@tokenfactory/acc-runner 0.25.0 → 0.27.0

package/dist/secrets/inject.d.ts

@@ -1,70 +0,0 @@
-/**
- * Runner-side `{{secret:NAME}}` placeholder expander.
- *
- * The runner never holds the service-role key (which would let it pull
- * arbitrary plaintext from the vault). Instead, name→id resolution and
- * decryption run server-side behind the user's JWT, and the runner POSTs
- * to /api/runner/expand-secret for each unique name encountered in a
- * tool-call argument tree.
- *
- * The plaintext flow is:
- *
- *   1. Runner extracts `{{secret:NAME}}` placeholders from the args.
- *   2. For each unique NAME, runner POSTs `/api/runner/expand-secret`
- *      with `{ name, agent_id, tool_name }`. The endpoint uses
- *      `getAdminClient()` to call acc.resolve_secret_id_by_name (v0.7-D)
- *      then acc.fetch_secret_for_runtime (v0.7-B, frozen).
- *   3. Plaintext is held in memory ONLY for the duration of the tool
- *      call. We never log it, never serialize it, never copy it to the
- *      DB. The pre-expansion args (still containing the literal
- *      `{{secret:…}}`) are what gets logged to telemetry.
- *   4. Caller hands the expanded result to MCP stdio.
- *
- * Telemetry tripwire test: a fake secret named `TRIPWIRE_VALUE` with
- * plaintext `tripwire-do-not-log-me` must NOT appear in any captured
- * telemetry row. See packages/acc-runner/tests/expand-args.test.ts.
- *
- * Deviations from planning/v0.7-D-chat-encryption-and-visibility.md:
- *   - The planning doc imagined `import { supabaseAdmin } from '../db'`
- *     — a service-role client at the runner. That doesn't exist (and
- *     shouldn't; the runner is end-user-deployed). The /api/runner/
- *     expand-secret endpoint is the actual seam.
- *   - The planning doc's single fetch_secret_for_runtime call is split
- *     into resolve_secret_id_by_name → fetch_secret_for_runtime because
- *     v0.7-B's frozen contract takes a uuid, not a name.
- */
-export declare const SECRET_PATTERN: RegExp;
-/**
- * Fetcher signature. Production wires this to an HTTP call against
- * /api/runner/expand-secret; tests pass a stub.
- *
- * MUST throw on any failure (missing secret, locked vault, denied
- * grant, rate-limit). MUST NOT include any secret-derived data in the
- * error message.
- */
-export type SecretFetcher = (name: string, agentId: string, toolName?: string) => Promise<string>;
-export interface ExpandResult {
-    expanded: string;
-    consumedSecrets: string[];
-}
-/**
- * Expand `{{secret:NAME}}` placeholders in a single string. Returns the
- * expanded string plus the list of secret names consumed (for telemetry
- * of NAMES, never plaintexts). Throws if any required secret is
- * unavailable — partial expansion is never returned (atomic).
- */
-export declare function expandSecretsInString(raw: string, agentId: string, fetcher: SecretFetcher, toolName?: string): Promise<ExpandResult>;
-/**
- * Build an HTTP-backed SecretFetcher pointing at the deployed
- * /api/runner/expand-secret endpoint. The runner wires this at startup
- * once it has its user JWT and config.
- *
- * The endpoint MUST NOT echo the plaintext into any error path; this
- * helper trusts that contract.
- */
-export declare function makeHttpSecretFetcher(opts: {
-    publicUrl: string;
-    jwt: string;
-    fetchImpl?: typeof fetch;
-}): SecretFetcher;
-//# sourceMappingURL=inject.d.ts.map

package/dist/secrets/inject.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"inject.d.ts","sourceRoot":"","sources":["../../src/secrets/inject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,eAAO,MAAM,cAAc,QAAsC,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAElG,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,CAAC,CA4BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,aAAa,CAwBhB"}

package/dist/secrets/inject.js

@@ -1,102 +0,0 @@
-/**
- * Runner-side `{{secret:NAME}}` placeholder expander.
- *
- * The runner never holds the service-role key (which would let it pull
- * arbitrary plaintext from the vault). Instead, name→id resolution and
- * decryption run server-side behind the user's JWT, and the runner POSTs
- * to /api/runner/expand-secret for each unique name encountered in a
- * tool-call argument tree.
- *
- * The plaintext flow is:
- *
- *   1. Runner extracts `{{secret:NAME}}` placeholders from the args.
- *   2. For each unique NAME, runner POSTs `/api/runner/expand-secret`
- *      with `{ name, agent_id, tool_name }`. The endpoint uses
- *      `getAdminClient()` to call acc.resolve_secret_id_by_name (v0.7-D)
- *      then acc.fetch_secret_for_runtime (v0.7-B, frozen).
- *   3. Plaintext is held in memory ONLY for the duration of the tool
- *      call. We never log it, never serialize it, never copy it to the
- *      DB. The pre-expansion args (still containing the literal
- *      `{{secret:…}}`) are what gets logged to telemetry.
- *   4. Caller hands the expanded result to MCP stdio.
- *
- * Telemetry tripwire test: a fake secret named `TRIPWIRE_VALUE` with
- * plaintext `tripwire-do-not-log-me` must NOT appear in any captured
- * telemetry row. See packages/acc-runner/tests/expand-args.test.ts.
- *
- * Deviations from planning/v0.7-D-chat-encryption-and-visibility.md:
- *   - The planning doc imagined `import { supabaseAdmin } from '../db'`
- *     — a service-role client at the runner. That doesn't exist (and
- *     shouldn't; the runner is end-user-deployed). The /api/runner/
- *     expand-secret endpoint is the actual seam.
- *   - The planning doc's single fetch_secret_for_runtime call is split
- *     into resolve_secret_id_by_name → fetch_secret_for_runtime because
- *     v0.7-B's frozen contract takes a uuid, not a name.
- */
-export const SECRET_PATTERN = /\{\{secret:([A-Z][A-Z0-9_]*)\}\}/g;
-/**
- * Expand `{{secret:NAME}}` placeholders in a single string. Returns the
- * expanded string plus the list of secret names consumed (for telemetry
- * of NAMES, never plaintexts). Throws if any required secret is
- * unavailable — partial expansion is never returned (atomic).
- */
-export async function expandSecretsInString(raw, agentId, fetcher, toolName) {
-    const matches = [...raw.matchAll(SECRET_PATTERN)];
-    if (matches.length === 0) {
-        return { expanded: raw, consumedSecrets: [] };
-    }
-    const names = [...new Set(matches.map((m) => m[1]))];
-    const plaintexts = new Map();
-    for (const name of names) {
-        try {
-            const plaintext = await fetcher(name, agentId, toolName);
-            plaintexts.set(name, plaintext);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            throw new Error(`secret_unavailable: ${name}: ${message}`);
-        }
-    }
-    const expanded = raw.replace(SECRET_PATTERN, (_match, name) => {
-        const value = plaintexts.get(name);
-        if (value === undefined) {
-            throw new Error(`secret_unavailable: ${name}: missing after fetch`);
-        }
-        return value;
-    });
-    return { expanded, consumedSecrets: names };
-}
-/**
- * Build an HTTP-backed SecretFetcher pointing at the deployed
- * /api/runner/expand-secret endpoint. The runner wires this at startup
- * once it has its user JWT and config.
- *
- * The endpoint MUST NOT echo the plaintext into any error path; this
- * helper trusts that contract.
- */
-export function makeHttpSecretFetcher(opts) {
-    const f = opts.fetchImpl ?? fetch;
-    const endpoint = `${opts.publicUrl.replace(/\/$/, "")}/api/runner/expand-secret`;
-    return async (name, agentId, toolName) => {
-        const res = await f(endpoint, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${opts.jwt}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({ name, agent_id: agentId, tool_name: toolName ?? null }),
-        });
-        if (!res.ok) {
-            // Read body for the error reason, but the endpoint contract is
-            // that the body NEVER contains plaintext.
-            const text = await res.text().catch(() => "");
-            throw new Error(`expand-secret HTTP ${res.status}: ${text || res.statusText}`);
-        }
-        const data = (await res.json());
-        if (typeof data.plaintext !== "string") {
-            throw new Error("expand-secret response missing plaintext");
-        }
-        return data.plaintext;
-    };
-}
-//# sourceMappingURL=inject.js.map

package/dist/secrets/inject.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"inject.js","sourceRoot":"","sources":["../../src/secrets/inject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAiBlE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAW,EACX,OAAe,EACf,OAAsB,EACtB,QAAiB;IAEjB,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QACpE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,uBAAuB,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAIrC;IACC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC;IACjF,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE;gBACnC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,+DAA+D;YAC/D,0CAA0C;YAC1C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC"}

package/dist/supabase.d.ts

@@ -1,4 +0,0 @@
-import type { RunnerConfig } from "./config.js";
-export declare function createRunnerClient(cfg: RunnerConfig, jwt: string): import("@supabase/supabase-js").SupabaseClient<any, "public", "acc", any, any>;
-export type RunnerSupabaseClient = ReturnType<typeof createRunnerClient>;
-//# sourceMappingURL=supabase.d.ts.map

package/dist/supabase.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,kFAoBhE;AAED,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/supabase.js

@@ -1,36 +0,0 @@
-/**
- * Supabase client factory for the CLI. Authenticates with the user's
- * stored JWT (loaded from keychain) so RLS / acc.is_member() resolve
- * correctly on every RPC.
- *
- * Realtime transport is pinned to the `ws` package. Node 20+ has a
- * native WebSocket global, but Supabase's runtime detector still warns
- * "Node.js 20 detected without native WebSocket support" because it
- * looks for a Node-API-shaped constructor, not the WHATWG one. Passing
- * `ws` explicitly silences the warning and is the same transport every
- * server-side Supabase consumer uses.
- */
-import { createClient } from "@supabase/supabase-js";
-import WebSocket from "ws";
-export function createRunnerClient(cfg, jwt) {
-    return createClient(cfg.supabaseUrl, cfg.supabaseAnonKey, {
-        db: { schema: "acc" },
-        auth: {
-            persistSession: false,
-            autoRefreshToken: false,
-            detectSessionInUrl: false,
-        },
-        global: {
-            headers: {
-                Authorization: `Bearer ${jwt}`,
-            },
-        },
-        realtime: {
-            // any-allowed: ws's type matches Node, not the browser WebSocket
-            // interface Supabase's option signature is declared against.
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            transport: WebSocket,
-        },
-    });
-}
-//# sourceMappingURL=supabase.js.map

package/dist/supabase.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,SAAS,MAAM,IAAI,CAAC;AAG3B,MAAM,UAAU,kBAAkB,CAAC,GAAiB,EAAE,GAAW;IAC/D,OAAO,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,EAAE;QACxD,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrB,IAAI,EAAE;YACJ,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,KAAK;SAC1B;QACD,MAAM,EAAE;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,EAAE;aAC/B;SACF;QACD,QAAQ,EAAE;YACR,iEAAiE;YACjE,6DAA6D;YAC7D,8DAA8D;YAC9D,SAAS,EAAE,SAAgB;SAC5B;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/task-runner.d.ts

@@ -1,313 +0,0 @@
-import { type ExecaChildProcess } from "execa";
-import { type RunnerConfig, type RunnerProfile } from "./config.js";
-import { type NormalizedUsage } from "./cost-pricing.js";
-import { type ClaudeExitClass } from "./failure-classifier.js";
-import { type GitRunner } from "./git.js";
-import { type GhRunner } from "./gh.js";
-import { type McpConfigCleanup, type McpSpawnOptions } from "./mcp-spawn.js";
-import { type PostRunnerStateArgs } from "./messaging.js";
-import { type TaskLock } from "./runtime/locks.js";
-import { type PreparedWorktree, type PrepareWorktreeOptions } from "./runtime/worktree.js";
-import { type ConflictResolutionDeps } from "./runtime/conflict-resolver.js";
-import { type AssertResolutionOptions, type ResolutionIntegrityDeps, type ResolutionIntegrityResult } from "./runtime/resolution-integrity.js";
-import type { RunnerSupabaseClient } from "./supabase.js";
-export interface CostEventPayload extends NormalizedUsage {
-    task_id: string;
-    model: string;
-    usd_cents: number;
-    runner_id?: string | null;
-}
-export interface RunTaskDeps {
-    supabase: RunnerSupabaseClient;
-    cfg: RunnerConfig;
-    git?: GitRunner;
-    gh?: GhRunner;
-    /** Override for tests — defaults to
-     *  execa('claude', ['--print', '--dangerously-skip-permissions',
-     *  '--output-format=json', '--model', modelId?]).
-     *
-     *  v0.6.0 REG-296: modelId is forwarded as `--model <modelId>` when
-     *  the task carries one, so cost tracking matches the actual model
-     *  claude spawned with (previously the operator's default Opus was
-     *  always used regardless of task.model_id). */
-    spawnClaude?: (cwd: string, modelId?: string) => ExecaChildProcess;
-    /** v0.6.0 REG-301: plain `git checkout <baseBranch>` so the task
-     *  branch forks from the integration base, not whatever was checked
-     *  out in cwd. Defaults to `execa('git', ['checkout', baseBranch])`.
-     *  Tests inject a mock to assert the call ordering against the
-     *  task-runner pre-spawn sequence. */
-    checkoutBase?: (repoPath: string, baseBranch: string) => Promise<void>;
-    /**
-     * Cost-event sink. Defaults to a direct `acc.record_cost_event` RPC
-     * on the runner's already-authenticated supabase client. Tests
-     * override; production callers (watch.ts) can override too if they
-     * prefer to route through /api/runner/cost-event.
-     */
-    postCostEvent?: (event: CostEventPayload) => Promise<void>;
-    /**
-     * Runner session coordinates threaded down so the per-task
-     * .mcp.json can be authored before Claude Code spawns AND so the
-     * v0.6.1 claim_task_with_locks RPC can attribute the lock to the
-     * caller's runner row. v0.6.1 (REG-309 sibling): required now —
-     * watch.ts has always passed it; tests must stub it.
-     */
-    session: {
-        accessToken: string;
-        runnerId: string;
-    };
-    /** Public URL forwarded to acc-mcp-server for telemetry POSTs. */
-    publicUrl?: string;
-    /** Override for tests; defaults to writing a real .mcp.json. */
-    writeMcpConfig?: (opts: McpSpawnOptions) => Promise<McpConfigCleanup>;
-    /**
-     * v0.11-F: per-task PID lock at `~/.cache/acc-runner/locks/<task_id>.pid`.
-     * Throws `TaskLockHeldError` when another live runner holds the lock;
-     * the caller surfaces `phase: "worktree_lock"` and bails before any
-     * worktree side-effect lands.
-     */
-    acquireLock?: (taskId: string) => Promise<TaskLock>;
-    /**
-     * v0.11-F: provision an isolated git worktree at
-     * `~/.cache/acc-runner/work/<task_id>/`. All subsequent git ops +
-     * spawnClaude run with the worktree's path as cwd, never the
-     * operator's shared clone.
-     */
-    prepareWorktree?: (opts: PrepareWorktreeOptions) => Promise<PreparedWorktree>;
-    /**
-     * v0.12-RESUME: cadence (ms) for the periodic
-     * `acc.update_task_signal` RPC that refreshes
-     * `acc.tasks.last_runner_signal_at` while the task is in flight.
-     * The 5-minute cron sweep uses a 5-minute cutoff, so 30s gives
-     * ~10 missed signals of margin before a still-alive runner gets
-     * its task pulled back to queued. Tests override to a sub-second
-     * cadence so the loop is observable without real-time waits.
-     */
-    signalIntervalMs?: number;
-    /**
-     * v0.14-MESSAGING-RUNTIME-WIRE: bus sink for state transitions.
-     * Defaults to `acc.post_agent_message` on the same supabase client.
-     * Tests override to capture the call sequence. Best-effort — a
-     * failed post is logged but never bubbles past the task run.
-     */
-    postRunnerStateMessage?: (args: PostRunnerStateArgs) => Promise<void>;
-    /**
-     * v0.14-MESSAGING-RUNTIME-WIRE: runner-profile loader. Defaults to
-     * `loadProfile()` from config.js. Returns null when no profile is
-     * selected (the v0.13 byte-identical path). Tests inject a stub so
-     * the prelude consumer can be exercised without writing a real JSON
-     * + module pair to disk.
-     */
-    loadProfile?: () => RunnerProfile | null;
-    /**
-     * v0.14-MESSAGING-RUNTIME-WIRE: prelude-module loader. Defaults to
-     * the production dynamic-import path; tests inject a stub so the
-     * vitest/jsdom-backed environment doesn't try to route the
-     * file-URL through Vite's resolver. Returns the prelude string —
-     * empty string when the profile has no prelude or the module's
-     * default export is not a string.
-     */
-    loadPromptPrelude?: (profile: RunnerProfile) => Promise<string>;
-    /**
-     * v0.48 T-48-5: optional dep overrides for the conflict-resolution path.
-     * Tests inject stubs to avoid real GitHub API calls. Production callers
-     * (watch.ts) leave this undefined — the defaults apply.
-     */
-    conflictResolutionDeps?: Partial<ConflictResolutionDeps>;
-    /**
-     * v0.51 T-51-1: resolve a PR's head branch via gh when a rework task's
-     * sentinel carries an empty branch. Tests inject a stub; production
-     * defaults to `gh pr view <n> -R <repo> --json headRefName`.
-     */
-    fetchPrHeadRef?: (repo: string, prNumber: number) => Promise<string>;
-    /**
-     * v0.63 T-63-1: authoritative env tiebreaker for a silent instant-empty
-     * claude exit. Defaults to spawning `claude --version` with a short
-     * timeout. Returns `ok: true` when the binary answers (the host is fine,
-     * so the exit was a transient `claude_unavailable` → pause + retry, NEVER
-     * quarantine) and `ok: false` when the probe itself errors / times out /
-     * exits non-zero (the binary or host is genuinely broken → upgrade to
-     * env_broken → quarantine). Tests inject a stub so they don't shell out to
-     * a real claude.
-     */
-    healthProbe?: () => Promise<{
-        ok: boolean;
-        detail: string;
-    }>;
-    /**
-     * v0.57 T-57-2: conflict-resolution integrity guardrail. Runs before the
-     * push of a conflict-resolution task and rejects merges that left conflict
-     * markers, fail typecheck, or regressed a package version without a
-     * matching CHANGELOG entry. Defaults to `assertResolutionIntegrity` against
-     * the worktree; tests inject a stub to drive the three incident replays
-     * without a real worktree.
-     */
-    assertResolutionIntegrity?: (workdir: string, opts: AssertResolutionOptions, deps?: ResolutionIntegrityDeps) => Promise<ResolutionIntegrityResult>;
-}
-export interface RunTaskController {
-    taskId: string;
-    promise: Promise<RunTaskOutcome>;
-    cancel(): void;
-}
-/**
- * Failure phase tag. watch.ts pump() prints this on the stderr summary
- * line (REG-294) so an operator can tell whether a multi-minute task
- * died at fetch, git, claude, or push.
- */
-export type RunTaskPhase = "claim_locks" | "transition_to_running" | "fetch" | "worktree_lock" | "git" | "claude_exit" | "push" | "github";
-export interface RunTaskOutcome {
-    taskId: string;
-    status: "ok" | "failed" | "cancelled" | "capacity_paused" | "requeued";
-    prUrl?: string;
-    exitCode?: number | null;
-    error?: string;
-    /** v0.6.0 REG-294: which phase of runTask produced the failure. Set
-     *  on every non-ok return so watch.ts pump() can surface a clear
-     *  one-liner to the operator. */
-    phase?: RunTaskPhase;
-    /**
-     * v0.48: set when the failure classifier identifies a machine-level
-     * failure (usage_limit | auth_expired | env_broken). watch.ts uses
-     * this to quarantine the runner and NOT count the failure toward
-     * the task's retry budget.
-     *
-     * v0.56 (T-56-1): NEVER set for capacity_exhausted — capacity is a
-     * pause, not a quarantine. The capacity case sets the two fields below
-     * and status='capacity_paused' instead.
-     */
-    quarantine_cause?: ClaudeExitClass;
-    /**
-     * v0.56 (T-56-1): true when claude exited because the Claude account hit
-     * its session/usage limit (api_error_status 429). The task is NOT
-     * transitioned to 'failed' — it is left for the stale-running sweep to
-     * return to 'queued' (runner_id cleared) losslessly — and watch.ts pauses
-     * the whole runner (tasks AND reviews) until `resume_at`. No
-     * dead-letter, no quarantine, no retry-budget burn.
-     */
-    capacity_exhausted?: boolean;
-    /**
-     * v0.63 (T-63-1): true when claude exited with the silent instant-empty
-     * fingerprint (fast + empty, no 127, no env/auth/usage pattern) AND a
-     * `claude --version` health probe confirmed the binary still works — i.e.
-     * claude was momentarily unavailable, not the host broken. Routed exactly
-     * like capacity_exhausted: the task is left 'running' for the stale-running
-     * sweep to requeue losslessly (no dead-letter, no quarantine, no
-     * retry-budget burn) and `status` is 'capacity_paused' so watch.ts pauses
-     * the runner via the existing capacity lane. `resume_at` carries an
-     * EXPONENTIAL backoff instant (longer each consecutive silent exit). A
-     * sustained streak inside a rolling window escalates to a human INFRA alert
-     * — but NEVER quarantines.
-     */
-    claude_unavailable?: boolean;
-    /**
-     * v0.56 (T-56-1): the stated reset instant (ISO-8601) parsed from
-     * claude's "...resets <time>" message, or null when no time was present
-     * (watch.ts then applies its default capacity backoff).
-     *
-     * v0.63 (T-63-1): also carries the exponential-backoff resume instant for a
-     * claude_unavailable pause (always non-null in that case).
-     */
-    resume_at?: string | null;
-    /**
-     * v0.53 T-53-4: number of consecutive instant-empty claude exits that
-     * produced the quarantine_cause (only set alongside an env_broken
-     * cause). watch.ts persists it into quarantine.json's `consecutive`
-     * field. A definitive env_broken records 1; a heuristic env_broken
-     * records 2 (the runner retried the spawn and it exited instantly
-     * again). Undefined for non-env_broken causes.
-     */
-    quarantine_consecutive?: number;
-}
-/**
- * v0.6.0 REG-296: build the argv for `claude --print`. Splitting this
- * out keeps the model-passthrough logic unit-testable without spawning
- * a real subprocess. modelId is forwarded as `--model <id>` when
- * non-empty (whitespace counts as empty); otherwise omitted so claude
- * uses the operator's default model.
- */
-export declare function buildClaudeArgs(modelId?: string | null): string[];
-/**
- * v0.6.0 REG-295: expand `~/...` paths against $HOME so a task can
- * carry `repo_path_hint = "~/work/foo"` from a row populated on a
- * different machine. Absolute and relative paths pass through.
- */
-export declare function expandHomePath(p: string): string;
-/**
- * v0.63 T-63-1: knobs for the silent-claude-unavailability response. Defaults
- * pause + back off + retry on each silent instant-empty exit, growing the
- * backoff exponentially, and raise a human INFRA alert only after a SUSTAINED
- * streak inside a rolling window — never on 2, and never a quarantine.
- */
-export interface ClaudeUnavailableKnobs {
-    /** Rolling window for the sustained-streak INFRA alert. */
-    windowMs: number;
-    /** Silent exits within `windowMs` that trip the INFRA alert (default ~5). */
-    alertThreshold: number;
-    /** First pause backoff; doubles each consecutive silent exit. */
-    backoffBaseMs: number;
-    /** Backoff ceiling so the ladder can't run away. */
-    backoffMaxMs: number;
-}
-/** v0.63 T-63-1: override the silent-unavailability knobs (used by tests). */
-export declare function configureClaudeUnavailable(partial: Partial<ClaudeUnavailableKnobs>): void;
-/** v0.63 T-63-1: reset both the streak and the knobs (used by tests). */
-export declare function resetClaudeUnavailableState(): void;
-export interface ClaudeUnavailableDecision {
-    /** Consecutive silent exits (drives the exponential backoff). */
-    streak: number;
-    /** Silent exits inside the rolling window (drives the INFRA alert). */
-    windowCount: number;
-    /** True once windowCount reaches the alert threshold — escalate to a human. */
-    alert: boolean;
-    /** Pause backoff (ms) for this exit. */
-    backoffMs: number;
-    /** Absolute resume instant (ISO-8601) = now + backoffMs. */
-    resumeAt: string;
-}
-/**
- * v0.63 T-63-1: record one silent instant-empty exit and compute the response
- * (exponential backoff + whether the sustained-streak INFRA alert trips).
- * Exported so the watch process and the unit suite share one definition.
- */
-export declare function recordClaudeUnavailable(now: number): ClaudeUnavailableDecision;
-/**
- * Pull the structured report block from claude's stdout. Recognises
- * both `--output-format=json` (extracts .result) and plain text. Falls
- * back to the entire stdout (capped) if no `## Summary` heading is
- * present — that way the PR body still tells the reviewer what happened.
- */
-export declare function extractReportFromOutput(stdout: string): string;
-/**
- * v0.35-B: extract the PR number from a `gh pr create` URL. Returns null
- * when the URL doesn't carry a `/pull/<int>` segment so the caller can
- * fall back to the webhook-driven path. GitHub URLs encode PR ids as the
- * last path segment; anchors and query strings are tolerated.
- */
-export declare function parsePrNumber(url: string | null | undefined): number | null;
-/**
- * Build a cost event from claude's stdout. Always returns a payload
- * (zero-cost when usage isn't parseable) so the cap-tracking surface
- * stays consistent: one cost_events row per attempt.
- */
-export declare function buildCostEvent(taskId: string, stdout: string, fallbackModel: string | null | undefined, runnerId: string | null | undefined): CostEventPayload;
-/**
- * v0.14-MESSAGING-RUNTIME-WIRE — dynamic-import the prelude module
- * referenced by a runner profile and return its default-exported string.
- *
- * The prelude path in the profile JSON (e.g. `./src/profiles/developer-
- * prompt.ts`) is interpreted from the runner package root — the parent
- * of the runner-profiles dir where the JSON lives. In source/dev the
- * .ts file is importable via tsx; in the npm-published artifact only
- * `dist/` ships, so we map `src/*.ts` → `dist/*.js` when the .ts target
- * doesn't exist. Returns empty string when no prelude is configured or
- * the import resolves to a non-string default (v0.13 byte-identical).
- *
- * Exported so tests can stub the resolution + import seam via the
- * `loadPromptPrelude` dep on RunTaskDeps — vitest's Vite-backed
- * transform pipeline does not handle dynamic imports of arbitrary file
- * URLs in the jsdom environment, so the production path is exercised
- * by the runner's own unit suite (node env) rather than by the
- * top-level integration test.
- */
-export declare function loadPromptPrelude(profile: RunnerProfile): Promise<string>;
-export declare function runTask(taskId: string, deps: RunTaskDeps): RunTaskController;
-//# sourceMappingURL=task-runner.d.ts.map

package/dist/task-runner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"task-runner.d.ts","sourceRoot":"","sources":["../src/task-runner.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAEtD,OAAO,EAAqC,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAKjC,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAC;AAOxC,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,OAAO,EAAK,MAAM,CAAC;IACnB,KAAK,EAAO,MAAM,CAAC;IACnB,SAAS,EAAG,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd;;;;;;;oDAOgD;IAChD,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,iBAAiB,CAAC;IACnE;;;;0CAIsC;IACtC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9E;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IACzC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,uBAAuB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,KAC3B,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,uBAAuB,GACvB,OAAO,GACP,eAAe,GACf,KAAK,GACL,aAAa,GACb,MAAM,GAIN,QAAQ,CAAC;AAEb,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,UAAU,CAAC;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;qCAEiC;IACjC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAKjE;AAqCD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIhD;AA8BD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAkBD,8EAA8E;AAC9E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAEzF;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD;AAED,MAAM,WAAW,yBAAyB;IACxC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,OAAO,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,yBAAyB,CAgB9E;AA6DD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAM3E;AA8ED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,gBAAgB,CAWlB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB/E;AA+KD,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,GAChB,iBAAiB,CA6xCnB"}