@tokenfactory/acc-runner 0.44.7 → 0.44.8

package/dist/build-info.generated.d.ts

@@ -1,3 +1,3 @@
-export declare const BUILD_COMMIT_SHA = "49e865f002badc256757c4d42654e6635eb081ed";
+export declare const BUILD_COMMIT_SHA = "5b40ef40fe44b552238ee21cb9d6a1abc3ae2db8";
 export declare const BUILD_DIST_SHA256 = "pending-build";
 //# sourceMappingURL=build-info.generated.d.ts.map

package/dist/build-info.generated.js

@@ -1,3 +1,3 @@
 // Generated by scripts/gen-build-info.mjs. Do not edit by hand.
-export const BUILD_COMMIT_SHA = "49e865f002badc256757c4d42654e6635eb081ed";
-export const BUILD_DIST_SHA256 = "ec0277436f698957e2ba3cf05ed09b9a2868a5f78eeb7f72b8bf74185c24769c";
+export const BUILD_COMMIT_SHA = "5b40ef40fe44b552238ee21cb9d6a1abc3ae2db8";
+export const BUILD_DIST_SHA256 = "315020a9a7c9ce65e1e35c70a989bb71cc8b577aec47b4091faa53d415352067";

package/dist/engines/codex-chat.d.ts

@@ -1,5 +1,6 @@
 import { type ExecaChildProcess } from "execa";
 import { type CodexAuthMode } from "../provider-auth.js";
+import { type McpServerEntry } from "../mcp-spawn.js";
 import { type ParsedChatStreamEvent } from "./chat-stream.js";
 import type { AccMcpToolBusFence, ConformantAgentEngine, EngineCapabilityMatrix, EngineStreamTurnOptions } from "./types.js";
 /**
@@ -30,11 +31,21 @@ export declare function accMcpToolBusOnly(): AccMcpToolBusFence;
  *       an approval prompt, is the boundary (mirrors the batch lane rationale).
  *   -c tools.<native>=false                  → defence-in-depth block-list
  *   -c experimental_use_only_mcp_tools=true  → ONLY MCP (acc-mcp) tools may run
+ *   --ignore-user-config                     → ambient MCP servers stay excluded
  * `--model` is forwarded only when the turn pins a non-blank model.
  */
-export declare function buildCodexChatArgs(opts?: {
+export interface CodexChatArgsOptions {
     modelId?: string | null;
-}): string[];
+    accMcpServer?: McpServerEntry;
+}
+/**
+ * Read the runner-provisioned ACC entry from `<cwd>/.mcp.json`. Claude consumes
+ * that file directly; Codex does not, so the Codex adapter converts only the
+ * non-secret launch shape into per-process config overrides. A missing or
+ * malformed entry fails closed instead of starting an unfenced chat turn.
+ */
+export declare function loadAccMcpServerForCodex(cwd: string): McpServerEntry;
+export declare function buildCodexChatArgs(opts?: CodexChatArgsOptions): string[];
 /**
  * Augment the base environment for a codex chat turn: resolve the first-attempt
  * auth channel (subscription vs api-key) via the shared `withOpenAiAuth` (so chat
@@ -42,7 +53,7 @@ export declare function buildCodexChatArgs(opts?: {
  * per-turn delegation token so the acc-mcp bus acts with the narrowly-scoped
  * companion delegation rather than the runner token. Never mutates `base`.
  */
-export declare function codexChatEnv(opts: EngineStreamTurnOptions): NodeJS.ProcessEnv;
+export declare function codexChatEnv(opts: EngineStreamTurnOptions, accMcpServer?: McpServerEntry): NodeJS.ProcessEnv;
 /**
  * TOLERANT parse of one line of a codex chat stream into a stream event. Reads
  * TWO shapes so one conformance suite drives both adapters:

package/dist/engines/codex-chat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-chat.d.ts","sourceRoot":"","sources":["../../src/engines/codex-chat.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EAErB,sBAAsB,EAItB,uBAAuB,EAExB,MAAM,YAAY,CAAC;AAIpB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAOxD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAE9E;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,CAEtD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,MAAM,EAAE,CASnF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC,UAAU,CAM7E;AAuDD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAmCnF;AAoED,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,EAAE,sBAOrC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,iBAAiB,CAAC;IACjE,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,aAAa,CAAC;IAC7D,wFAAwF;IACxF,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IAChD,mIAAmI;IACnI,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,uGAAuG;IACvG,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAaD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,aAAkB,GAAG,qBAAqB,CAYrF;AAED,uDAAuD;AACvD,eAAO,MAAM,eAAe,EAAE,qBAA+C,CAAC"}
+{"version":3,"file":"codex-chat.d.ts","sourceRoot":"","sources":["../../src/engines/codex-chat.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EAErB,sBAAsB,EAItB,uBAAuB,EAExB,MAAM,YAAY,CAAC;AAIpB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAOxD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAE9E;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,CAEtD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,cAAc,CAAC;CAC/B;AASD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAiCpE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,oBAAyB,GAAG,MAAM,EAAE,CA+B5E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,uBAAuB,EAC7B,YAAY,CAAC,EAAE,cAAc,GAC5B,MAAM,CAAC,UAAU,CASnB;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAmCnF;AAoED,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,EAAE,sBAOrC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,iBAAiB,CAAC;IACjE,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,aAAa,CAAC;IAC7D,wFAAwF;IACxF,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IAChD,mIAAmI;IACnI,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,uGAAuG;IACvG,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAaD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,aAAkB,GAAG,qBAAqB,CAYrF;AAED,uDAAuD;AACvD,eAAO,MAAM,eAAe,EAAE,qBAA+C,CAAC"}

package/dist/engines/codex-chat.js

@@ -19,9 +19,10 @@
  *      fence and `buildCodexChatArgs()` enforces it: every native codex tool
  *      (shell / apply_patch / web_search / file IO) is disabled via a
  *      `-c tools.<name>=false` override AND only MCP tools may run
- *      (`experimental_use_only_mcp_tools=true`). The runner writes a codex config
- *      listing ONLY the acc-mcp server (the codex analog of the `.mcp.json`
- *      mcp-spawn writes for claude), so no native tool can escape the fence.
+ *      (`experimental_use_only_mcp_tools=true`). The adapter ignores ambient
+ *      Codex config and translates the runner-provisioned ACC `.mcp.json` entry
+ *      into per-process Codex config overrides, so no native or unrelated MCP
+ *      tool can escape the fence and no secret is placed in argv.
  *   3. Credential-tier probe — `credentialProbe()` resolves the OpenAI/Codex auth
  *      channel (api-key OR ChatGPT subscription) and the highest tier it
  *      authorises (`full` with a repo-write grant, else `draft-only`;
@@ -38,9 +39,11 @@
  * `codexChatEngine` is the wired default built from the production deps.
  */
 import os from "node:os";
+import fs from "node:fs";
+import path from "node:path";
 import { execa } from "execa";
 import { openaiApiKey, describeCodexAuthMode, withOpenAiAuth, } from "../provider-auth.js";
-import { ACC_MCP_KEY } from "../mcp-spawn.js";
+import { ACC_MCP_KEY, MCP_CONFIG_FILENAME, } from "../mcp-spawn.js";
 import { codexEngine, resolveCodexSpawnMode } from "./codex.js";
 import { classifyCapacityFromLoad, ACC_MCP_DELEGATION_TOKEN_ENV, } from "./claude-code-chat.js";
 import { streamChatTurn } from "./chat-stream.js";
@@ -73,24 +76,68 @@ export const CODEX_MCP_ONLY_OVERRIDE = "experimental_use_only_mcp_tools=true";
 export function accMcpToolBusOnly() {
     return { enforced: true, allowedServers: [ACC_MCP_KEY] };
 }
+function tomlValue(value) {
+    // JSON string/array syntax is valid TOML for the scalar shapes used here.
+    // Keeping this serializer tiny also makes secret-bearing values impossible:
+    // only the command, non-secret argv and env VARIABLE NAMES reach argv.
+    return JSON.stringify(value);
+}
 /**
- * Build the argv for a headless streaming codex chat turn. Fences the tool bus
- * to acc-mcp only and disables every native tool, all through codex's generic
- * `-c key=value` config-override mechanism so the fence survives a point-release
- * flag rename:
- *   exec --json                              → headless structured event stream
- *   --dangerously-bypass-approvals-and-sandbox → non-interactive; the fence, not
- *       an approval prompt, is the boundary (mirrors the batch lane rationale).
- *   -c tools.<native>=false                  → defence-in-depth block-list
- *   -c experimental_use_only_mcp_tools=true  → ONLY MCP (acc-mcp) tools may run
- * `--model` is forwarded only when the turn pins a non-blank model.
+ * Read the runner-provisioned ACC entry from `<cwd>/.mcp.json`. Claude consumes
+ * that file directly; Codex does not, so the Codex adapter converts only the
+ * non-secret launch shape into per-process config overrides. A missing or
+ * malformed entry fails closed instead of starting an unfenced chat turn.
  */
+export function loadAccMcpServerForCodex(cwd) {
+    const filePath = path.join(cwd, MCP_CONFIG_FILENAME);
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`Codex chat requires a valid runner-provisioned ${MCP_CONFIG_FILENAME}: ${error.message}`);
+    }
+    const root = parsed && typeof parsed === "object" ? parsed : null;
+    const servers = root?.mcpServers;
+    const entry = servers && typeof servers === "object"
+        ? servers[ACC_MCP_KEY]
+        : null;
+    if (!entry || typeof entry !== "object") {
+        throw new Error(`Codex chat requires ${MCP_CONFIG_FILENAME} to contain mcpServers.${ACC_MCP_KEY}`);
+    }
+    const candidate = entry;
+    if (typeof candidate.command !== "string" ||
+        candidate.command.trim().length === 0 ||
+        !Array.isArray(candidate.args) ||
+        !candidate.args.every((arg) => typeof arg === "string") ||
+        !candidate.env ||
+        typeof candidate.env !== "object" ||
+        !Object.values(candidate.env).every((value) => typeof value === "string")) {
+        throw new Error(`Codex chat found an invalid mcpServers.${ACC_MCP_KEY} entry`);
+    }
+    return {
+        command: candidate.command,
+        args: candidate.args,
+        env: candidate.env,
+    };
+}
 export function buildCodexChatArgs(opts = {}) {
-    const args = ["exec", "--json", "--dangerously-bypass-approvals-and-sandbox"];
+    const args = [
+        "exec",
+        "--json",
+        // Ignore global and project Codex configuration for this invocation. Auth
+        // remains available, while unapproved MCP servers cannot join ACC's bus.
+        "--ignore-user-config",
+        "--dangerously-bypass-approvals-and-sandbox",
+    ];
     for (const tool of NATIVE_TOOLS_DISABLED_CODEX) {
         args.push("-c", `tools.${tool}=false`);
     }
     args.push("-c", CODEX_MCP_ONLY_OVERRIDE);
+    if (opts.accMcpServer) {
+        const envVars = Object.keys(opts.accMcpServer.env).sort();
+        args.push("-c", `mcp_servers.${ACC_MCP_KEY}.command=${tomlValue(opts.accMcpServer.command)}`, "-c", `mcp_servers.${ACC_MCP_KEY}.args=${tomlValue(opts.accMcpServer.args)}`, "-c", `mcp_servers.${ACC_MCP_KEY}.env_vars=${tomlValue(envVars)}`, "-c", `mcp_servers.${ACC_MCP_KEY}.required=true`, "-c", `mcp_servers.${ACC_MCP_KEY}.enabled=true`);
+    }
     const trimmed = (opts.modelId ?? "").trim();
     if (trimmed)
         args.push("--model", trimmed);
@@ -103,23 +150,28 @@ export function buildCodexChatArgs(opts = {}) {
  * per-turn delegation token so the acc-mcp bus acts with the narrowly-scoped
  * companion delegation rather than the runner token. Never mutates `base`.
  */
-export function codexChatEnv(opts) {
+export function codexChatEnv(opts, accMcpServer) {
     const base = opts.baseEnv ?? process.env;
-    const next = { ...withOpenAiAuth(resolveCodexSpawnMode(base), base) };
+    const next = {
+        ...withOpenAiAuth(resolveCodexSpawnMode(base), base),
+        ...(accMcpServer?.env ?? {}),
+    };
     const token = (opts.delegationToken ?? "").trim();
     if (token)
         next[ACC_MCP_DELEGATION_TOKEN_ENV] = token;
     return next;
 }
 function spawnCodexChat(opts) {
-    return execa(BINARY, buildCodexChatArgs({ modelId: opts.modelId }), {
+    const cwd = opts.cwd ?? process.cwd();
+    const accMcpServer = loadAccMcpServerForCodex(cwd);
+    return execa(BINARY, buildCodexChatArgs({ modelId: opts.modelId, accMcpServer }), {
         ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
         ...(opts.signal ? { signal: opts.signal } : {}),
         stdin: "pipe",
         stdout: "pipe",
         stderr: "pipe",
         reject: false,
-        env: codexChatEnv(opts),
+        env: codexChatEnv(opts, accMcpServer),
     });
 }
 function asRecord(v) {

package/dist/engines/codex-chat.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-chat.js","sourceRoot":"","sources":["../../src/engines/codex-chat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAA0B,MAAM,OAAO,CAAC;AACtD,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAA8B,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAa/D,MAAM,MAAM,GAAG,OAAO,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,OAAO;IACP,aAAa;IACb,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,YAAY;CACb,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoC,EAAE;IACvE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,4CAA4C,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAA6B;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;IACzC,MAAM,IAAI,GAAsB,EAAE,GAAG,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK;QAAE,IAAI,CAAC,4BAA4B,CAAC,GAAG,KAAK,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAA6B;IACnD,OAAO,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE;QAClE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,kEAAkE;AAClE,SAAS,QAAQ,CAAC,GAA4B;IAC5C,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,6EAA6E;AAC7E,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AACpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,QAAQ;IACR,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,oEAAoE;IACpE,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;IAED,6BAA6B;IAC7B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvG,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAA2B;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,4BAA4B;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,aAAa,GACjB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACzF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO;YACP,IAAI,EAAE,aAAa;YACnB,MAAM,EACJ,4HAA4H;SAC/H,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAyB,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,IAAI;QACJ,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,gBAAgB,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,0BAA0B,EAAE;KACvH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAA2B;IAC7D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA2B;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,4BAA4B;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,sBAAsB,CAAC;QAC5B,QAAQ,EAAE,WAAW,CAAC,EAAE;QACxB,OAAO;QACP,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAChD,MAAM,EACJ,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,yFAAyF;KAChG,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D,iBAAiB,EAAE,IAAI;IACvB,aAAa,EAAE,IAAI;IACnB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE,IAAI;IAChB,IAAI,EAAE,MAAM;CACb,CAAC;AAmBF,MAAM,YAAY,GAA0B;IAC1C,SAAS,EAAE,cAAc;IACzB,gBAAgB,EAAE,qBAAqB;IACvC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;IAChD,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;IACxC,cAAc,EAAE,qBAAqB;IACrC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;CAC9E,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAsB,EAAE;IAC5D,MAAM,CAAC,GAA0B,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9D,OAAO;QACL,GAAG,WAAW;QACd,YAAY,EAAE,uBAAuB;QACrC,UAAU,EAAE,CAAC,IAA6B,EAAoC,EAAE,CAC9E,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC;QAC1E,iBAAiB;QACjB,eAAe,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC7C,gBAAgB,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC/C,eAAe,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAA0B,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"codex-chat.js","sourceRoot":"","sources":["../../src/engines/codex-chat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAA0B,MAAM,OAAO,CAAC;AACtD,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,mBAAmB,GAEpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAA8B,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAa/D,MAAM,MAAM,GAAG,OAAO,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,OAAO;IACP,aAAa;IACb,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,YAAY;CACb,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;AAC3D,CAAC;AAoBD,SAAS,SAAS,CAAC,KAAwB;IACzC,0EAA0E;IAC1E,4EAA4E;IAC5E,uEAAuE;IACvE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACrD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,mBAAmB,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,MAAM,OAAO,GAAG,IAAI,EAAE,UAAU,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAClD,CAAC,CAAE,OAAmC,CAAC,WAAW,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uBAAuB,mBAAmB,0BAA0B,WAAW,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IACE,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;QAC9B,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;QACvD,CAAC,SAAS,CAAC,GAAG;QACd,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,WAAW,QAAQ,CAAC,CAAC;IACjF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,GAAG,EAAE,SAAS,CAAC,GAA6B;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA6B,EAAE;IAChE,MAAM,IAAI,GAAG;QACX,MAAM;QACN,QAAQ;QACR,0EAA0E;QAC1E,yEAAyE;QACzE,sBAAsB;QACtB,4CAA4C;KAC7C,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,eAAe,WAAW,YAAY,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAC5E,IAAI,EACJ,eAAe,WAAW,SAAS,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EACtE,IAAI,EACJ,eAAe,WAAW,aAAa,SAAS,CAAC,OAAO,CAAC,EAAE,EAC3D,IAAI,EACJ,eAAe,WAAW,gBAAgB,EAC1C,IAAI,EACJ,eAAe,WAAW,eAAe,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,IAA6B,EAC7B,YAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;IACzC,MAAM,IAAI,GAAsB;QAC9B,GAAG,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACpD,GAAG,CAAC,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC;KAC7B,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK;QAAE,IAAI,CAAC,4BAA4B,CAAC,GAAG,KAAK,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAA6B;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE;QAChF,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,kEAAkE;AAClE,SAAS,QAAQ,CAAC,GAA4B;IAC5C,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,6EAA6E;AAC7E,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AACpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,QAAQ;IACR,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,oEAAoE;IACpE,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;IAED,6BAA6B;IAC7B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvG,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAA2B;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,4BAA4B;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,aAAa,GACjB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACzF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO;YACP,IAAI,EAAE,aAAa;YACnB,MAAM,EACJ,4HAA4H;SAC/H,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAyB,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,IAAI;QACJ,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,gBAAgB,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,0BAA0B,EAAE;KACvH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAA2B;IAC7D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA2B;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,4BAA4B;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,sBAAsB,CAAC;QAC5B,QAAQ,EAAE,WAAW,CAAC,EAAE;QACxB,OAAO;QACP,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAChD,MAAM,EACJ,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,yFAAyF;KAChG,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D,iBAAiB,EAAE,IAAI;IACvB,aAAa,EAAE,IAAI;IACnB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE,IAAI;IAChB,IAAI,EAAE,MAAM;CACb,CAAC;AAmBF,MAAM,YAAY,GAA0B;IAC1C,SAAS,EAAE,cAAc;IACzB,gBAAgB,EAAE,qBAAqB;IACvC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;IAChD,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;IACxC,cAAc,EAAE,qBAAqB;IACrC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;CAC9E,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAsB,EAAE;IAC5D,MAAM,CAAC,GAA0B,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9D,OAAO;QACL,GAAG,WAAW;QACd,YAAY,EAAE,uBAAuB;QACrC,UAAU,EAAE,CAAC,IAA6B,EAAoC,EAAE,CAC9E,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC;QAC1E,iBAAiB;QACjB,eAAe,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC7C,gBAAgB,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC/C,eAAe,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAA0B,qBAAqB,EAAE,CAAC"}

package/dist/machine-console/index.d.ts

@@ -0,0 +1,41 @@
+import { spawn } from "node:child_process";
+import type { RunnerConfig } from "../config.js";
+import type { RunnerSupabaseClient } from "../supabase.js";
+import { type MachineCommandClassification } from "./policy.js";
+export declare const MACHINE_CONSOLE_ENABLED_ENV = "ACC_RUNNER_MACHINE_CONSOLE";
+export declare const DEFAULT_MACHINE_POLL_MS = 1000;
+export declare const DEFAULT_MACHINE_WALL_MS = 120000;
+export interface ClaimedMachineCommand {
+    command_id: string;
+    session_id: string;
+    project_id: string;
+    repo: string;
+    command_text: string;
+    classification: MachineCommandClassification;
+    expires_at: string;
+}
+export interface MachineConsoleHandle {
+    stop(): Promise<void>;
+    refreshClient(client: RunnerSupabaseClient): void;
+    pollOnce(): Promise<void>;
+    activeCommands(): number;
+}
+export interface MachineConsoleDeps {
+    cfg: RunnerConfig;
+    runnerId: string;
+    supabase: RunnerSupabaseClient;
+    pollMs?: number;
+    wallClockMs?: number;
+    onLog?: (line: string) => void;
+    spawnCommand?: typeof spawn;
+}
+export declare function machineConsoleEnabled(env?: NodeJS.ProcessEnv): boolean;
+/** Resolve only runner-owned, already-present repository roots. */
+export declare function resolveMachineRepoPath(cfg: RunnerConfig, repo: string): string;
+/** Closed, non-secret environment inherited by console children. */
+export declare function machineCommandEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function startMachineCommandServing(deps: MachineConsoleDeps): Promise<MachineConsoleHandle | null>;
+export { redactMachineOutput, StreamingMachineRedactor } from "./redact.js";
+export { validateMachineCommand } from "./policy.js";
+export type { MachineCommandClassification } from "./policy.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/machine-console/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/machine-console/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAA0B,KAAK,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAGxF,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAC7C,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAG/C,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,4BAA4B,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,aAAa,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,cAAc,IAAI,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,YAAY,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE,OAAO,KAAK,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEnF;AAQD,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAc9E;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAKzF;AA+BD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAgK/G;AAED,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,YAAY,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC"}

package/dist/machine-console/index.js

@@ -0,0 +1,256 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
+import { canServeRepo, localRepoPathFor } from "../config.js";
+import { clonePathForRepo } from "../runtime/clone-cache.js";
+import { validateMachineCommand } from "./policy.js";
+import { StreamingMachineRedactor } from "./redact.js";
+export const MACHINE_CONSOLE_ENABLED_ENV = "ACC_RUNNER_MACHINE_CONSOLE";
+export const DEFAULT_MACHINE_POLL_MS = 1_000;
+export const DEFAULT_MACHINE_WALL_MS = 120_000;
+const OUTPUT_CHUNK_BYTES = 48 * 1024;
+export function machineConsoleEnabled(env = process.env) {
+    return (env[MACHINE_CONSOLE_ENABLED_ENV] ?? "").trim() !== "0";
+}
+function expandHome(value) {
+    if (value === "~")
+        return process.env.HOME ?? value;
+    if (value.startsWith("~/"))
+        return path.join(process.env.HOME ?? "~", value.slice(2));
+    return value;
+}
+/** Resolve only runner-owned, already-present repository roots. */
+export function resolveMachineRepoPath(cfg, repo) {
+    const slug = repo.trim().toLowerCase();
+    if (!canServeRepo(cfg.repos, slug))
+        throw new Error("repo is outside this runner's served scope");
+    const local = localRepoPathFor(cfg, slug);
+    let candidate = local;
+    if (!candidate && cfg.targetRepo.trim().toLowerCase() === slug)
+        candidate = cfg.repoPath;
+    if (!candidate && cfg.cloneOnDemand)
+        candidate = clonePathForRepo(slug);
+    if (!candidate)
+        throw new Error("repo has no runner-local working copy");
+    const resolved = fs.realpathSync(expandHome(candidate));
+    if (!fs.statSync(resolved).isDirectory() || !fs.existsSync(path.join(resolved, ".git"))) {
+        throw new Error("resolved path is not a git working copy");
+    }
+    return resolved;
+}
+/** Closed, non-secret environment inherited by console children. */
+export function machineCommandEnv(env = process.env) {
+    const names = ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "TERM", "TMPDIR", "NO_COLOR"];
+    const out = { ACC_MACHINE_CONSOLE: "1" };
+    for (const name of names)
+        if (env[name] !== undefined)
+            out[name] = env[name];
+    return out;
+}
+function splitByBytes(value, maxBytes = OUTPUT_CHUNK_BYTES) {
+    const chunks = [];
+    let remaining = value;
+    while (Buffer.byteLength(remaining) > maxBytes) {
+        let end = Math.min(remaining.length, maxBytes);
+        while (end > 1 && Buffer.byteLength(remaining.slice(0, end)) > maxBytes)
+            end -= 1;
+        chunks.push(remaining.slice(0, end));
+        remaining = remaining.slice(end);
+    }
+    if (remaining)
+        chunks.push(remaining);
+    return chunks;
+}
+function terminateProcess(child) {
+    if (child.exitCode !== null || child.killed)
+        return;
+    try {
+        if (process.platform !== "win32" && child.pid)
+            process.kill(-child.pid, "SIGTERM");
+        else
+            child.kill("SIGTERM");
+    }
+    catch {
+        child.kill("SIGTERM");
+    }
+    const hardKill = setTimeout(() => {
+        if (child.exitCode !== null)
+            return;
+        try {
+            if (process.platform !== "win32" && child.pid)
+                process.kill(-child.pid, "SIGKILL");
+            else
+                child.kill("SIGKILL");
+        }
+        catch {
+            child.kill("SIGKILL");
+        }
+    }, 2_000);
+    hardKill.unref?.();
+}
+export async function startMachineCommandServing(deps) {
+    if (!machineConsoleEnabled())
+        return null;
+    let client = deps.supabase;
+    let stopped = false;
+    let polling = false;
+    let active = null;
+    const log = deps.onLog ?? (() => { });
+    const spawnImpl = deps.spawnCommand ?? spawn;
+    const append = async (id, sequence, stream, content) => {
+        const { error } = await client.rpc("append_machine_output", {
+            p_command_id: id,
+            p_sequence_no: sequence,
+            p_stream: stream,
+            p_content: content,
+            p_runner_id: deps.runnerId,
+        });
+        if (error)
+            throw new Error(error.message);
+    };
+    const complete = async (id, status, exitCode) => {
+        const { error } = await client.rpc("complete_machine_command", {
+            p_command_id: id,
+            p_status: status,
+            p_exit_code: exitCode,
+            p_runner_id: deps.runnerId,
+        });
+        if (error)
+            throw new Error(error.message);
+    };
+    const execute = async (command) => {
+        const policy = validateMachineCommand(command.command_text, command.classification);
+        if (!policy.allowed) {
+            await append(command.command_id, 0, "system", `Command refused: ${policy.reason ?? "policy"}\n`);
+            await complete(command.command_id, "failed", 126);
+            return;
+        }
+        let cwd;
+        try {
+            cwd = resolveMachineRepoPath(deps.cfg, command.repo);
+        }
+        catch (err) {
+            await append(command.command_id, 0, "system", `Command refused: ${err.message}\n`);
+            await complete(command.command_id, "failed", 126);
+            return;
+        }
+        const shell = process.platform === "win32" ? (process.env.ComSpec ?? "cmd.exe") : "/bin/sh";
+        const args = process.platform === "win32"
+            ? ["/d", "/s", "/c", command.command_text]
+            : ["-lc", command.command_text];
+        const child = spawnImpl(shell, args, {
+            cwd,
+            env: machineCommandEnv(),
+            detached: process.platform !== "win32",
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        active = { id: command.command_id, child };
+        let sequence = 0;
+        let outputFailure = null;
+        let chain = Promise.resolve();
+        const stdoutDecoder = new StringDecoder("utf8");
+        const stderrDecoder = new StringDecoder("utf8");
+        const stdoutRedactor = new StreamingMachineRedactor();
+        const stderrRedactor = new StreamingMachineRedactor();
+        const queueOutput = (stream, value) => {
+            if (!value || outputFailure)
+                return;
+            chain = chain.then(async () => {
+                for (const chunk of splitByBytes(value))
+                    await append(command.command_id, sequence++, stream, chunk);
+            }).catch((err) => {
+                outputFailure = err;
+                terminateProcess(child);
+            });
+        };
+        child.stdout?.on("data", (data) => queueOutput("stdout", stdoutRedactor.push(stdoutDecoder.write(data))));
+        child.stderr?.on("data", (data) => queueOutput("stderr", stderrRedactor.push(stderrDecoder.write(data))));
+        let cancelRequested = false;
+        const cancelPoll = setInterval(() => {
+            void Promise.resolve(client.rpc("machine_command_status_for_runner", {
+                p_command_id: command.command_id,
+                p_runner_id: deps.runnerId,
+            })).then(({ data, error }) => {
+                if (!error && data === "cancel_requested") {
+                    cancelRequested = true;
+                    terminateProcess(child);
+                }
+            }).catch(() => { });
+        }, 500);
+        cancelPoll.unref?.();
+        const remainingLease = Math.max(1_000, Date.parse(command.expires_at) - Date.now());
+        const wallMs = Math.min(deps.wallClockMs ?? DEFAULT_MACHINE_WALL_MS, remainingLease);
+        let timedOut = false;
+        const wallTimer = setTimeout(() => { timedOut = true; terminateProcess(child); }, wallMs);
+        wallTimer.unref?.();
+        const exit = await new Promise((resolve) => {
+            child.once("error", () => resolve({ code: 127, signal: null }));
+            child.once("exit", (code, signal) => resolve({ code, signal }));
+        });
+        clearInterval(cancelPoll);
+        clearTimeout(wallTimer);
+        queueOutput("stdout", stdoutRedactor.push(stdoutDecoder.end()) + stdoutRedactor.finish());
+        queueOutput("stderr", stderrRedactor.push(stderrDecoder.end()) + stderrRedactor.finish());
+        if (timedOut)
+            queueOutput("system", `Command stopped after ${wallMs}ms wall-clock limit.\n`);
+        await chain;
+        active = null;
+        if (outputFailure) {
+            await complete(command.command_id, "failed", exit.code ?? 1).catch(() => { });
+            throw outputFailure;
+        }
+        if (cancelRequested)
+            await complete(command.command_id, "cancelled", exit.code);
+        else if (timedOut || Date.now() >= Date.parse(command.expires_at)) {
+            await complete(command.command_id, "expired", exit.code);
+        }
+        else {
+            await complete(command.command_id, exit.code === 0 ? "succeeded" : "failed", exit.code);
+        }
+    };
+    const pollOnce = async () => {
+        if (stopped || polling || active)
+            return;
+        polling = true;
+        try {
+            const { data, error } = await client.rpc("claim_machine_command", { p_runner_id: deps.runnerId });
+            if (error) {
+                // Migration rollout window and transient network errors are non-fatal.
+                if (!/could not find|does not exist|schema cache/i.test(error.message)) {
+                    log(`[acc-runner] machine console claim failed: ${error.message}`);
+                }
+                return;
+            }
+            const command = Array.isArray(data) ? data[0] : undefined;
+            if (command) {
+                log(`[acc-runner] machine console claimed ${command.command_id} for ${command.repo}`);
+                await execute(command);
+            }
+        }
+        catch (err) {
+            log(`[acc-runner] machine console command failed: ${err.message}`);
+        }
+        finally {
+            polling = false;
+        }
+    };
+    const timer = setInterval(() => void pollOnce(), deps.pollMs ?? DEFAULT_MACHINE_POLL_MS);
+    timer.unref?.();
+    void pollOnce();
+    log("[acc-runner] machine console serving enabled");
+    return {
+        stop: async () => {
+            stopped = true;
+            clearInterval(timer);
+            if (active)
+                terminateProcess(active.child);
+        },
+        refreshClient: (next) => { client = next; },
+        pollOnce,
+        activeCommands: () => active ? 1 : 0,
+    };
+}
+export { redactMachineOutput, StreamingMachineRedactor } from "./redact.js";
+export { validateMachineCommand } from "./policy.js";
+//# sourceMappingURL=index.js.map

package/dist/machine-console/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/machine-console/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,sBAAsB,EAAqC,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAC/C,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AA6BrC,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC;IACpD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,GAAiB,EAAE,IAAY;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAkB,KAAK,CAAC;IACrC,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI;QAAE,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC;IACzF,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa;QAAE,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAsB,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,QAAQ,GAAG,kBAAkB;IAChE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC/C,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,QAAQ;YAAE,GAAG,IAAI,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACrC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO;IACpD,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;;YAC9E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;QAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO;QACpC,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;;gBAC9E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;IACpC,CAAC,EAAE,KAAK,CAAC,CAAC;IACV,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAwB;IACvE,IAAI,CAAC,qBAAqB,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAA+C,IAAI,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;IAE7C,MAAM,MAAM,GAAG,KAAK,EAAE,EAAU,EAAE,QAAgB,EAAE,MAAc,EAAE,OAAe,EAAE,EAAE;QACrF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE;YAC1D,YAAY,EAAE,EAAE;YAChB,aAAa,EAAE,QAAQ;YACvB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,OAAO;YAClB,WAAW,EAAE,IAAI,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAU,EAAE,MAAc,EAAE,QAAuB,EAAE,EAAE;QAC7E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE;YAC7D,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,QAAQ;YACrB,WAAW,EAAE,IAAI,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,OAA8B,EAAE,EAAE;QACvD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,oBAAoB,MAAM,CAAC,MAAM,IAAI,QAAQ,IAAI,CAAC,CAAC;YACjG,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,oBAAqB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;YAC9F,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;YACvC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;YAC1C,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YACnC,GAAG;YACH,GAAG,EAAE,iBAAiB,EAAE;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;QAC3C,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,aAAa,GAAiB,IAAI,CAAC;QACvC,IAAI,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,wBAAwB,EAAE,CAAC;QACtD,MAAM,cAAc,GAAG,IAAI,wBAAwB,EAAE,CAAC;QAEtD,MAAM,WAAW,GAAG,CAAC,MAAsC,EAAE,KAAa,EAAE,EAAE;YAC5E,IAAI,CAAC,KAAK,IAAI,aAAa;gBAAE,OAAO;YACpC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC5B,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;oBAAE,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACvG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,aAAa,GAAG,GAAY,CAAC;gBAC7B,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAElH,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YAClC,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE;gBACnE,YAAY,EAAE,OAAO,CAAC,UAAU;gBAChC,WAAW,EAAE,IAAI,CAAC,QAAQ;aAC3B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBACzB,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC1C,eAAe,GAAG,IAAI,CAAC;oBACvB,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvB,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,uBAAuB,EAAE,cAAc,CAAC,CAAC;QACrF,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1F,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAEpB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAyD,CAAC,OAAO,EAAE,EAAE;YACjG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1B,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,QAAQ;YAAE,WAAW,CAAC,QAAQ,EAAE,yBAAyB,MAAM,wBAAwB,CAAC,CAAC;QAC7F,MAAM,KAAK,CAAC;QACZ,MAAM,GAAG,IAAI,CAAC;QAEd,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC7E,MAAM,aAAa,CAAC;QACtB,CAAC;QACD,IAAI,eAAe;YAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;aAC3E,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,OAAO,IAAI,OAAO,IAAI,MAAM;YAAE,OAAO;QACzC,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClG,IAAI,KAAK,EAAE,CAAC;gBACV,uEAAuE;gBACvE,IAAI,CAAC,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvE,GAAG,CAAC,8CAA8C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAsC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/F,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,wCAAwC,OAAO,CAAC,UAAU,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtF,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,gDAAiD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,uBAAuB,CAAC,CAAC;IACzF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,KAAK,QAAQ,EAAE,CAAC;IAChB,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAEpD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,MAAM;gBAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;QAC3C,QAAQ;QACR,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC"}

package/dist/machine-console/policy.d.ts

@@ -0,0 +1,16 @@
+/**
+ * MA-1 runner-side command policy.
+ *
+ * The database classifies a request before dispatch. This is the second gate,
+ * beside the process that would execute it: a stale or compromised caller does
+ * not get a general-purpose shell merely by labelling a command "read".
+ * Interactive shell syntax belongs to the later, approval-backed PTY phase.
+ */
+export type MachineCommandClassification = "read" | "write" | "destructive";
+export interface MachineCommandPolicyResult {
+    allowed: boolean;
+    reason?: string;
+}
+/** Fail-closed validation for a command claimed from the control plane. */
+export declare function validateMachineCommand(command: string, classification: MachineCommandClassification): MachineCommandPolicyResult;
+//# sourceMappingURL=policy.d.ts.map

package/dist/machine-console/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/machine-console/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,4BAA4B,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AAE5E,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA6CD,2EAA2E;AAC3E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,4BAA4B,GAC3C,0BAA0B,CAmC5B"}