.baseUrl)}${e}`,{method:"POST",headers:{authorization:`Bearer ${r.tokens[r.actor]}`,"content-type":"application/json","x-correlation-id":i},body:JSON.stringify(n),signal:s.signal});if(Number(a.headers.get("content-length")??0)>Bzt)throw fy(t);let c=await a.text();if(!a.ok)throw fy(t,a.status);if(Buffer.byteLength(c)>Bzt||U7n.test(c))throw fy(t);let l;try{l=JSON.parse(c)}catch{throw fy(t)}if(!l||typeof l!="object"||Array.isArray(l))throw fy(t);return l}finally{clearTimeout(o)}}async function Qzt(t){let e=Date.now(),r=(0,cTe.randomUUID)();try{let n=await Szt("action_list","/action/list",t,t.payload,r);if(!Array.isArray(n.items))throw fy("action_list");return{correlation_id:r,actor:t.actor,operation:"action_list",status:"success",latency_ms:Date.now()-e,items:n.items}}catch(n){throw n instanceof Error&&/^Worker-agent action_list request failed/.test(n.message)?n:fy("action_list")}}async function Dzt(t){let e=Date.now(),r=(0,cTe.randomUUID)();try{let{project:n,...i}=t.payload,s={...i,project_domain:n},a=(await Szt("action_create","/action/create",t,s,r)).action_item_id;if(typeof a!="string"||a.length<36)throw fy("action_create");return{correlation_id:r,actor:t.actor,operation:"action_create",status:"success",latency_ms:Date.now()-e,action_item_id:a}}catch(n){throw n instanceof Error&&/^Worker-agent action_create request failed/.test(n.message)?n:fy("action_create")}}var cTe,Bzt,U7n,Rzt=H(()=>{"use strict";cTe=require("node:crypto");oR();Bzt=256*1024,U7n=/\bwck_[A-Za-z0-9_-]{20,}\b|\bAuthorization\b|postgres(?:ql)?:\/\/|\bDATABASE_URL\b|\bSEMO_OPS_WORKER_KB_TOKEN\b/i});function aR(t){if(!qE.isAbsolute(t)||qE.normalize(t)!==t)throw new Error("feedback spool root must be a normalized absolute path");return t}function uTe(t){let e=aR(t);ct.existsSync(e)||ct.mkdirSync(e,{recursive:!0,mode:448});let r=ct.lstatSync(e);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("feedback spool root is unsafe");return ct.chmodSync(e,448),e}function H7(t,e){return qE.join(aR(t),`${e}.jsonl`)}function Mzt(t){return qE.join(aR(t),".replay.lock")}function dTe(t){let e=ct.lstatSync(t);if(!e.isFile()||e.isSymbolicLink())throw new Error("feedback spool file is unsafe");if(e.mode&63)throw new Error("feedback spool file is not private")}function j7n(t){ct.existsSync(t)&&dTe(t);let e=ct.constants.O_WRONLY|ct.constants.O_CREAT|ct.constants.O_APPEND|(ct.constants.O_NOFOLLOW??0),r=ct.openSync(t,e,384);if(!ct.fstatSync(r).isFile())throw ct.closeSync(r),new Error("feedback spool file is unsafe");return ct.fchmodSync(r,384),r}function $7n(t,e){let r=uTe(t),n=H7(r,e.actor),i=JSON.stringify(e);if(MI.test(i))throw new Error("feedback spool record is unsafe");let s=j7n(n);try{ct.writeSync(s,`${i}
 `),ct.fsyncSync(s)}finally{ct.closeSync(s)}return fTe(r,e.actor).length}function Ozt(t){if(!t||typeof t!="object"||Array.isArray(t))return!1;let e=t,r=new Set(["category","summary","failed_rule","severity","evidence","proposed_fix"]);if(Object.keys(e).some(i=>!r.has(i))||!["context-failure","env-drift","policy-gap","tooling"].includes(String(e.category)))return!1;let n=(i,s,o)=>typeof i=="string"&&i.length>=s&&i.length<=o&&i.trim()===i&&![...i].some(a=>a.charCodeAt(0)<32)&&!MI.test(i);return!n(e.summary,8,500)||e.severity!=null&&!["low","normal","high","urgent"].includes(String(e.severity))||e.failed_rule!=null&&!n(e.failed_rule,1,500)||e.evidence!=null&&!n(e.evidence,1,1e4)||e.proposed_fix!=null&&!n(e.proposed_fix,1,1e4)?!1:!MI.test(JSON.stringify(e))}function W7n(t,e){if(!t||typeof t!="object"||Array.isArray(t))return!1;let r=t;return Object.keys(r).sort().join(",")===["actor","attempts","payload","queued_at","schema_version"].sort().join(",")&&r.schema_version===1&&r.actor===e&&typeof r.queued_at=="string"&&!Number.isNaN(Date.parse(r.queued_at))&&Number.isInteger(r.attempts)&&r.attempts>=1&&r.attempts<=Number.MAX_SAFE_INTEGER&&Ozt(r.payload)}function fTe(t,e){let r=aR(t),n=H7(r,e);if(!ct.existsSync(n))return[];dTe(n);let i=ct.readFileSync(n,"utf8");if(!i)return[];if(MI.test(i))throw new Error("feedback spool file is unsafe");return(i.endsWith(`
 `)?i.slice(0,-1).split(`
 `):i.split(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-semicolon/semicolony-cli",
-  "version": "4.18.110",
+  "version": "4.18.111",
   "description": "SemiColony CLI - AI operations and agent orchestration installer",
   "main": "dist/bundle.js",
   "bin": {