@theokit/sdk 5.15.1 → 5.15.3

package/dist/{registry-5TDAF7RK.js → registry-DOYBR237.js}

@@ -1,9 +1,9 @@
-export { __getSubscribersCountForTests, __resetTaskRegistryForTests, cancel, configure, get, list, submit, subscribe } from './chunk-HWMGR3HA.js';
-import './chunk-K2BQQ445.js';
+export { __getSubscribersCountForTests, __resetTaskRegistryForTests, cancel, configure, get, list, submit, subscribe } from './chunk-GEQLHBJM.js';
+import './chunk-3GQYMKVJ.js';
 import './chunk-AHKS3DKI.js';
-import './chunk-MLGETTYX.js';
-import './chunk-M4U24U6G.js';
+import './chunk-4YUIYSZO.js';
+import './chunk-AZK3QM36.js';
 import './chunk-TNFOU6SB.js';
 import './chunk-3OY6H3I7.js';
-//# sourceMappingURL=registry-5TDAF7RK.js.map
-//# sourceMappingURL=registry-5TDAF7RK.js.map
+//# sourceMappingURL=registry-DOYBR237.js.map
+//# sourceMappingURL=registry-DOYBR237.js.map

package/dist/{registry-5TDAF7RK.js.map → registry-DOYBR237.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"registry-5TDAF7RK.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"registry-DOYBR237.js"}

package/dist/{registry-W7TSCLQO.cjs → registry-PB7JFVUJ.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var chunkL7JPXZ2C_cjs = require('./chunk-L7JPXZ2C.cjs');
-require('./chunk-BUUUWQMB.cjs');
+var chunkER3BF23R_cjs = require('./chunk-ER3BF23R.cjs');
+require('./chunk-PNL63WDP.cjs');
 require('./chunk-FLDMPVUC.cjs');
-require('./chunk-BWYC7RZG.cjs');
-require('./chunk-ZOFRNNZD.cjs');
+require('./chunk-XTQWTVVI.cjs');
+require('./chunk-IZV72OEI.cjs');
 require('./chunk-CEGU5AVD.cjs');
 require('./chunk-RNXXYF22.cjs');
 
@@ -12,35 +12,35 @@ require('./chunk-RNXXYF22.cjs');
 
 Object.defineProperty(exports, "__getSubscribersCountForTests", {
   enumerable: true,
-  get: function () { return chunkL7JPXZ2C_cjs.__getSubscribersCountForTests; }
+  get: function () { return chunkER3BF23R_cjs.__getSubscribersCountForTests; }
 });
 Object.defineProperty(exports, "__resetTaskRegistryForTests", {
   enumerable: true,
-  get: function () { return chunkL7JPXZ2C_cjs.__resetTaskRegistryForTests; }
+  get: function () { return chunkER3BF23R_cjs.__resetTaskRegistryForTests; }
 });
 Object.defineProperty(exports, "cancel", {
   enumerable: true,
-  get: function () { return chunkL7JPXZ2C_cjs.cancel; }
+  get: function () { return chunkER3BF23R_cjs.cancel; }
 });
 Object.defineProperty(exports, "configure", {
   enumerable: true,
-  get: function () { return chunkL7JPXZ2C_cjs.configure; }
+  get: function () { return chunkER3BF23R_cjs.configure; }
 });
 Object.defineProperty(exports, "get", {
   enumerable: true,
-  get: function () { return chunkL7JPXZ2C_cjs.get; }
+  get: function () { return chunkER3BF23R_cjs.get; }
 });
 Object.defineProperty(exports, "list", {
   enumerable: true,
-  get: function () { return chunkL7JPXZ2C_cjs.list; }
+  get: function () { return chunkER3BF23R_cjs.list; }
 });
 Object.defineProperty(exports, "submit", {
   enumerable: true,
-  get: function () { return chunkL7JPXZ2C_cjs.submit; }
+  get: function () { return chunkER3BF23R_cjs.submit; }
 });
 Object.defineProperty(exports, "subscribe", {
   enumerable: true,
-  get: function () { return chunkL7JPXZ2C_cjs.subscribe; }
+  get: function () { return chunkER3BF23R_cjs.subscribe; }
 });
-//# sourceMappingURL=registry-W7TSCLQO.cjs.map
-//# sourceMappingURL=registry-W7TSCLQO.cjs.map
+//# sourceMappingURL=registry-PB7JFVUJ.cjs.map
+//# sourceMappingURL=registry-PB7JFVUJ.cjs.map

package/dist/{registry-W7TSCLQO.cjs.map → registry-PB7JFVUJ.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"registry-W7TSCLQO.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"registry-PB7JFVUJ.cjs"}

package/dist/sandbox/index.cjs

@@ -1,14 +1,14 @@
 'use strict';
 
-var chunkFLDHYF5C_cjs = require('../chunk-FLDHYF5C.cjs');
+var chunkX2XLSE2N_cjs = require('../chunk-X2XLSE2N.cjs');
 require('../chunk-2ZPEDVLM.cjs');
 var chunkCEGU5AVD_cjs = require('../chunk-CEGU5AVD.cjs');
 var chunkRNXXYF22_cjs = require('../chunk-RNXXYF22.cjs');
-var child_process = require('child_process');
-var fs = require('fs');
-var path = require('path');
-var crypto = require('crypto');
-var os = require('os');
+var node_child_process = require('node:child_process');
+var node_fs = require('node:fs');
+var path = require('node:path');
+var node_crypto = require('node:crypto');
+var node_os = require('node:os');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -24,7 +24,7 @@ function resolveEntry(entry) {
     throw new TypeError(`denyReadPaths: "${entry}" is not an absolute path`);
   }
   try {
-    return fs.realpathSync(entry);
+    return node_fs.realpathSync(entry);
   } catch (cause) {
     throw new TypeError(`denyReadPaths: "${entry}" cannot be resolved: ${String(cause)}`);
   }
@@ -32,7 +32,7 @@ function resolveEntry(entry) {
 function keptRoots(cwd) {
   let real = cwd;
   try {
-    real = fs.realpathSync(cwd);
+    real = node_fs.realpathSync(cwd);
   } catch {
   }
   return [.../* @__PURE__ */ new Set([cwd, real, ...KEPT_ROOTS_ALWAYS])];
@@ -57,7 +57,7 @@ function denyReadFlags(paths, policy) {
     resolved.add(target);
   }
   return [...resolved].flatMap(
-    (target) => fs.statSync(target).isDirectory() ? ["--tmpfs", target] : ["--ro-bind", "/dev/null", target]
+    (target) => node_fs.statSync(target).isDirectory() ? ["--tmpfs", target] : ["--ro-bind", "/dev/null", target]
   );
 }
 function refuseUnhonourableDenyRead(paths, mode, detect) {
@@ -65,7 +65,7 @@ function refuseUnhonourableDenyRead(paths, mode, detect) {
   if (mode === "danger-full-access") denyReadFlags(paths, { mode, cwd: "/" });
   const detection = detect();
   if (!detection.ok) {
-    throw new chunkFLDHYF5C_cjs.SandboxNotAvailableError(
+    throw new chunkX2XLSE2N_cjs.SandboxNotAvailableError(
       `denyReadPaths needs kernel confinement and it is unavailable (${detection.reason}); refusing to run unconfined`
     );
   }
@@ -94,7 +94,7 @@ function buildBwrapArgv(mode, opts) {
   const denyFlags = denyReadFlags(opts.denyReadPaths, { mode, cwd });
   if (mode === "danger-full-access") return null;
   const gitDir = path__default.default.join(cwd, ".git");
-  const hasGit = opts.gitDirExists ?? fs.existsSync(gitDir);
+  const hasGit = opts.gitDirExists ?? node_fs.existsSync(gitDir);
   const argv = [
     // core, always (bwrap.rs:318-332; user+pid namespaces explicit so it works as root in containers)
     "--new-session",
@@ -150,7 +150,7 @@ var realProbes = {
   which: () => {
     realProbeRuns++;
     try {
-      const out = child_process.execFileSync("which", ["bwrap"], { encoding: "utf8", timeout: 2e3 }).trim();
+      const out = node_child_process.execFileSync("which", ["bwrap"], { encoding: "utf8", timeout: 2e3 }).trim();
       if (!out || out.startsWith(process.cwd() + path__default.default.sep)) return null;
       return out;
     } catch {
@@ -159,7 +159,7 @@ var realProbes = {
   },
   helpText: (bin) => {
     try {
-      return child_process.execFileSync(bin, ["--help"], { encoding: "utf8", timeout: 2e3 });
+      return node_child_process.execFileSync(bin, ["--help"], { encoding: "utf8", timeout: 2e3 });
     } catch (err) {
       const e = err;
       return [e.stdout, e.stderr].filter(Boolean).join("\n") || null;
@@ -167,7 +167,7 @@ var realProbes = {
   },
   userns: (bin) => {
     try {
-      child_process.execFileSync(bin, ["--unshare-user", "--unshare-net", "--ro-bind", "/", "/", "/bin/true"], {
+      node_child_process.execFileSync(bin, ["--unshare-user", "--unshare-net", "--ro-bind", "/", "/", "/bin/true"], {
         timeout: 500,
         stdio: "ignore"
       });
@@ -180,7 +180,7 @@ var realProbes = {
 var memo;
 function detectBwrapMemoized(probes = realProbes) {
   memo ??= detectBwrap(probes);
-  if (memo.ok && !fs.existsSync(memo.bin)) {
+  if (memo.ok && !node_fs.existsSync(memo.bin)) {
     memo = { ok: false, reason: `bwrap disappeared from ${memo.bin} after detection` };
   }
   return memo;
@@ -191,7 +191,7 @@ function resetBwrapMemo() {
 var CONTAINER_WORKDIR = "/workspace";
 function defaultRunner(bin) {
   return (args, { input, timeoutMs, maxOutputBytes }) => new Promise((resolve2, reject) => {
-    const child = child_process.spawn(bin, [...args], { stdio: ["pipe", "pipe", "pipe"] });
+    const child = node_child_process.spawn(bin, [...args], { stdio: ["pipe", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     let timedOut = false;
@@ -219,7 +219,7 @@ function defaultRunner(bin) {
     child.stdin.end(input);
   });
 }
-var DockerSandbox = class extends chunkFLDHYF5C_cjs.SandboxBackend {
+var DockerSandbox = class extends chunkX2XLSE2N_cjs.SandboxBackend {
   networkPolicy;
   image;
   network;
@@ -229,7 +229,7 @@ var DockerSandbox = class extends chunkFLDHYF5C_cjs.SandboxBackend {
   constructor(config = {}) {
     super({
       ...config,
-      workDir: config.workDir ?? fs.mkdtempSync(path.join(os.tmpdir(), "theokit-docker-ws-"))
+      workDir: config.workDir ?? node_fs.mkdtempSync(path.join(node_os.tmpdir(), "theokit-docker-ws-"))
     });
     this.image = config.image ?? "alpine:3";
     this.network = config.network ?? false;
@@ -269,7 +269,7 @@ var DockerSandbox = class extends chunkFLDHYF5C_cjs.SandboxBackend {
     ];
   }
   async run(interactive, argv, timeoutMs, input) {
-    const name = `theokit-sbx-${crypto.randomBytes(6).toString("hex")}`;
+    const name = `theokit-sbx-${node_crypto.randomBytes(6).toString("hex")}`;
     const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;
     let r;
     try {
@@ -279,7 +279,7 @@ var DockerSandbox = class extends chunkFLDHYF5C_cjs.SandboxBackend {
         maxOutputBytes: max
       });
     } catch (e) {
-      throw new chunkFLDHYF5C_cjs.SandboxNotAvailableError(
+      throw new chunkX2XLSE2N_cjs.SandboxNotAvailableError(
         `docker could not be started: ${e instanceof Error ? e.message : String(e)}`
       );
     }
@@ -303,7 +303,7 @@ var DockerSandbox = class extends chunkFLDHYF5C_cjs.SandboxBackend {
   async uploadFile(path3, content) {
     const target = path3.startsWith("/") ? path.posix.normalize(path3) : path.posix.normalize(`${CONTAINER_WORKDIR}/${path3}`);
     if (target !== CONTAINER_WORKDIR && !target.startsWith(`${CONTAINER_WORKDIR}/`)) {
-      throw new chunkFLDHYF5C_cjs.SandboxSecurityError(`uploadFile path escapes the workspace: ${path3}`);
+      throw new chunkX2XLSE2N_cjs.SandboxSecurityError(`uploadFile path escapes the workspace: ${path3}`);
     }
     const r = await this.run(
       true,
@@ -430,14 +430,14 @@ var PIPE_SCRIPT = 'r() { p=$1; shift; printf "$p" | exec "$@" 3<&0 0<&4 4<&-; };
 function wrapWithSeccompProgram(bwrapArgv, command, program) {
   assertSeccompProgramShape(program);
   const words = [octalPrintfArg(program), ...bwrapArgv, "--seccomp", "3", "--", "/bin/sh", "-c"];
-  return `exec /bin/sh -c ${chunkFLDHYF5C_cjs.shellEscapePosix(PIPE_SCRIPT)} sh ${[...words, command].map(chunkFLDHYF5C_cjs.shellEscapePosix).join(" ")}`;
+  return `exec /bin/sh -c ${chunkX2XLSE2N_cjs.shellEscapePosix(PIPE_SCRIPT)} sh ${[...words, command].map(chunkX2XLSE2N_cjs.shellEscapePosix).join(" ")}`;
 }
 var programsWritten = /* @__PURE__ */ new Map();
 function rememberSeccompFile(path3, program) {
   programsWritten.set(path.resolve(path3), Buffer.from(program));
 }
 function removeDirOnExit(dir) {
-  const cleanup = () => fs.rmSync(dir, { recursive: true, force: true });
+  const cleanup = () => node_fs.rmSync(dir, { recursive: true, force: true });
   process.once("exit", cleanup);
   for (const signal of ["SIGINT", "SIGTERM"]) {
     process.prependOnceListener(signal, () => {
@@ -455,7 +455,7 @@ function wrapWithSeccompPath(bwrapArgv, policy, command, seccompPath) {
     ...bwrapArgv.slice(-3, -1)
   ];
   if (program !== void 0) return wrapWithSeccompProgram(flags, command, program);
-  return `${[...flags, "--seccomp", "3", "--"].map(chunkFLDHYF5C_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkFLDHYF5C_cjs.shellEscapePosix(command)} 3< ${chunkFLDHYF5C_cjs.shellEscapePosix(seccompPath)}`;
+  return `${[...flags, "--seccomp", "3", "--"].map(chunkX2XLSE2N_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkX2XLSE2N_cjs.shellEscapePosix(command)} 3< ${chunkX2XLSE2N_cjs.shellEscapePosix(seccompPath)}`;
 }
 function readOnlyBindForSeccompPath(mode, cwd, seccompPath, bind) {
   const file = path.resolve(seccompPath);
@@ -475,7 +475,7 @@ function wrapCommandForSandbox(mode, opts, command) {
     return wrapWithSeccompProgram([bin, ...argv.slice(0, -1)], command, opts.seccompProgram);
   }
   if (opts.seccompPath === void 0) {
-    return `${[bin, ...argv].map(chunkFLDHYF5C_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkFLDHYF5C_cjs.shellEscapePosix(command)}`;
+    return `${[bin, ...argv].map(chunkX2XLSE2N_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkX2XLSE2N_cjs.shellEscapePosix(command)}`;
   }
   return wrapWithSeccompPath([bin, ...argv], { mode, cwd: opts.cwd }, command, opts.seccompPath);
 }
@@ -498,7 +498,7 @@ function allowlistedEnv(source = process.env) {
   }
   return out;
 }
-var LinuxSandbox = class extends chunkFLDHYF5C_cjs.LocalSandbox {
+var LinuxSandbox = class extends chunkX2XLSE2N_cjs.LocalSandbox {
   mode;
   network;
   cwd;
@@ -561,7 +561,7 @@ var LinuxSandbox = class extends chunkFLDHYF5C_cjs.LocalSandbox {
     const target = path3.startsWith("/") ? path3 : `${this.cwd}/${path3}`;
     const b64 = Buffer.from(content).toString("base64");
     const r = await this.execute(
-      `mkdir -p ${chunkFLDHYF5C_cjs.shellEscapePosix(path.dirname(target))} && printf %s ${chunkFLDHYF5C_cjs.shellEscapePosix(b64)} | base64 -d > ${chunkFLDHYF5C_cjs.shellEscapePosix(target)}`
+      `mkdir -p ${chunkX2XLSE2N_cjs.shellEscapePosix(path.dirname(target))} && printf %s ${chunkX2XLSE2N_cjs.shellEscapePosix(b64)} | base64 -d > ${chunkX2XLSE2N_cjs.shellEscapePosix(target)}`
     );
     if (r.exitCode !== 0) {
       throw new Error(
@@ -585,10 +585,10 @@ function seccompPathForArch(arch, warn) {
     return void 0;
   }
   try {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ab-seccomp-"));
+    const dir = node_fs.mkdtempSync(path.join(node_os.tmpdir(), "ab-seccomp-"));
     const path3 = path.join(dir, "filter.bpf");
     const program = buildSeccompFilter({ networkRestricted: true });
-    fs.writeFileSync(path3, program);
+    node_fs.writeFileSync(path3, program);
     rememberSeccompFile(path3, program);
     removeDirOnExit(dir);
     return path3;
@@ -623,7 +623,7 @@ function resolveSandboxPosture(opts) {
 function createSandboxBackend(opts) {
   const config = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };
   refuseUnhonourableDenyRead(opts.denyReadPaths, opts.mode, opts.detect ?? detectBwrapMemoized);
-  if (opts.mode === "danger-full-access") return new chunkFLDHYF5C_cjs.LocalSandbox(config);
+  if (opts.mode === "danger-full-access") return new chunkX2XLSE2N_cjs.LocalSandbox(config);
   const detection = (opts.detect ?? detectBwrapMemoized)();
   if (!detection.ok) {
     if (!warnedUnavailable) {
@@ -633,7 +633,7 @@ function createSandboxBackend(opts) {
         `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 falling back to tool-level gating only (sandbox_mode=${opts.mode}).`
       );
     }
-    return new chunkFLDHYF5C_cjs.LocalSandbox(config);
+    return new chunkX2XLSE2N_cjs.LocalSandbox(config);
   }
   return new LinuxSandbox(config, { ...opts, bin: detection.bin });
 }
@@ -692,7 +692,7 @@ var RepoProvisionError = class extends chunkCEGU5AVD_cjs.TheokitAgentError {
 };
 var SAFE_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 async function provisionRepo(sandboxOrOpts, maybeOpts) {
-  const sandbox = maybeOpts !== void 0 ? sandboxOrOpts : new chunkFLDHYF5C_cjs.LocalSandbox();
+  const sandbox = maybeOpts !== void 0 ? sandboxOrOpts : new chunkX2XLSE2N_cjs.LocalSandbox();
   const opts = maybeOpts ?? sandboxOrOpts;
   const { repoUrl, ref, instanceId } = opts;
   if (!SAFE_INSTANCE_ID.test(instanceId)) {
@@ -705,20 +705,20 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
     throw new RepoProvisionError(instanceId, `invalid ref: must not begin with '-' (got ${ref})`);
   }
   const clone = await sandbox.execute(
-    `git -c protocol.ext.allow=never clone --quiet -- ${chunkFLDHYF5C_cjs.shellEscapePosix(repoUrl)} ${chunkFLDHYF5C_cjs.shellEscapePosix(instanceId)}`
+    `git -c protocol.ext.allow=never clone --quiet -- ${chunkX2XLSE2N_cjs.shellEscapePosix(repoUrl)} ${chunkX2XLSE2N_cjs.shellEscapePosix(instanceId)}`
   );
   if (clone.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `clone failed: ${clone.stderr.trim()}`);
   }
   const top = await sandbox.execute(
-    `git -C ${chunkFLDHYF5C_cjs.shellEscapePosix(instanceId)} rev-parse --show-toplevel`
+    `git -C ${chunkX2XLSE2N_cjs.shellEscapePosix(instanceId)} rev-parse --show-toplevel`
   );
   if (top.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `resolve repoDir failed: ${top.stderr.trim()}`);
   }
   const repoDir = top.stdout.trim();
   const checkout = await sandbox.execute(
-    `git -C ${chunkFLDHYF5C_cjs.shellEscapePosix(repoDir)} checkout --quiet ${chunkFLDHYF5C_cjs.shellEscapePosix(ref)}`
+    `git -C ${chunkX2XLSE2N_cjs.shellEscapePosix(repoDir)} checkout --quiet ${chunkX2XLSE2N_cjs.shellEscapePosix(ref)}`
   );
   if (checkout.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `checkout ${ref} failed: ${checkout.stderr.trim()}`);
@@ -728,27 +728,27 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
 
 Object.defineProperty(exports, "LocalSandbox", {
   enumerable: true,
-  get: function () { return chunkFLDHYF5C_cjs.LocalSandbox; }
+  get: function () { return chunkX2XLSE2N_cjs.LocalSandbox; }
 });
 Object.defineProperty(exports, "SandboxBackend", {
   enumerable: true,
-  get: function () { return chunkFLDHYF5C_cjs.SandboxBackend; }
+  get: function () { return chunkX2XLSE2N_cjs.SandboxBackend; }
 });
 Object.defineProperty(exports, "SandboxNotAvailableError", {
   enumerable: true,
-  get: function () { return chunkFLDHYF5C_cjs.SandboxNotAvailableError; }
+  get: function () { return chunkX2XLSE2N_cjs.SandboxNotAvailableError; }
 });
 Object.defineProperty(exports, "SandboxSecurityError", {
   enumerable: true,
-  get: function () { return chunkFLDHYF5C_cjs.SandboxSecurityError; }
+  get: function () { return chunkX2XLSE2N_cjs.SandboxSecurityError; }
 });
 Object.defineProperty(exports, "resolveSandbox", {
   enumerable: true,
-  get: function () { return chunkFLDHYF5C_cjs.resolveSandbox; }
+  get: function () { return chunkX2XLSE2N_cjs.resolveSandbox; }
 });
 Object.defineProperty(exports, "shellEscapePosix", {
   enumerable: true,
-  get: function () { return chunkFLDHYF5C_cjs.shellEscapePosix; }
+  get: function () { return chunkX2XLSE2N_cjs.shellEscapePosix; }
 });
 exports.DockerSandbox = DockerSandbox;
 exports.LinuxSandbox = LinuxSandbox;