@tickernelz/paperclip-pro-adapter-utils 2026.925.0

package/dist/login-runner-lifecycle.js

@@ -0,0 +1,52 @@
+// The shared login-runner lifecycle contract. Both login runners use these
+// types: the Codex device-login runner and the Claude setup-token runner. The
+// module defines the runner outcome union, the result base type, the fixed-log
+// callback type, the timeout and cancellation options, the dispose contract, and
+// the timeout race helper. The module holds types and one pure helper only. It
+// does not change runner behavior.
+//
+// Security (secret handling): the outcome and the result carry only a fixed,
+// non-secret status. They never carry a URL, a code, or a token byte. The log
+// callback receives only fixed status lines. Each runner keeps this rule.
+/**
+ * Races the streaming `work` against the timeout and the cancellation signal. The
+ * work result resolves the race with an `exit` status; the timeout resolves it
+ * with a `timeout` status; the signal resolves it with a `cancelled` status. A
+ * pre-aborted signal resolves the race with a `cancelled` status at once, before
+ * the helper starts the timer or listens to the work. A work error rejects the
+ * race, so the caller can convert it to a fixed, non-secret error. A late work
+ * rejection after the race already settled is consumed here, so it never becomes
+ * an unhandled rejection. The helper clears the timer and removes the signal
+ * listener on the first settle.
+ */
+export function raceLoginRunnerExit(work, timeoutMs, signal) {
+    return new Promise((resolve, reject) => {
+        // The signal is already aborted. Resolve with the cancelled status now. The
+        // "abort" event does not fire again for an already-aborted signal, so a late
+        // listener never runs. The helper still consumes a late work rejection below.
+        if (signal?.aborted) {
+            work.then(() => { }, () => { });
+            resolve({ kind: "cancelled" });
+            return;
+        }
+        let settled = false;
+        const cleanup = () => {
+            clearTimeout(timer);
+            if (signal)
+                signal.removeEventListener("abort", onAbort);
+        };
+        const finish = (run) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            run();
+        };
+        const timer = setTimeout(() => finish(() => resolve({ kind: "timeout" })), timeoutMs);
+        const onAbort = () => finish(() => resolve({ kind: "cancelled" }));
+        if (signal)
+            signal.addEventListener("abort", onAbort, { once: true });
+        work.then((value) => finish(() => resolve({ kind: "exit", exitCode: value.exitCode })), (error) => finish(() => reject(error)));
+    });
+}
+//# sourceMappingURL=login-runner-lifecycle.js.map

package/dist/login-runner-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-runner-lifecycle.js","sourceRoot":"","sources":["../src/login-runner-lifecycle.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,mCAAmC;AACnC,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AA2D1E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0C,EAC1C,SAAiB,EACjB,MAA+B;IAE/B,OAAO,IAAI,OAAO,CAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,4EAA4E;QAC5E,6EAA6E;QAC7E,8EAA8E;QAC9E,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CACP,GAAG,EAAE,GAAE,CAAC,EACR,GAAG,EAAE,GAAE,CAAC,CACT,CAAC;YACF,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,MAAM;gBAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,GAAe,EAAE,EAAE;YACjC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,GAAG,EAAE,CAAC;QACR,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CACP,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,EAC5E,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/login-runner-lifecycle.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=login-runner-lifecycle.test.d.ts.map

package/dist/login-runner-lifecycle.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-runner-lifecycle.test.d.ts","sourceRoot":"","sources":["../src/login-runner-lifecycle.test.ts"],"names":[],"mappings":""}

package/dist/login-runner-lifecycle.test.js

@@ -0,0 +1,122 @@
+import { describe, expect, it, vi } from "vitest";
+import { raceLoginRunnerExit, } from "./login-runner-lifecycle.js";
+describe("LoginRunnerOutcome", () => {
+    it("names the four terminal outcomes", () => {
+        const outcomes = ["success", "failure", "timeout", "cancelled"];
+        expect(new Set(outcomes).size).toBe(4);
+    });
+});
+describe("LoginRunnerResult", () => {
+    it("carries the fixed status fields", () => {
+        const result = { outcome: "success", exitCode: 0, promptSurfaced: true };
+        expect(result).toEqual({ outcome: "success", exitCode: 0, promptSurfaced: true });
+    });
+});
+describe("raceLoginRunnerExit", () => {
+    it("resolves with the exit kind when the work resolves first", async () => {
+        const raced = await raceLoginRunnerExit(Promise.resolve({ exitCode: 0 }), 10_000, undefined);
+        expect(raced).toEqual({ kind: "exit", exitCode: 0 });
+    });
+    it("passes a non-zero exit code through", async () => {
+        const raced = await raceLoginRunnerExit(Promise.resolve({ exitCode: 7 }), 10_000, undefined);
+        expect(raced).toEqual({ kind: "exit", exitCode: 7 });
+    });
+    it("passes a null exit code through", async () => {
+        const raced = await raceLoginRunnerExit(Promise.resolve({ exitCode: null }), 10_000, undefined);
+        expect(raced).toEqual({ kind: "exit", exitCode: null });
+    });
+    it("resolves with the timeout kind when the work hangs past the timeout", async () => {
+        const hang = new Promise(() => { });
+        const raced = await raceLoginRunnerExit(hang, 5, undefined);
+        expect(raced).toEqual({ kind: "timeout" });
+    });
+    it("resolves with the cancelled kind when the signal aborts", async () => {
+        const hang = new Promise(() => { });
+        const controller = new AbortController();
+        const racePromise = raceLoginRunnerExit(hang, 10_000, controller.signal);
+        controller.abort();
+        expect(await racePromise).toEqual({ kind: "cancelled" });
+    });
+    it("resolves with the cancelled kind when the signal is already aborted", async () => {
+        const hang = new Promise(() => { });
+        const controller = new AbortController();
+        controller.abort();
+        const raced = await raceLoginRunnerExit(hang, 10_000, controller.signal);
+        expect(raced).toEqual({ kind: "cancelled" });
+    });
+    it("returns cancelled for a pre-aborted signal even when the work can resolve", async () => {
+        const controller = new AbortController();
+        controller.abort();
+        const raced = await raceLoginRunnerExit(Promise.resolve({ exitCode: 0 }), 10_000, controller.signal);
+        expect(raced).toEqual({ kind: "cancelled" });
+    });
+    it("consumes a late work rejection after a pre-aborted signal cancels the race", async () => {
+        let rejectWork = () => { };
+        const work = new Promise((_resolve, reject) => {
+            rejectWork = reject;
+        });
+        const controller = new AbortController();
+        controller.abort();
+        const raced = await raceLoginRunnerExit(work, 10_000, controller.signal);
+        expect(raced).toEqual({ kind: "cancelled" });
+        // The pre-aborted signal already cancelled the race. The work then rejects.
+        // The helper consumes the late rejection, so it never becomes an unhandled
+        // rejection.
+        expect(() => rejectWork(new Error("late"))).not.toThrow();
+        await Promise.resolve();
+    });
+    it("rejects when the work rejects", async () => {
+        const error = new Error("the driver errored");
+        await expect(raceLoginRunnerExit(Promise.reject(error), 10_000, undefined)).rejects.toBe(error);
+    });
+    it("does not double-settle when the signal aborts after the exit", async () => {
+        const controller = new AbortController();
+        const raced = await raceLoginRunnerExit(Promise.resolve({ exitCode: 0 }), 10_000, controller.signal);
+        expect(raced).toEqual({ kind: "exit", exitCode: 0 });
+        // The race already settled. A late abort must not throw or change the result.
+        expect(() => controller.abort()).not.toThrow();
+    });
+    it("removes the abort listener after it settles on the exit", async () => {
+        const controller = new AbortController();
+        const removeSpy = vi.spyOn(controller.signal, "removeEventListener");
+        await raceLoginRunnerExit(Promise.resolve({ exitCode: 0 }), 10_000, controller.signal);
+        expect(removeSpy).toHaveBeenCalledWith("abort", expect.any(Function));
+    });
+    it("consumes a late work rejection after the timeout settles the race", async () => {
+        let rejectWork = () => { };
+        const work = new Promise((_resolve, reject) => {
+            rejectWork = reject;
+        });
+        const raced = await raceLoginRunnerExit(work, 5, undefined);
+        expect(raced).toEqual({ kind: "timeout" });
+        // The race already settled on the timeout. The work then rejects. The helper
+        // consumes the late rejection, so it never becomes an unhandled rejection.
+        expect(() => rejectWork(new Error("late"))).not.toThrow();
+        await Promise.resolve();
+    });
+});
+describe("login-runner lifecycle ordering", () => {
+    it("disposes a driver one time", async () => {
+        const dispose = vi.fn(async () => { });
+        const driver = { dispose };
+        await driver.dispose();
+        expect(dispose).toHaveBeenCalledTimes(1);
+    });
+    it("races to a terminal state, then disposes the driver", async () => {
+        const events = [];
+        const driver = {
+            dispose: vi.fn(async () => {
+                events.push("dispose");
+            }),
+        };
+        const work = Promise.resolve({ exitCode: 0 }).then((value) => {
+            events.push("exit");
+            return value;
+        });
+        const raced = await raceLoginRunnerExit(work, 10_000, undefined);
+        await driver.dispose();
+        expect(raced).toEqual({ kind: "exit", exitCode: 0 });
+        expect(events).toEqual(["exit", "dispose"]);
+    });
+});
+//# sourceMappingURL=login-runner-lifecycle.test.js.map

package/dist/login-runner-lifecycle.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-runner-lifecycle.test.js","sourceRoot":"","sources":["../src/login-runner-lifecycle.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,mBAAmB,GAKpB,MAAM,6BAA6B,CAAC;AAErC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,QAAQ,GAAyB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACtF,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAChG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,IAAI,OAAO,CAA8B,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,IAAI,GAAG,IAAI,OAAO,CAA8B,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzE,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,IAAI,OAAO,CAA8B,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAChC,MAAM,EACN,UAAU,CAAC,MAAM,CAClB,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,IAAI,UAAU,GAA2B,GAAG,EAAE,GAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,OAAO,CAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACzE,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,4EAA4E;QAC5E,2EAA2E;QAC3E,aAAa;QACb,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAChC,MAAM,EACN,UAAU,CAAC,MAAM,CAClB,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,8EAA8E;QAC9E,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QACrE,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,IAAI,UAAU,GAA2B,GAAG,EAAE,GAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,OAAO,CAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACzE,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,MAAM,MAAM,GAA0B,EAAE,OAAO,EAAE,CAAC;QAClD,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAA0B;YACpC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzB,CAAC,CAAC;SACH,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAwB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-isolation.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-isolation.integration.test.d.ts.map

package/dist/mcp-isolation.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-isolation.integration.test.d.ts","sourceRoot":"","sources":["../src/mcp-isolation.integration.test.ts"],"names":[],"mappings":""}

package/dist/mcp-isolation.integration.test.js

@@ -0,0 +1,202 @@
+import fs from "node:fs/promises";
+import http from "node:http";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterEach, describe, expect, it } from "vitest";
+import { createAcpRuntime, createAgentRegistry, createRuntimeStore, } from "acpx/runtime";
+import { commandVersion, createMcpIsolationRoot, runCommand, writeClaudeMcpConfig, writeCodexMcpConfig, } from "./test-support/mcp-isolation-harness.js";
+const repoRoot = fileURLToPath(new URL("../../..", import.meta.url));
+const stdioFixturePath = path.join(repoRoot, "scripts/mcp-fixtures/servers/stdio-fixture.mjs");
+const acpFixturePath = path.join(repoRoot, "scripts/mcp-fixtures/servers/acp-isolation-agent.mjs");
+const cleanupRoots = [];
+afterEach(async () => {
+    await Promise.all(cleanupRoots.splice(0).map((root) => fs.rm(root, { recursive: true, force: true })));
+});
+function fixtureServer(name) {
+    return {
+        name,
+        command: process.execPath,
+        args: [stdioFixturePath],
+        env: [],
+    };
+}
+async function runAcpxFixtureSession(root, sessionName, mcpServers) {
+    const runtime = createAcpRuntime({
+        cwd: repoRoot,
+        sessionStore: createRuntimeStore({ stateDir: path.join(root, `acpx-${sessionName}`) }),
+        agentRegistry: createAgentRegistry({
+            overrides: {
+                isolation_fixture: `${process.execPath} ${acpFixturePath}`,
+            },
+        }),
+        mcpServers,
+        permissionMode: "deny-all",
+        nonInteractivePermissions: "deny",
+        timeoutMs: 10_000,
+    });
+    const handle = await runtime.ensureSession({
+        sessionKey: `isolation-${sessionName}`,
+        agent: "isolation_fixture",
+        mode: "oneshot",
+        cwd: repoRoot,
+    });
+    let output = "";
+    for await (const event of runtime.runTurn({
+        handle,
+        text: "List the MCP tools visible to this session.",
+        mode: "prompt",
+        requestId: `request-${sessionName}`,
+    })) {
+        if (event.type === "text_delta" && event.stream !== "thought")
+            output += event.text;
+    }
+    await runtime.close({
+        handle,
+        reason: "isolation test complete",
+        discardPersistentState: true,
+    });
+    return JSON.parse(output);
+}
+async function startUnauthorizedAnthropicFixture() {
+    const server = http.createServer((_request, response) => {
+        response.writeHead(401, { "content-type": "application/json" });
+        response.end(JSON.stringify({ type: "error", error: { type: "authentication_error" } }));
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("Failed to bind Claude API fixture");
+    return {
+        baseUrl: `http://127.0.0.1:${address.port}`,
+        close: () => new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve())),
+    };
+}
+describe("same-machine MCP isolation", () => {
+    it("passes disjoint MCP server sets through acpx session/new and tools/list", async () => {
+        const root = await createMcpIsolationRoot("paperclip-acpx-mcp-isolation-");
+        cleanupRoots.push(root);
+        const [alpha, beta, zero] = await Promise.all([
+            runAcpxFixtureSession(root, "alpha", [fixtureServer("agent_alpha")]),
+            runAcpxFixtureSession(root, "beta", [fixtureServer("agent_beta")]),
+            runAcpxFixtureSession(root, "zero", []),
+        ]);
+        expect(alpha.map((entry) => entry.name)).toEqual(["agent_alpha"]);
+        expect(beta.map((entry) => entry.name)).toEqual(["agent_beta"]);
+        expect(alpha[0]?.tools).toContain("echo.echo");
+        expect(beta[0]?.tools).toContain("echo.echo");
+        expect(JSON.stringify(alpha)).not.toContain("agent_beta");
+        expect(JSON.stringify(beta)).not.toContain("agent_alpha");
+        expect(zero).toEqual([]);
+    }, 20_000);
+    it("keeps concurrent Claude CLI MCP configs strict and disjoint", async () => {
+        const version = await commandVersion("claude");
+        if (!version)
+            return;
+        const claudeVersionMatch = version.match(/^2\.1\.(\d+) \(Claude Code\)$/);
+        expect(claudeVersionMatch).not.toBeNull();
+        expect(Number(claudeVersionMatch?.[1])).toBeGreaterThanOrEqual(207);
+        const root = await createMcpIsolationRoot("paperclip-claude-mcp-isolation-");
+        cleanupRoots.push(root);
+        const home = path.join(root, "home");
+        const alphaConfig = path.join(root, "alpha.json");
+        const betaConfig = path.join(root, "beta.json");
+        await fs.mkdir(home, { recursive: true });
+        await writeClaudeMcpConfig(path.join(home, ".claude.json"), {
+            user_pollution: { command: process.execPath, args: [stdioFixturePath] },
+        });
+        await writeClaudeMcpConfig(alphaConfig, {
+            agent_alpha: { command: process.execPath, args: [stdioFixturePath] },
+        });
+        await writeClaudeMcpConfig(betaConfig, {
+            agent_beta: { command: process.execPath, args: [stdioFixturePath] },
+        });
+        const apiFixture = await startUnauthorizedAnthropicFixture();
+        const runClaude = async (name, configPath) => {
+            const debugPath = path.join(root, `${name}.debug.log`);
+            const args = ["-p"];
+            if (configPath)
+                args.push("--mcp-config", configPath);
+            args.push("--strict-mcp-config", "--debug-file", debugPath, "Reply with OK.");
+            const result = await runCommand("claude", args, {
+                cwd: repoRoot,
+                timeoutMs: 4_000,
+                env: {
+                    ...process.env,
+                    HOME: home,
+                    CLAUDE_CONFIG_DIR: undefined,
+                    ANTHROPIC_API_KEY: "paperclip-invalid-test-key",
+                    ANTHROPIC_BASE_URL: apiFixture.baseUrl,
+                },
+            });
+            expect(result.exitCode === 0 || result.timedOut || result.exitCode === 1).toBe(true);
+            return fs.readFile(debugPath, "utf8");
+        };
+        try {
+            const [alphaLog, betaLog, zeroLog] = await Promise.all([
+                runClaude("alpha", alphaConfig),
+                runClaude("beta", betaConfig),
+                runClaude("zero"),
+            ]);
+            expect(alphaLog).toContain('MCP server "agent_alpha": Successfully connected');
+            expect(betaLog).toContain('MCP server "agent_beta": Successfully connected');
+            expect(alphaLog).not.toContain('MCP server "agent_beta"');
+            expect(betaLog).not.toContain('MCP server "agent_alpha"');
+            for (const log of [alphaLog, betaLog, zeroLog]) {
+                expect(log).not.toContain('MCP server "user_pollution"');
+            }
+            expect(zeroLog).not.toMatch(/MCP server "[^"]+": Successfully connected/);
+        }
+        finally {
+            await apiFixture.close();
+        }
+    }, 20_000);
+    it("keeps concurrent Codex homes disjoint and supports CLI MCP overrides", async () => {
+        const version = await commandVersion("codex");
+        if (!version)
+            return;
+        expect(version).toMatch(/^codex-cli \d+\.\d+\.\d+$/);
+        const root = await createMcpIsolationRoot("paperclip-codex-mcp-isolation-");
+        cleanupRoots.push(root);
+        const home = path.join(root, "home");
+        const alphaHome = path.join(root, "codex-alpha");
+        const betaHome = path.join(root, "codex-beta");
+        const zeroHome = path.join(root, "codex-zero");
+        await writeCodexMcpConfig(path.join(home, ".codex"), {
+            user_pollution: { command: process.execPath, args: [stdioFixturePath] },
+        });
+        await writeCodexMcpConfig(alphaHome, {
+            agent_alpha: { command: process.execPath, args: [stdioFixturePath] },
+        });
+        await writeCodexMcpConfig(betaHome, {
+            agent_beta: { command: process.execPath, args: [stdioFixturePath] },
+        });
+        await fs.mkdir(zeroHome, { recursive: true });
+        const runList = (codexHome, args = []) => runCommand("codex", [...args, "mcp", "list"], {
+            cwd: repoRoot,
+            env: { ...process.env, HOME: home, CODEX_HOME: codexHome },
+        });
+        const [alpha, beta, zero, override] = await Promise.all([
+            runList(alphaHome),
+            runList(betaHome),
+            runList(zeroHome),
+            runList(zeroHome, [
+                "-c",
+                `mcp_servers.override_agent.command=${JSON.stringify(process.execPath)}`,
+                "-c",
+                `mcp_servers.override_agent.args=${JSON.stringify([stdioFixturePath])}`,
+            ]),
+        ]);
+        for (const result of [alpha, beta, zero, override]) {
+            expect(result.timedOut).toBe(false);
+            expect(result.exitCode).toBe(0);
+            expect(`${result.stdout}${result.stderr}`).not.toContain("user_pollution");
+        }
+        expect(alpha.stdout).toContain("agent_alpha");
+        expect(alpha.stdout).not.toContain("agent_beta");
+        expect(beta.stdout).toContain("agent_beta");
+        expect(beta.stdout).not.toContain("agent_alpha");
+        expect(zero.stdout).toContain("No MCP servers configured yet");
+        expect(override.stdout).toContain("override_agent");
+    }, 20_000);
+});
+//# sourceMappingURL=mcp-isolation.integration.test.js.map

package/dist/mcp-isolation.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-isolation.integration.test.js","sourceRoot":"","sources":["../src/mcp-isolation.integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAEjD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAC;AAC/F,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sDAAsD,CAAC,CAAC;AACnG,MAAM,YAAY,GAAa,EAAE,CAAC;AASlC,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CACf,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,IAAI,EAAE,CAAC,gBAAgB,CAAC;QACxB,GAAG,EAAE,EAAE;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,WAAmB,EACnB,UAAuB;IAEvB,MAAM,OAAO,GAAG,gBAAgB,CAAC;QAC/B,GAAG,EAAE,QAAQ;QACb,YAAY,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,WAAW,EAAE,CAAC,EAAE,CAAC;QACtF,aAAa,EAAE,mBAAmB,CAAC;YACjC,SAAS,EAAE;gBACT,iBAAiB,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,EAAE;aAC3D;SACF,CAAC;QACF,UAAU;QACV,cAAc,EAAE,UAAU;QAC1B,yBAAyB,EAAE,MAAM;QACjC,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;QACzC,UAAU,EAAE,aAAa,WAAW,EAAE;QACtC,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;QACxC,MAAM;QACN,IAAI,EAAE,6CAA6C;QACnD,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,WAAW,WAAW,EAAE;KACpC,CAAC,EAAE,CAAC;QACH,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC;IACtF,CAAC;IAED,MAAM,OAAO,CAAC,KAAK,CAAC;QAClB,MAAM;QACN,MAAM,EAAE,yBAAyB;QACjC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAqB,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,iCAAiC;IAI9C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACtD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAChE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClG,OAAO;QACL,OAAO,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE;QAC3C,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KAC1G,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,+BAA+B,CAAC,CAAC;QAC3E,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;YACpE,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;YAClE,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC1E,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAEpE,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,iCAAiC,CAAC,CAAC;QAC7E,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE;YAC1D,cAAc,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE;SACxE,CAAC,CAAC;QACH,MAAM,oBAAoB,CAAC,WAAW,EAAE;YACtC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE;SACrE,CAAC,CAAC;QACH,MAAM,oBAAoB,CAAC,UAAU,EAAE;YACrC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE;SACpE,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,iCAAiC,EAAE,CAAC;QAE7D,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAE,UAAmB,EAAE,EAAE;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YACtD,IAAI,CAAC,IAAI,CACP,qBAAqB,EACrB,cAAc,EACd,SAAS,EACT,gBAAgB,CACjB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAC9C,GAAG,EAAE,QAAQ;gBACb,SAAS,EAAE,KAAK;gBAChB,GAAG,EAAE;oBACH,GAAG,OAAO,CAAC,GAAG;oBACd,IAAI,EAAE,IAAI;oBACV,iBAAiB,EAAE,SAAS;oBAC5B,iBAAiB,EAAE,4BAA4B;oBAC/C,kBAAkB,EAAE,UAAU,CAAC,OAAO;iBACvC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrF,OAAO,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACrD,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;gBAC/B,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC;gBAC7B,SAAS,CAAC,MAAM,CAAC;aAClB,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,kDAAkD,CAAC,CAAC;YAC/E,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;YAC7E,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;YAC1D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YAC1D,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;QAC5E,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAErD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,gCAAgC,CAAC,CAAC;QAC5E,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC/C,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE;YACnD,cAAc,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE;SACxE,CAAC,CAAC;QACH,MAAM,mBAAmB,CAAC,SAAS,EAAE;YACnC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE;SACrE,CAAC,CAAC;QACH,MAAM,mBAAmB,CAAC,QAAQ,EAAE;YAClC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE;SACpE,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,IAAI,GAAa,EAAE,EAAE,EAAE,CACzD,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;YAC5C,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE;SAC3D,CAAC,CAAC;QACL,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,OAAO,CAAC,SAAS,CAAC;YAClB,OAAO,CAAC,QAAQ,CAAC;YACjB,OAAO,CAAC,QAAQ,CAAC;YACjB,OAAO,CAAC,QAAQ,EAAE;gBAChB,IAAI;gBACJ,sCAAsC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACxE,IAAI;gBACJ,mCAAmC,IAAI,CAAC,SAAS,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE;aACxE,CAAC;SACH,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAC/D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACtD,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/dist/paperclip-runner-permissions.d.ts

@@ -0,0 +1,110 @@
+export type PaperclipRunnerProvider = "codex" | "opencode" | "claude_managed" | "aws_agentcore" | "acpx";
+export type CodexPermissionMode = "never" | "on-request" | "untrusted";
+export type OpenCodePermissionMode = "allow" | "ask" | "deny";
+export type AcpxPermissionMode = "approve-all" | "approve-paperclip" | "approve-reads" | "deny-all";
+export type PaperclipRunnerPermissionMode = CodexPermissionMode | OpenCodePermissionMode | AcpxPermissionMode;
+export declare const PAPERCLIP_RUNNER_IDLE_TIMEOUT_DEFAULT_MS = 300000;
+export declare const PAPERCLIP_RUNNER_IDLE_TIMEOUT_MAX_MS = 86400000;
+export declare const PAPERCLIP_RUNNER_DEFAULT_MODELS: {
+    readonly codex: "gpt-5.6-sol";
+    readonly acpx: "claude-sonnet-5";
+    readonly opencode: "openrouter/deepseek/deepseek-v4-flash-0731";
+};
+export interface PaperclipRunnerPermissionOption<TMode extends string = string> {
+    value: TMode;
+    label: string;
+    description: string;
+}
+export type PaperclipRunnerPermissionCapability = {
+    configurable: true;
+    configKey: "codexPermissionMode" | "opencodePermissionMode" | "acpxPermissionMode";
+    defaultMode: PaperclipRunnerPermissionMode;
+    options: readonly PaperclipRunnerPermissionOption<PaperclipRunnerPermissionMode>[];
+    description: string;
+} | {
+    configurable: false;
+    defaultMode: "provider-managed";
+    options: readonly [];
+    description: string;
+};
+/**
+ * Control-plane catalog for Paperclip Runner permission UX and validation.
+ * Runtime contracts validate the same native values again at the process
+ * boundary; this catalog must remain browser-safe.
+ */
+export declare const PAPERCLIP_RUNNER_PERMISSION_CAPABILITIES: {
+    readonly codex: {
+        readonly configurable: true;
+        readonly configKey: "codexPermissionMode";
+        readonly defaultMode: "never";
+        readonly description: "Codex runs automatically inside a root-denied, workspace-scoped, network-disabled Paperclip environment.";
+        readonly options: readonly [{
+            readonly value: "never";
+            readonly label: "Automatic (isolated)";
+            readonly description: "Run without Codex approval pauses while Paperclip keeps its independent workspace, network, and environment restrictions.";
+        }];
+    };
+    readonly opencode: {
+        readonly configurable: true;
+        readonly configKey: "opencodePermissionMode";
+        readonly defaultMode: "allow";
+        readonly description: "Controls OpenCode tool permissions inside the assigned Paperclip environment.";
+        readonly options: readonly [{
+            readonly value: "allow";
+            readonly label: "Full auto (allow)";
+            readonly description: "Allow OpenCode operations without approval pauses.";
+        }, {
+            readonly value: "ask";
+            readonly label: "Ask for permission";
+            readonly description: "Prompt before protected OpenCode operations.";
+        }, {
+            readonly value: "deny";
+            readonly label: "Deny operations";
+            readonly description: "Reject protected OpenCode operations.";
+        }];
+    };
+    readonly claude_managed: {
+        readonly configurable: false;
+        readonly defaultMode: "provider-managed";
+        readonly options: readonly [];
+        readonly description: "Claude Managed runs non-interactively under its qualified provider profile and Paperclip policy.";
+    };
+    readonly aws_agentcore: {
+        readonly configurable: false;
+        readonly defaultMode: "provider-managed";
+        readonly options: readonly [];
+        readonly description: "AWS AgentCore runs non-interactively under its qualified harness profile and Paperclip policy.";
+    };
+    readonly acpx: {
+        readonly configurable: true;
+        readonly configKey: "acpxPermissionMode";
+        readonly defaultMode: "approve-all";
+        readonly description: "Controls ACPX agent operations inside the assigned Paperclip environment.";
+        readonly options: readonly [{
+            readonly value: "approve-all";
+            readonly label: "Full auto (approve all)";
+            readonly description: "Approve ACPX operations without approval pauses.";
+        }, {
+            readonly value: "approve-paperclip";
+            readonly label: "Automatic Paperclip actions";
+            readonly description: "Automatically run assigned Paperclip planning and task tools, including reassignment. Company permissions and approval requirements still apply. Other operations require permission.";
+        }, {
+            readonly value: "approve-reads";
+            readonly label: "Allow Paperclip reads";
+            readonly description: "Automatically allow assigned Paperclip read tools. Other operations stop with an approval-required message because this runner has no interactive approval handler.";
+        }, {
+            readonly value: "deny-all";
+            readonly label: "Deny all";
+            readonly description: "Reject harness permission requests.";
+        }];
+    };
+};
+export declare function isPaperclipRunnerProvider(value: unknown): value is PaperclipRunnerProvider;
+export declare function resolvePaperclipRunnerPermissionMode(provider: PaperclipRunnerProvider, value: unknown): PaperclipRunnerPermissionMode | "provider-managed";
+export declare function resolvePaperclipRunnerModel(provider: keyof typeof PAPERCLIP_RUNNER_DEFAULT_MODELS, value: unknown): string;
+export declare function resolvePaperclipRunnerIdleTimeoutMs(value: unknown): number;
+/** Defaults for converting a local adapter; the operator may override the provider. */
+export declare function paperclipRunnerTransitionConfig(previousAdapterType: string, previousModel: unknown, providerOverride?: unknown): Record<string, unknown>;
+/** Old ACPX Codex agent settings use native Codex on their next configuration write. */
+export declare function normalizeLegacyRunnerProvider(config: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=paperclip-runner-permissions.d.ts.map

package/dist/paperclip-runner-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paperclip-runner-permissions.d.ts","sourceRoot":"","sources":["../src/paperclip-runner-permissions.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,uBAAuB,GACjC,OAAO,GAAG,UAAU,GAAG,gBAAgB,GAAG,eAAe,GAAG,MAAM,CAAC;AAErE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW,CAAC;AACvE,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,mBAAmB,GAAG,eAAe,GAAG,UAAU,CAAC;AAEpG,MAAM,MAAM,6BAA6B,GACvC,mBAAmB,GAAG,sBAAsB,GAAG,kBAAkB,CAAC;AAEpE,eAAO,MAAM,wCAAwC,SAAU,CAAC;AAChE,eAAO,MAAM,oCAAoC,WAAa,CAAC;AAC/D,eAAO,MAAM,+BAA+B;aAC1C,KAAK,EAAE,aAAa;aACpB,IAAI,EAAE,iBAAiB;aACvB,QAAQ,EAAE,4CAA4C;CAC9C,CAAC;AAEX,MAAM,WAAW,+BAA+B,CAC9C,KAAK,SAAS,MAAM,GAAG,MAAM;IAE7B,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,mCAAmC,GAC3C;IACE,YAAY,EAAE,IAAI,CAAC;IACnB,SAAS,EACP,qBAAqB,GAAG,wBAAwB,GAAG,oBAAoB,CAAC;IAC1E,WAAW,EAAE,6BAA6B,CAAC;IAC3C,OAAO,EAAE,SAAS,+BAA+B,CAAC,6BAA6B,CAAC,EAAE,CAAC;IACnF,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,YAAY,EAAE,KAAK,CAAC;IACpB,WAAW,EAAE,kBAAkB,CAAC;IAChC,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,wCAAwC;;;4BAGtC,qBAAqB;8BACnB,OAAO;8BAMlB,0GAA0G;;4BAGjG,OAAO;4BACP,sBAAsB;kCAE3B,2HAA2H;;;;;4BAMtH,wBAAwB;8BACtB,OAAO;8BAElB,+EAA+E;;4BAGtE,OAAO;4BACP,mBAAmB;kCACb,oDAAoD;;4BAG1D,KAAK;4BACL,oBAAoB;kCACd,8CAA8C;;4BAGpD,MAAM;4BACN,iBAAiB;kCACX,uCAAuC;;;;iBAKxD,YAAY;iBACZ,WAAW,EAAE,kBAAkB;iBAC/B,OAAO;iBACP,WAAW,EACT,kGAAkG;;;iBAGpG,YAAY;iBACZ,WAAW,EAAE,kBAAkB;iBAC/B,OAAO;iBACP,WAAW,EACT,gGAAgG;;;;4BAIvF,oBAAoB;8BAClB,aAAa;8BAExB,2EAA2E;;4BAGlE,aAAa;4BACb,yBAAyB;kCACnB,kDAAkD;;4BAGxD,mBAAmB;4BACnB,6BAA6B;kCAElC,uLAAuL;;4BAGlL,eAAe;4BACf,uBAAuB;kCAE5B,qKAAqK;;4BAGhK,UAAU;4BACV,UAAU;kCACJ,qCAAqC;;;CAOzD,CAAC;AAEF,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,uBAAuB,CAQlC;AAED,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,uBAAuB,EACjC,KAAK,EAAE,OAAO,GACb,6BAA6B,GAAG,kBAAkB,CAMpD;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,OAAO,+BAA+B,EACtD,KAAK,EAAE,OAAO,GACb,MAAM,CAIR;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO1E;AAED,uFAAuF;AACvF,wBAAgB,+BAA+B,CAC7C,mBAAmB,EAAE,MAAM,EAC3B,aAAa,EAAE,OAAO,EACtB,gBAAgB,CAAC,EAAE,OAAO,GACzB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwBzB;AAED,wFAAwF;AACxF,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB"}