@trenchwork/erosolar 1.1.30 → 1.1.32

package/dist/runtime/phaseEmitter.js

@@ -0,0 +1,207 @@
+/**
+ * Phase emitter — auto-instruments offsec tools so the portal's
+ * Engagement → Target → Finding phase tabs populate without the
+ * operator manually calling FindingUpdatePhase after every tool run.
+ *
+ * The mapping below routes a tool name (e.g. 'kali_subfinder',
+ * 'bin_radare2_cmd', 'afl_fuzz_start') to one of the canonical phase
+ * names the portal renders (recon, static, fuzz, triage, exploit,
+ * validate, disclose). On a successful tool result, the emitter:
+ *
+ *   1. Reads the active engagement / target / finding selection from
+ *      the EngagementCapability in-process state. If no finding is
+ *      selected, no-op (we don't invent a finding for a tool run).
+ *   2. Calls the cliFindingUpdate Lambda with `{ <phase>: { tool, args,
+ *      output, ts } }` merged into the finding doc. The CLI does not
+ *      block on Lambda — emit is fire-and-forget.
+ *   3. For long-running tools (afl_fuzz_start, ghidra_batch), also
+ *      writes a `users/<uid>/jobs/<id>` row via cliJobStart so the
+ *      portal's Jobs rail shows it live.
+ *
+ * Gating: only fires when the active profile is offsec (variant-research
+ * / engagement-delivery). Default coding sessions never emit. Best-
+ * effort throughout — a Lambda failure or unauthenticated session
+ * silently drops the emit; the tool result is unaffected.
+ */
+import { isOffsecProfile } from './profileGates.js';
+import { callLambda } from '../utils/lambdaClient.js';
+import { getEngagementSelection } from '../tools/engagementTools.js';
+/**
+ * Tool name → phase. Uses prefix matching so adding a new bin_xxx
+ * tool gets static-phase emission for free without touching this map.
+ */
+const TOOL_PREFIX_TO_PHASE = [
+    // Recon — Kali enumeration / surface mapping
+    ['kali_subfinder', 'recon'],
+    ['kali_amass', 'recon'],
+    ['kali_masscan', 'recon'],
+    ['kali_gobuster', 'recon'],
+    ['kali_ffuf', 'recon'],
+    ['kali_feroxbuster', 'recon'],
+    ['kali_nikto', 'recon'],
+    ['kali_wpscan', 'recon'],
+    // Static analysis — every bin_* + ghidra_* + radare2 invocation
+    ['bin_', 'static'],
+    ['ghidra_', 'static'],
+    // Fuzzing — AFL++ campaign + corpus tools
+    ['afl_', 'fuzz'],
+    // Triage — gdb / pwndbg / GEF
+    ['gdb_', 'triage'],
+    // Exploit dev — pwntools (ROP search, primitives, packing)
+    ['pwn_', 'exploit'],
+    // Validation — Kali post-exploit / vuln-confirmation tools
+    ['kali_sqlmap', 'validate'],
+    ['kali_hydra', 'validate'],
+    ['kali_john', 'validate'],
+    ['kali_hashcat', 'validate'],
+];
+/**
+ * Tools that kick off long-running background jobs. The emitter writes
+ * a Job record on start so the portal Jobs rail tracks them live.
+ * Most everything else is short-running and only needs a phase emit.
+ */
+const JOB_START_TOOLS = new Map([
+    ['afl_fuzz_start', { kind: 'fuzz', tool: 'afl++' }],
+    ['ghidra_batch', { kind: 'decomp', tool: 'ghidra' }],
+    ['MonitorStart', { kind: 'monitor', tool: 'shell' }],
+]);
+const JOB_END_TOOLS = new Map([
+    ['afl_fuzz_stop', 'stopped'],
+    ['MonitorStop', 'stopped'],
+]);
+export function phaseForTool(name) {
+    if (!name)
+        return null;
+    for (const [prefix, phase] of TOOL_PREFIX_TO_PHASE) {
+        if (name === prefix || name.startsWith(prefix))
+            return phase;
+    }
+    return null;
+}
+export function jobKindForTool(name) {
+    return JOB_START_TOOLS.get(name) ?? null;
+}
+export function jobEndStatusForTool(name) {
+    return JOB_END_TOOLS.get(name) ?? null;
+}
+const MAX_OUTPUT_CHARS = 8000;
+function clipString(value, max = MAX_OUTPUT_CHARS) {
+    if (value.length <= max)
+        return value;
+    return value.slice(0, max) + `\n…[truncated ${value.length - max} chars]`;
+}
+/**
+ * Emit a phase block for a successful tool call. Returns silently when
+ * gating denies the emit (wrong profile, no selection, no auth). Never
+ * throws — best-effort.
+ */
+export async function emitPhaseRecord(call, output, ctx) {
+    if (!ctx.forceEmit && !isOffsecProfile(ctx.profile))
+        return;
+    const phase = phaseForTool(call.name);
+    if (!phase)
+        return;
+    const sel = getEngagementSelection();
+    // We need at least an engagement + target + finding to attach phase
+    // data. If the operator hasn't selected one, drop silently — the
+    // tool result still surfaces in chat; the portal just won't get the
+    // structured copy.
+    if (!sel.engagementId || !sel.targetId || !sel.findingId)
+        return;
+    const payload = {
+        engagementId: sel.engagementId,
+        targetId: sel.targetId,
+        id: sel.findingId,
+        phase,
+        [phase]: {
+            tool: call.name,
+            args: call.arguments,
+            output: clipString(typeof output === 'string' ? output : String(output)),
+            at: Date.now(),
+        },
+    };
+    try {
+        await callLambda('cliFindingUpdate', payload);
+    }
+    catch {
+        // Best-effort. The tool result remains valid even if the portal
+        // doesn't reflect the phase block.
+    }
+}
+/**
+ * Emit a Jobs record for a tool that starts a long-running background
+ * task. Re-issued via cliJobUpdate / cliJobComplete by the matching
+ * stop / status tools (or by the process-exit hook in
+ * tools/monitorTools.ts).
+ */
+export async function emitJobStart(call, output, ctx) {
+    if (!ctx.forceEmit && !isOffsecProfile(ctx.profile))
+        return;
+    const job = jobKindForTool(call.name);
+    if (!job)
+        return;
+    const sel = getEngagementSelection();
+    // Job-start needs an id we can use for completion later. The tool
+    // output usually echoes the id Firebase needs; pull the first
+    // alnum/-_ token from the output string as a heuristic id.
+    const idMatch = String(output).match(/(?:job|monitor|fuzz)[-_]([a-zA-Z0-9_-]{6,64})/i);
+    const id = idMatch?.[1] ?? `job-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
+    const payload = {
+        id,
+        kind: job.kind,
+        tool: job.tool,
+        name: call.name,
+        status: 'running',
+        startedAt: Date.now(),
+        engagementId: sel.engagementId,
+        targetId: sel.targetId,
+        findingId: sel.findingId,
+    };
+    try {
+        await callLambda('cliJobStart', payload);
+    }
+    catch {
+        // Best-effort.
+    }
+}
+export async function emitJobEnd(call, output, ctx) {
+    if (!ctx.forceEmit && !isOffsecProfile(ctx.profile))
+        return;
+    const status = jobEndStatusForTool(call.name);
+    if (!status)
+        return;
+    // Caller passed the original id via args (e.g. `afl_fuzz_stop({ id })`).
+    const id = typeof call.arguments['id'] === 'string'
+        ? call.arguments['id']
+        : null;
+    if (!id)
+        return;
+    void output;
+    try {
+        await callLambda('cliJobComplete', { id, status });
+    }
+    catch {
+        // Best-effort.
+    }
+}
+/**
+ * Build the ToolRuntimeObserver that hooks all three emits onto the
+ * runtime. Wire it via createNodeRuntime's `toolObserver` option.
+ * Returns a no-op observer for non-offsec profiles so the runtime
+ * doesn't pay the per-call cost when gating would deny anyway.
+ */
+export function createPhaseEmitterObserver(profile) {
+    if (!isOffsecProfile(profile)) {
+        return {};
+    }
+    const ctx = { profile };
+    return {
+        onToolResult(call, output) {
+            // Fire-and-forget: never block the runtime on the emit.
+            void emitPhaseRecord(call, output, ctx);
+            void emitJobStart(call, output, ctx);
+            void emitJobEnd(call, output, ctx);
+        },
+    };
+}
+//# sourceMappingURL=phaseEmitter.js.map

package/dist/runtime/phaseEmitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phaseEmitter.js","sourceRoot":"","sources":["../../src/runtime/phaseEmitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAIrE;;;GAGG;AACH,MAAM,oBAAoB,GAA4C;IACpE,6CAA6C;IAC7C,CAAC,gBAAgB,EAAK,OAAO,CAAC;IAC9B,CAAC,YAAY,EAAS,OAAO,CAAC;IAC9B,CAAC,cAAc,EAAO,OAAO,CAAC;IAC9B,CAAC,eAAe,EAAM,OAAO,CAAC;IAC9B,CAAC,WAAW,EAAU,OAAO,CAAC;IAC9B,CAAC,kBAAkB,EAAG,OAAO,CAAC;IAC9B,CAAC,YAAY,EAAS,OAAO,CAAC;IAC9B,CAAC,aAAa,EAAQ,OAAO,CAAC;IAC9B,gEAAgE;IAChE,CAAC,MAAM,EAAe,QAAQ,CAAC;IAC/B,CAAC,SAAS,EAAY,QAAQ,CAAC;IAC/B,0CAA0C;IAC1C,CAAC,MAAM,EAAe,MAAM,CAAC;IAC7B,8BAA8B;IAC9B,CAAC,MAAM,EAAe,QAAQ,CAAC;IAC/B,2DAA2D;IAC3D,CAAC,MAAM,EAAe,SAAS,CAAC;IAChC,2DAA2D;IAC3D,CAAC,aAAa,EAAQ,UAAU,CAAC;IACjC,CAAC,YAAY,EAAS,UAAU,CAAC;IACjC,CAAC,WAAW,EAAU,UAAU,CAAC;IACjC,CAAC,cAAc,EAAO,UAAU,CAAC;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,eAAe,GAAwD,IAAI,GAAG,CAAC;IACnF,CAAC,gBAAgB,EAAM,EAAE,IAAI,EAAE,MAAM,EAAI,IAAI,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC,cAAc,EAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC1D,CAAC,cAAc,EAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;CAC3D,CAAC,CAAC;AAEH,MAAM,aAAa,GAAuD,IAAI,GAAG,CAAC;IAChF,CAAC,eAAe,EAAG,SAAS,CAAC;IAC7B,CAAC,aAAa,EAAK,SAAS,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;QACnD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,SAAS,UAAU,CAAC,KAAa,EAAE,GAAG,GAAG,gBAAgB;IACvD,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,iBAAiB,KAAK,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC;AAC5E,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB,EACrB,MAAc,EACd,GAAgB;IAEhB,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO;IAC5D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,mBAAmB;IACnB,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO;IAEjE,MAAM,OAAO,GAA4B;QACvC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,EAAE,EAAE,GAAG,CAAC,SAAS;QACjB,KAAK;QACL,CAAC,KAAK,CAAC,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,MAAM,EAAE,UAAU,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;SACf;KACF,CAAC;IACF,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,mCAAmC;IACrC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAqB,EACrB,MAAc,EACd,GAAgB;IAEhB,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO;IAC5D,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,kEAAkE;IAClE,8DAA8D;IAC9D,2DAA2D;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACvF,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,OAAO,GAA4B;QACvC,EAAE;QACF,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAqB,EACrB,MAAc,EACd,GAAgB;IAEhB,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO;IAC5D,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,yEAAyE;IACzE,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,QAAQ;QACjD,CAAC,CAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAY;QAClC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,KAAK,MAAM,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAoB;IAC7D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAgB,EAAE,OAAO,EAAE,CAAC;IACrC,OAAO;QACL,YAAY,CAAC,IAAI,EAAE,MAAM;YACvB,wDAAwD;YACxD,KAAK,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACxC,KAAK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACrC,KAAK,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runtime/profileGates.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Profile-based capability gating.
+ *
+ * Kept as a leaf module (no runtime imports) so it can be required
+ * cheaply from tests and from the boot path without dragging the
+ * AgentSession / config tree behind it.
+ */
+export type ProfileName = string;
+/**
+ * Profiles that get the offsec capability surface (Kali / AFL++ / gdb /
+ * pwntools / binary-analysis / Ghidra). The default coding profile
+ * (`erosolar-code`) deliberately excludes these so the model's tool
+ * inventory in normal sessions does not include sqlmap, ROP-gadget
+ * search, etc. Every irrelevant tool taxes every turn — see CLAUDE.md
+ * "Capability separation".
+ */
+export declare const OFFSEC_PROFILES: ReadonlySet<ProfileName>;
+export declare function isOffsecProfile(profile: ProfileName): boolean;
+//# sourceMappingURL=profileGates.d.ts.map

package/dist/runtime/profileGates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profileGates.d.ts","sourceRoot":"","sources":["../../src/runtime/profileGates.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,WAAW,CAGnD,CAAC;AAEH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAE7D"}

package/dist/runtime/profileGates.js

@@ -0,0 +1,23 @@
+/**
+ * Profile-based capability gating.
+ *
+ * Kept as a leaf module (no runtime imports) so it can be required
+ * cheaply from tests and from the boot path without dragging the
+ * AgentSession / config tree behind it.
+ */
+/**
+ * Profiles that get the offsec capability surface (Kali / AFL++ / gdb /
+ * pwntools / binary-analysis / Ghidra). The default coding profile
+ * (`erosolar-code`) deliberately excludes these so the model's tool
+ * inventory in normal sessions does not include sqlmap, ROP-gadget
+ * search, etc. Every irrelevant tool taxes every turn — see CLAUDE.md
+ * "Capability separation".
+ */
+export const OFFSEC_PROFILES = new Set([
+    'variant-research',
+    'engagement-delivery',
+]);
+export function isOffsecProfile(profile) {
+    return OFFSEC_PROFILES.has(profile);
+}
+//# sourceMappingURL=profileGates.js.map

package/dist/runtime/profileGates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profileGates.js","sourceRoot":"","sources":["../../src/runtime/profileGates.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAA6B,IAAI,GAAG,CAAC;IAC/D,kBAAkB;IAClB,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}

package/dist/runtime/universal.d.ts

@@ -0,0 +1,18 @@
+import { AgentHost, type CapabilityModule } from './agentHost.js';
+import { AgentSession } from './agentSession.js';
+import type { ProfileName } from '../config.js';
+import type { ToolRuntimeObserver } from '../core/toolRuntime.js';
+export interface UniversalRuntimeOptions {
+    profile: ProfileName;
+    workspaceContext: string | null;
+    workingDir: string;
+    toolObserver?: ToolRuntimeObserver;
+    env?: NodeJS.ProcessEnv;
+    additionalModules?: CapabilityModule[];
+}
+export interface UniversalRuntime {
+    host: AgentHost;
+    session: AgentSession;
+}
+export declare function createUniversalRuntime(options: UniversalRuntimeOptions): Promise<UniversalRuntime>;
+//# sourceMappingURL=universal.d.ts.map

package/dist/runtime/universal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"universal.d.ts","sourceRoot":"","sources":["../../src/runtime/universal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,WAAW,CAAC;IACrB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAgC3B"}

package/dist/runtime/universal.js

@@ -0,0 +1,31 @@
+import { AgentHost } from './agentHost.js';
+import { registerProject } from '../utils/projectRegistration.js';
+export async function createUniversalRuntime(options) {
+    const env = options.env ? { ...options.env } : { ...process.env };
+    const host = new AgentHost({
+        profile: options.profile,
+        workspaceContext: options.workspaceContext,
+        workingDir: options.workingDir,
+        toolObserver: options.toolObserver,
+        env,
+    });
+    const additionalModules = options.additionalModules ?? [];
+    if (additionalModules.length) {
+        await host.loadModules(additionalModules);
+    }
+    const session = await host.getSession();
+    // Fire-and-forget: register this workspace under the user's projects
+    // collection so the portal can render a cross-machine "where am I
+    // working" list. Honours the privacy gates inside registerProject —
+    // offsec profiles are opt-in via EROSOLAR_ENABLE_PROJECT_REGISTRATION.
+    // Never blocks startup; failures are silent (the agent runs fine
+    // without a project record).
+    void registerProject(options.workingDir, options.profile).catch(() => {
+        // Best-effort. The portal just won't show this workspace.
+    });
+    return {
+        host,
+        session,
+    };
+}
+//# sourceMappingURL=universal.js.map

package/dist/runtime/universal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"universal.js","sourceRoot":"","sources":["../../src/runtime/universal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,gBAAgB,CAAC;AAIlE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAgBlE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG;KACJ,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAE1D,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IAExC,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,iEAAiE;IACjE,6BAA6B;IAC7B,KAAK,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACnE,0DAA0D;IAC5D,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/shell/autoExecutor.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Auto-executor for validation gaps, recommendations, and follow-ups
+ *
+ * This module parses assistant responses and automatically executes:
+ * - Validation gaps (e.g., npm install if tests fail)
+ * - Recommendations (e.g., remove unnecessary files)
+ * - Follow-up tasks (e.g., git status)
+ */
+export interface ValidationGap {
+    type: 'validation_gap';
+    description: string;
+    command: string;
+    autoExecutable: boolean;
+}
+export interface Recommendation {
+    type: 'recommendation';
+    description: string;
+    action: 'remove_file' | 'remove_dir' | 'run_command';
+    target?: string;
+    command?: string;
+    requiresConfirmation: boolean;
+}
+export interface FollowUp {
+    type: 'follow_up';
+    description: string;
+    command: string;
+    autoExecutable: boolean;
+}
+export type AutoExecutableAction = ValidationGap | Recommendation | FollowUp;
+export interface ParsedActions {
+    validationGaps: ValidationGap[];
+    recommendations: Recommendation[];
+    followUps: FollowUp[];
+}
+export interface ExecutionResult {
+    success: boolean;
+    output: string;
+    error?: string;
+}
+/**
+ * Parse assistant response for structured actions
+ */
+export declare function parseAssistantResponse(response: string): ParsedActions;
+/**
+ * Execute a validation gap
+ */
+export declare function executeValidationGap(gap: ValidationGap, workingDir: string): Promise<ExecutionResult>;
+/**
+ * Execute a recommendation
+ */
+export declare function executeRecommendation(recommendation: Recommendation, workingDir: string): Promise<ExecutionResult>;
+/**
+ * Execute a follow-up task
+ */
+export declare function executeFollowUp(followUp: FollowUp, workingDir: string): Promise<ExecutionResult>;
+/**
+ * Execute all auto-executable actions
+ */
+export declare function executeAutoActions(actions: ParsedActions, workingDir: string, options?: {
+    skipConfirmation?: boolean;
+}): Promise<{
+    executed: number;
+    failed: number;
+    results: Array<{
+        type: string;
+        description: string;
+        result: ExecutionResult;
+    }>;
+}>;
+//# sourceMappingURL=autoExecutor.d.ts.map

package/dist/shell/autoExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autoExecutor.d.ts","sourceRoot":"","sources":["../../src/shell/autoExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,aAAa,CAAC;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE7E,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,SAAS,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAyEtE;AA6GD;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,aAAa,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAoB1B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAqD1B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAoB1B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,OAAO,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;CAChF,CAAC,CAoCD"}